Episodes

  • Soap Box: AI has entered the SOC, and it ain't going anywhere

    Soap Box: AI has entered the SOC, and it ain't going anywhere
    Jun 16 2025

    In this sponsored Soap Box edition of the Risky Business podcast Patrick Gray chats with Dropzone AI founder Ed Wu about the role of LLMs in the SOC.

    The debate about whether AI agents are going to wind up in the SOC is over, they’ve already arrived. But what are they good for? What are they NOT good for? And where else will we see AI popping up in security?

    This episode is also available on Youtube.

    Show notes
      Show more Show less
      31 mins
    • Risky Business #795 -- How The Com is hacking Salesforce tenants

      Risky Business #795 -- How The Com is hacking Salesforce tenants
      Jun 11 2025
      On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news: New York Times gets a little stolen Russian FSB data as a treatiVerify spots possible evidence of iOS exploitation against the Harris-Walz campaignResearcher figures out a trick to get Google account holders’ full names and phone numbersMajor US food distributor gets ransomwaredThe Com’s social engineering of Salesforce app authorisations is a harbinger of our future problemsAustralian Navy forgets New Zealand has computers, zaps Kiwis with their giant radar. This week’s episode is sponsored by identity provider Okta. Long-time friend of the show Alex Tilley is Okta’s Global Threat Research Coordinator, and he joins to discuss how organisations can use both human and technical signals to spot North Koreans in their midst. This episode is also available on Youtube. Show notes How The Times Obtained Secret Russian Intelligence Documents - The New York TimesUkraine's military intelligence claims cyberattack on Russian strategic bomber maker | The Record from Recorded Future NewsHarris-Walz campaign may have been targeted by iPhone hackers, cybersecurity firm saysiVerify Uncovers Evidence of Zero-Click Mobile Exploitation in the U.S.Spyware maker cuts ties with Italy after government refused audit into hack of journalist’s phone | The Record from Recorded Future NewsItalian lawmakers say Italy used spyware to target phones of immigration activists, but not against journalist | TechCrunchAndroid chipmaker Qualcomm fixes three zero-days exploited by hackers | TechCrunchCellebrite to acquire mobile testing firm Corellium in $200 million deal | CyberScoopApple Gave Governments Data on Thousands of Push NotificationsA Researcher Figured Out How to Reveal Any Phone Number Linked to a Google AccountBruteforcing the phone number of any Google userAcreed infostealer poised to replace Lumma after global crackdown | The Record from Recorded Future NewsBidenCash darknet forum taken down by US, Dutch law enforcement | The Record from Recorded Future NewsNHS calls for 1 million blood donors as UK stocks remain low following cyberattack | The Record from Recorded Future NewsMajor food wholesaler says cyberattack impacting distribution systems | The Record from Recorded Future NewsKettering Health confirms attack by Interlock ransomware group as health record system is restored | The Record from Recorded Future NewsHackers abuse malicious version of Salesforce tool for data theft, extortion | Cybersecurity Diveshubs on X: "IP whitelisting is fundamentally broken. At @assetnote, we've successfully bypassed network controls by routing traffic through a specific location (cloud provider, geo-location). Today, we're releasing Newtowner, to help test for this issue: https://t.co/X3dkMz9gwK" / XRoss Ulbricht Got a $31 Million Donation From a Dark Web Dealer, Crypto Tracers Suspect | WIREDAustralian navy ship causes radio and internet outages to parts of New Zealand
      Show more Show less
      1 hr and 8 mins
    • Risky Business #794 -- Psychic Panda outgunned by Fluffy Lizard and UNC56728242

      Risky Business #794 -- Psychic Panda outgunned by Fluffy Lizard and UNC56728242
      Jun 4 2025

      On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

      • Cyber firms agree to deconflict and cross-reference hacker group names
      • Russian nuclear facility blueprints gathered from public procurement websites
      • Someone audio deepfaked the White House Chief of Staff, but for the dumbest reasons
      • Germany identifies the Trickbot kingpin
      • Google spots China’s MSS using Calendar events for malware C2
      • Meta apps abuse localhost listeners to track web sessions.

      This week’s episode is sponsored by automation vendor Tines. Its Field CISO, Matt Muller, joins the show to discuss an open letter penned by JP Morgan Chase’s CISO that pleads with Software as a Service suppliers to try to suck less at security.

      This episode is also available on Youtube.

      Show notes
      • 'Forest Blizzard' vs 'Fancy Bear' - cyber companies hope to untangle weird hacker nicknames | Reuters
      • Ukraine's Massive Drone Attack Was Powered by Open Source Software
      • Massive security breach: Russian nuclear facilities exposed online
      • How a Spyware App Compromised Assad’s Army - New Lines Magazine
      • Exclusive | Federal Authorities Probe Effort to Impersonate White House Chief of Staff Susie Wiles - WSJ
      • Malaysian home minister’s WhatsApp hacked, used to scam contacts | The Record from Recorded Future News
      • U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scams – Krebs on Security
      • Top counter antivirus service disrupted in global takedown | CyberScoop
      • Cops in Germany Claim They’ve ID’d the Mysterious Trickbot Ransomware Kingpin | WIRED
      • Australian ransomware victims now must tell the government if they pay up | The Record from Recorded Future News
      • Google: China-backed hackers hiding malware in calendar events | Cybersecurity Dive
      • Coinbase breach linked to customer data leak in India, sources say | Reuters
      • US military IT specialist arrested for allegedly trying to leak secrets to foreign government | The Record from Recorded Future News
      • NSO appeals WhatsApp decision, says it can’t pay $168 million in ‘unlawful’ damages | The Record from Recorded Future News
      • ConnectWise says nation-state attack targeted multiple ScreenConnect customers | The Record from Recorded Future News
      • Google Online Security Blog: Sustaining Digital Certificate Security - Upcoming Changes to the Chrome Root Store
      • Meta and Yandex are de-anonymizing Android users’ web browsing identifiers - Ars Technica
      • An Open Letter to Third-Party Suppliers
      Show more Show less
      58 mins
    • Risky Business #793 -- Scattered Spider is hijacking MX records

      Risky Business #793 -- Scattered Spider is hijacking MX records
      May 28 2025
      In this week’s edition of Risky Business Dmitri Alperovitch and Adam Boileau join Patrick Gray to talk through the week’s news, including: EXCLUSIVE: A Scattered Spider-style crew is hijacking DNS MX entries and compromising enterprises within minutesThe SVG format brings the all horrors of HTML+JS to image files, and attackers have noticedBrian Krebs eats a 6.3Tbps DDoS … ‘cause that’s how you demo your packet cannonLaw enforcement takes out Lumma Stealer, Qakbot, Danabot and some dark web drug traffickersIranian behind 2019 Baltimore ransomware mysteriously appears in North Carolina and pleads guiltyCISA’s leadership is fleeing in droves, even though the US needs them more than ever. This week’s episode is sponsored by Thinkst Canary. Long time friend of the show Haroon Meer joins and talks through where he feels the industry is at, having just returned home from the AI-fueled hype at this year’s RSA conference. This episode is also available on Youtube. Show notes China-linked ‘Silk Typhoon’ hackers accessed Commvault cloud environments, person familiar says - Nextgov/FCW Risky Bulletin: SVG use for phishing explodes in 2025 - Risky Business Media KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS – Krebs on Security Midwestern telco Cellcom confirms cyber incident after days of service outages | The Record from Recorded Future News Microsoft leads international takedown of Lumma Stealer | Cybersecurity Dive Who said what? on X: "Message from the administrator of Lumma Stealer on the forums about the recent events🕊️👀 https://t.co/MOjCSMMErK" / X Ransomware hackers charged, infrastructure dismantled in international law enforcement operation | The Record from Recorded Future News Oops: DanaBot Malware Devs Infected Their Own PCs – Krebs on Security DOJ charges man allegedly behind Qakbot malware | The Record from Recorded Future News US, Europol arrest 270 dark web drug traffickers in Operation RapTor | The Record from Recorded Future News Iranian pleads guilty to launching Baltimore ransomware attack, faces 30 years behind bars | The Record from Recorded Future News Decentralized crypto platform Cetus hit with $223 million hack | The Record from Recorded Future News Nearly 70,000 impacted by Coinbase breach involving $20 million ransom demand | The Record from Recorded Future News USA: Crypto investor charged with kidnapping, torturing man in an NYC apartment Vietnam orders ban on Telegram messaging app over security concerns | The Record from Recorded Future News Exclusive: Hacker who breached communications app used by Trump aide stole data from across US government | Reuters CISA loses nearly all top officials as purge continues | Cybersecurity Dive White House dismisses scores of National Security Council staff - The Washington Post
      Show more Show less
      1 hr and 5 mins
    • Risky Business #792 -- Beware, Coinbase users. Crypto thieves are taking fingers now

      Risky Business #792 -- Beware, Coinbase users. Crypto thieves are taking fingers now
      May 21 2025

      On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

      • TeleMessage memory dumps show up on DDoSecrets
      • Coinbase contractor bribed to hand over user data
      • Telegram does seem to be actually cooperating with law enforcement
      • Britain’s legal aid service gets 15 years worth of applicant data stolen
      • Shocking no one, Ivanti were weaseling when they blamed latest bugs on a third party library

      This week’s episode is sponsored by Prowler, who make an open source cloud security tool. Founder and original project developer Toni de la Fuente joins to talk through the flexibility that open tooling brings. Prowler is also adding support for SaaS platforms like M365, and of course, an AI assistant to help you write checks!

      This episode is also available on Youtube.

      Show notes
      • TeleMessage - Distributed Denial of Secrets
      • How the Signal Knockoff App TeleMessage Got Hacked in 20 Minutes | WIRED
      • Coinbase says thieves stole user data and tried to extort $20M
      • Hack could cost Coinbase up to $400M: filing | Cybersecurity Dive
      • Severed Fingers and ‘Wrench Attacks’ Rattle the Crypto Elite
      • Money Stuff: US Debt Rates Itself | NewsletterHunt
      • 2 massive black market services blocked by Telegram, messaging app says | Reuters
      • Telegram Gave Authorities Data on More than 20,000 Users
      • GovDelivery, an email alert system used by governments, abused to send scam messages | TechCrunch
      • ATO warning as hackers steal $14,000 in tax returns: ‘Be wary’
      • Hack of SEC social media account earns 14-month prison sentence for Alabama man | The Record from Recorded Future News
      • 19-year-old accused of largest child data breach in U.S. agrees to plead guilty
      • Beach mansion, Benz and Bitcoin worth $4.5m seized from League of Legends hacker Shane Stephen Duffy | 7NEWS
      • Pegasus spyware maker rebuffed in efforts to get off trade blacklist - The Washington Post
      • Ransomware attack hits supplier of refrigerated groceries to British supermarkets | The Record from Recorded Future News
      • UK government confirms massive data breach following hack of Legal Aid Agency | The Record from Recorded Future News
      • Ivanti Endpoint Mobile Manager customers exploited via chained vulnerabilities | Cybersecurity Dive
      • Expression Payloads Meet Mayhem - Ivanti EPMM Unauth RCE Chain (CVE-2025-4427 and CVE-2025-4428)
      Show more Show less
      53 mins
    • Risky Biz Soap Box: Push Security does identity security in your browser

      Risky Biz Soap Box: Push Security does identity security in your browser
      May 15 2025

      In this wholly sponsored Soap Box edition of the show, Patrick Gray chats with Adam Bateman and Luke Jennings from Push Security.

      Push has built an identity security platform that collects identity information from your users’ browsers. It can detect phish kits and stop them, protect SSO passwords, and even find every single shadow/personal account that a user has spun up.

      We think about phishing as protecting your users’ SSO details. But what about all the SaaS they’re using? What about the automation platforms your developers and admins use? What about data platforms like Snowflake? Are they using MFA? How would you know?

      This is a fun one!

      This episode is also available on Youtube.

      Show notes
        Show more Show less
        34 mins
      • Risky Business #791 -- Woof! Copilot for Sharepoint coughs up creds and keys

        Risky Business #791 -- Woof! Copilot for Sharepoint coughs up creds and keys
        May 14 2025

        On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

        • Struggling to find that pesky passwords.xlsx in Sharepoint? Copilot has your back!
        • The ransomware ecosystem is finding life a bit tough lately
        • SAP Netweaver bug being used by Chinese APT crew
        • Academics keep just keep finding CPU side-channel attacks
        • And of course… bugs! Asus, Ivanti, Fortinet… and a Nissan LEAF?

        This week’s episode is sponsored by Resourcely, who will soothe your Terraform pains. Founder and CEO Tracis McPeak joins to talk about how to get from a very red dashboard full of cloud problems to a workable future.

        This episode is also available on Youtube.

        Show notes
        • Exploiting Copilot AI for SharePoint | Pen Test Partners
        • MrBruh's Epic Blog
        • Ransomware group Lockbit appears to have been hacked, analysts say | Reuters
        • "CONTI LEAK: Video they tried to bury! 6+ Conti members on a private jet. TARGET’s birthday — $10M bounty on his head. Filmed by TARGET himself. Original erased — we kept a copy."
        • Mysterious hackers who targeted Marks and Spencer's computer systems hint at political allegiance as they warn other tech criminals not to attack former Soviet states
        • The organizational structure of ransomware groups is evolving rapidly.
        • SAP NetWeaver exploitation enters second wave of threat activity
        • China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures
        • DOGE software engineer’s computer infected by info-stealing malware
        • Hackers hijack Japanese financial accounts to conduct nearly $2 billion in trades
        • FBI and Dutch police seize and shut down botnet of hacked routers
        • Poland arrests four in global DDoS-for-hire takedown
        • School districts hit with extortion attempts after PowerSchool breach
        • EU launches vulnerability database to tackle cybersecurity threats
        • Training Solo - vusec
        • Branch Privilege Injection: Exploiting Branch Predictor Race Conditions – Computer Security Group
        • Remote Exploitation of Nissan Leaf: Controlling Critical Body Elements from the Internet
        • PSIRT | FortiGuard Labs
        • EPMM Security Update | Ivanti
        Show more Show less
        58 mins
      • Wide World of Cyber: How state adversaries attack security vendors

        Wide World of Cyber: How state adversaries attack security vendors
        May 9 2025

        In this edition of the Wide World of Cyber podcast Patrick Gray talks to SentinelOne’s Steve Stone and Alex Stamos about how foreign adversaries are targeting security vendors, including them.

        From North Korean IT workers to Chinese supply chain attacks, SentinelOne and its competitors are constantly fending off sophisticated hacking campaigns.

        This edition of the Wide World of Cyber was recorded in front of a live audience in San Francisco, with Patrick attending via Zoom.

        The Wide World of Cyber podcast series is a wholly sponsored co-production between SentinelOne and Risky Business Media.

        This episode is also available on Youtube.

        Show notes
          Show more Show less
          53 mins
        adbl_web_global_use_to_activate_webcro805_stickypopup