Full episode and show notes

Ransomware, Penetration Testing, Black Hat

Ransomware Economy Players, Pentest War Stories, & Ransomware Groups Working Together – ESW #329

During this segment, Jon will explore today’s ransomware economy players from IABS to RaaS affiliates, to money launders and now C2Ps. For the discussion, Jon will leverage Halcyon’s latest research, which demonstrates a new technique to uncover how C2Ps, like Cloudzy, are used to identify upcoming ransomware campaigns and other advanced attacks. The research revealed that Cloudzy, knowingly or not, provided services to attackers while assuming a legitimate business profile. Threat actors that leveraged Cloudzy include APT groups tied to the Chinese, Iranian, North Korean, Russian, Indian, Pakistani, and Vietnamese governments; a sanctioned Israeli spyware vendor whose tools are known to tar...

August 24, 2023

This episode is sponsored by

Full Segment Notes

During this segment, Jon will explore today’s ransomware economy players from IABS to RaaS affiliates, to money launders and now C2Ps. For the discussion, Jon will leverage Halcyon’s latest research, which demonstrates a new technique to uncover how C2Ps, like Cloudzy, are used to identify upcoming ransomware campaigns and other advanced attacks. The research revealed that Cloudzy, knowingly or not, provided services to attackers while assuming a legitimate business profile. Threat actors that leveraged Cloudzy include APT groups tied to the Chinese, Iranian, North Korean, Russian, Indian, Pakistani, and Vietnamese governments; a sanctioned Israeli spyware vendor whose tools are known to target civilians; several criminal syndicates and ransomware affiliates whose campaigns have spurred international headlines.

This segment is sponsored by Halcyon. Visit https://securityweekly.com/halcyonbh to learn more about them!

In this session, Snehal will discuss several real-world examples of what autonomous pentesting discovered in networks just like yours. You’ll hear more about how fast and easy it was to safely compromise some of the biggest (and smallest) networks in the world - with full domain takeover in a little more than a few hours. Learn how you can safely do the same in your own network today!

This segment is sponsored by Horizon3.ai. Visit https://securityweekly.com/horizon3aibh to learn more about them!

In this Black Hat 2023 interview, CRA’s Bill Brenner and Sophos’ John Shier discuss the company’s latest research on the Royal ransomware gang. Though Royal is a notoriously closed off group that doesn’t openly solicit affiliates from underground forums, granular similarities in the forensics of the attacks suggest all three groups are sharing either affiliates or highly specific technical details of their activities.

This segment is sponsored by Sophos. Visit https://securityweekly.com/sophosbh to learn more about them!

Guests

Field CTO, Threat Intelligence at Sophos

John Shier is a Field CTO, Threat Intelligence at Sophos with more than two decades of cybersecurity experience. He’s passionate about protecting consumers and organizations from advanced threats, and has researched everything from costly ransomware to illicit dark web activity, uncovering insights needed to strengthen proactive cybersecurity defenses.

John is often consulted by press, and has been quoted in publications like Reuters, WIRED, Fortune, CNN, The Hill, Fast Co, Yahoo, and more. He’s also a frequent speaker at industry events like RSA Conference, Infosec, Cebit, Gitex, and more.

Based in Toronto, John is available on Twitter (@john_shier) and can be reached via email at [email protected].

CEO and Co-Founder at Horizon3.ai

Snehal Antani is the Co-Founder and CEO of Horizon3.ai, where he leads the company’s mission to empower organizations to proactively defend their infrastructure through autonomous security solutions. With a unique blend of entrepreneurial, public sector, and enterprise leadership experience, Snehal previously served as CTO of JSOC, CTO at Splunk, and CIO at GE Capital. An industry-recognized technologist and innovation advocate, Snehal holds 18 U.S. patents in data processing, cloud computing, and virtualization. He is a sought-after keynote speaker and a prolific writer on topics including leadership, digital transformation, cybersecurity, and cloud architecture.

CEO & Co-Founder at Halcyon

Jon Miller is the CEO & Co-founder of Halcyon with 25+ years working in the cybersecurity industry. Prior to Halcyon, Jon was the CEO & Co-founder of Boldend, a next-generation defense contractor focused on building offensive tools for the US Government. Previous to Boldend, Jon held the title of Chief Research Officer of Cylance (now Blackberry) where he focused on malware and product efficacy. Prior to Cylance, Jon was employee number 70 at Accuvant (now Optiv) where with a group of others he helped build and lead the largest technical consultancy at the time Accuvant LABS, working with over 95% of the Fortune 500 as an offensive security expert. Before Accuvant, Jon was a ten year veteran penetration tester, serving as one of the first in the industry working for the Internet Security Systems (now IBM) X-Force.

Hosts

https://www.scmagazine.com/cra-business-intelligence

https://www.secureideas.com/

@survivatrix#0613

Stay in the Know, No Smoke and Mirrors – Join Our Newsletter

Get expert insights and technical breakdowns straight to your inbox.