Adversary Universe Podcast

The rise of hacktivism — the use of hacking techniques to make a statement supporting a political or social cause — is often associated with the Occupy Wall Street movement and the Anonymous hacktivist collective. But the practice of hacking as a form of civil disobedience goes back to the 1990s. It has taken many forms in the years since, driven by a wide range of hacktivists around the world. In...

Organizations fear adversaries will attack. Threat hunters assume adversaries are already in the system — and their investigations seek unusual behavior that may indicate malicious activity is afoot. Andrew Munchbach, CrowdStrike’s Global VP, Field Engineering, joins Adam and Cristian in this week’s episode to explore what threat hunting is, how it works, and what makes a good threat hunting progr...

Today’s conversation explores a common question around adversary activity: Why does attribution matter? When a cyberattack hits, why go to the trouble of learning who is behind it? Each attempt at an intrusion can reveal a lot about an adversary — who they are, what they’re doing and what their motivations may be. This information can not only inform your response to an attack but how you strength...

The National Security Agency’s Cybersecurity Collaboration Center (CCC) was created based on a growing need for the public and private sectors to work together and share insights to understand adversaries’ intentions, as well as the scope and scale of their activity. In this special episode of the Adversary Universe podcast, Adam and Cristian are joined by Morgan Adamski, Chief of the CCC and gove...

CrowdStrike Chief Security Officer Shawn Henry joined CrowdStrike as employee number 19 after a 24-year career at the FBI, where he retired as the Bureau’s Executive Assistant Director. Today, he joins Adam and Cristian for a wide-ranging conversation exploring his early days at CrowdStrike and transition to the private sector, his perspective on the 2016 DNC breach and the risks modern elections...

The days of automated cyberattacks are dwindling: last year CrowdStrike saw a 60% jump in interactive intrusions, a type of attack in which a human is on the other side, working to break in and navigating their target environment as soon as they gain access. Most (75% of) attacks in 2023 didn’t involve malware at all — in nearly all cases, the adversary relied on identity-related techniques or exp...

CrowdStrike has long said, “You don’t have a malware problem — you have an adversary problem.” Much like we analyze the malware and tools used in cyberattacks, we must also learn about the people who orchestrate them. Adam and Cristian are joined by Cameron Malin, a behavioral profiler who specializes in understanding adversaries and the “why” behind their activity. Cameron built the FBI’s Cyber B...

Though the inner workings of North Korea remain a mystery to much of the world, its global cyber activity has been tracked and analyzed for years. CrowdStrike’s Counter Adversary Operations team, which tracks five North Korean threat actors, has a unique perspective on the country’s evolution as a global cybersecurity threat and the many ways it has used cyber capabilities to achieve its goals. In...

Cristian is joined by CrowdStrike Global CTO Elia Zaitsev to revisit the world of AI and large language models (LLMs), this time from the perspective of modern defenders. While this space has seen explosive growth in the past year, most organizations are still working to determine how LLM technology fits into their cybersecurity strategies. In this episode, Cristian and Elia unpack the rapid evolu...

In mid-December 2023, an adversary CrowdStrike tracks as VOODOO BEAR targeted Ukrainian telecom provider Kyivstar, wreaking havoc and disrupting thousands of systems and assets. The Russia-linked adversary has for years treated Ukraine as its “lab of offensive cyber operations”, testing attack techniques and demonstrating the destructive behavior it has become known for since it emerged in late 20...

It has been a whirlwind year for the cybersecurity industry. In this episode of the Adversary Universe podcast, we revisit clips from standout episodes of 2023. Tune in to catch pieces of our conversations on the evolution of cloud-focused cyberattacks, the rise of cyber activity from Iran and China, the process of discovering and mitigating vulnerabilities, the role of AI in the cyber threat land...

Organizations around the world must navigate a growing number of cyber incident reporting regulations mandated by government bodies. In the U.S., these regulations come from agencies including the Securities and Exchange Commission (SEC), Federal Trade Commission (FTC), Cybersecurity and Infrastructure Security Agency (CISA) and others. This “alphabet soup” of regulations, as Cristian puts it, can...

Today’s adversaries are working smarter, not harder — and it’s clear in the way their tactics are evolving. In this episode, Adam and Cristian explore the way adversaries are shifting their focus to data extortion. Instead of deploying noisy ransomware, more threat actors are quietly stealing data and threatening to publicly leak it if they’re not paid. Tune in to learn what’s driving this change,...

At a time when breaches make headlines daily, the healthcare sector is among the most popular adversary targets. Cyberattacks against healthcare organizations have spiked in recent years, disrupting patient care, jeopardizing safety and privacy, and obstructing compliance with industry regulations. In this episode, Cristian is joined by Dennis Egan, director of healthcare services for CrowdStrike,...

“Iran’s digital presence is something we don’t want to underestimate.” Though its cyber activity has been making headlines during a dynamic past few weeks, Iran’s history as a major player in the threat landscape spans decades. In this episode, Adam and Cristian take you back to the days of Stuxnet and trace Iran’s evolution from nascent threat actor to prominent nation-state adversary. Tune in to...

China is the source of some of the most prolific and aggressive nation-state cyber activity organizations face. Every business vertical, across every geography, is affected by China’s unrelenting focus on growth and power. In this episode, Adam and Cristian take you through the evolution of Chinese threat activity from the early 2010s through today, closely examining the myriad ways they seek to b...

A cyberattack is any security team’s worst nightmare — but the earlier a breach is detected, the faster you can respond and mitigate the damage. In this episode, we’ll share the warning signs that could indicate a breach has occurred, the immediate next steps to take in the incident response process, and why having the right data is essential to a successful recovery. Please note that all referenc...

When an adversary seeks entry into an organization, they no longer need to develop their own vulnerability exploits or steal credentials. Many turn to access brokers, the sellers of credentials, exploits and other tools threat actors can buy and use to gain initial access. In this episode, we discuss who access brokers are, how they gain and sell access, and their crucial role in the cybercrime ec...

Adversaries are moving and innovating at a rapid pace — but so are we. In this bonus episode, Adam and Cristian chat about the biggest announcements from Fal. Con, CrowdStrike’s annual conference, which took place last week in Las Vegas. Tune in to hear their take on new and developing technologies like Charlotte AI Investigator and Falcon Foundry, why they’re excited about the Bionic acquisition...

Artificial intelligence. It’s the hot topic in cybersecurity today. Everyone is curious about it, excited about its use cases and nervous about the problems it may cause in the wrong hands. Adam and Cristian get right into the questions you want answered: How are adversaries using AI today? How might they use it in the future? What should businesses really be worried about? Tune in to learn the tr...

School is back in session — and adversaries have already done their homework. They know educational institutions often lack the resources and expertise to keep up with the wave of ransomware, data extortion and other attacks pummeling their systems. Cristian and Adam examine why schools are a common target, the threats they face and how they can best defend themselves. In this episode, we also hea...

Vulnerabilities are the unlocked doors allowing adversaries a foothold into your organization. Left unpatched, they provide an entryway for intruders to break in, move laterally and wreak havoc. This episode shares everything you want to know about vulnerability intelligence: What types of vulnerabilities are most common? How should organizations prioritize patching? What is an n-day flaw? Learn t...

“Scary and incredible.” “Terrifying.” Adam and Cristian dig into new data from CrowdStrike’s recently formed Counter Adversary Operations Unit. A new report reveals adversaries are growing faster and smarter, with a focus on collecting identities and pilfering cloud environments. In this episode, learn what’s behind the massive 583% year-over-year jump in Kerberoasting attacks and the 147% jump in...

Multiple U.S. government agencies were recently breached after adversaries exploited vulnerabilities in Microsoft’s Azure Active Directory. With Microsoft vulnerabilities at the heart of some of the worst breaches in recent history, many in the cybersecurity industry are beginning to wonder: Do the dangers of the Microsoft monoculture outweigh the benefits? In this special bonus episode, Adam and...

Most organizations rely on cloud services or infrastructure to power their day-to-day operations — and adversaries know it. In this episode, we’ll explore how threat actors use the cloud to their advantage: how they breach cloud environments, the actions they take once they’re in, and the ways they use the cloud as a tool in their attacks. We’ll also discuss how organizations often unknowingly put...