Join hosts John and Alex, alongside special guest and ReliaQuest CTO Joe Partlow, as they discuss:

• How Claude Mythos autonomously generated exploits
• Why AI is accelerating CVE volume
• Defense strategies organizations need now

Joe Partlow: CTO of ReliaQuest, a leading Information Security provider and is currently involved with new product initiatives along with research and development efforts. Joe has been involved the Information Security field for over 30 years, in both the defensive side and offensive capabilities. Current projects include data ingestion/analytics at scale, DFIR automation and generative AI. He is also a regular speaker and contributor at security conferences, groups and associations. Joe has a degree in Computer Information Systems and holds many industry-specific certifications

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Alexandra Moore: Manager of Threat Intelligence at ReliaQuest, where she leads intelligence analysis and customer dissemination to help organizations understand and respond to emerging cyber threats. Prior to this, she established and scaled monitoring across Russian-language cybercriminal platforms at Digital Shadows, building collection and analytical coverage to support digital risk protection capabilities.

Join hosts John and Tehman as they break down two of the most consequential supply chain attacks of 2026:

• How DPRK actors socially engineered a NPM maintainer
• Why hijacked GitHub versions are a CI/CD wake-up call
• The three gaps every security team needs to close

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Tehman Tariq: Sr. Manager of Cyber Operations at ReliaQuest. He has spent a majority of my career leading our Incident Response, Security Architecture, and Detection teams. As well has working hand in hand with CISOs to introduce automation allowing for the maturity of their security programs.

Join hosts Alexandra and John, live from Exponent 2026, alongside top security leaders as they discuss:

• How organizations keep pace with attackers
• Why one in four incidents starts with social engineering
• How automated response is helping organizations

Chris Thompson: CISO of Caris Life Sciences, a leading, next-generation AI TechBio company and precision medicine pioneer.  Chris is a retired Federal Agent having most recently led the North Texas Cyber Task Force for the FBI and was an operator on the FBI Cyber Action Team.

Michael Andreano: Sr. Director of Information Security at Hikma Pharmaceuticals, leading their global information security team.  He has over 30 years experience in the healthcare and hospitality industries with roles of increasing responsibility at Merck, Wyndham Hotels, Olympus, Syneos Health, and now Hikma the past four years.  He also is part of the Evanta C-Suite Information Security Community where he serves as a Governing Body member and active in his local Cloud Security Alliance chapter in Lehigh Valley, Pennsylvania. 

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Alexandra Moore: Manager of Threat Intelligence at ReliaQuest, where she leads intelligence analysis and customer dissemination to help organizations understand and respond to emerging cyber threats. Prior to this, she established and scaled monitoring across Russian-language cybercriminal platforms at Digital Shadows, building collection and analytical coverage to support digital risk protection capabilities.

Join hosts Brandon and John as they discuss:

• How Handala wiped 200,000 devices by weaponizing a trusted platform
• Why your organization doesn't need to be a direct target to be at risk
• How AI-enhanced malware is helping attackers get faster

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Brandon Tirado: Brandon Tirado is the Director of GreyMatter Operations for ReliaQuest. Brandon is a skilled cyber defense professional with a unique combination of management and hands-on experience. With a deep understanding of adversary motives and the tactics, techniques, and procedures (TTPs) they use to achieve their goals, Brandon enjoys operationalizing his knowledge to make it more difficult for adversaries to operate within the environments of ReliaQuest customers. His managerial and hands-on experience enriches ShadowTalk with practical and strategic viewpoints. 

Join hosts John and Alex as they discuss:

• How a Chinese APT maintained access for over a year
• Why North Korean impersonation surged 116%
• Why attackers exploit the same foundational gaps

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Alexander Capraro: Alexander Capraro is a Cyber Threat Intelligence Analyst at ReliaQuest with over five years of experience in cybersecurity. With his prior experience as a Security Analyst, he specializes in incident response, malware campaign tracking, and OSINT investigations. 

Join hosts Tehman and John as they discuss:

• Why ransomware now prioritizes exfiltration over encryption 
• How attackers can exfiltrate your data in just 6 minutes
• Why proactive darkweb monitoring is critical

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Tehman Tariq: Sr. Manager of Cyber Operations at ReliaQuest. He has spent a majority of my career leading our Incident Response, Security Architecture, and Detection teams. As well has working hand in hand with CISOs to introduce automation allowing for the maturity of their security programs.

Join hosts Brandon and John as they discuss:

• How attacker breakout times dropped to as little as 4 minutes 
• Why ClickFix surged 200%
• Why behavioral detection is critical

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Brandon Tirado: Director of Threat Research for ReliaQuest. A skilled cyber defense professional with a unique combination of management and hands-on experience. With a deep understanding of adversary motives and the tactics, techniques, and procedures (TTPs) they use to achieve their goals, Brandon enjoys operationalizing his knowledge to make it more difficult for adversaries to operate within the environments of ReliaQuest customers. His managerial and hands-on experience enriches ShadowTalk with practical and strategic viewpoints.

Join hosts John and Tehman as they discuss:

• What attackers prefer over custom malware
• How signature-based detection fails
• Proactive governance vs. reactive triage

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Tehman Tariq: Sr. Manager of Cyber Operations at ReliaQuest. He has spent a majority of my career leading our Incident Response, Security Architecture, and Detection teams. As well has working hand in hand with CISOs to introduce automation allowing for the maturity of their security programs.

Join hosts Brandon and John as they discuss:

• Why extortion payment rates are the lowest ever
• Organizations paying ransomware but refusing data extortion demands
• Why defenders need both visibility and speed

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Brandon Tirado: Director of Threat Research for ReliaQuest. A skilled cyber defense professional with a unique combination of management and hands-on experience. With a deep understanding of adversary motives and the tactics, techniques, and procedures (TTPs) they use to achieve their goals, Brandon enjoys operationalizing his knowledge to make it more difficult for adversaries to operate within the environments of ReliaQuest customers. His managerial and hands-on experience enriches ShadowTalk with practical and strategic viewpoints.

Join hosts Brandon and John as they discuss:

• Why traditional patch cycles can't beat attackers exploiting vulnerabilities in 24 hours
• The shift from reactive patching to predictive intelligence using EPSS and CISA KEV
• How to defend against zero-days when patching isn't an option

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Brandon Tirado: Director of Threat Research for ReliaQuest. A skilled cyber defense professional with a unique combination of management and hands-on experience. With a deep understanding of adversary motives and the tactics, techniques, and procedures (TTPs) they use to achieve their goals, Brandon enjoys operationalizing his knowledge to make it more difficult for adversaries to operate within the environments of ReliaQuest customers. His managerial and hands-on experience enriches ShadowTalk with practical and strategic viewpoints.

Join hosts John and Tehman as they discuss:

• Why phishing emails are no longer the top malware delivery method
• Emerging social engineering tactics: vishing, copy and paste abuse, and software impersonation
• How campaigns have evolved from Black Basta to ShinyHunters

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Tehman Tariq: Sr. Manager of Cyber Operations at ReliaQuest. He has spent a majority of my career leading our Incident Response, Security Architecture, and Detection teams. As well has working hand in hand with CISOs to introduce automation allowing for the maturity of their security programs.

John and Tehman as they discuss:

• How AI is enabling large-scale, high-speed attacks
• Nation-states weaponizing AI for attack automation
• The rise of sophisticated AI-generated malware

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Tehman Tariq: Sr. Manager of Cyber Operations at ReliaQuest. He has spent a majority of my career leading our Incident Response, Security Architecture, and Detection teams. As well has working hand in hand with CISOs to introduce automation allowing for the maturity of their security programs.

Join hosts Brandon and John as they discuss:

• How supply-chain attacks evolved
• Campaigns targeting NPM package maintainers
• Actionable defense strategies

Brandon Tirado: Director of Threat Research for ReliaQuest. A skilled cyber defense professional with a unique combination of management and hands-on experience. With a deep understanding of adversary motives and the tactics, techniques, and procedures (TTPs) they use to achieve their goals, Brandon enjoys operationalizing his knowledge to make it more difficult for adversaries to operate within the environments of ReliaQuest customers. His managerial and hands-on experience enriches ShadowTalk with practical and strategic viewpoints.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Join hosts Brandon and Tehman as they discuss:

• The resurgence of LockBit 5.0 and its December 2025 surge in named organizations
• How top ransomware groups like Qilin, Akira, and Clop dominated in 2025.
• Actionable defense strategies for organizations to proactively combat ransomware in 2026

Brandon Tirado: Director of Threat Research for ReliaQuest. Brandon is a skilled cyber defense professional with a unique combination of management and hands-on experience. With a deep understanding of adversary motives and the tactics, techniques, and procedures (TTPs) they use to achieve their goals, Brandon enjoys operationalizing his knowledge to make it more difficult for adversaries to operate within the environments of ReliaQuest customers. His managerial and hands-on experience enriches ShadowTalk with practical and strategic viewpoints.

Tehman Tariq: Sr. Manager of Cyber Operations at ReliaQuest. He has spent a majority of my career leading our Incident Response, Security Architecture, and Detection teams. As well has working hand in hand with CISOs to introduce automation allowing for the maturity of their security programs.

Join host John and intelligence analyst Ivan as they discuss:

• React2Shell Exploits Flood the Internet as Attacks Continue (1:06)
• ClickFix Style Attack Leveraging Grok and ChatGPT for Malware Delivery (7:39)
• New ConsentFix Attack Hijacking Microsoft Accounts via Azure CLI (13:50)
• Holiday Season Attack Risks: Phishing, Ransomware, and Defense Recommendations (18:22)

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Ivan Righi: Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. Since joining ReliaQuest in June 2019, Ivan has focused on data breach investigations, automations, threat actor profiling, and reverse engineering threat campaigns. He holds a Master of Science degree in Cybersecurity and a GIAC Reverse Engineering Malware (GREM) certification, bringing technical expertise and actionable insights.

Join host John along with systems security engineer Corey and intelligence analyst Hayden as they discuss:

• Chinese Threat Groups Exploiting the React2Shell Vulnerability (1:18)
• CISA Issues Alert on Persistent Brickstorm Backdoor Attacks (9:05)
• ShadyPanda Hackers Turn Millions of Browsers into Weapons (13:36)
• Storm-0249’s Shift to Targeted EDR Exploitation (20:09)

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Corey Carter: Systems Security Engineer at ReliaQuest. A Florida native and former infantryman in the United States Marines, Corey holds a bachelor's degree in computer science with a specialization in information assurance. His experience as a detection researcher, security analyst, and threat hunter at ReliaQuest, combined with his military background, equips him with a unique perspective on cybersecurity challenges.

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security.

Join host John and intelligence analysts Alex and Hayden as they discuss:

• Scattered Lapsus$ Hunters Targeting Zendesk (1:14)
• Microsoft Teams Guest Access Phishing Bypass (3:37)
• Dark AI Tools Enhancing Threat Actors (6:08)
• Silver Fox’s Campaign: Chinese APT Spotlight (10:05)

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Alexander Capraro: Cyber Threat Intelligence Analyst at ReliaQuest with over five years of experience in cybersecurity. With his prior experience as a Security Analyst, he specializes in incident response, malware campaign tracking, and OSINT investigations. 

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security.

Do you really need predictions to tackle cyber threats? Join host Kim along with intelligence analyst John & special guest CISO Rafal Baran as they discuss:

• New NPM Supply Chain Threat (1:13)
• China Manipulates AI for Initial Access (4:46)
• Cloud Gaps Bring IoT Takeover (7:29)
• 2026 Cyber-Threat Predictions (10:57)

Rafal Baran: IT security leader and CISO in the global reinsurance space. He focuses on building practical security and privacy programs across multiple jurisdictions, with an emphasis on cloud security and incident readiness. He advises senior leadership on emerging risks and resilience and holds boardroom certification as a Qualified Technology Expert, along with multiple credentials spanning cybersecurity, privacy, and the re/insurance domains. Outside his role, he mentors upcoming security professionals and contributes to the broader cyber community. 

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Join host Kim, intelligence analyst John, and threat hunter Tristan as they discuss:

• Fortinet Flaw Enables Admin Takeover
• Akira Ransomware Targets Nutanix VMs
• Smart Redirects Evade Phishing Detection
• Threat Hunter Hacks: SEO Hits Hard

Listen on @Listennotes: https://lnns.co/mgbyVjXv7p6

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Tristan Luikey: Threat Hunter at ReliaQuest, specializing in responding to and mitigating active breaches to safeguard customers' networks. In addition to breach response, Tristan conducts comprehensive research into emerging threats and attack techniques, enabling proactive threat hunting to strengthen organizational security.

Wondering why Gootloader is suddenly back in action? Join host Kim along with intelligence analyst Hayden & Systems Security Engineer Corey as they discuss:

• Gootloader Returns Using SEO Poisoning (1:27)
• New Android Spyware LANDFALL (6:33)
• Curly COMrades Hide in Windows Using Linux VMs (10:57)
• Sector-by-Sector Cyber Trends Q3 2025 (15:20)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Corey Carter: Detection Researcher at ReliaQuest. A Florida native and former infantryman in the United States Marines, Corey holds a bachelor's degree in computer science with a specialization in information assurance. His experience as a Security Analyst and Threat Hunter at ReliaQuest, combined with his military background, equips him with a unique perspective on cybersecurity challenges.

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security.

Did you know 99% of cloud identities are over-privileged, creating the perfect storm for attackers to seamlessly infiltrate your environment? Join host Kim along with intelligence analysts John & Alex as they discuss: 

• Chinese Nation-State Campaigns and Geopolitics (1:12)
• Malicious NPM Packages (7:20)
• TruffleNet Attacks on AWS (10:53)
• The Danger of Over-Privileged Cloud Identities (15:36)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Alexander Capraro: Alexander Capraro is a Cyber Threat Intelligence Analyst at ReliaQuest with over five years of experience in cybersecurity. With his prior experience as a Security Analyst, he specializes in incident response, malware campaign tracking, and OSINT investigations. 

Picture this: You close a $50M acquisition on Friday and by Monday, attackers are in your network. Sound far-fetched? It's not. Join host Kim along with intelligence analyst John & Threat Hunter Leo as they discuss:

• Attackers Exploit WSUS Flaw (1:15)
• Qilin Deploys Cross-Platform Attacks (4:21)
• Lazarus Group Reignites Operation DreamJob (9:05)
• Threat Hunter Hacks: Active Cyber Threats in M&A (15:19)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Leo Dawson: Leo Dawson is a Threat Hunter on the ReliaQuest Threat Research Team. With a deep background in Experimental Physics and Artificial Intelligence, Leo brings a unique interdisciplinary perspective to cybersecurity. He is driven by a passion for leveraging these skills to proactively track, analyze, and understand threat actor campaigns while gaining deeper insights into their evolving tactics and behaviors. 

Wondering what makes ransomware operations successful? Join host Kim along with intelligence analyst John & former FBI Special Agent Keith Mularski as they discuss:

• Year-Long F5 Breach (2:42)
• North Korean Attacker Adopts EtherHiding (7:53)
• Phishing Attacks Target LastPass (12:11)
• Fighting Ransomware Automation: A CISO's Guide (17:19)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Keith Mularski is the Chief Global Ambassador at Qintel, where he leads global engagement and represents the company’s intelligence mission across governments, industry, and cybersecurity communities worldwide. Before joining Qintel, Keith led the Cyber Threat Management group at Ernst & Young, advising Fortune 100 companies on proactive defense and intelligence strategies. He also served more than 20 years as an FBI Special Agent, leading groundbreaking cybercrime investigations and pioneering collaboration between law enforcement and the private sector. His undercover work has been featured in the books Kingpin and DarkMarket. Keith is also co-host of the podcast Only Malware in the Building, where he explores the stories behind cybercrime and threat intelligence.

How long could Flax Typhoon nestle silently in your networks? Join host Kim along with intelligence analysts John & Joey as they discuss:

• Velociraptor Abused in Ransomware Attacks (1:13)
• New Oracle E-business Suite Flaw (5:19)
• GitHub CamoLeak AI Attack (7:46)
• Year-Long Flax Typhoon ArcGIS Campaign  (11:23)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs.

Join host Kim along with Intelligence Analyst John and Threat Detection Engineer Marken as they discuss:

• Clop's Exploitation of Oracle E-Business Suite (1:09)
• Scattered Lapsus$ Hunters Return With Salesforce Leaks (5:27)
• Shutdown Threatens US Intel Sharing and Cyber Defense (10:02)
• Ransomware and Cyber Extortion in Q3 2025 (15:02)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Marken Teder: Threat Detection Engineer at ReliaQuest, with a total of 7 years at the company. A native Estonian, he has previously worked as an Incident Response Analyst, Content Developer, and Security Architect. Marken's extensive experience in detection and response brings a robust technical perspective to discussions.

Join host Joey along with intelligence analysts Alex and Hayden as they discuss:

• Brickstorm Backdoor in U.S. Legal and Tech Sectors (1:17)
• Storm-1849 Targeting Cisco ASA Devices (4:38)
• Medusa Attempts to Pay Reporter for Initial Access (7:00)
• Debate Over Government Zero-Day Stockpiling (14:41)

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs.

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security. 

Alexander Capraro: Cyber Threat Intelligence Analyst at ReliaQuest with over five years of experience in cybersecurity. With his prior experience as a Security Analyst, he specializes in incident response, malware analysis and campaign tracking, and OSINT investigations.

Join host Kim along with intelligence analysts John and Joey as they discuss:

• Summer 2025 Attacker Trends (13:41)
• Self-Replicating 'Shai-hulud' Worm Targeting NPM Packages (1:05)
• Fortra Critical Patch for GoAnywhere MFT Vulnerability (3:49)
• Phishing Round Up: File Fix Campaign and Microsoft's RaccoonO365 Takedown (7:12)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs. 

Get news, research and actionable strategies from industry leaders, to help you stay ahead of attackers.

New episodes every Wednesday at 1pm EST.

Thinking about whether you need more AI in SecOps? Join host Kim along with intelligence analyst Joey & systems security engineer Corey as they discuss:

• SAP S/4HANA Flaw Exploitation (2:09)
• AI-Powered Malware Exposes GitHub (4:24)
• APT28 Outlook Backdoor hits NATO (8:21)
• ReliaQuest Experts Answer Your Questions (11:55)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs. 

Corey Carter: Detection Researcher at ReliaQuest. A Florida native and former infantryman in the United States Marines, Corey holds a bachelor's degree in computer science with a specialization in information assurance. His experience as a Security Analyst and Threat Hunter at ReliaQuest, combined with his military background, equips him with a unique perspective on cybersecurity challenges.

Need the latest information on Salesloft Drift? Join host Kim along with intelligence analyst John & detection engineer Marken as they discuss:

• Salesloft Drift Tokens Result in Salesforce Data Theft (1:31)
• Storm-0501 Shifts Ransomware Attacks to Cloud (6:36)
• APT29 Microsoft 365 Campaign Disrupted (11:26)
• Axios, Direct Send Abuse Redefine Phishing (14:19)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Marken Teder: Threat Detection Engineer at ReliaQuest, with a total of 7 years at the company. A native Estonian, he has previously worked as an Incident Response Analyst, Content Developer, and Security Architect. Marken's extensive experience in detection and response brings a robust technical perspective to discussions.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest. 

Curious about the skills needed for modern cyber attacks? Join host Kim along with intelligence analysts John & Hayden as they discuss:

• Apple Patches Exploited Zero-Day (1:40)
• Hackers Abuse Linux Files to Drop Malware (3:50)
• Silk Typhoon Attacks Cloud Supply Chains (7:21)
• ReliaQuest Uncovers Cybercriminals' Most Sought After Skills (11:02)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest. 

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security. 

Intrigued by Warlock ransomware's Chinese connection? Join host Kim along with intelligence analysts Joey & John as they discuss:

• \Warlock Ransomware Attacks Against Telecoms (3:12)
• New FortiSIEM Flaw Exploited in the Wild (5:19)
• Man-in-the-Prompt Attack Steals Data from LLMs (8:04)
• How ReliaQuest Tracks Ransomware Groups and Evolving Cyber Threats (12:36)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs. 

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest. 

Want to know if ShinyHunters and Scattered Spider are really working together? Join host Kim along with detection engineer Marken as they discuss:

• WinRAR Zero-Day Exploited in RomCom Attacks (1:44)
• New EDR Killer Popular with Ransomware Groups (4:30)
• Data Breach Reveal Kimsuky Inner Workings (11:31)
• ReliaQuest Uncovers Potential ShinyHunters x Scattered Spider Collaboration (15:00)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Marken Teder: Threat Detection Engineer at ReliaQuest, with a total of 7 years at the company. A native Estonian, he has previously worked as an Incident Response Analyst, Content Developer, and Security Architect. Marken's extensive experience in detection and response brings a robust technical perspective to discussions.

• Akira Ransomware Exploiting a Potential Zero Day
• Plague Backdoor Emerges as Silent Intruder
• Evolving Tactics of North Korean Attacker
• DRP Threats Surge Amid Organizational Growth

Resources: https://linktr.ee/ReliaQuestShadowTalk

Joseph Keyes: Joseph Keyes is a Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs. 

John Dilgen: John Dilgen is a Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest. 

Hayden Evans: Hayden Evans is a Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security. 

Curious how the latest CrushFTP exploit works? Join host Kim along with intelligence analyst Hayden and threat hunter Leo as they discuss:

• BreachForums Back, XSS Out (1:28)
• Warlock Ransomware Hits SharePoint (5:28)
• Fire Ant Stings ESXi (9:39)
• ReliaQuest Uncovers CrushFTP Attack Chain (13:35

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security.

Leo Dawson: Threat Hunter on the ReliaQuest Threat Research Team. With a deep background in Experimental Physics and Artificial Intelligence, Leo brings a unique interdisciplinary perspective to cybersecurity. He is driven by a passion for leveraging these skills to proactively track, analyze, and understand threat actor campaigns while gaining deeper insights into their evolving tactics and behaviors. 

Curious about how cybercriminals use AI? Join host Kim along with detection engineer Marken and intelligence analyst Alex as they discuss:

• New SharePoint Vulnerability (1:34)
• LameHug AI-Powered Malware (5:55)
• UK Bans Ransomware Payments (9:44)
• AI Tactics Behind the Latest Cyber Threats (14:11)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Marken Teder: Threat Detection Engineer at ReliaQuest, with a total of 7 years at the company. A native Estonian, he has previously worked as an Incident Response Analyst, Content Developer, and Security Architect. Marken's extensive experience in detection and response brings a robust technical perspective to discussions.

Alexander Capraro: Cyber Threat Intelligence Analyst at ReliaQuest with over five years of experience in cybersecurity. With his prior experience as a Security Analyst, he specializes in incident response, malware analysis and campaign tracking, and OSINT investigations.

Ever wondered if IOCs are still relevant in a world of polymorphic malware and zero-day exploits? Join host Kim along with intelligence analyst Joey and threat hunter Tristan as they discuss:

• North American APT Targets China (1:25)
• Chatbot Exposes Thousands of Job Applications (4:57)
• New Phishing Campaign Targets VIPs (7:17)
• How IOCs are Used in Modern Threat Hunting (10:07)

Kim Bromley: Kim Bromley is a Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights for ShadowTalk.  

Joseph Keyes: Joseph Keyes is a Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs. 

Tristan Luikey: Tristan Luikey is a Threat Hunter at ReliaQuest, specializing in responding to and mitigating active breaches to safeguard customers' networks. In addition to breach response, Tristan conducts comprehensive research into emerging threats and attack techniques, enabling proactive threat hunting to strengthen organizational security. 

Have you heard of SafePay ransomware? Join host Kim along with intelligence analysts Hayden and John as they discuss:

• SafePay Targets Ingram Micro (1:16)
• Updates on Iran-Israel (5:43)
• North Korea Adopts ClickFix & Attacks Web3 (8:24)
• Insights from ReliaQuest Customer Incidents (13:14)

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Join host Kim along with intelligence analysts Ivan and John as they discuss:

• Citrix Bleed 2
• Scattered Spider Hits Aviation 
• From ClickFix to FileFix
• Ransomware Threats from Q2

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Ivan Righi: Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. Since joining ReliaQuest in June 2019, Ivan has focused on data breach investigations, automations, threat actor profiling, and reverse engineering threat campaigns. He holds a Master of Science degree in Cybersecurity and a GIAC Reverse Engineering Malware (GREM) certification, bringing technical expertise and actionable insights.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Join host Kim along with Intelligence Analyst Hayden and Threat Hunter Leo as they discuss:

• New Scattered Spider Attack Chain
• Israel and Iran Cyber Threat Deep Dive
• Top Iran-linked Threat Groups & How to Mitigate

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security.

Leo Dawson: Threat Hunter on the ReliaQuest Threat Research Team. With a deep background in Experimental Physics and Artificial Intelligence, Leo brings a unique interdisciplinary perspective to cybersecurity. He is driven by a passion for leveraging these skills to proactively track, analyze, and understand threat actor campaigns while gaining deeper insights into their evolving tactics and behaviors. 

Join host Kim along with intelligence analyst Joey and detection engineer Marken as they discuss:

• Anubis Ransomware Wiper Capability
• Teamfiltration Pentesting Tool
• Cyber Implications of Israel-Iran Conflict
• The Most Up to Date Attacker Trends

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Marken Teder: Threat Detection Engineer at ReliaQuest, with a total of 7 years at the company. A native Estonian, he has previously worked as an Incident Response Analyst, Content Developer, and Security Architect. Marken's extensive experience in detection and response brings a robust technical perspective to discussions.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs.

Join host Kim along with intelligence analysts Alex and John as they discuss:

• The Enduring Legacy of Black Basta
• Qilin's Exploitation of Fortinet Flaws
• Vishing for Salesforce Data
• Atomic Stealer x ClickFix Campaign

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Alexander Capraro: Cyber Threat Intelligence Analyst at ReliaQuest with over five years of experience in cybersecurity. With his prior experience as a Security Analyst, he specializes in incident response, malware analysis and campaign tracking, and OSINT investigations. 

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Join host Kim along with intelligence analysts Joey and Alex as they discuss:

• Scattered Spider's Focus on Tech Vendors
• How APT41 Abuses Google Calendar for C2
• The SentinelOne Outage
• A New Void Blizzard Espionage Campaign

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs.

Alexander Capraro: Cyber Threat Intelligence Analyst at ReliaQuest with over five years of experience in cybersecurity. With his prior experience as a Security Analyst, he specializes in incident response, malware analysis and campaign tracking, and OSINT investigations. 

Join host Kim along with intelligence analysts Joey and Alex as they discuss:

• Factors Driving Russian Market's Popularity
• Attackers' Favorite Infostealers
• Infostealer Attack Paths
• Main Types and Exclusivity of Stolen Logs

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs.

Alexander Capraro: Cyber Threat Intelligence Analyst at ReliaQuest with over five years of experience in cybersecurity. With his prior experience as a Security Analyst, he specializes in incident response, malware analysis and campaign tracking, and OSINT investigations. 

Join host Joey along with intelligence analysts John and Hayden as they discuss:

• ReliaQuest's investigation into hijacked routers and SEO poisoning fueling payroll heists
• Nation-state actors leveraging the SAP NetWeaver vulnerability en masse
• A new "Defendnot" tool that tricks Windows Defender into disabling itself
• Ransomware groups using a stealthy post-exploitation malware

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs.

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security. 

Join host Kim along with intelligence analysts Joey and Hayden as they discuss:

• ReliaQuest's Forecast for How US Policy will Impact Russia-linked Cyber Threats
• Infostealers Spread by Fake AI Video Generators
• Kickidler Abuse by Ransomware Groups
• FBI Takedown of Huge Botnet

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs.

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security. 

Join host Kim along with intelligence analyst John and threat hunter Tristan as they discuss:

• Scattered Spider Attacks UK Retail Orgs
• Bring Your Own Installer SentinelOne Bypass
• Hunting for North Korean Insiders

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

John Dilgen: John Dilgen is a Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Tristan Luikey: Threat Hunter at ReliaQuest, specializing in responding to and mitigating active breaches to safeguard customers' networks. In addition to breach response, Tristan conducts comprehensive research into emerging threats and attack techniques, enabling proactive threat hunting to strengthen organizational security. 

Join host Kim along with detection engineer Marken and intelligence analyst Alex as they discuss:

• ReliaQuest's Discovery of Critical SAP NetWeaver Vulnerability
• AI Upgrade for Darcula Phishing Kit 
• DragonForce's New Cartel Business Model
• Maximum Severity Commvault flaw

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Marken Teder: Threat Detection Engineer at ReliaQuest, with a total of 7 years at the company. A native Estonian, he has previously worked as an Incident Response Analyst, Content Developer, and Security Architect. Marken's extensive experience in detection and response brings a robust technical perspective to discussions.

Alexander Capraro: Alexander Capraro is a Cyber Threat Intelligence Analyst at ReliaQuest with over five years of experience in cybersecurity. With his prior experience as a Security Analyst, he specializes in incident response, malware analysis and campaign tracking, and OSINT investigations. 

Join host Kim along with intelligence analysts Joey and John as they discuss:

• BreachForums Down: Dark Storm Team Takes Credit
• A Potential New Vulnerability in SAP NetWeaver
• Exploit User Targets Salesforce Data
• ReliaQuest Research: Understanding Chinese Espionage Strategies

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Joseph Keyes: Joseph Keyes is a Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs. 

John Dilgen: John Dilgen is a Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest. 

Join host Kim along with intelligence analysts Ivan and Hayden as they discuss:

• How ReliaQuest Identified a New Backdoor and Persistence Technique
• Our Latest Ransomware Quarterly Report
• How Attackers Maintained Access to Patched FortiGate VPNs
• What Oracle Said Next About That Breach

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Ivan Righi: Senior Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. His areas of expertise include the development of cyber intelligence tools, data breach investigations, threat actor profiling, and reverse engineering of threat campaigns. Before joining ReliaQuest, Ivan was a member of the Digital Shadows Photon Research Team, where he investigated, researched, and responded to cyber threats across the clear, deep, and dark web. 

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security. 

Join host Kim along with intelligence analyst Joey and threat hunter Leo as they discuss:

• Ivanti Patches Exploited Vulnerability
• Fast Flux DNS Evasion Warning
• Ransomware Scene Shifts
• ReliaQuest's Approach to Threat Hunting

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs.

Leo Dawson: Threat Hunter on the ReliaQuest Threat Research Team. With a deep background in Experimental Physics and Artificial Intelligence, Leo brings a unique interdisciplinary perspective to cybersecurity. He is driven by a passion for leveraging these skills to proactively track, analyze, and understand threat actor campaigns while gaining deeper insights into their evolving tactics and behaviors. 

Join host Kim along with intelligence analyst Hayden and threat detection engineer Marken as they discuss:

• Oracle Data Breach Latest Updates
• BlackLock Ransomware Exposed
• Active Exploitation of ChatGPT Flaw
• Up to the Minute Attacker Techniques

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Marken Teder: Threat Detection Engineer at ReliaQuest, with a total of 7 years at the company. A native Estonian, he has previously worked as an Incident Response Analyst, Content Developer, and Security Architect. Marken's extensive experience in detection and response brings a robust technical perspective to discussions.

Hayden Evans: Cyber Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security. 

Join host Kim along with intelligence analyst Joey and special guest Rachel Ratcliff as they discuss:

•  The latest Insights on the Alleged Oracle Data Breach
• A Critical Vulnerability in Next.js Middleware
• The Importance of Incident Response when Tackling Today's Cyber Threats

Rachel Ratcliff: Engagement Management Leader for Aon Cyber Solutions and Stroz Friedberg Digital Forensics and Incident Response where she sits on the Executive Committee and oversees global commercial strategy for the firm’s reactive services practice.  She and her team of professionals are responsible for managing complex digital forensic investigations, responding to data breach incidents, and overseeing testing and assessment in a host of cases involving cybercrime, theft of intellectual property, deletion of digital data, e-forgery, cyber-harassment, and online fraud and abuse.  Rachel brings over 15 years of experience in incident response, and prior to joining Aon/Stroz Friedberg, she was a practicing lawyer in Dallas, Texas.  Rachel is a frequent speaker, guest lecturer, and advisor to boards and C-suite executives on cybersecurity matters.

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs.

Join host Kim along with intelligence analysts Ivan and John as they discuss:

• ReliaQuest's Research: Devastating Paths to VPN Exploitation
• SuperBlack Ransomware Exploits Fortinet Flaws
• BRUTED Framework Automates Black Basta Attacks
• ClickFix Campaign Hooks Hospitality Sector

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Ivan Righi: Senior Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. His areas of expertise include the development of cyber intelligence tools, data breach investigations, threat actor profiling, and reverse engineering of threat campaigns. Before joining ReliaQuest, Ivan was a member of the Digital Shadows Photon Research Team, where he investigated, researched, and responded to cyber threats across the clear, deep, and dark web. 

Join host Kim, and intelligence analysts Joey and Anna as they discuss:

• ReliaQuest's Research: Cyber Threats to Hospitality and Recreation
• Silk Typhoon Expands to Supply-Chain Attacks
• Insider's Kill Switch Cripples Ex-Employer
• Akira Ransomware Uses Webcam to Compromise Network

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs. 

Anna Jones: Cyber Threat Intelligence Analyst at ReliaQuest, based in our London office. She joined in June 2023 and specializes in OSINT investigations, with 5 years of experience in threat intelligence. Anna's expertise in sourcing and analyzing covert threat data provides unique insights into cybercriminal activities. 

Join host Kim and Detection Researcher Marken Teder as they discuss:

• ReliaQuest's Research: Blink and They're In
• The Latest Ransomware Developments
• 244 Million Passwords Added to 'Have I Been Pwned'
• VMware Zero-Days Actively Exploited

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Marken Teder: Detection Researcher at ReliaQuest, with a total of 6 years at the company. A native Estonian, he has previously worked as an Incident Response Analyst, Content Developer, and Security Architect. Marken's extensive experience in detection and response brings a robust technical perspective to discussions.

Join host Kim and cyber threat intelligence analysts Joey Keyes and Hayden Evans as they discuss insights from ReliaQuest's 2025 Annual Cyber-Threat Report:

• The Top Successful Initial Access Techniques 
• How Attackers Achieve Breakout in 48 Minutes
• Key Recommendations to Outpace Attackers

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. With his prior role as a Cyber Security Analyst, he has gained years of experience in triaging and responding to active threats using GreyMatter's various tools. Joseph is skilled in intrusion response, threat actor profiling, OSINT across the clear and dark web, and analyzing adversarial TTPs. 

Hayden Evans: Threat Intelligence Analyst at ReliaQuest. He has experience in the F3EAD lifecycle and analyzing adversaries' TTPs to operationalize this information. He is also experienced with intrusion response, OSINT investigations, and offensive security. 

Join hosts Chris and Kim as they discuss:

• Storm-2372 Device Code Phishing Campaign
• China Linked Espionage Tools Used Alongside Ransomware
• 8Base Leak Site Seized in Law Enforcement Operation
• ReliaQuest Research on the Worlds Fastest Rising Ransomware Group: BlackLock

Chris Morgan: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes.

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Join hosts Chris and Kim, and Detection researcher Corey Carter as they discuss:

• Large Scale Brute Force Campaign Targeting Edge Devices
• Critical Microsoft RCE Vulnerability Exploited 
• Ransomware Criminals Attempt to Recruit Insiders
• ReliaQuest Research: Manufacturing Sector Report

Chris Morgan: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes.

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Corey Carter: Detection Researcher at ReliaQuest. A Florida native and former infantryman in the United States Marines, Corey holds a bachelor's degree in computer science with a specialization in information assurance. His experience as a Security Analyst and Threat Hunter at ReliaQuest, combined with his military background, equips him with a unique perspective on cybersecurity challenges. 

Join hosts Chris and Kim, and Senior Threat Intelligence Analyst Ivan Righi as they discuss:

• APT Groups Use AI for Reconnaissance
• Unused AWS Buckets Pose Supply-Chain Risk
• New Lazarus Group Infrastructure Uncovered
• ReliaQuest Research: Attackers Abuse Legitimate Tools

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Chris Morgan: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes.

Ivan Righi: Senior Cyber Threat Intelligence Analyst at ReliaQuest, specializing in technical cyber threat research. His areas of expertise include the development of cyber intelligence tools, data breach investigations, threat actor profiling, and reverse engineering of threat campaigns. Before joining ReliaQuest, Ivan was a member of the Digital Shadows Photon Research Team, where he investigated, researched, and responded to cyber threats across the clear, deep, and dark web. 

•  ReliaQuest's Research into Attacker Breakout Times
•  Lumma Infostealer Spreading via Fake Reddit Webpages
•  Ransomware Persisting with SSH Tunnelling
•  DeepSeek and the Potential Risks to User Data 

Chris Morgan: Chris Morgan is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  brings deep insights into various threat landscapes.

Marken Teder: Marken Teder is a Detection Researcher at ReliaQuest, with a total of 6 years at the company. A native Estonian, he has previously worked as an Incident Response Analyst, Content Developer, and Security Architect. Marken's extensive experience in detection and response brings a robust technical perspective.

Anna Jones: Anna is a Cyber Threat Intelligence Analyst at ReliaQuest, based in our London office. She joined in June 2023 and specializes in OSINT investigations, with 5 years of experience in threat intelligence. Anna's expertise in sourcing and analyzing covert threat data provides unique insights into cybercriminal activities for ShadowTalk. 

• ReliaQuest's Q4 Ransomware Report
• FortiGate Data Leak
• New Sneaky 2FA Phishing Kit
• UK Contemplates Ransomware Payment Ban

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Chris Morgan: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes.

Corey Carter: Detection Researcher at ReliaQuest. A Florida native and former infantryman in the United States Marines, Corey holds a bachelor's degree in computer science with a specialization in information assurance. His experience as a Security Analyst and Threat Hunter at ReliaQuest, combined with his military background, equips him with a unique perspective on cybersecurity challenges. 

• Fortinet and Ivanti zero-days under active exploitation
• Infostealer spread via fake LDAPNightmare exploit
• Biden administration hasten's executive order
• The importance of taking a proactive approach within threat intelligence

Barri Graham: Experienced Security professional with over 25 years in the field. His 20+ years of military service saw stints as security practitioner and leader in both UK and Global settings. Following military retirement he took up the mantle of auditor and joined NQA in 2019 as an information security auditor. After 2 years in the role he struck out as consultant for a range of public and private sector clients. In 2023, the opportunity to work with a global FTSE100 company presented itself when he joined Beazley as Head of Cyber Threat Intelligence where he works today.

Chris Morgan: Chris Morgan is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes.

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

•  Chinese Espionage Hits US Treasury Department
• New OtterCookie Variant Used in North Korea Recruitment Scam
• FireScam Infostealer Imitates Telegram to Steal Your Data
• ReliaQuest's Response to a Speedy Pure Malware Compromise

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Chris Morgan: Chris Morgan is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes.

Brian Kelly: Brian Kelly is an experienced Threat Hunter and Intrusion Response Operator with a deep understanding of adversary tactics, techniques, procedures (TTPs), and motivations. Beginning his career in IT, Brian swiftly transitioned into cybersecurity, where he actively hunts for threats within organizations and responds to ongoing incidents. His expertise in adversary emulation and TTP exploration empowers him to anticipate and counteract malicious activities. Positioned on the front lines, Brian offers invaluable and actionable insights on the current threat landscape.

•  2024 look-back, 2025 forecast. We discuss our expectations for the coming year
• Clop resurface in new campaign
• President-elect Trump administration pivot on tackling Chinese espionage
• The future for AI and automation in shaping the security landscape

Noah Davis: Seasoned technologist with over 20 years of experience, excelling in translating complex tech challenges into simple business solutions for Fortune 500 companies. As VP & Chief Information Security Officer at Ingersoll Rand, he leads global cybersecurity efforts. Previously, he held senior roles in IT audit, incident response, and security architecture. Noah champions leadership by prioritizing people, enabling a secure and flexible future, and fostering authenticity and transparency.

Chris Morgan: Chris Morgan is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes.

Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

• Termite Ransomware claiming responsibility for Blue Yonder incident
• Ransomware impacting Romanian electricity supply
• Researchers divulge QR code based browser bypass
• ReliaQuest research into malware distribution through CAPTCHA hijacking

Chris Morgan: Chris Morgan is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  brings deep insights into various threat landscapes.

Kim Bromley: Kim Bromley is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights.

Rick Holland: Rick Holland is one of ReliaQuest’s Chief Information Security Officers. A seasoned cybersecurity executive, practitioner, and former Forrester Research industry analyst, Rick is also a U.S. Army intelligence veteran. He regularly speaks at leading security conferences, including SANS, RSAC, and BSides. Rick's extensive expertise and industry insights make him an invaluable contributor.

Marken Teder: Marken Teder is a Detection Researcher at ReliaQuest, with a total of 6 years at the company. A native Estonian, he has previously worked as an Incident Response Analyst, Content Developer, and Security Architect. Marken's extensive experience in detection and response brings a robust technical perspective.

•  BootKitty Linux Bootkit
• LockBit Arrest in Russia
• Novel Phishing Campaign Corrupts Word
• Cyber Threats During M&A

Kim Bromley: Kim Bromley is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights for ShadowTalk.  

Chris Morgan: Chris Morgan is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes.

Brian Kelly: Brian Kelly is an experienced Threat Hunter and Intrusion Response Operator with a deep understanding of adversary tactics, techniques, procedures (TTPs), and motivations. Beginning his career in IT, Brian swiftly transitioned into cybersecurity, where he actively hunts for threats within organizations and responds to ongoing incidents. His expertise in adversary emulation and TTP exploration empowers him to anticipate and counteract malicious activities. Positioned on the front lines, Brian offers invaluable and actionable insights on the current threat landscape for ShadowTalk. 

• APT28 conduct 'Nearest Neighbor' WiFi Attack
• Windows Reissue Controversial Recall Feature 
• Update on Palo Alto Critical Vulnerability Exploitation
• Navigating potential obstacles as a new CISO

Resources: https://linktr.ee/RQShadowTalk

Chris Gunner: Group CISO at a global financial service firm, comprised of federated business units across 20 countries. Chris is responsible for Group-wide cyber strategy as well as advising the business in the Group. Previously held roles as a security leader in law firms, as well as varied roles in consulting. Passionate that cyber security is a business enabler, where it can drive better business decisions, as well as protecting organizations and their customers.

Chris Morgan: Chris Morgan is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes.

Kim Bromley: Kim Bromley is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights for ShadowTalk. 

• Black Friday: Cyber Threats Facing the Retail Sector
• T-Mobile Breached Again
• Attacks Exploiting PAN-OS Zero-Day
• Fake AI Image Generators Deploy Infostealers

Resources:

• https://linktr.ee/RQShadowTalk

Kim Bromley: Kim Bromley is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights for ShadowTalk.  

Chris Morgan: Chris Morgan is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes. 

Rick Holland: Rick Holland is one of ReliaQuest’s Chief Information Security Officers. A seasoned cybersecurity executive, practitioner, and former Forrester Research industry analyst, Rick is also a U.S. Army intelligence veteran. He regularly speaks at leading security conferences, including SANS, RSAC, and BSides. Rick's extensive expertise and industry insights make him an invaluable contributor on ShadowTalk. 

Corey Carter: Corey Carter is a Detection Researcher at ReliaQuest. A Florida native and former infantryman in the United States Marines, Corey holds a bachelor's degree in computer science with a specialization in information assurance. His experience as a Security Analyst and Threat Hunter at ReliaQuest, combined with his military background, equips him with a unique perspective on cybersecurity challenges. 

• ReliaQuest's Cyber Threat Predictions for 2025
• Huge Data Leak Linked to 2023 MOVEit Flaw
• New Ransomware Partners with RustyStealer
• Volt Typhoon Rebuilds Dismantled Botnet

Resources:

• https://www.reliaquest.com/blog/report-shows-ransomware-has-grown-41-for-construction-industry/
• https://www.reliaquest.com/blog/service-account-abuse/

Chris Morgan: Chris Morgan is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes.

Kim Bromley: Kim Bromley is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights for ShadowTalk.

Anna Jones: Anna is a Cyber Threat Intelligence Analyst at ReliaQuest, based in our London office. She joined in June 2023 and specializes in OSINT investigations, with 5 years of experience in threat intelligence. Anna's expertise in sourcing and analyzing covert threat data provides unique insights into cybercriminal activities for ShadowTalk. 

• ReliaQuest research exploring credential theft and misuse
• Social engineering campaign targets LastPass users
• Patch now: Sharepoint vulnerability exploited in the wild
• New Interlock ransomware group targeting FreeBSD OS

Resources:

• https://www.reliaquest.com/blog/the-credential-abuse-cycle-theft-trade-and-exploitation/

• ReliaQuest research identifies Black Basta TTP changes
• Amazon seize APT29 domains
• Tango down: Redline & Meta Infostealers taken down by Dutch police
• The importance of supporting DEI programs in hiring practices

Resources:

• https://www.reliaquest.com/blog/black-basta-social-engineering-technique-microsoft-teams/
• https://www.reliaquest.com/blog/5-critical-threat-actors-you-need-to-know-about/

Eric Knopp: VP Security Operations for one of ReliaQuest’s customers, a large global financial services company. Eric has been in the IT industry for almost 30 years, with the past 11 in IT Security. He also has a passion for diversity, equity and inclusion, co-leading the DEI Committee in London. He also supports the cyber apprenticeship program in the UK.

Kim Bromley: Kim Bromley is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights for ShadowTalk.

Chris Morgan: Chris Morgan is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes. 

• Scattered Spider x RansomHub: A New Partnership
• US Authorities Indict Anonymous Sudan Leaders
• Crypt Ghouls Deploys LockBit on Russian Organizations
• APT41 Targets Gambling and Gaming Industry in New Financially-Motivated Campaign  

Resources:

• https://www.reliaquest.com/resources/research-reports/five-ways-cyber-attackers-exploit-cloud-environments/
• https://www.reliaquest.com/blog/virtual-machines-defense-evasion/

Kim Bromley: Kim Bromley is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights for ShadowTalk.

Brandon Tirado: Brandon Tirado is the Director of Threat Research for ReliaQuest. Brandon is a skilled cyber defense professional with a unique combination of management and hands-on experience. With a deep understanding of adversary motives and the tactics, techniques, and procedures (TTPs) they use to achieve their goals, Brandon enjoys operationalizing his knowledge to make it more difficult for adversaries to operate within the environments of ReliaQuest customers. His managerial and hands-on experience enriches ShadowTalk with practical and strategic viewpoints. 

Brian Kelly: Brian Kelly is an experienced Threat Hunter and Intrusion Response Operator with a deep understanding of adversary tactics, techniques, procedures (TTPs), and motivations. Beginning his career in IT, Brian swiftly transitioned into cybersecurity, where he actively hunts for threats within organizations and responds to ongoing incidents. His expertise in adversary emulation and TTP exploration empowers him to anticipate and counteract malicious activities. Positioned on the front lines, Brian offers invaluable and actionable insights on the current threat landscape for ShadowTalk.

• ReliaQuest reporting on ransomware activity in Q3 2024
• OpenAI confirm malicious use of ChatGPT
• Russian APT29 mass exploiting known vulnerabilities
• CISCO data reportedly breached by IntelBroker

Resources:

• https://media.defense.gov/2024/Oct/09/2003562611/-1/-1/0/CSA-UPDATE-ON-SVR-CYBER-OPS.PDF
• https://www.reliaquest.com/blog/q3-2024-ransomware/

Chris Morgan: Chris Morgan is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team and has been the host of ShadowTalk since 2021. Chris joined ReliaQuest in August 2020, previously working as a Cyber Threat Intelligence analyst in the telecommunications and financial sectors. Chris also has a background in the British military. With his diverse background, he  enhances ShadowTalk with deep insights into various threat landscapes.

Kim Bromley: Kim Bromley is a Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement, and has acted as host since 2024.  Kim brings a wealth of experience in threat intelligence and law enforcement tactics, providing unique insights for ShadowTalk.

Corey Carter: Corey Carter is a Detection Researcher at ReliaQuest. A Florida native and former infantryman in the United States Marines, Corey holds a bachelor's degree in computer science with a specialization in information assurance. His experience as a Security Analyst and Threat Hunter at ReliaQuest, combined with his military background, equips him with a unique perspective on cybersecurity challenges. 

• Cyber Threats Facing the Health Care and Social Assistance Sector
• Salt Typhoon Compromises US-based Telecoms Companies 
• Microsoft and US DoJ Takedown Star Blizzard Infrastructure
• Gorilla Botnet Conducts Large-Scale DDoS Campaign

Resources:

• https://www.reliaquest.com/blog/threats-health-care-social-assistance-landscape/

• The Critical Role of Cyber Insurance in Mitigating Cyber Risk
• Embargo Ransomware Targeting Cloud
• Iranian Threat Actors Conducting Influence Ops Against US Elections
• National Crime Agency Tease Lockbit Update

Resources:

• https://www.reliaquest.com/blog/2024-us-election-top-cyber-threats-organizational-impacts/

• Telegram Pivot 180: Agree to Share IP and Phone Data on Legal Requests
• Kaspersky Auto-Replace Software with UltraAV Antivirus
• Dell Investigate Two Data Breaches
• ReliaQuest Data Exfiltration Case Study

• Threat actors express difficulty in retrieving stolen Fortinet data
• Amadey malware's novel approach: Users locked in Kiosk Mode 
• Aftermath of incident affecting Transport for London (TFL)
• ReliaQuest Response to Insider Threat Cases

Resources:

• https://www.reliaquest.com/blog/common-infostealers/

• Russia's Military Intelligence target CNI, identified using "Non-Lethal Acoustic Weapons" 
• New Sextortion scam targets spouses
• Privacy concerns with smart automobiles
• ReliaQuest research into "Inc Ransom" Data Extortion Attack

 Resources:

• https://www.reliaquest.com/blog/inc-ransom-attack-analysis/ 

• City of Columbus Ohio sue security researcher following ransomware breach
• Dutch Data Protection Authority fine AI/Facial recognition company
• Building security teams and improving your cyber maturity
• ReliaQuest research into top attacker techniques

Resources:

• https://www.reliaquest.com/blog/top-cyber-attacker-techniques/ 

• Telegram CEO arrested in France over alleged criminal use of the platform
•  Return of Volt Typhoon: China APT exploiting Versa high-severity bug
•  Cybercriminals discuss exploiting physical security gaps to target SMEs

• Data breach at NPD affecting millions resulted from exposed credentials
• Iran-linked APT groups abuse OpenAI to create US-election propaganda
• ReliaQuest Research: Service Account Abuse

Resources:

• https://www.reliaquest.com/blog/exploring-impacket-abuse/
• https://www.reliaquest.com/blog/service-account-abuse/

• Unusual Espionage: China-linked threat groups target Russian government, IT organizations
• Vicious Vulnerabilities: New vulnerability in all Windows systems with IPv6, Sonos Speaker flaws allow eavesdropping
• ReliaQuest Research: Data Exfiltration Tools and Malware Loaders

Resources:

https://www.reliaquest.com/blog/exfiltration-tools

https://www.reliaquest.com/blog/common-malware-loaders

• Takeaways from BlackHat CISO Summit
• ReliaQuest presentation on Remote Monitoring & Management (RMM) tools
• Things to look forward to at DEF CON 32

• Rise of the Deepfakes: Threat actors target Ferrari, Fake North Korean IT worker fake's job interview
• Developments in ransomware: Stormous v3, VSXI, Black Basta develop custom malware
• ReliaQuest Research: Beyond the Endpoint: Threats Bypassing your Endpoint Detection and Response (EDR) solutions

Resources:

• https://www.reliaquest.com/blog/beyond-the-endpoint-cyber-threats-eluding-endpoint-detection/
• https://arstechnica.com/tech-policy/2024/07/us-security-firm-unwittingly-hired-apparent-nation-state-hacker-from-north-korea/
• https://www.drive.com.au/news/ferrari-ceo-impersonated-ai-deepfake-scam/

• CrowdStrike Global IT Outage breaks records in impacting 8.5 million devices (1:22)
• The importance of accountability and trust when working with third party vendors
• ReliaQuest research into threats facing Financial & Insurance (18:46)

Resources:

• https://www.reliaquest.com/blog/crowdstrike-outage-script-phishing-and-social-engineering-attacks/

• ReliaQuest Research: Ransomware in Q2 2024
• Weekly roundup: Threat actors weaponizing exploits within 22 minutes, Disney/AT&T breaches
• Linking security strategy to expenditure
• Supporting cyber apprenticeships and investing in people

Resources:

• https://www.reliaquest.com/blog/q2-2024-ransomware/
• https://app.galabid.com/shawburyproms/items

• The influence of Generative Artificial Intelligence (GenAI) on cybercrime
• Tango down: Law enforcement takedown over 600 Cobalt Strike servers
• Record breaking DDoS attack disclosed by researchers
• Rockyou2024: 9.9 Billion stolen passwords posted onto BreachForums

Resource: AI-powered Cybercrime Report

• TeamViewer compromised by APT29 in supply chain attack
• MOVEit in the headlines again, critical severity vulnerability disclosed
• Popular Content Delivery Network (CDN) providers compromised in supply chain attacks
• ReliaQuest research in a case study attributed to the Medusa ransomware group

Resources: 

• https://www.reliaquest.com/blog/medusa-attack-analysis/

• Lockbit claim breach of the US Federal Reserve, but are they telling the truth? 
• ReliaQuest research into misuse of Protocol Tunneling
• Fallout from the US Ban of Kaspersky

Resources:

• https://www.reliaquest.com/blog/protocol-tunneling-tools-and-techniques/#:~:text=Protocol%20tunneling%20is%20a%20technique%20used%20to%20encapsulate,be%20transmitted%20through%20a%20secure%20or%20otherwise-allowed%20protocol.

• Scattered Spider leader reportedly arrested, as group pivot to target SaaS solutions
• ReliaQuest research into supply chain compromise. Detections to improve your resilience
• Classifying insider threats and the difficulties of proving intent

Resources:

• https://www.reliaquest.com/blog/what-is-scattered-spider/
• https://www.reliaquest.com/blog/scattered-spider-attack-analysis-account-compromise/
• https://www.reliaquest.com/blog/software-supply-chain-risk-management/
• https://www.reliaquest.com/blog/virtual-machines-defense-evasion/

• Significant threats facing healthcare: Ransomware, accidental insiders
• The influence of COVID on ransomware activity
• The immediate and long term impact of the Optum breach
• The importance of understanding your revenue cycle to weather the storm of a breach
• Methods of maintaining engagement and retaining staff
• AI and automation: Improving timeliness and efficiency of incident response

• How InfoSec stacks up against the US cyber conferences
• Snowflake data breach affecting TicketMaster and others
• Cybercriminal reflections on generative AI

Resources:

• https://www.reliaquest.com/blog/common-infostealers/

• Microsoft set to begin the deprecation of VBScript in the second half of 2024 
• ReliaQuest research into the top three Infostealers 
• Dive into a new crypto miner dubbed 'GhostEngine' 
• ReliaQuest analysis of a BlackSuit ransomware attack 

Resources:

• https://techcommunity.microsoft.com/t5/windows-it-pro-blog/vbscript-deprecation-timelines-and-next-steps/ba-p/4148301
• https://www.reliaquest.com/blog/common-infostealers/
• https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine 
• https://www.reliaquest.com/blog/blacksuit-attack-analysis/ 

• Microsoft mandating multi-factor authentication across Azure
• ReliaQuest research exploring fileless malware and living against the land (LoTL) techniques 
• Use of deepfakes in social engineering in 2024

Resources:

• https://www.reliaquest.com/blog/socgholish-fakeupdates/
• https://www.reliaquest.com/blog/new-python-socgholish-infection-chain/
• https://www.reliaquest.com/blog/living-off-the-land-fileless-malware/
   

• Recent ransomware attacks on the healthcare sector do not necessarily suggest a change in targeting preferences
• Black Basta pivot TTPs: New social engineering campaign using mass sign ups to mailing list spam
• Pain on the adversary, in having multiple controls to slow down an attacker, can greatly improve cyber resilience when combined with network visibility 
• Initial access brokers (IAB) continuing to play a crucial role in facilitating cybercrime

Resources:

• https://www.reliaquest.com/blog/q1-2024-attacker-trends/

• The importance of tact and developing both soft and hard skills
• Working around personnel constraints  
• Picking the right vendors to compliment your security model
• Recommendations for advancing your own career

• APT28 Exploit 6 year old CISCO vulnerability
• ReliaQuest research on Iran/Israel Tensions
• Ransomware Rebrands
• Apple notify users impacted by Spyware

Resources:

• https://www.reliaquest.com/blog/cyber-threats-linked-to-iran-israel-conflict/

• Palo Alto Critical Vulnerability under active exploitation 
• ReliaQuest research on VPN attack surface management
• Optum Healthcare data breached by RansomHub group

• Health sector Cybersecurity Coordination Center (HC3) issues alert warning regarding attackers using social engineering to target IT helpdesk's across the health sector
• ReliaQuest releases it's findings from it's Q1 Phishing report
• How improper permissions can lead to problems with new Microsoft Copilot AI

Resources:

• https://www.reliaquest.com/blog/health-care-social-engineering-campaign/
• https://www.reliaquest.com/blog/phishing-tactics-and-trends-2024/

• Sophisticated backdoor identified in XZ Utils
• Our Spotlight report on SEO poisoning
• Impersonation scams cost $1.1 billion in 2023

• Issues with Google AI-powered search generative experience recommending scam sites
• Spain high court judge issues temporary ban on messaging platform 'Telegram'
• Speculative Execution vulnerabilities found on Apple M Series and Intel Raptor Lake CPU's

• 2021 AT&T breach released for free 
• Magnet Goblin threat group exploiting 1-day vulnerabilities
• An introduction to ReliaQuest's Annual Threat Report (ATR)

• TeamCity Server critical vulnerability leaves potential for supply chain risk
• ReliaQuest research into advanced business email compromise (BEC) detections
• Microsoft compromised by Midnight Blizzard password spraying attack

Resources: 

• https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/ 
• https://blog.jetbrains.com/teamcity/2024/03/our-approach-addressing-recently-discovered-vulnerabilities-in-teamcity-on-premises/ 
• https://blog.jetbrains.com/teamcity/2024/03/preventing-exploits-jetbrains-ethical-approach-to-vulnerability-disclosure/ 
• https://www.reliaquest.com/blog/business-email-compromise-detection/

• An overview of the critical severity vulnerabilities affecting ConnectWise, patch now!
• ReliaQuest research into Browser Credential Dumping attacks
• The latest in the world of ransomware
• Update to National Institute of Standards and Technology (NIST) framework

Resources:

• https://www.reliaquest.com/blog/browser-credential-dumping/ 

• Lockbit return following law enforcement operation
• Recent Structured Analytical Technique (SAT) exercises ran by ReliaQuest
• The Optum Breach and what you need to know
• 'SubdoMailing' malvertising campaign leveraging compromised domains

Resources:

• https://www.reliaquest.com/blog/lockbit-taken-down-what-comes-next/
• https://www.reliaquest.com/blog/scattered-spider-attack-analysis-account-compromise/

• Lockbit taken down by NCA led operation. Does this spell the end for the ransomware group?
• ReliaQuest research into abuse of Remote monitoring and management (RMM) tools
• Insider leaks Chinese government documents on Github

Resources:

• https://www.reliaquest.com/blog/lockbit-taken-down-what-comes-next/

• ReliaQuest research into changes observed on SocGholish infection chain
• Update to Volt Typhoon campaign affecting US CNI
• Furore over reporting on Toothbrush smart devices reportedly used in DDoS attacks
• Canada bans Flipper Zero consumer hacking device, over car theft concerns

 Resources:

• https://www.reliaquest.com/blog/new-python-socgholish-infection-chain/
• https://www.reliaquest.com/blog/socgholish-fakeupdates/

• Breach of Remote Desktop Application 'AnyDesk' results
• Continued Ivanti vulnerability exploitations
• The rise of BEC deepfake social engineering attacks
• ReliaQuest's top priorities for the remainder of Q1 2024

Resources:

• https://event.on24.com/eventRegistration/EventLobbyServlet?target=reg20.jsp&eventid=4448957&sessionid=1&key=3FBF0E608FF3216DD9F1526D92EE5CCE&groupId=5180806&partnerref=website&sourcepage=register
• https://event.on24.com/wcc/r/4387339/A63BC17298406ECD68AABFFEF416702B?partnerref=organic

• The emergence of Killnet 2.0 
• Best practices for Baselining Detection Rules
• Insights from ReliaQuest's Q4 2023 Ransomware blog

Resources:

• https://www.reliaquest.com/blog/q4-2023-ransomware/

•  Midnight Blizzard Targeting Microsoft
•  Threat research on Attacker techniques observed from Customer incidents
•  Two new Citrix NetScaler vulnerabilities being exploited in the wild

Resources:

• https://www.reliaquest.com/blog/top-cyber-threat-techniques-q4-2023
• https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/ 
• https://www.theregister.com/2024/01/18/citrix_netscaler_bugs_attacked/

• Ivanti Zero-day vulnerabilities under mass exploitation
• ReliaQuest research into misuse of Valid Accounts 
• Risk posed through emerging Internet of Things (IoT) devices

Resources:

• https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US 

• A recap of major developments in 2023: Ransomware, Business Email Compromise, Living off the land (LotL)
• The influence of Generative AI on cyber threats
• Lockbit targeting healthcare providers in Germany

• ALPHV targeted in law enforcement operation
• A look back at major events from the previous 12 months
• Predictions for the cyber threat landscape in 2024
• 'Expense in depth' and maximising investments

Resources:

• https://www.reliaquest.com/blog/double-extortion-attack-analysis/
• https://www.reliaquest.com/blog/alphv-ransomware-site-outage/ 
• https://www.justice.gov/media/1329536/dl?inline=&utm_medium=email&utm_source=govdelivery

• An overview of a ReliaQuest report on a sophisticated incident involving a technique known as Bring Your Own Vulnerable Driver (BYOVD).
• ALPHV ransomware site outage rumored to be caused by law enforcement.
• Apps vulnerable to Log4Shell still being exploited by Advanced Persistence Threats.
• FBI releases policy notice that informs cyber victims how they can request to delay public disclosures to the Securities and Exchange Commission.

Resources:

• https://www.sonatype.com/resources/log4j-vulnerability-resource-center
• https://blog.talosintelligence.com/lazarus_new_rats_dlang_and_telegram/
• https://www.reliaquest.com/blog/alphv-ransomware-site-outage/
• https://www.fbi.gov/file-repository/fbi-policy-notice-120623.pdf/view
• https://www.kovrr.com/blog-post/cybersecurity-legal-and-financial-experts-share-their-reactions-to-the-secs-latest-cyber-disclosure-regulations

• Ransomware groups increasingly targeting ESXi
• Cyber Threats to the Airline industry
• Incidents affecting CNI in the US, UK, and Israel

Resources:

• https://www.gov.uk/government/news/response-to-a-news-report-on-cyber-security-at-sellafield
• https://www.cshub.com/attacks/news/lockbit-hackers-publish-43gb-of-stolen-boeing-data-following-cyber-attack
• https://www.theregister.com/2023/11/29/water_authority_ciso_iran/
• https://www.bleepingcomputer.com/news/security/linux-version-of-qilin-ransomware-focuses-on-vmware-esxi/

• An overview of ReliaQuest's latest report covering EDR Pitfalls and Best Practices.
• Latest updates to Okta's Support Case Management System intrusion that occurred in October.
• Discussion on guidelines released for secure AI system development by CISA and UK NCSC.
• Infostealers making headlines after allegedly being able to restore expired Google cookies.

Resources:

Okta's Support Case Management System Intrusion Update-
https://sec.okta.com/harfiles

Proactive Defense: Positioning your IR Team for Success webinar-
https://event.on24.com/wcc/r/4388361/F9C6D55AEEB34F33683F29973F48D174?partnerref=shadowtalk

 CISA and UK NCSC Joint Guidelines-
https://www.cisa.gov/news-events/alerts/2023/11/26/cisa-and-uk-ncsc-unveil-joint-guidelines-secure-ai-system-development

 Scattered Spider Blog-
https://www.reliaquest.com/blog/scattered-spider-attack-analysis-account-compromise/

• AlphaV filing a complaint with the SEC
• ReliaQuest case study on the Scattered Spider attack
• Sandworm hacker group conducts "largest ever" attack on Danish infrastructure

Resources:

• https://www.reliaquest.com/blog/scattered-spider-attack-analysis-account-compromise/

• CitrixBleed vulnerability mass targeted by threat actors
• Taking the burden from incidents responders by taking proactive steps
• Hacktivists targeting Israeli organizations with "BiBi" data wiping malware

Resources:

https://www.reliaquest.com/blog/citrix-bleed-vulnerability-background-and-recommendations/

• Apache ActiveMQ vulnerability (CVE-2023-46604) exploited by ransomware gangs
• Discussion over charges filed by the US SEC against SolarWinds
• Active exploitation of a Critical Atlassian Confluence flaw (CVE-2023-22518)
• An overview of QR code phishing threats

Resources:

• https://event.on24.com/wcc/r/4387339/A63BC17298406ECD68AABFFEF416702B?partnerref=organic

• The charges filed by the US SEC against SolarWinds
• A sneak-peak of the findings from our Vulnerabilities Roundup blog
• An overview of some vulnerabilities impacting users right now
• The Executive Order issued by the Biden administration on artificial intelligence.

• The findings of ReliaQuest's Quarterly Ransomware Report recapping Q3 2023 activity.
•  ServiceNow vulnerability and what it means for you
• The latest on a security incident pertaining to authentication provider, Okta.

Resources:

• https://www.reliaquest.com/blog/ransomware-trends-q3-2023/

• Threat actors exploiting Critical CISCO IOS XE Vuln 
• Increase in Business Email Compromise (BEC) activity
• Social media platform Discord being used for malicious activity

• Cyber threat implications from the Hamas - Israel Conflict
• Top Adversary Techniques: What We're Seeing Right Now
• Has Qakbot returned? 

Resources:

• https://www.reliaquest.com/blog/iranian-cyber-threats-practical-advice-for-security-professionals/

• 2023 National Cyber Security Awareness Month (NCSAM) 
• Progress FTP Server
• The risk posed by open Remote Desktop Protocol (RDP) Sessions
• IronNet ceasure operations

Resources:

•  https://www.reliaquest.com/blog/cybersecurity-awareness-automation/ 
• https://www.reliaquest.com/blog/israel-hamas-implications-for-cyber-threats/ 

• Hunting for MFA bypass techniques
• Exploitation of a Zero-day LibWebP Vulnerability
• Threat actors targeting VMWare ESXI

Resources:

https://www.reliaquest.com/blog/mfa-bypass-techniques/#:~:text=Attackers%20also%20bypass%20MFA%20by,for%20sale%20on%20cybercriminal%20platforms. 

• A deep dive into popular MFA bypass techniques and how to mitigate them
• How a misconfigured SAS token led to a big Microsoft data breach
• The latest ALPHV ransomware attack

Resources:

• https://www.reliaquest.com/blog/domain-redirection-attacks-wrong-turns-in-cyberspace/

•  A deep dive on domain redirection attacks
• New ransomware report from the UK government
• New Managed Engine zero-day exploited by multiple threat actors
• Anonymous Sudan Telegram bans and DDoS attacks.

Resources:

• https://www.ncsc.gov.uk/whitepaper/ransomware-extortion-and-the-cyber-crime-ecosystem
• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a
• https://www.reliaquest.com/blog/5-macos-infostealers/
• https://www.reliaquest.com/blog/cisos-guide-six-steps-to-start-adopting-ai/

• A deep dive of malware loader SocGhoulish
• Artificial intelligence: implications, security concerns, and use by cybercriminals
• LockBit leaking top secret information from the UK’s Ministry of Defence

Resources: 

• https://www.reliaquest.com/blog/the-3-malware-loaders-behind-80-of-incidents
• https://www.reliaquest.com/blog/socgholish-fakeupdates
• https://www.reliaquest.com/blog/lockbit-ransomware-2023

• The FBI operation targeting Qakbot infrastructure
• Barracuda Zero-Day targeted by Peoples Republic of China (PRC) aligned actors
• The resurgence and future of Hacktivism

• Malware Loaders
• Ransomware Runbooks 
• Generative AI 
• Barracuda ESG - Zero-Day

Resources:

• https://www.reliaquest.com/blog/lockbit-ransomware-2023/
• https://analyst1.com/ransomware-diaries-volume-1/
• https://www.bleepingcomputer.com/news/security/angry-conti-ransomware-affiliate-leaks-gangs-attack-playbook/
• https://www.reliaquest.com/news-and-press/reliaquest-adds-ai-capabilities-to-greymatter-intelligent-analysis/
• https://www.reliaquest.com/blog/understanding-generative-ai-in-cybersecurity/
• https://www.reliaquest.com/blog/intersection-generative-ai-cybersecurity/
• https://www.mandiant.com/resources/blog/threat-actors-generative-ai-limited
• https://www.ic3.gov/Media/News/2023/230823.pdf 

• Recap of DefCon conference
• The latest updates regarding Clop's exploitation of MOVEit zero-day
• The return of the infamous Raccoon Stealer

• Themes in recent Business Email Compromise (BEC) activity
• A breakdown of ReliaQuest research into threats facing the Professional, Scientific, and Technical Services (PSTS) sector
• The influence of AI on the cyber threat landscape 
• ReliaQuest activities at BlackHat 2023 conference

• Twitter becoming X security concerns
• Cl0p names 71 new victims
• ReliaQuest releases Q2 ransomware report
• Hackers target Norwegian government ministries with Ivanti zero-day exploit
• ALPHV ransomware group creates API key for its data leak site

Resources:

• https://www.bleepingcomputer.com/news/security/norway-says-ivanti-zero-day-was-used-to-hack-govt-it-systems/
• https://www.bleepingcomputer.com/news/security/alphv-ransomware-adds-data-leak-api-in-new-extortion-strategy/

• ReliaQuest research into common attacker techniques
• An update on Clop's exploitation of the MOVEit vulnerability 
• ChatGPT rival with ‘no ethical boundaries’ sold on dark web

Resources:

• https://www.reliaquest.com/blog/top-adversary-techniques-july-2023/
• https://www.reliaquest.com/blog/clop-leaks-first-victims/
• https://www.zdnet.com/article/wormgpt-what-to-know-about-chatgpts-malicious-cousin/

• Chinese hackers breach Microsoft Cloud
• Strava App – Tracked and Killed
• Cl0p Update
• Remote Monitoring and Management Software – RMM

Resources:

• https://www.cnn.com/2023/07/11/europe/russian-submarine-commander-killed-krasnador-intl/index.html
• https://www.telegraph.co.uk/news/2023/07/11/russian-submarine-commander-shot-strava-krasnodar-vinnytsia/
• https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_1_1_yamashige-nakatani-tanaka_en.pdf
• https://www.reliaquest.com/blog/clop-leaks-first-victims/
• https://www.cisa.gov/sites/default/files/2023-07/aa23-193a_joint_csa_enhanced_monitoring_to_detect_apt_activity_targeting_outlook_online.pdf
• https://www.washingtonpost.com/national-security/2023/07/12/microsoft-hack-china/
• https://blogs.microsoft.com/on-the-issues/2023/07/11/mitigation-china-based-threat-actor/
• https://www.whitehouse.gov/briefing-room/statements-releases/2023/07/13/fact-sheet-biden-harrisadministration-publishes-thenational-cybersecurity-strategyimplementation-plan/

• Threat actors obfuscating activity through virtualization
• LockBit claim to have impacted Taiwanese semiconductor giant TSMC
• CISA identify new exploited vulnerabilities
• New critical vulnerability impacting Fortinet, FortiOS and FortiProxy SSL-VPN appliances

Resources:

• https://www.reliaquest.com/blog/virtual-machines-defense-evasion/
• https://www.bleepingcomputer.com/news/security/cisa-orders-govt-agencies-to-patch-bugs-exploited-by-russian-hackers/
• https://thehackernews.com/2023/07/alert-330000-fortigate-firewalls-still.html
• https://www.scmagazine.com/brief/ransomware/tsmc-discloses-data-breach-from-lockbit-claimed-attack-against-third-party

• The SEC reportedly charging SolarWinds executives
• APT29 hunting for credentials
• Our new, shiny Annual Threat Report

Resources:

• https://www.reuters.com/technology/solarwinds-executives-receive-wells-notice-us-sec-2023-06-23/
• https://www.scmagazine.com/brief/identity-and-access/apt29-intensifies-credential-stealing-attacks
• https://www.reliaquest.com/resources/research-reports/annual-threat-report/

• The latest updates related to Cl0p's exploitation of MOVEit zero-day
• Killnet targeting European financial institutions
• Insights drawn from our closed sources team
• The team's observations on this years InfoSec conference

Resources:

• https://www.reliaquest.com/blog/clop-leaks-first-victims/ 
• https://techmonitor.ai/technology/cybersecurity/killnet-revil-and-anonymous-threaten-swift-with-destructive-attack-in-48-hours 

• The latest updates related to Clop's exploitation of MOVEit zero-day
• An overview of the Gootloader initial access malware
• Fortinet RCE CVE-2023-27997
• Ukraine's Cyber Anarchy Squad take down Infotel

Resources:

• https://www.reliaquest.com/blog/clop-leaks-first-victims/
• https://www.scmagazine.com/news/device-security/fortinet-patches-critical-rce-fortigate-ssl-vpn-appliances
• https://www.bleepingcomputer.com/news/security/ukrainian-hackers-take-down-service-provider-for-russian-banks/

• What you need to know on the MOVEit Zero-day vulnerability and the latest Cl0p updates 
• Infostealers ecosystem: most common malware, impact, and mitigation strategies
• Key insights from the latest Verizon's DBIR issue

Resources:

• https://www.reliaquest.com/blog/moveit-vulnerability-update-clop-claims-responsibility/ 
• https://www.verizon.com/business/resources/reports/dbir/

• What you need to know on the MOVEit Zero-day vulnerability
• RaidForums user's data breached
• The Buhti ransomware taking a unique approach to targeting victims

Resources:

• https://www.reliaquest.com/blog/moveit-transfer-zero-day/
• https://www.bleepingcomputer.com/news/security/new-buhti-ransomware-gang-uses-leaked-windows-linux-encryptors/
• https://www.bleepingcomputer.com/news/security/new-hacking-forum-leaks-data-of-478-000-raidforums-members/

• An investigation into the GootLoader malware
• The latest operation from hacktivist group Intrusion Truth
• A cyber espionage campaign conduct by Volt Typhoon
• RQ Exponent conference debrief

Resources:

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
• https://www.washingtonpost.com/politics/2023/05/15/they-dox-chinese-hackers-now-theyre-back/

• Revisiting the SocGholish malware distribution framework 
• Getting pricked by the Cactus ransomware
• Greatness Phishing-as-a-service 

Resources:

• https://www.reliaquest.com/blog/socgholish-fakeupdates/
• https://thehackernews.com/2023/05/new-ransomware-strain-cactus-exploits.html
• https://www.bleepingcomputer.com/news/security/new-greatness-service-simplifies-microsoft-365-phishing-attacks/

• Five Eyes agencies takedown FSB-linked Snake malware
• Hunting Kubernetes for privilege escalation techniques
• Investigation offers insights into Caffeine PhaaS platform

Resources:

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a
• https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/kubernetes-privilege-escalation-excessive-permissions-in-popular-platforms
• https://www.bleepingcomputer.com/news/security/caffeine-service-lets-anyone-launch-microsoft-365-phishing-attacks/

• A day in the life of a Threat Engineer at ReliaQuest
• ALPHV leaking internal comm's related to victims incident response
• High Severity vulnerability affecting Veeam back servers exploited in the wild (CVE-2023-27532)

• Highlights from the ReliaQuest Ransomware Quarterly Report Q1 2023
• A supply-chain of a supply-chain: 3CX Update
• Analysis of Russia-Ukraine cyber operations
• A look into recent shifts in the cybercriminal ecosystem

Resources:

• https://www.reliaquest.com/blog/2023-ransomware-attacks-q1/
• https://www.ncsc.gov.uk/news/new-analysis-eccri-highlights-ukraine-defence-against-russian-offensive
• https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

• cyber trends they're seeing across RSA Conference 2023
• the benefits of such an event
• AI in cyber and more.

• A breakdown of ReliaQuest's latest Vulnerability quarterly report
• Aftermath of the ransomware attack affecting Capita
• The "Domino" Backdoor and "Project Nemesis" information stealing malware
• Lockbit targeting macOS

Resources:

• https://www.reliaquest.com/blog/2023-q1-vulnerabilities-cves/
• https://www.reliaquest.com/blog/2023-ransomware-attacks-q1/

• A new approach in malicious infrastructure takedown
• The latest TTPs of MERCURY aka MuddyWater
• What's new on this Patch Tuesday?

Resources:

• https://blogs.microsoft.com/on-the-issues/2023/04/06/stopping-cybercriminals-from-abusing-security-tools/
• https://www.microsoft.com/en-us/security/blog/2023/04/07/mercury-and-dev-1084-destructive-attack-on-hybrid-environment/
• https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2023-patch-tuesday-fixes-1-zero-day-97-flaws/

• The prominent Genesis Market has been seized: What's next?
• Confidential Vulkan Files expose ties between Russian APTs and private sector
• Microsoft mitigates malicious attachments delivered via OneNote

Resources:

• https://news.sky.com/story/notorious-criminal-marketplace-genesis-market-which-sold-stolen-bank-details-taken-down-12850517
• https://www.theguardian.com/technology/2023/mar/30/vulkan-files-leak-reveals-putins-global-and-domestic-cyberwarfare-tactics
• https://www.securityweek.com/microsoft-onenote-starts-blocking-dangerous-file-extensions/
• https://www.reliaquest.com/blog/top-reads-march-2023/

• Implications from the 3CX supply-chain attack and what you need to do going forward
• Russian telco Rostec de-anonymizing Telegram users
• Updates to the IcedID malware

Resources:

• https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
• https://www.reliaquest.com/blog/3cx-trojan-attack/
• https://www.bleepingcomputer.com/news/security/russia-s-rostec-allegedly-can-de-anonymize-telegram-users/
• https://www.bleepingcomputer.com/news/security/new-icedid-variants-shift-from-bank-fraud-to-malware-delivery/

• Implications following the arrest of BreachForums administrator Pompompurin
• Cryptojacking activity group the TeamTNT threat group 
• Microsoft Outlook bug CVE-2023-23397

Resources:

• https://www.reliaquest.com/blog/breachforums-arrest-fbi/
• https://www.reliaquest.com/blog/cyber-threats-svb-collapse/
• https://www.reliaquest.com/platform/phishing-analyzer/

• https://www.reliaquest.com/blog/cyber-threats-svb-collapse/?
• https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf
• https://www.reliaquest.com/blog/qbot-black-basta-ransomware/
• https://www.reliaquest.com/blog/html-smuggling-dark-web/

• the new US National Cybersecurity Strategy
• the return of Emotet
• zero-day exploited by the Cl0p ransomware group.

• the email threat of HTML Smuggling
• the latest guidance on logging from CISA.

• https://resources.digitalshadows.com/weekly-intelligence-summary/weekly-intelligence-summary-24-feb

• https://resources.digitalshadows.com/weekly-intelligence-summary/weekly-intelligence-summary-17-feb

• https://resources.digitalshadows.com/weekly-intelligence-summary/weekly-intelligence-summary-10-feb

• https://resources.digitalshadows.com/weekly-intelligence-summary/weekly-intelligence-summary-3-feb

• REvil connection to Ransom Cartel
• Cryptocurrency hacks in Japan by Lazarus
• Toyota T-Connect Attack

Resources:

• https://resources.digitalshadows.com/weekly-intelligence-summary/weekly-intelligence-summary-21-october
• https://www.digitalshadows.com/blog-and-research/ransomware-in-q3-2022/
• https://www.digitalshadows.com/blog-and-research/alternative-future-analysis-pro-russian-hacktivism/
• https://resources.digitalshadows.com/threat-intelligence-podcast-shadowtalk/special-geoff-white-and-the-lazarus-heist