ShadowTalk: Powered by ReliaQuest

DPRK Insider Threats: How Remote-Worker Tactics Are Evolving Oct 7, 2026 1801 Security leaders should be asking a hard question: if a remote hire looks legitimate at every checkpoint, what would expose the operation? Security operations is the defense layer of the business, and the teams defending it need AI to move faster across the full environment.In this episode of ShadowTalk, Daxton Wirth and John Dilgen share practical guidance on what to verify, where teams miss inco

CISO Wisdom: Turning Security Investments Into Measurable Risk Reduction Sep 30, 2026 1993 Security teams are contending with more tools, alerts, and vulnerabilities than ever—but volume does not necessarily equal security. Jigar Shah joins us to discuss how organizations can automate repetitive work, prioritize vulnerabilities based on business risk, build identity-driven security strategies, and connect cybersecurity investments to measurable outcomes. With two decades of leadership e

Fake NDAs, Real Money: Inside the M&A Social Engineering Playbook Sep 23, 2026 1687 In this episode, we examine the Phantom Deal campaign, in which threat actors used publicly available details about companies’ acquisition histories, subsidiaries, executives, and employees to create convincing fake M&A scenarios. The goal: persuade employees to initiate large financial transfers while keeping conversations off corporate communication channels.We also cover a recent series of

From Vulnerability Research to Domain Admin in Minutes Sep 16, 2026 1885 AI is changing the economics of cyberattacks. In this episode, we examine how a suspected threat actor used AI agents to accelerate PaperCut vulnerability research, exploit development, target identification, and post-compromise activity—moving from initial access to domain administrator access in as little as seven minutes.We also explore recent reporting on large-scale AI-model distillation camp

One Empty Field: The Email Security Bypass Letting Attackers Impersonate Your Executives Sep 9, 2026 1794 Organizations rely on Microsoft 365's RejectDirectSend control to block internal email spoofing—but a structural gap lets attackers walk right past it. With nothing more than a basic Python script and an empty envelope sender, threat actors are impersonating executives, IT support, and finance teams to launch Business Email Compromise, payment fraud, and follow-on account takeover.Join hosts

From Data Dumps to Critical Findings: The New Era of Data Extortion Sep 2, 2026 1736 Threat actors do not see old email archives, forgotten shared drives, and outdated CRM exports as clutter. They see them as searchable inventory. With AI-assisted analysis, attackers can rapidly identify sensitive communications, regulatory exposure, customer relationships, and credentials buried in stolen data.Join hosts John Dilgen and Brandon Tirado as they discuss:Why data theft has become a c

Vishing at Scale: Inside the Criminal SaaS Platform Enabling Account Takeover Aug 26, 2026 1873 What if a threat actor already knew your name, your job title, your manager's name, and your direct number before they ever picked up the phone? That's not a hypothetical — that's Work Panel. A new report gave us a rare inside look at the criminal SaaS platform enabling vishing campaigns at scale, and the findings are a wake-up call. Join hosts John Dilgen and Alexandra Moore as the

Nation-State Actors: Iran’s PLC Attacks, Russia’s Zero-Click Email Exploit, and North Korea’s Fake Employees Aug 19, 2026 1632 Three nation-states. Three distinct playbooks. Iranian actors are targeting internet-exposed industrial controllers and disabling critical safety systems. A Russian threat group built a zero-click email exploit that steals 90 days of inbox data the moment a user views a message. And North Korean operatives are applying for software-development jobs at Western companies—and getting hired.Join hosts

When AI Escapes the Lab: The Hugging Face Breach, PyPI Malware, and What It Means for Defenders Aug 12, 2026 1428 Fully autonomous attacks are here. AI agents escape a test environment, exploit zero-days, coordinate through shared infrastructure, and breach a production company—generating more than 17,000 security events along the way. Elsewhere, another model autonomously publishes malware to PyPI, while AI agents target real open-source developers with tailored social engineering. Join hosts John Dilgen and

The Gentlemen, Deadlock, and Clop: The Groups Driving Ransomware & Extortion in 2026 Aug 5, 2026 2189 An affiliate receives a ready-made intrusion kit — pre-compromised targets, an EDR killer, and a full deployment workflow included. No building from scratch. No long ramp-up. Just deploy, observe, and iterate. That's the future of ransomware; it's how the new number-one group operated in Q2 2026. And it's just one of three stories reshaping the extortion landscape right now.Join hos

Compromised Hotel Gateways, Fake Microsoft Domains, and the APT28-Adjacent Campaign That Bypasses MFA Without a Phishing Click Jul 29, 2026 1885 An employee connects to hotel Wi-Fi, receives a familiar Microsoft 365 sign-in prompt, and authenticates. No phishing email. No malicious link. No suspicious attachment. Yet an attacker walks away with a valid, MFA-satisfied session token. Join hosts Alexandra Moore and John Dilgen as they break down:How compromised hotel and conference-center Wi-Fi gateways silently redirect Microsoft authenticat

The Largest Patch Tuesday Ever: 622 CVEs, a 1,380% Phishing Surge, and the Two-Front War on Initial Access Jul 22, 2026 1682 Defenders aren't losing ground on one front, they're losing it on two at once. The largest Patch Tuesday in history just dropped alongside a 1,380% surge in phishing, and threat actors aren't waiting for you to catch up.Join hosts Alexandra Moore and John Dilgen as they break down: How new extortion group Helix and ClickFix are weaponizing identity compromise at scale Why 622 vulner

FortiBleed, 70,000 Compromised Devices, and the Credential Economy Powering Every Breach Jul 15, 2026 1371 When a 20-person team using AI, automated tools, and a list of default credentials compromised 70,000 devices across 194 countries they exposed how mature the criminal market behind credential theft has become. Initial access brokers are now packaging pre-validated enterprise access for an average of $113,000, and the window from information stealer infection to ransomware deployment is just seven

Inside Conti's Leaked Chats: 300,000 Messages, a Criminal Empire, and the Ransomware Playbook Still Running Today Jul 8, 2026 2552 When 300,000 internal messages from the world's most prolific ransomware gang were leaked, they exposed more then a shadowy underground network, a full company. HR departments. Conti operated with the structure of a mid-sized software firm, and that changes how defenders need to think about the ransomware landscape today.Join host John and special guest Geoff White, journalist and author of R

How Hackers Are Using AI Right Now: Faster Attacks, Smarter Malware, and a New Arms Race Jul 1, 2026 1518 AI is not replacing threat actors, instead it is making them faster, cheaper, and harder to stop. From AI powered phishing campaigns generating thousands of pages simultaneously, to a newly discovered macOS implant called Gaslight that injects fabricated system error messages into AI powered triage pipelines, the arms race between attackers and defenders is accelerating. The question is not whethe

Klue, Kali365, OAuth: When the Front Door Is a Trusted Integration Jun 24, 2026 1688 In the Klue compromises threat actors walked in through a trusted integration, using legitimate credentials to quietly siphon Salesforce CRM data at scale. The challenge isn't just responding to Klue. It's recognizing that every OAuth-connected integration in your environment is part of your attack surface.Join hosts Alexandra and John as they discuss:How compromised Klue integrations we

ShinyHunters' Expanding Toolkit: Oracle PeopleSoft Zero-Day Exploitation and the BreachForums Defense Gaps Jun 17, 2026 1179 ShinyHunters dominated headlines this week: a zero-day, a BreachForums listing, and unverified claims all hitting at once. The problem isn't just keeping up with the volume. It's knowing which of it is real, which is noise, and what your team actually needs to act on.Join hosts Tehman and John as they discuss:ShinyHunters zero-day exploitation of CVE-2026-35273Why a BreachForums listing

China-Linked Cyber Espionage: How OP-512 Exploited Legacy IIS Servers and Evaded Detection Jun 10, 2026 1388 Your team built defenses around known China-linked clusters. The file hashes are tracked. The behavioral patterns are documented. What those weren't built to catch is a new cluster that studied those exact defenses and engineered around them. A China-linked attacker compromised an internet-facing IIS server, maintained access for over 75 days, and came back on fresh infrastructure.With four C

SonicWall, MFA Bypass, IABs: Why Patched Devices Are Still Handing Attackers Initial Access Jun 3, 2026 1251 Your team patches the device. The firmware version matches the advisory. The ticket closes. The device comes off the remediation queue. What your workflow never tracked is that the advisory also required six manual LDAP configuration steps — and without them, the authentication bypass still works. An initial access broker authenticated through the VPN, reached a domain-joined file server, and was

Device Code, OAuth, PhaaS: How Session Token Theft is Breaking the Phishing Playbook May 27, 2026 1762 Your user clicked a link, landed on a real Microsoft login page, typed their password, completed MFA, and walked away thinking nothing happened. Somewhere across the internet, an attacker's device just received an authenticated session token. The password is irrelevant. The MFA prompt already fired and passed. With PhaaS platforms now converging on token-theft tradecraft and post-compromise a

SQLite, Mistral, OpenAI: How AI Attacks Are Reshaping the Attack Surface May 20, 2026 1188 What happens when an AI agent uncovers a zero-day in hours instead of weeks, and state-backed groups are already operationalizing the same tools? With self-hosted AI infrastructure sprawling outside asset registers and supply chain worms reaching inside AI vendors themselves, defenders need a new operating model.Join hosts Tehman and John as they discuss: How an AI agent surfaced a memory-safety z

Canvas, Trellix, Mini Shai-Hulud: How Defenders Respond When Supply Chain Attacks Become Weekly May 14, 2026 1891 What's driving the surge in weekly supply chain attacks, and why does the real defender problem start after the supplier gets hit? With 275 million records exposed and 8,809 institutions caught in the downstream fallout, organizations need a new playbook.Join hosts Alexandra and John as they discuss:How ShinyHunters abused admin sessionsRansomHouse's hypervisor-focused automationHow Mini

Akira, ShinyHunters, and The Gentlemen: Extortion Lessons From Early 2026 May 6, 2026 2095 What factors have driven the top ransomware and extortion groups' success in early 2026? And how should organizations structure their defenses to protect against them?Join hosts Alexandra and John as they discuss:How Akira is exploiting unknown assets inherited through M&AWhy ShinyHunters' vishing and SaaS misconfiguration models workHow The Gentlemen grew 588% quarter-over-quarter T

What Happened to Black Basta's Playbook? The Automated Teams Phishing Threat Hitting Executives Apr 29, 2026 1596 Black Basta disbanded in February 2025, but their playbook didn't go with them. In March 2026, 77% of observed incidents targeted executives and directors, and attackers moved from first contact to malicious script execution in as little as 12 minutes. The tactic has been automated, refined, and is now running faster than most SOCs can respond. Join hosts Alexandra and John as they discuss:Ho

Did ShinyHunters Compromise Vercel? Every CISO's Cloud Security Visibility Problem Apr 22, 2026 1520 89% of organizations that suffered a SaaS breach last year believed they had appropriate visibility. They had the logs — what they lacked was detection on what mattered. The Vercel incident shows exactly how costly that gap can be. Join hosts Brandon and John as they discuss:How a third-party OAuth chain may have exposed Vercel's internal dataWhy SaaS visibility gaps leave organizations expos

What Claude Mythos Means for Organizations Apr 15, 2026 1537 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts John and Alex, alongside special guest and ReliaQuest CTO Joe Partlow, as they discuss:How Claude Mythos autonomously generated exploitsWhy AI is accelerating CVE volumeDefense strategies organizations need nowJoe Partlow: CTO of ReliaQuest, a leading Information Security provider and is currently involved with new product initiatives alo

Axios and Trivy — Supply Chain Gaps Organizations Must Fix Apr 8, 2026 1493 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts John and Tehman as they break down two of the most consequential supply chain attacks of 2026:How DPRK actors socially engineered a NPM maintainerWhy hijacked GitHub versions are a CI/CD wake-up callThe three gaps every security team needs to closeJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in resear

Faster, Smarter, and Already Escalated — What It Takes to Defend Against the Modern Threat Landscape Apr 1, 2026 2001 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts Alexandra and John, live from Exponent 2026, alongside top security leaders as they discuss:How organizations keep pace with attackersWhy one in four incidents starts with social engineeringHow automated response is helping organizationsChris Thompson: CISO of Caris Life Sciences, a leading, next-generation AI TechBio company and precisio

The Invisible Attack Surface: Iran-Aligned Threat Actors and Corporate Blind Spots Mar 25, 2026 1191 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts Brandon and John as they discuss:How Handala wiped 200,000 devices by weaponizing a trusted platformWhy your organization doesn't need to be a direct target to be at riskHow AI-enhanced malware is helping attackers get fasterJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threat

The 2026 Annual Threat Report Breakdown, Part 3: The Long Game — Nation-State Threats & What's Coming in 2026 Mar 18, 2026 1507 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts John and Alex as they discuss:How a Chinese APT maintained access for over a yearWhy North Korean impersonation surged 116%Why attackers exploit the same foundational gapsJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical b

The 2026 Annual Threat Report Breakdown, Part 2 — Once They're In: Post-Compromise Tactics, Ransomware & Exfiltration Mar 11, 2026 1566 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts Tehman and John as they discuss:Why ransomware now prioritizes exfiltration over encryption How attackers can exfiltrate your data in just 6 minutesWhy proactive darkweb monitoring is criticalJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With

The 2026 Annual Threat Report Breakdown, Part 1 — How AI Contributes to Attacker Speed, and the Malware That's Winning Mar 4, 2026 1539 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts Brandon and John as they discuss:How attacker breakout times dropped to as little as 4 minutes Why ClickFix surged 200%Why behavioral detection is criticalJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he pr

Malware Isn't Required—How Ransomware Groups Turn Legitimate RMMs Into a Weapon Feb 25, 2026 1266 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts John and Tehman as they discuss:What attackers prefer over custom malwareHow signature-based detection failsProactive governance vs. reactive triageJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previousl

Ransomware vs. Exfiltration-Only—The Extortion Model Showdown Feb 18, 2026 1704 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts Brandon and John as they discuss:Why extortion payment rates are the lowest everOrganizations paying ransomware but refusing data extortion demandsWhy defenders need both visibility and speedJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With

Patch Management Is Losing—The Case for Predictive Vulnerability Defense Feb 11, 2026 1748 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts Brandon and John as they discuss:Why traditional patch cycles can't beat attackers exploiting vulnerabilities in 24 hoursThe shift from reactive patching to predictive intelligence using EPSS and CISA KEVHow to defend against zero-days when patching isn't an optionJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, whe

Beyond Phishing Emails—Social Engineering Drives Initial Access Feb 4, 2026 1371 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts John and Tehman as they discuss:Why phishing emails are no longer the top malware delivery methodEmerging social engineering tactics: vishing, copy and paste abuse, and software impersonationHow campaigns have evolved from Black Basta to ShinyHuntersJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in rese

Malicious AI—The New Face of Cyber Threats Jan 28, 2026 1234 Resources: https://linktr.ee/ReliaQuestShadowTalkJohn and Tehman as they discuss:How AI is enabling large-scale, high-speed attacksNation-states weaponizing AI for attack automationThe rise of sophisticated AI-generated malwareJohn Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical backg

Maintainer Compromise: The Next Supply-Chain Attack Vector in 2026 Jan 21, 2026 1632 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts Brandon and John as they discuss:How supply-chain attacks evolvedCampaigns targeting NPM package maintainersActionable defense strategiesBrandon Tirado: Director of Threat Research for ReliaQuest. A skilled cyber defense professional with a unique combination of management and hands-on experience. With a deep understanding of adversary mo

Kicking Off 2026 with Ransomware Insights and Defense Strategies Jan 14, 2026 1894 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin hosts Brandon and Tehman as they discuss:The resurgence of LockBit 5.0 and its December 2025 surge in named organizationsHow top ransomware groups like Qilin, Akira, and Clop dominated in 2025.Actionable defense strategies for organizations to proactively combat ransomware in 2026Brandon Tirado: Director of Threat Research for ReliaQuest. Brand

React2Shell Attacks Evolve, ClickFix Attacks, and Holiday Season Threats Dec 17, 2025 1898 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host John and intelligence analyst Ivan as they discuss:React2Shell Exploits Flood the Internet as Attacks Continue (1:06)ClickFix Style Attack Leveraging Grok and ChatGPT for Malware Delivery (7:39)New ConsentFix Attack Hijacking Microsoft Accounts via Azure CLI (13:50)Holiday Season Attack Risks: Phishing, Ransomware, and Defense Recommendati

React2Shell Exploits, CISA’s Brickstorm Warning, ShadyPanda’s Browser Weaponization Dec 10, 2025 1949 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host John along with systems security engineer Corey and intelligence analyst Hayden as they discuss:Chinese Threat Groups Exploiting the React2Shell Vulnerability (1:18)CISA Issues Alert on Persistent Brickstorm Backdoor Attacks (9:05)ShadyPanda Hackers Turn Millions of Browsers into Weapons (13:36)Storm-0249’s Shift to Targeted EDR Exploitati

Scattered Lapsus$ Hunters, SilverFox's ValleyRat Campaign, and More Dec 3, 2025 1501 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host John and intelligence analysts Alex and Hayden as they discuss:Scattered Lapsus$ Hunters Targeting Zendesk (1:14)Microsoft Teams Guest Access Phishing Bypass (3:37)Dark AI Tools Enhancing Threat Actors (6:08)Silver Fox’s Campaign: Chinese APT Spotlight (10:05)John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specialize

Are Cyber Predictions Worth It? Plus Chinese AI Attacks, IoT Takeovers Nov 26, 2025 1673 Resources: https://linktr.ee/ReliaQuestShadowTalkDo you really need predictions to tackle cyber threats? Join host Kim along with intelligence analyst John & special guest CISO Rafal Baran as they discuss:New NPM Supply Chain Threat (1:13)China Manipulates AI for Initial Access (4:46)Cloud Gaps Bring IoT Takeover (7:29)2026 Cyber-Threat Predictions (10:57)Rafal Baran: IT security leader and CI

Fortinet Flaw Exposed and Exploited! Plus, Threat Hunter Hacks: SEO Hits Hard Nov 19, 2025 1775 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim, intelligence analyst John, and threat hunter Tristan as they discuss:Fortinet Flaw Enables Admin TakeoverAkira Ransomware Targets Nutanix VMsSmart Redirects Evade Phishing DetectionThreat Hunter Hacks: SEO Hits HardListen on @Listennotes: https://lnns.co/mgbyVjXv7p6Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQues

Gootloader's Return, LANDFALL Android Spyware, Sector-by-Sector Cyber Trends Nov 12, 2025 2057 Resources: https://linktr.ee/ReliaQuestShadowTalkWondering why Gootloader is suddenly back in action? Join host Kim along with intelligence analyst Hayden & Systems Security Engineer Corey as they discuss:Gootloader Returns Using SEO Poisoning (1:27)New Android Spyware LANDFALL (6:33)Curly COMrades Hide in Windows Using Linux VMs (10:57)Sector-by-Sector Cyber Trends Q3 2025 (15:20)Kim Bromley:

Why Cloud Threats Are Escalating: Identity Risks, Automation Flaws, and Legacy Vulnerabilities, Plus the Latest on Chinese APT Campaigns and NPM Package Abuse Nov 5, 2025 1638 Resources: https://linktr.ee/ReliaQuestShadowTalkDid you know 99% of cloud identities are over-privileged, creating the perfect storm for attackers to seamlessly infiltrate your environment? Join host Kim along with intelligence analysts John & Alex as they discuss: Chinese Nation-State Campaigns and Geopolitics (1:12)Malicious NPM Packages (7:20)TruffleNet Attacks on AWS (10:53)The Danger of

Why Cyber Threats Surge 20% During M&A, Plus the Latest on Qilin and Lazarus Group Campaigns Oct 29, 2025 1865 Resources: https://linktr.ee/ReliaQuestShadowTalkPicture this: You close a $50M acquisition on Friday and by Monday, attackers are in your network. Sound far-fetched? It's not. Join host Kim along with intelligence analyst John & Threat Hunter Leo as they discuss:Attackers Exploit WSUS Flaw (1:15)Qilin Deploys Cross-Platform Attacks (4:21)Lazarus Group Reignites Operation DreamJob (9:05)T

Automate to Defend: A Former FBI Agent's Ransomware Guide for CISOs Oct 22, 2025 1928 Resources: https://linktr.ee/ReliaQuestShadowTalkWondering what makes ransomware operations successful? Join host Kim along with intelligence analyst John & former FBI Special Agent Keith Mularski as they discuss:Year-Long F5 Breach (2:42)North Korean Attacker Adopts EtherHiding (7:53)Phishing Attacks Target LastPass (12:11)Fighting Ransomware Automation: A CISO's Guide (17:19)Kim Bromley

Is Your Software a Secret Backdoor? Flax Typhoon's Latest Campaign Unwrapped Oct 15, 2025 1341 Resources: https://linktr.ee/ReliaQuestShadowTalkHow long could Flax Typhoon nestle silently in your networks? Join host Kim along with intelligence analysts John & Joey as they discuss:Velociraptor Abused in Ransomware Attacks (1:13)New Oracle E-business Suite Flaw (5:19)GitHub CamoLeak AI Attack (7:46)Year-Long Flax Typhoon ArcGIS Campaign (11:23)Kim Bromley: Senior Cyber Threat Intelligenc

Cl0p's Latest Heist: Exploiting Oracle's Critical Vulnerability Oct 8, 2025 2108 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with Intelligence Analyst John and Threat Detection Engineer Marken as they discuss:Clop's Exploitation of Oracle E-Business Suite (1:09)Scattered Lapsus$ Hunters Return With Salesforce Leaks (5:27)Shutdown Threatens US Intel Sharing and Cyber Defense (10:02)Ransomware and Cyber Extortion in Q3 2025 (15:02)Kim Bromley: Senio

Should Governments Hoard Zero Days? Analyzing Brickstorm Malware and Storm-1849 Oct 1, 2025 1589 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Joey along with intelligence analysts Alex and Hayden as they discuss:Brickstorm Backdoor in U.S. Legal and Tech Sectors (1:17)Storm-1849 Targeting Cisco ASA Devices (4:38)Medusa Attempts to Pay Reporter for Initial Access (7:00)Debate Over Government Zero-Day Stockpiling (14:41)Joseph Keyes: Cyber Threat Intelligence Analyst at ReliaQuest

Attacker Breakout Time Hits 18 Minutes, New Shai-hulud NPM Worm Sep 24, 2025 1739 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with intelligence analysts John and Joey as they discuss:Summer 2025 Attacker Trends (13:41)Self-Replicating 'Shai-hulud' Worm Targeting NPM Packages (1:05)Fortra Critical Patch for GoAnywhere MFT Vulnerability (3:49)Phishing Round Up: File Fix Campaign and Microsoft's RaccoonO365 Takedown (7:12)Kim Bromley: Senior

Welcome to ShadowTalk Sep 16, 2025 49 Host, Kim, alongside ReliaQuest's Threat Research experts, cut through the noise to bring you the cyber insights that matter most. Get news, research and actionable strategies from industry leaders, to help you stay ahead of attackers.New episodes every Wednesday at 1pm EST.

Do You Need AI to Fight AI? Plus Supply-Chain Attacks and Russia's Latest Backdoor Sep 10, 2025 1669 Resources: https://linktr.ee/ReliaQuestShadowTalkThinking about whether you need more AI in SecOps? Join host Kim along with intelligence analyst Joey & systems security engineer Corey as they discuss:SAP S/4HANA Flaw Exploitation (2:09)AI-Powered Malware Exposes GitHub (4:24)APT28 Outlook Backdoor hits NATO (8:21)ReliaQuest Experts Answer Your Questions (11:55)Kim Bromley: Senior Cyber Threat

Salesforce Attack Fallout, Axios Abuse, and Cloud Ransomware Sep 3, 2025 1399 Resources: https://linktr.ee/ReliaQuestShadowTalkNeed the latest information on Salesloft Drift? Join host Kim along with intelligence analyst John & detection engineer Marken as they discuss:Salesloft Drift Tokens Result in Salesforce Data Theft (1:31)Storm-0501 Shifts Ransomware Attacks to Cloud (6:36)APT29 Microsoft 365 Campaign Disrupted (11:26)Axios, Direct Send Abuse Redefine Phishing (1

New Silk Typhoon Attacks, the Cybercriminal Recruitment Underworld, and More! Aug 27, 2025 1586 Resources: https://linktr.ee/ReliaQuestShadowTalkCurious about the skills needed for modern cyber attacks? Join host Kim along with intelligence analysts John & Hayden as they discuss:Apple Patches Exploited Zero-Day (1:40)Hackers Abuse Linux Files to Drop Malware (3:50)Silk Typhoon Attacks Cloud Supply Chains (7:21)ReliaQuest Uncovers Cybercriminals' Most Sought After Skills (11:02)Kim B

Warlock Ransomware Hits Telecoms, LLM Data Theft, and ShinyHunters Updates Aug 20, 2025 1520 Resources: https://linktr.ee/ReliaQuestShadowTalkIntrigued by Warlock ransomware's Chinese connection? Join host Kim along with intelligence analysts Joey & John as they discuss:\Warlock Ransomware Attacks Against Telecoms (3:12)New FortiSIEM Flaw Exploited in the Wild (5:19)Man-in-the-Prompt Attack Steals Data from LLMs (8:04)How ReliaQuest Tracks Ransomware Groups and Evolving Cyber Thr

ShinyHunters, Scattered Spider, and Salesforce? Plus, Kimsuky Data Breach! Aug 13, 2025 1684 Resources: https://linktr.ee/ReliaQuestShadowTalkWant to know if ShinyHunters and Scattered Spider are really working together? Join host Kim along with detection engineer Marken as they discuss:WinRAR Zero-Day Exploited in RomCom Attacks (1:44)New EDR Killer Popular with Ransomware Groups (4:30)Data Breach Reveal Kimsuky Inner Workings (11:31)ReliaQuest Uncovers Potential ShinyHunters x Scattered

Akira’s Zero-Day Chaos + The Rise of DRP Threats Aug 6, 2025 1723 Akira ransomware group is exploiting potential zero-day vulnerabilities, and digital risk protection (DRP) threats are rapidly evolving. Join host Joey, along with intelligence analysts John and Hayden, as they dive into:Akira Ransomware Exploiting a Potential Zero DayPlague Backdoor Emerges as Silent IntruderEvolving Tactics of North Korean AttackerDRP Threats Surge Amid Organizational GrowthReso

Full CrushFTP Attack Chain, Plus BreachForums is Back! Jul 30, 2025 1664 Resources: https://linktr.ee/ReliaQuestShadowTalkCurious how the latest CrushFTP exploit works? Join host Kim along with intelligence analyst Hayden and threat hunter Leo as they discuss:BreachForums Back, XSS Out (1:28)Warlock Ransomware Hits SharePoint (5:28)Fire Ant Stings ESXi (9:39)ReliaQuest Uncovers CrushFTP Attack Chain (13:35Kim Bromley: Senior Cyber Threat Intelligence Analyst on the Rel

New SharePoint Flaw, How Cybercriminals Use AI Jul 23, 2025 1569 Resources: https://linktr.ee/ReliaQuestShadowTalkCurious about how cybercriminals use AI? Join host Kim along with detection engineer Marken and intelligence analyst Alex as they discuss:New SharePoint Vulnerability (1:34)LameHug AI-Powered Malware (5:55)UK Bans Ransomware Payments (9:44)AI Tactics Behind the Latest Cyber Threats (14:11)Kim Bromley: Senior Cyber Threat Intelligence Analyst on the

Do You Really Need IOCs? Plus Zero-Day Exploits, AI Data Leaks, and Phishing for VIPs Jul 16, 2025 1433 Resources: https://linktr.ee/ReliaQuestShadowTalkEver wondered if IOCs are still relevant in a world of polymorphic malware and zero-day exploits? Join host Kim along with intelligence analyst Joey and threat hunter Tristan as they discuss:North American APT Targets China (1:25)Chatbot Exposes Thousands of Job Applications (4:57)New Phishing Campaign Targets VIPs (7:17)How IOCs are Used in Modern

SafePay Ransomware Rises, North Korea Adopts ClickFix Jul 9, 2025 1460 Resources: https://linktr.ee/ReliaQuestShadowTalkHave you heard of SafePay ransomware? Join host Kim along with intelligence analysts Hayden and John as they discuss:SafePay Targets Ingram Micro (1:16)Updates on Iran-Israel (5:43)North Korea Adopts ClickFix & Attacks Web3 (8:24)Insights from ReliaQuest Customer Incidents (13:14)Kim Bromley: Senior Cyber Threat Intelligence Analyst on the Relia

Citrix Bleed 2, Scattered Spider Hits Aviation Jul 2, 2025 1611 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with intelligence analysts Ivan and John as they discuss:Citrix Bleed 2Scattered Spider Hits Aviation From ClickFix to FileFixRansomware Threats from Q2Kim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10-year career in UK law enforcement,

Analyzing Iran-Israel Cyber Threats, New Scattered Spider Attack Chain Jun 25, 2025 2089 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with Intelligence Analyst Hayden and Threat Hunter Leo as they discuss:New Scattered Spider Attack ChainIsrael and Iran Cyber Threat Deep DiveTop Iran-linked Threat Groups & How to MitigateKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following

Israel-Iran Cyber Warfare, Anubis Ransomware, and More Attacker Trends Jun 18, 2025 2167 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with intelligence analyst Joey and detection engineer Marken as they discuss:Anubis Ransomware Wiper CapabilityTeamfiltration Pentesting ToolCyber Implications of Israel-Iran ConflictThe Most Up to Date Attacker TrendsKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQue

Black Basta's Enduring Legacy, Qilin Exploits Fortinet Flaws Jun 11, 2025 1795 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with intelligence analysts Alex and John as they discuss:The Enduring Legacy of Black BastaQilin's Exploitation of Fortinet FlawsVishing for Salesforce DataAtomic Stealer x ClickFix CampaignKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 followi

Scattered Spider's Evolving Playbook, SentinelOne Outage Jun 4, 2025 1656 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with intelligence analysts Joey and Alex as they discuss:Scattered Spider's Focus on Tech VendorsHow APT41 Abuses Google Calendar for C2The SentinelOne OutageA New Void Blizzard Espionage CampaignKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 f

SPECIAL: How Russian Market Fuels Credential-Based Attacks May 28, 2025 2657 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with intelligence analysts Joey and Alex as they discuss:Factors Driving Russian Market's PopularityAttackers' Favorite InfostealersInfostealer Attack PathsMain Types and Exclusivity of Stolen LogsKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June

The Threat Evolution: SAP Exploits, SEO Poisoning, and SkitNet Malware May 21, 2025 1743 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Joey along with intelligence analysts John and Hayden as they discuss:ReliaQuest's investigation into hijacked routers and SEO poisoning fueling payroll heistsNation-state actors leveraging the SAP NetWeaver vulnerability en masseA new "Defendnot" tool that tricks Windows Defender into disabling itselfRansomware groups using

Will US Politics Reshape Russian Cyber Threats? May 14, 2025 1679 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with intelligence analysts Joey and Hayden as they discuss:ReliaQuest's Forecast for How US Policy will Impact Russia-linked Cyber ThreatsInfostealers Spread by Fake AI Video GeneratorsKickidler Abuse by Ransomware GroupsFBI Takedown of Huge BotnetKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat

Scattered Spider Strikes Again, Hunt for North Korean Insiders Heats Up May 7, 2025 1688 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with intelligence analyst John and threat hunter Tristan as they discuss:Scattered Spider Attacks UK Retail OrgsBring Your Own Installer SentinelOne BypassHunting for North Korean InsidersKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 following a 10

Demystifying CVE-2025-31324, The New Critical SAP NetWeaver Flaw Apr 30, 2025 1471 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with detection engineer Marken and intelligence analyst Alex as they discuss:ReliaQuest's Discovery of Critical SAP NetWeaver VulnerabilityAI Upgrade for Darcula Phishing Kit DragonForce's New Cartel Business ModelMaximum Severity Commvault flawKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Thre

BreachForums Down: Hacktivist Attack or FBI Crackdown? Apr 23, 2025 1455 Resources: https://linktr.ee/ReliaQuestShadowTalkJoin host Kim along with intelligence analysts Joey and John as they discuss:BreachForums Down: Dark Storm Team Takes CreditA Potential New Vulnerability in SAP NetWeaverExploit User Targets Salesforce DataReliaQuest Research: Understanding Chinese Espionage StrategiesKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Res

Hijacked and Hidden: ReliaQuest Identifies New Backdoor and Persistence Technique Apr 16, 2025 1611 Resources: https://linktr.ee/RQShadowTalkJoin host Kim along with intelligence analysts Ivan and Hayden as they discuss:How ReliaQuest Identified a New Backdoor and Persistence TechniqueOur Latest Ransomware Quarterly ReportHow Attackers Maintained Access to Patched FortiGate VPNsWhat Oracle Said Next About That BreachKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat R

Fast Flux DNS Challenges, Evolving Adversary Tactics, and Proactive Defense Strategies Apr 9, 2025 2056 Resources: https://linktr.ee/RQShadowTalkJoin host Kim along with intelligence analyst Joey and threat hunter Leo as they discuss:Ivanti Patches Exploited VulnerabilityFast Flux DNS Evasion WarningRansomware Scene ShiftsReliaQuest's Approach to Threat HuntingKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in June 2020 followi

From Oracle to AI: Everything You Need to Know About Emerging Cyber Threats Apr 3, 2025 2037 Resources: https://linktr.ee/RQShadowTalkJoin host Kim along with intelligence analyst Hayden and threat detection engineer Marken as they discuss:Oracle Data Breach Latest UpdatesBlackLock Ransomware ExposedActive Exploitation of ChatGPT FlawUp to the Minute Attacker TechniquesKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Research Team. She joined ReliaQuest in Ju

Guest Episode: Navigating Cyber Storms with Expert Insights on Incident Response Mar 26, 2025 2313 Resources: https://linktr.ee/RQShadowTalkJoin host Kim along with intelligence analyst Joey and special guest Rachel Ratcliff as they discuss: The latest Insights on the Alleged Oracle Data BreachA Critical Vulnerability in Next.js MiddlewareThe Importance of Incident Response when Tackling Today's Cyber ThreatsRachel Ratcliff: Engagement Management Leader for Aon Cyber Solutions and Stroz Fr

When Old Meets New: The Rise of VPN Exploits and Brute-Force Tools Mar 19, 2025 1635 Resources: https://linktr.ee/RQShadowTalkJoin host Kim along with intelligence analysts Ivan and John as they discuss:ReliaQuest's Research: Devastating Paths to VPN ExploitationSuperBlack Ransomware Exploits Fortinet FlawsBRUTED Framework Automates Black Basta AttacksClickFix Campaign Hooks Hospitality SectorKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Threat Resea

Webcam Warfare, Supply Chains Under Siege, Insider Threats, and More! Mar 12, 2025 1498 Resources: https://linktr.ee/RQShadowTalkJoin host Kim, and intelligence analysts Joey and Anna as they discuss:ReliaQuest's Research: Cyber Threats to Hospitality and RecreationSilk Typhoon Expands to Supply-Chain AttacksInsider's Kill Switch Cripples Ex-EmployerAkira Ransomware Uses Webcam to Compromise NetworkKim Bromley: Senior Cyber Threat Intelligence Analyst on the ReliaQuest Thre

Episodes

Recommended