The Security Swarm Podcast (Hornetsecurity)

In today's digital landscape, ransomware threats have become an increasingly significant concern for organizations of all sizes. Cybercriminals are continuously devising new ways to exploit vulnerabilities, and the repercussions can be devastating. Its ever-evolving nature makes it a top threat. To uncover the full extent of its threat, Hornetsecurity recently conducted a survey to gauge the awareness and preparedness of businesses in the face of ransomware attacks. 

In today’s episode, Andy and Matt Frye, Head of Presales and Education at Hornetsecurity, will recap the key findings and insights from the ransomware survey as well as offer effective tools and protocols to protect your business.   

Timestamps:

In this episode of the Security Swarm Podcast, host Andy is joined by Umut Alemdar, Head of Security Lab at Hornetsecurity, to explore the escalating threat of election interference by cyber threat actors across the globe. They talk about motivations driving these actors and the various tactics used to infiltrate political parties, target election equipment, and spread misinformation, including the use of deepfakes.  

The episode also revisits significant cases of election meddling, from the 2015 German Bundestag hack to the 2020 Iranian hack of U.S. city election websites, highlighting the ongoing risks. Andy and Umut conclude with strategies to combat these threats, emphasizing the importance of policy changes, enhanced public communication, and rigorous cybersecurity training for election officials. 

Key Takeaways: 

Timestamps: 

(01:00) Introduction and Categorizing Threat Actors 

(08:00) Infiltrating Political Parties and Targeting Election Equipment 

(09:44) Consequences of Spreading Misinformation  

(14:00) Past Attacks: Germany, France, and Ukraine 

(21:32) US-Based Attacks: 2016 Presidential Election and Breaching City Websites   

(28:30) What Can Be Done? Policies, Communication, and Monitoring 

Episode Resources: 

EU Sanctions Russian Hackers for German Bundestag Hack 

Webinar containing deep fake materials  

Washington Post Article about Local Election Website Hacks 

Microsoft's recent decision to throttle traffic from old and outdated versions of On-Premises Exchange has sent shockwaves through the tech community. In today's episode, Andy and Paul Schnackenburg delve into the details of Microsoft's plans to protect Exchange Online against persistently vulnerable on-premises Exchange Servers by throttling and blocking emails from these unsupported servers. 

Tune in to understand the reasoning behind Microsoft's strategy with this change, how organizations can keep themselves protected through process, and where third-party vendors can plug in and provide value. 

Timestamps:

In this episode of the Security Swarm podcast, host Andy is joined by Romain Basset from Hornetsecurity to discuss the cybersecurity implications of the upcoming 2024 Olympic Games in Paris, France. The conversation explores how the geopolitical landscape, with ongoing global tensions and conflicts, creates a high-profile stage that threat actors may target for hacktivism, financial gain, or destabilization. 

Throughout the episode, they highlight the increased risks leading up to the 2024 Games, noting that French infrastructure has already been targeted by various threat actor groups, including DDoS attacks. They discuss the blurring lines between cybercrime and geopolitical threats, with many threat actors now engaging in both financially and politically motivated attacks. 

Key takeaways: 

Timestamps: 

(01:15) - Why Cybersecurity is Important for the Olympics  

(02:25) - Geopolitical Tensions and Threat Actors  

(04:31) - Potential Cyber Attacks - Scams, Extortion, Disinformation  

(06:50) - The 2018 Pyeongchang Olympics Cyber Attack  

(12:48) - False Flags and Attribution Challenges  

(16:05) - Overlap Between Cybercrime and Geopolitical Destabilization  

(19:13) - Real-World Impacts of Geopolitical Cyber Tensions  

(23:08) - Cybersecurity Best Practices and Advice 

Episode Resources:

Read our blog about Russia’s notorious history of attacking the Olympics

Protect your business before it’s too late with 365 Total Protection

Train your users to spot phishing emails during the Olympics with Security Awareness Service

We’re back for another episode with Philip Galea, R&D Manager at Hornetsecurity. In today’s episode, Andy and Philip discuss the frustrations and challenges IT admins face when managing permissions and sharing effectively in SharePoint Online.  

As more organizations embrace remote work, collaborate with external freelancers, and rely on tools like Microsoft Teams and emails for sharing files, the need to manage permissions has become crucial. Tune in to this episode to learn about the complexities of SharePoint and discover ways to regain control over your access management. 

Timestamps:

During last week’s episode, we briefly spoke about major security incidents that took place between January and February 2024, including the Midnight Blizzard attack. Today, we're delving deeper into the specifics of this attack. From exploiting OAuth mechanics to navigating Microsoft's corporate environment, the attackers demonstrated a level of sophistication that evaded conventional detection controls.  

Tune in to hear Andy and Paul examine its intricate attack chain and discuss their insights on what Microsoft should do in response.  

Timestamps: 

(2:00) – What does the attack chain for this breach look like? 

(7:11) – Timeline of the Attack 

(8:53) – Thoughts on Microsoft’s Response 

(18:55) – A Definition of an OAuth App and a Service Principal 

(27:36) – What do Admins need to do about this? 

(33:20) – Does the speed of change and the scale of Cloud Services negatively impact security? 

Episode Resources: 

Andy and Paul Discuss Malicious OAuth Apps

YouTube Video from Andy Robbins

BingBang 

As cybersecurity professionals, MSSPs, and security vendors, we often get mired down in the weeds of the “tech” involved in the job and frequently struggle to convey the value of said technology to the C-Suite. With that said, we’re deviating from our regularly scheduled programming this week to bring you something of a “soft-skills” episode to address this key point.  

This week we’re excited to bring you the business and C-Suite knowledge of our very own Hornetsecurity Chief Operating Officer, Daniel Blank for a discussion on how you can get your leadership team to see value in technology, put priority on security, and ultimately sell cybersecurity to the C-Suite. Hope you enjoy! 

Timestamps:

We're kicking off 2024 with our Monthly Threat Report analysis. Every month, our Security Lab looks into M365 security trends and email-based threats and provides commentary on current events in the cybersecurity space. 

In this episode, Andy and Eric Siron discuss the Monthly Threat Report for January 2024. Tune in to learn about the top-targeted industries, brand impersonations, the MOVEit supply chain attack, the active attack by the Iranian hacking group "Homeland Justice" on the Albanian government, and much more! 

Episode Resources:

Full Monthly Threat Report for January 2024

Annual Cyber Security Report 2024

Andy on LinkedIn , Twitter , Mastodon

Eric on Twitter

In this week's episode, Andy and guest Eric Siron discuss the cybersecurity landscape based on data from the Monthly Threat Report for May 2024. They cover a range of news items, including Microsoft's recent announcement to expand the Secure Future Initiative, the new PSTI (Product Security and Telecommunications Infrastructure) Act in the UK and a significant brand impersonation campaign targeting the German financial entity Commerzbank. Additionally, they provide updates on the Change Healthcare ransomware attack. 

Key takeaways: 

We’re back for another episode with Umut Alemdar - Head of Security Lab here at Hornetsecurity. Today, we’re discussing Advanced Threat Protection (ATP) and its crucial role in detecting, preventing, and responding to increasingly sophisticated cyber threats. 

Throughout the episode, Andy and Umut discuss common ATP techniques such as sandboxing, time of click protection, and spam filters, all of which are critical in fortifying defenses against malicious actors. Furthermore, they emphasize the vital function of the natural language understanding module in ATP in detecting sophisticated social engineering attacks.  

While this episode focuses on ATP in general, Andy and Umut draw concrete examples from our own ATP scanning methods here at Hornetsecurity.  

Timestamps:

The Monthly Threat Report by Hornetsecurity is a valuable resource that provides monthly insights into M365 security trends, email-based threats, and commentary on current events in the cybersecurity space. For this episode, Andy is joined by Hornetsecurity’s CTO – Yvonne Bernard, for an in-depth analysis of major security breaches and ransomware attacks that occurred between January and February 2024. 

From the Midnight Blizzard attack on Microsoft to a ransomware attack that cost Johnson Controls 27 million USD, our hosts explore what went wrong and provide expert recommendations from the Security Lab at Hornetsecurity on how to protect your business from similar threats. 

Timestamps: 

(3:20) – Email Threat Trends from January 

(6:51) – What were the Most Targeted Industries for January? 

(9:52) – What were the most impersonated brands in January? 

(12:30) – A Discussion on the Midnight Blizzard attack on Microsoft 

(22:38) – The Recent Breach of AnyDesk 

(27:15) – $27 Million Cost of Ransomware attack on Johnson Controls 

(32:34) – A C-Suite Look at Microsoft 365 Co-Pilot and the Danger of Misconfigured Permissions 

Episode Resources:

Episode on Malicious OAuth Applications

Microsoft post on Midnight Blizzard Attack

Detailed Tactics Post from Microsoft on Midnight Blizzard Attack

Any Desk Public Announcement

Effortlessly manage Microsoft 365 permissions, enforce compliance policies, and monitor violations with 365 Permission Manager

Monthly Threat Report - February 2024

DMARC Pro Tips

What is SPF? 

What is DKIM?

In this episode of The Security Swarm Podcast, host Andy Syrewicze is joined by Matt Lee from Pax8 to discuss the risks associated with deploying always on remote access software on managed endpoints.  

The conversation spans various topics, including Matt Lee's extensive background in the MSP space, where he shares insights gained from his experience with a mass ransomware event. Together, they explore the risks and implications of constant remote access, emphasizing the need for organizations to adopt a more proactive stance toward cybersecurity.  

Join host Andy and special guest Philip Galea, R&D Manager at Hornetsecurity, as they explore insider threats within Microsoft 365. In this episode, the focus is on SharePoint Online and OneDrive for Business, shedding light on the nuances of insider threats and offering valuable insights on safeguarding against them. 

Tune in for expert analysis and practical tips on fortifying your defenses and protecting your organization's sensitive data in the evolving landscape of cloud-hosted infrastructures. 

Episode Resources:

Effortlessly manage Microsoft 365 permissions 

In this week’s episode, Andy and Paul have a discussion that has been brewing for the past several episodes. Microsoft has experienced a series of security incidents in the last few years. For example, the SolarWinds debacle in 2020, multiple exchange server on-prem issues, and more recently the Storm-0558 incident. 

The core issue that all these problems raise, especially for a major global cloud provider, is trust. Can Microsoft be trusted to secure these services that millions around the globe use every single day? This is the main question that the guys get into in this episode along with lots of other great discussions around security in the Microsoft Cloud.  

Timestamps:

The use of Large Language Models (LLMs), like ChatGPT has skyrocketed, infiltrating multiple facets of modern life. In today's podcast episode, Andy and Paul Schnackenburg explore Microsoft 365 Co-Pilot and some surprising risks it can surface. Microsoft 365 Co-Pilot is more than just a virtual assistant: it's a powerhouse of productivity! It is a versatile generative AI tool that is embedded within various Microsoft 365 applications, and as such, it can execute various tasks across different software platforms in seconds. 

Amidst discussions about Co-Pilot’s unique features and functionalities, many wonder: How does M365 Co-Pilot differ from other LLMs, and what implications does this hold for data security and privacy? Tune in to learn more!

Timestamps:

In this week’s episode, Andy sits down with Daniel Hofmann, the CEO of Hornetsecurity, for an exclusive glimpse into life as a cybersecurity CEO in the modern era. During the episode, Daniel shares the complexities of leading a top-tier security organization exploring the challenges and rewards that come with the role whilst touching upon some predictions for the ever-evolving cybersecurity industry. 

With cybersecurity being an industry that never stands still, the conversation also delves into the constant opportunities for innovation. Tune in to discover ways of staying informed and constantly adapting to the shifting threat landscape. 

Timestamps:

In today’s episode, Andy and Umut Alemdar explore one of the most malicious botnets in today’s digital threat landscape: Qakbot. What makes Qakbot so dangerous? 

Qakbot originally started out as an information stealer back in 2007. Over the years, it has undergone significant transformations, evolving into a multi-modular malware that poses a severe threat to businesses. In our discussion and analysis, we uncover its attack chain from infecting a system to downloading malicious payload. 

Timestamps:

Remember the days of DNS route-based email security? It's been a steadfast approach, but in recent years, the landscape has shifted towards API-driven solutions, particularly evident in platforms like Microsoft 365 utilizing the Graph API.

In this episode, Umut Alemdar from Hornetsecurity's Security Lab joins Andy once again to discuss email filtration, particularly the DNS route-based approach versus the emerging API-based method. The discussion isn’t just a comparison; it’s an exploration of how these two approaches can complement each other in a hybrid model, offering a more robust and versatile email security framework.

Episode Resources:

365 Total Protection Free Trial

Romain Basset is back for another podcast episode. Today, Andy and Romain discuss the notorious threat actor group, Anonymous Sudan. They explore who this group is, their affiliations, motivations, and the tactics, techniques, and procedures (TTPs) they employ.  

The discussion includes an overview of various types of threat actor groups, situating Anonymous Sudan within this landscape, and providing a detailed background on the group's emergence, targets, and the significant impact of their attacks. 

Key Takeaways: 

Timestamps: 

(02:43) - Categories of Threat Actor Groups 

(05:44) - Ties Between Anonymous Sudan and Russia 

(10:59) - Tools Used by Anonymous Sudan 

(15:47) - Techniques and Procedures of Anonymous Sudan 

(24:08) - Typical DDoS Attack Procedure 

Episode Resources: 

Next-gen Microsoft Security and Compliance Management to meet your Requirements

You can’t be in the IT security space without thinking about certifications. Certifications are the backbone of our industry, serving as benchmarks for knowledge, skills, and expertise. But, let's face it, navigating the maze of IT and security certifications available can be a daunting task making it difficult to figure out which route you need to take.  

In today’s episode, Andy and Umut Alemdar explore the critical role certifications play in our field and why these certifications hold more value than just being decorative pieces on your office wall. They’ll also go a little further into the top certifications that are particularly relevant for security professionals in today's ever-changing cybersecurity landscape. 

Timestamps:

Episode Resources:

Comptia Security+

GSEC

Cisco CCNA

CISSP

CISM

CEH

OSCP

Careers at Hornetsecurity (We offer training!)

The Monthly Threat Report by Hornetsecurity brings you monthly insights into M365 security trends, email-based threats, and commentary on current events in the cybersecurity space. This edition of the Monthly Threat Report focuses on data from the month of September 2023.  

The cybersecurity landscape is ever-evolving, and this month is no exception. Andy and Umut will be analysing the latest types of email threats. Unsurprisingly, the Entertainment and Mining industries continue to be the bullseye for malicious actors. Over the past 30 days, these sectors have borne the brunt of cyberattacks. Meanwhile, Microsoft remains in the spotlight for all the wrong reasons, as security incidents continue to plague the tech giant. This raises questions about the company's security culture and its ability to safeguard its vast user base. 

Tune in for more details! 

Timestamps:

Episode Resources:

Full Monthly Threat Report - October 2023

Andy and Paul Discuss Microsoft Security Problems

In today’s episode of the Security Swarm Podcast, Andy and Eric Siron discuss the Monthly Threat Report of August 2024. They cover the aftermath of the CrowdStrike incident, Microsoft's proposed enhancements to improve the security of their ecosystem, as well as the discovery of a vulnerability in AMD processors that could allow persistent malware. 

Additionally, they discuss the emergence of new AI jailbreak attacks, which can bypass content restrictions and generate harmful outputs and a VMware ESXi vulnerability that could allow attackers to gain access to virtual machines. 

Key Takeaways: 

Timestamps: 

(01:00) CrowdStrike Incident and Lessons Learned  

(04:14) Importance of Proper Software Testing and Development Processes 

(7:21) Potential Consequences of Rushed Software Updates  

(28:18) AI Jailbreak Attacks and Generative AI Risks  

(33:43) VMware ESXi Vulnerability and Potential Ransomware Implications  

(37:53) Bumblebee Loader and the Threat of Rapid Active Directory Compromise  

(39:41) HealthEquity Data Breach and the Normalization of PII Breaches  

(40:17) Anonymous Sudan and Their Disruptive DDOS Attacks 

(41:54) Cyber Attacks on the Olympic Games and the Role of Nation-State Actors  

Episode Resources:

Full Monthly Threat Report

Podcast episode on Anonymous Sudan

AMD CPU Vulnerability Info

Webinar where Andy covers the ways threat actors use Generative AI 

VMware ESXi Authentication Bypass Exploit

Security Swarm Podcast re: threat actor attacks on the Olympic Games

Paul Schnackenburg joins Andy in this episode to discuss the recent rebranding of Azure AD to Microsoft Entra ID, as well as talk about some new identity features in the Microsoft Cloud. To kick things off, they provide a brief overview of what Azure AD is/was and its crucial role in the Microsoft Cloud ecosystem.  

Amidst the changes, Andy and Paul emphasize a critical point: IT professionals and security experts primarily care about understanding a platform's functionality, features, and ability to solve real-world problems. The name may change, but the core value remains the same.

Timestamps:

Welcome back for another episode of the Security Swarm Podcast, the podcast that brings you the insights and expertise straight from the Security Lab here at Hornetsecurity. In this episode, we’ll be diving into recent security disclosures with Eric Siron, Microsoft MVP, and discussing how organizations should respond when vulnerabilities are discovered. 

We’ll focus on two major incidents as examples throughout this episode; the Outlook Vulnerability CVE-2023-23397, and the re-emergence of Emotet. 

In today’s digital landscape, threats are constantly evolving and becoming more sophisticated, making it critical to respond quickly and efficiently minimize the impact of such incidents. Whether you’re a SysAdmin working in a small organization or the CISO of a large business, you have to be more vigilant, and have a plan. 

Tune in to learn valuable insights into how tech professionals should handle security news.  

Timestamps:

The Monthly Threat Report by Hornetsecurity brings you monthly insights into M365 security trends, email-based threats, and commentary on current events in the cybersecurity space. This edition of the Monthly Threat Report focuses on data from October. 

During the episode, Andy and Eric Siron explore the rise of PDF-delivered malicious payloads, shifts in target industries, and escalating brand impersonation attempts in shipping and finance. They delve into Microsoft’s response to a recent cloud services attack and a significant vulnerability in Citrix NetScalers dubbed CitrixBleed, shedding light on the evolving threat landscape.  

Join us for an insightful analysis of the latest cybersecurity developments, providing valuable insights for both professionals and enthusiasts alike. 

Timestamps:

We're thrilled to have Jan Bakker, a seasoned Cloud Consultant with over 10 years of IT experience, joining us from the Netherlands. In this episode, Andy and Jan explore the revolutionary concept of passkeys, a technology that aims to replace traditional passwords and enhance security by providing phishing resistance. The conversation delves into the significance of passkeys and their value in improving user experience and security measures. The guys even discuss what is currently known publicly about passkeys in M365. 

Key takeaways 

Timestamps: 

(00:13) - Unveiling the Power of Pass Keys in Cybersecurity with Jan Bucker 

(03:47) - The Rise of MFA Bypass Kits and Adversary in the Middle Attacks 

(14:55) - Unlocking the Future of Passwordless Authentication with Passkeys 

(24:55) - Addressing Persistent Access in Malicious Apps and OAuth: A Call for Improved Security Practices 

(29:59) - Unpacking the Importance of Phishing Resistance and Token Security in Cybersecurity 

(33:01) - Enhancing Security with Passkeys and Onboarding Procedures in Public Services 

Episode resources: 

Passkeys Directory 

Jan Bakker’s website 

The Security Swarm Podcast - EP24: The Danger of Malicious OAuth Apps in M365 

Start your free trial of M365 Total Protection

In today’s episode, Andy and Umut are unravelling the transformative impact of AI in cybersecurity defense. Discover how AI empowers defenders with enhanced knowledge of setting up robust defense mechanisms, from firewalls to anomaly detection systems. Amidst the prevailing focus on AI's darker aspects, this episode illuminates its positive role in the security space, equipping blue teams to match wits with increasingly intelligent adversaries. Our hosts, Andy and Umut, both distinguished members of the Security Lab at Hornetsecurity, will provide expert insights into how Hornetsecurity's suite of products leverages AI to display a concrete example in the industry. 

Join us as we shift the narrative from AI's potential for malicious use to how defensive toolsets and security experts are harnessing its power.  

Timestamps: 

For our 50th episode of the Security Swarm Podcast, Andy and Eric Siron look back at the last 49 episodes of the show. They go through some core security topics and discuss whether they’re still relevant, how they’ve changed in comparison to the evolving threat landscape and provide updates on some of the major stories discussed. 

This is part 1 of a 2-part episode, with part 2 coming next week. 

Key Takeaways:

Timestamps:

(00:31) Using ChatGPT to create ransomware - still a relevant and evolving topic 

(02:22) How tech pros should handle security news and zero-days 

(09:09) The re-emergence of Emotet and the challenges of disrupting botnets 

(12:04) The persistent problem of social engineering and email attacks 

(13:25) The importance of immutability and backups against ransomware 

(16:29) The security of Microsoft 365 

(19:35) Deep dive on the QuickBot malware 

(20:20) The necessity of advanced threat protection (ATP) 

(22:58) Guidance on effective security awareness training 

(25:41) Tips for IT admins on working with CISOs 

(26:07) Microsoft's throttling of legacy on-premises Exchange servers 

(28:11) Discussing Episodes 12 and 13, recorded live at InfoSecurity Europe, on compliance and security horror stories 

Microsoft has recently been criticized for not prioritizing security enough. Following the CSRB's Report on the Storm-0558 attack, Microsoft announced that security is now a top priority, with a commitment to address security issues before new product innovations. In this podcast episode, Andy and Paul Schnackenburg discuss the blog post which analyzes the Secure Future Initiative and its advancements.  

The conversation brings up the burning question: Was it the Cyber Safety Review Board (CSRB) that catalyzed Microsoft’s proactive stance on security? 

Key takeaways: 

Welcome back to the Security Swarm Podcast! In this episode, our host Andy Syrewicze talks with Umut Alemdar, Head of Security Lab here at Hornetsecurity, about the reemergence of Emotet and the pervasiveness of botnets. Why do they keep coming back? 

Emotet, a well-known botnet for spreading malware and stealing personal information, had been dormant since December before reappearing in March 2023 with new tactics and capabilities. The Botnet has a modular architecture that allows threat actors to include any kind of payload that gets executed on the victim’s device. 

Tune in to hear Andy and Umut discuss the attack chain of Emotet, how it has evolved and the risks it may pose to your organization. They also explore why botnets such as Emotet persist despite efforts to shut them down. 

Timestamps:

In today’s episode, our host Andy sits down with Lia Fey, Customer Success Lead at Hornetsecurity, to discuss why employees need to be trained on security awareness and what type of training works best. In addition, they explore the challenges businesses face when trying to train their employees in today’s digital landscape.  

Lia Fey brings her expertise to the table and sheds light on real-world scenarios where organizations have successfully prevented attacks because an end user possessed the knowledge and ability to react appropriately. 

Timestamps:

Episode Resources:

Security Awareness Service

Cyber Security Report 2023

Andy on LinkedIn, Twitter or Mastodon 

Lia on LinkedIn 

The Monthly Threat Report by Hornetsecurity brings you monthly insights into M365 security trends, email-based threats, and commentary on current events in the cybersecurity space.  In today’s episode with Yvonne Bernard – CTO at Hornetsecurity, we are analyzing data from the month of August 2023. 

During the episode, Andy and Yvonne explore the overall threat trends including:  

In this episode, host Andy is joined by Paul to provide a comprehensive overview of confidential computing - what it is, why it's important, and how it's being implemented in cloud platforms like Microsoft Azure.  

Key Takeaways: 

Timestamps: 

(03:00) The Need for Confidential Computing 

(06:28) How Confidential Computing Works 

(14:38) Trusted Execution Environments and Trusted Computing Base  

(21:47) Confidential Computing in Azure and Beyond  

(27:58) Confidential Computing in Apple's AI  

Episode Resources:

The Confidential Computing Consortium

NVIDA Confidential Computing

Apple's Article

Watch: BlueHat IL 2024 - Ben Hania, Yair Netzer - Compromising confidential VMs and then fixing it

In this episode, we delve into the world of social engineering, phishing, and spam campaigns, exploring modern techniques threat actors are using to trick users into divulging sensitive information through email. Security Evangelist Andy and guest expert Umut Alemdar, head of the Security Lab here at Hornetsecurity, explain how phishing remains the top method of attack for many cybercriminals due to its cost-effectiveness and ability to exploit human vulnerability. 

Attackers use excellent context and timing to create convincing email messages that trick even the most savvy users into divulging sensitive information. Despite the prevalence of anti-spam solutions, phishing continues to rise as attackers adapt and evolve their techniques. 

Tune in to gain a better understanding of social engineering and how to protect your organization in the modern age. 

In this episode of the Security Swarm Podcast, host Andy and recurring guest Eric Siron discuss the Monthly Threat Review for June 2024.  They explore a new threat campaign distributing the Darkgate Malware using a technique called pastejacking. Additionally, they touch upon the 911 S5 Proxy Botnet takedown and how threat actors are exploiting Stack Overflow to distribute malware.  

Key takeaways: 

Timestamps: 

(03:15) - Insights into Email Threat Trends and Industry Targeting in Cybersecurity Landscape

(13:15) - Unveiling New Cybersecurity Threat Campaign using  Pastejacking

(23:31) - Massive Botnet Take Down and Arrest of Operator: A Victory Against Cybercrime

(29:29) - Beware of Malicious Packages: A Cautionary Case Study from Stack Overflow 

Episode Resources: 

Full Monthly Threat Report

Enhance Security Awareness by Training Employees

QR Codes are used everywhere in our society, from reading restaurant menus to accessing Wi-Fi networks and authenticating payments. However, as with any technological advancement, there's a flip side. While QR codes are not malicious in their essence, the landscape has shifted in recent years.  

Threat actors have evolved their tactics to exploit QR codes in various ways, posing new cybersecurity challenges. In this episode, host Andy teams up with Microsoft Certified Trainer Paul Schnackenburg to discuss the darker side of QR codes and the different ways in which threat actors are deceiving individuals. 

Episode Resources:

The Danger of Malicious OAuth Apps in M365

Train your users to spot malicious emails with the Security Awareness Services Demo

Safeguard your users from malicious QR codes with Advanced Threat Protection

The Monthly Threat Report by Hornetsecurity brings you monthly insights into M365 security trends, email-based threats, and commentary on current events in the cybersecurity space. Every month, Andy will be hosting an episode to dive into the key takeaways from the report. 

In today’s episode, Andy and Umut will be sharing a threat overview based on data from the Security Lab throughout July 2023. From the changing tactics in email attacks, to new brand impersonations and the impact of dark-web generative AI (Artificial Intelligence) tools like WormGPT, we will equip you with the right information to help you stay ahead of these new emerging threats.  

Timestamps:

Episode Resources:

Monthly Threat Report - August 2023 

EP 01 - We Used ChatGPT to Create Ransomware

Previous episode on Passkeys

Blog post of Jan

In today's episode, Andy has a special guest from our product development team at Hornetsecurity - Jean Paul (JP) Callus. The episode goes into an insightful discussion on how threats have morphed over the years. Andy and Jean Paul recount the days when backup primarily served as a safety net against accidental data loss and hardware failures. Fast forward to today, and backups have become a key weapon in the fight against ransomware and other sophisticated attacks. 

Tune in to discover the power of modern backups in the ever-evolving world of cybersecurity and how organizations can establish seamless data protection measures, ensuring minimal data loss and downtime in the face of cyber threats. 

Timestamps:

(2:16) – Ransomware continues to drive backup and recovery decisions.

Episode resources:

Podcast EP01: We Used ChatGPT to Create Ransomware

Podcast EP05: What is Immutability and Why Do Ransomware Gangs Hate it?

Hornetsecurity Ransomware Attack Survey

VM Backup V9

The Backup Bible 

Find Andy on LinkedIn, Twitter or Mastadon

Find Jean Paul on LinkedIn

In our very first episode we welcome Yvonne Bernard to the show for an in depth discussion into the security implications of ChatGPT. There is no doubting that ChatGPT and other recent AI models have brought some very positive change to a number of industries. However, did you know that there is potentially a darker side to AI? Can it be used for malicious purposes? The short answer is yes! In fact, we were able to use ChatGPT here at Hornetsecurity to essentially create ransomware! 

In today’s episode we discuss the particulars of that process, the implications as well as other methods threat-actors can use to get ChatGPT to help them with illicit activities! 

In this episode, Andy sits down once again with Paul to continue their conversation about Microsoft’s struggles with security. The episode focuses on a recent report from ProPublica about a Microsoft whistleblower named Andrew Harris. The report alleges that Microsoft was aware of a serious vulnerability in its on-premises Active Directory Federation Services (ADFS) software that could have enabled the SolarWinds supply chain attack, but chose not to fix it or disclose it to customers. 

Andy and Paul discuss how Microsoft's focus on new features and cloud growth over security, as well as the desire to win lucrative government contracts, may have contributed to this decision. They also touch on the challenges faced by Microsoft's security response team and the broader issue of security being seen as a cost center rather than a profit driver.   

Key Takeaways: 

Timestamps: 

(02:22) - Explaining the Whistleblower's Allegations and the SolarWinds Attack 

(07:32) - Vulnerability in ADFS and Microsoft's "Security Boundaries" Argument 

(13:06) - Why Was the Issue Swept Under the Rug? 

(19:16) - The Challenges Faced by the Microsoft Security Response Center (MSRC) 

(26:24) - Satya Nadella's Comments on Prioritizing Security over New Features 

(27:38) - The Controversy Around the "Recall" Feature in Windows 11 

Episode Resources: 

ProPublica Article

In this two-part episode, Andy and Paul Schnackenburg discuss Microsoft’s recently announced Secure Future Initiative, a multi-year commitment to revolutionize the design, building, testing and operation of technology for enhanced security standards in the age of AI. The discussion stems from the aftermath of the Storm 0558 breach that occurred in July 2023, orchestrated by Chinese nation-state threat actors. 

Tune in to gain a comprehensive understanding of the Secure Future Initiative and its implications. 

Episode Resources:

Episode 17: On-Prem Security vs. Cloud Security

Microsoft’s Announcement Regarding the Secure Future Initiative

This episode of the Security Swarm podcast features guest Eric Siron, a Microsoft MVP in cloud and data center management. Eric works primarily with healthcare organizations and small-to-medium businesses, helping them navigate security and IT challenges. The episode focuses on the important topic of vetting and selecting third-party software vendors.  

Andy and Eric discuss the recent CrowdStrike incident that caused major disruptions for many businesses. They use this as a case study to explore best practices for evaluating vendors, including assessing their security track record, testing their solutions thoroughly, understanding their update and patch management processes, and having contingency plans in place in case of vendor failures. 

Key takeaways: 

Timestamps: 

(02:20) - CrowdStrike Incident 

(04:17) - Vetting Third-Party Vendors 

(11:42) - Compliance and Industry-Specific Considerations 

(13:46) - Detailed Testing of Solutions 

(19:26) - Common Problems with Third-Party Vendors 

(22:40) - The CrowdStrike Incident and Vendor Processes 

(29:10) - Mitigation Strategies 

In today's fast-paced world, digital transformation has become a necessity for businesses to stay ahead of the game. With the increasing reliance on digital tools, however, there has been a seemingly corresponding rise in security incidents. Coincidence?  

The evolving landscape of IT and technology has brought to the forefront the question of whether the latest tech "innovations" are actually accelerating security threats.  

In this episode, Andy and Paul delve deeper into this issue, exploring how businesses can balance their need for technological advancements with maintaining robust security measures to protect against cyber threats. 

Timestamps: 

(2:54) – Commentary on the Rate of Change in Technology 

(13:21) – How has Innovation in Microsoft Cloud Services Contributed? 

(23:33) – What is the Cost of Innovation on Security Postures? 

Episode Resources:

Article from Andy Robbins

Listen to episode 34

Listen to episode 22

365 Total Protection Free Trial

Join us for an insightful discussion on the topic of licensing Microsoft 365 security features. Microsoft Certified Trainer, Paul Schnackenburg, joins us once again to share his valuable insights on how M365 licensing practices have evolved and why they’ve become so complex. 

In this episode Andy and Paul look at all the different ways native security features in M365 are licensed, what challenges come along with that process, how the process is confusing and more! This includes some discussion around how M365 licensing in general is flawed as well as how third-party software vendors help plug-in and do what they can to simplify this mess. 

Timestamps:

Find Andy on LinkedIn, Twitter or Mastadon

Find Paul on LinkedIn or Twitter

In this episode, Andy and Paul Schnackenburg, Microsoft Certified Trainer, investigate the burning question on everyone's mind: Is Microsoft 365 a secure platform? As we discuss the intricate details and inner workings of Microsoft 365 security, we leave no stone unturned.  

Tune in to learn valuable insights and expert analysis on the subject, as well as how Microsoft 365 holds up in today's ever-changing threat landscape. 

Timestamps:

In today’s episode, we’re delighted to welcome back Eric Siron, who’s no stranger to our show. Andy and Eric will be exploring some historical methods devised by the security community to safeguard backups against ransomware such as air gapping, removable media and application whitelisting. But here's the twist: we're approaching these protective measures from the mindset of a relentless threat actor, someone who's determined to breach your defenses and make your backups their own. 

Throughout the episode, we will discuss common misconceptions surrounding these historical solutions, often described as the ultimate ransomware defenses. Do they genuinely live up to the hype? Why do they seem to fall short when used in a vacuum? Tune in to learn more! 

Episode Resources: 

The Backup Bible by Eric Siron

EP22: Can You Trust Microsoft with Security?

Immutable Protection Against Ransomware

Andy on LinkedIn , Twitter , Mastodon

Eric on Twitter

We’re back for another episode with Lia Fey, Customer Success Lead at Hornetsecurity. In today’s episode, Lia brings her wealth of experience working closely with CISOs on a daily basis to share valuable insights and strategies for effectively collaborating with them.  

CISOs face a unique set of challenges as they operate in high-pressure environments and navigate the intersection of compliance requirements as well as the security needs of an organization.  

Join us as we explore the multifaceted nature of working with CISOs on security awareness and discover tips and tricks for fostering effective partnerships in the ever-evolving security and compliance landscape. 

Timestamps:

In this episode of the Security Swarm Podcast, host Andy Syrewicze and guest Romain Basset dive into the top spear phishing methods used in both the enterprise space and across all businesses, based on internal research conducted by Hornetsecurity.

The conversation covers spear phishing techniques, including initial contact, tax/W2, C-suite/CEO, lawyer, banking, and gift card fraud. They analyze the differences in the prevalence of these methods between enterprises and smaller businesses and provide insights on how organizations can combat these threats through training and robust processes.

Do you want to join the conversation? Join us in our Security Lab LinkedIn Group! 

Key Takeaways: 

Timestamps: 

(03:26) Discussion on initial contact fraud 

(07:12) Exploration of tax fraud and W-2 phishing 

(13:35) Examination of C-suite fraud and the importance of processes 

(19:25) Lawyer Fraud and Enterprise vs. SMB Differences 

(23:47) Banking Fraud and Processes  

(26:39) Gift Card Fraud 

Episode Resources: 

Security Lab LinkedIn Group

What is a Spear Phishing attack?

The Top 5 Spear Phishing Examples and Their Psychological Triggers

As the year comes to a close, the Security Swarm podcast takes a reflective journey, comparing the landscape of security then and now. In this special episode, Andy and Eric Siron explore the intriguing evolution of cybersecurity from the days of floppy disks and DOS to the complex, interconnected world of today. 

Tune in to learn about the significant shifts in security incidents, drawing correlations and highlighting differences. From the era of viruses attempting to one-up each other with floppy disks to the present, where data theft and ransomware dominate the landscape. 

Timestamps:

In this episode of The Security Swarm Podcast, Andy and Paul discuss the Cyber Safety Review Board's findings of the Microsoft Storm-0558 breach. During the episode, they talk about the implications of the breach and explore Microsoft’s security culture, stressing the need to prioritize robust security measures over rapid feature developments. 

Key Takeaways: 

Timestamps: 

(10:07) - Microsoft's Security Culture: Past, Present, and Future 

(15:45) - Uncovering Lack of Transparency and Accountability in Major Cloud Vendors

(20:09) - Microsoft's Security Standards: A Critical Assessment and Call for Action

(28:53) - A Discussion on Cloud Audit Logging 

Episode Resources: 

Cyber Safety Review Board Report

Microsoft Trustworty Computing Memo

In this episode of the Security Swarm Podcast, host Andy is joined by Romain Basset, the Director of Technology Strategy at Hornetsecurity. They’re exploring the topic of Open-Source Intelligence (OSINT) - what it is, how threat actors use it to launch effective attacks, and the dangers it poses.  

Throughout the episode, they discuss the ease with which OSINT can gather information using AI and other tools and provide examples of how it can be used in phishing, business email compromise, and even deep fake attacks. The conversation also touches on the importance of privacy awareness and security awareness training to mitigate these threats. 

Malicious OAuth apps are an issue that has plagued M365 for many years. By default, end users are given great freedom to “authorize” OAuth apps and provide them access to the M365 tenant, unknowingly creating a security issue that persists even once the affected user’s password has changed! 

In today’s episode, Andy and Paul Schnakenburg discuss the danger of malicious OAuth apps at length, providing listeners info on the danger, what you can do about it, and what you need to look out for! Hope you enjoy! 

Timestamps:

In this podcast episode, Andy and Paul discuss the upcoming release of Windows Server 2025 and the myriad security enhancements it will bring. They delve into various topics such as improvements to Active Directory, delegated managed service accounts, Kerberos protocol enhancements, SMB enhancements, hot patching, REFS file system for confidential computing, and extended security updates.  

Key takeaways: 

Join host Andy and special guest Martin Tanner from ADM Computing as they discuss real-life security horror stories. This fun and engaging episode was recorded live at Infosecurity Europe in London. Expect to hear interesting stories which both Andy and Martin have experienced first-hand. 

With a mix of humor and valuable insights, this episode is a must-listen for anyone interested in the fascinating, and at times terrifying, world of real-life security horror stories. 

Timestamps: 

Our final episode for 2023 is here! To wrap up the year, Andy and Umut Alemdar will be discussing our Monthly Threat Report for December 2023. The Monthly Threat Report by Hornetsecurity brings you monthly insights into M365 security trends, email-based threats, and commentary on current events in the cybersecurity space. In this episode, Andy and Umut are focusing on data from the month of November. 

Tune in to hear about Microsoft’s recent zero-day vulnerabilities, the most common file types used to deliver malicious payloads, M365 brand impersonations and a lot more! 

Episode Resources:

Full Monthly Threat Report - December 2023

Annual Cyber Security Report 2024 - Free Download

Timestamps: 

(03:17) The National Public Data Breach 

(12:21) The Issues with Social Security Numbers 

(18:02) The Danger of Insider Threats 

(27:10) The Risks of Vendor Dependence 

(34:12) Recommendations for Protecting Against Threats 

Episode Resources: 

Security Lab LinkedIn Group 

In-depth analyses from Hornetsecurity’s Security Lab 

#StopRansomware: RansomHub Ransomware | CISA 

Passkeys in Microsoft Entra: Benefits, Implementation Tips & More (hornetsecurity.com) 

How Threat Actors Tamper with Elections (hornetsecurity.com) 

Security headlines have been buzzing with major security events this month. In this podcast episode, Andy and Eric Siron discuss Hornetsecurity's Monthly Threat Report, analyzing recent security incidents and sharing expert insights.  

Tune in for more information on Lockbit's takedown and its reemergence days later, the CVSS 10 vulnerability in ConnectWise Screenconnect, and the Change Healthcare cyber-attack that has practically paralyzed prescription refills and is likely contributing to numerous deaths in the US. 

Timestamps: 

3:32 – Hornetsecurity Industry Data Review for Feb 1st to March 1st  

14:10 – The “takedown” and re-emergence of LockBit 

18:33 – CVSS 10 Vulnerability in ConnectWise ScreenConnect 

31:11 – Optum/Change Healthcare Ransomware Attack 

Episode Resources:

Read the full report 

Lockbit Takedown Notice

ScreenConnect Vulnerability – CVE-2024-1709

Ransomware Attack on Optum / Change Healthcare

365 Total Protection

In this two-part episode, Andy and Paul Schnackenburg discuss Microsoft’s recently announced Secure Future Initiative, a multi-year commitment to revolutionize the design, building, testing and operation of technology for enhanced security standards in the age of AI. The discussion stems from the aftermath of the Storm 0558 breach that occurred in July 2023, orchestrated by Chinese nation-state threat actors. 

Tune in to gain a comprehensive understanding of the Secure Future Initiative and its implications.  

Stay tuned for part 2! 

Timestamps: 

(2:55) – An Update on the Microsoft Storm-0558 Breach 

(8:40) – The Microsoft Secure Future Initiative (SFI) 

(12:12) – Comparison with the 2002 Trustworthy Computing Initiative Memo 

(17:39) – The Trustworthiness of On-Prem vs. The Cloud 

(23:04) – How Does Microsoft Want to Use AI in Security? 

Episode Resources:

365TP Compliance & Awareness Free Trial

EP17: On-Prem Security vs Cloud Security

EP18: Generative AI in Defensive Tools

EP22: Can you trust Microsoft with Security?

Get ready for an eye-opening episode recorded live at Infosecurity Europe in London. In this episode, Andy and Matt Frye dissect the results of a comprehensive IT compliance survey conducted by Hornetsecurity. In the rapidly evolving digital landscape, maintaining IT compliance has become a pressing concern for businesses worldwide.  

Tune in to explore the key findings from this survey, featuring insights from over 200 IT professionals representing diverse roles, regions, industries, and experience levels. 

Timestamps:

Paul Schnackenburg is back for another episode with Andy and this time, to discuss the story of backup and recovery inside of Microsoft 365. M365 backup has been a confusing experience over the years, especially with Microsoft's contradictory "no backup needed" guidance. To add to the confusion, Microsoft has introduced its own M365 backup product. 

During the episode, we'll look at the various methods and tools that have been used natively within M365 to help with backup, as well as why these methods frequently fall short. Don't miss out on this informative discussion as we delve into the complexities of data protection and recovery in M365! 

Episode Resources:

Free eBook - Microsoft 365: The Essential Companion Guide

365 Total Backup – Request a Trial

VM Backup - Free Trial

Find Andy on LinkedIn, Twitter or Mastadon

Find Paul on LinkedIn or Twitter

Ever wondered what it takes to break into the exciting world of cybersecurity? Join us in our latest podcast episode as we sit down with Grant Collins, an infrastructure security engineer and cybersecurity career coach. From choosing the right degree to navigating the hiring process, acquiring essential skills, and building a robust professional network, Grant and Andy share their personal experiences and insights. 

Throughout the episode, they debate on academic vs practical learning by comparing the merits of pursuing a cybersecurity/IT degree versus gaining real-world experience and self-directed training. They discuss the pros and cons of each approach, offering valuable insights to help you chart your own path in the cybersecurity landscape. 

In this episode of the Security Swarm Podcast, host Andy and recurring guest, Paul, talk about the challenges and opportunities organizations face amidst the Broadcom acquisition of VMware. They discuss the steep price hikes for VMware licenses and the security vulnerabilities recently discovered in VMware products.  

This acquisition has prompted many businesses to consider alternative solutions, and the episode provides a comprehensive overview of the available options within the Microsoft ecosystem. They cover a range of migration strategies, including moving to the Microsoft ecosystem through Azure, Azure Stack HCI, and on-premises Hyper-V solutions.  Andy and Paul offer valuable insights into ensuring a secure and seamless transition away from VMware, making this episode essential listening for IT professionals navigating these significant changes. 

Key takeaways:

Timestamps:

(02:51) - Vulnerabilities in VMware 

(07:30) - Migrating to the Microsoft Ecosystem 

(13:38) - On-Premises Microsoft Options 

(38:45) - Security Considerations for Migrations 

(44:52) - Pragmatic Approach to Platform Selection 

Episode Resources:

Microsoft and Broadcom to Support License Portability 

Paul’s article on options for migrating from VMware to Microsoft 

VMware Sandbox Escape Bugs