ShadowTalk: Powered by ReliaQuest

When 300,000 internal messages from the world's most prolific ransomware gang were leaked, they exposed more then a shadowy underground network, a full company. HR departments. Conti operated with the structure of a mid-sized software firm, and that changes how defenders need to think about the ransomware landscape today. Join host John and special guest Geoff White , journalist and author of...

AI is not replacing threat actors, instead it is making them faster, cheaper, and harder to stop. From AI powered phishing campaigns generating thousands of pages simultaneously, to a newly discovered macOS implant called Gaslight that injects fabricated system error messages into AI powered triage pipelines, the arms race between attackers and defenders is accelerating. The question is not whethe...

In the Klue compromises threat actors walked in through a trusted integration, using legitimate credentials to quietly siphon Salesforce CRM data at scale. The challenge isn't just responding to Klue. It's recognizing that every OAuth-connected integration in your environment is part of your attack surface. Join hosts Alexandra and John as they discuss: How compromised Klue integrations...

ShinyHunters dominated headlines this week: a zero-day, a BreachForums listing, and unverified claims all hitting at once. The problem isn't just keeping up with the volume. It's knowing which of it is real, which is noise, and what your team actually needs to act on. Join hosts Tehman and John as they discuss: ShinyHunters zero-day exploitation of CVE-2026-35273 Why a BreachForums listi...

Your team built defenses around known China-linked clusters. The file hashes are tracked. The behavioral patterns are documented. What those weren't built to catch is a new cluster that studied those exact defenses and engineered around them. A China-linked attacker compromised an internet-facing IIS server, maintained access for over 75 days, and came back on fresh infrastructure. With four...

Your team patches the device. The firmware version matches the advisory. The ticket closes. The device comes off the remediation queue. What your workflow never tracked is that the advisory also required six manual LDAP configuration steps — and without them, the authentication bypass still works. An initial access broker authenticated through the VPN, reached a domain-joined file server, and was...

Your user clicked a link, landed on a real Microsoft login page, typed their password, completed MFA, and walked away thinking nothing happened. Somewhere across the internet, an attacker's device just received an authenticated session token. The password is irrelevant. The MFA prompt already fired and passed. With PhaaS platforms now converging on token-theft tradecraft and post-compromise a...

What happens when an AI agent uncovers a zero-day in hours instead of weeks, and state-backed groups are already operationalizing the same tools? With self-hosted AI infrastructure sprawling outside asset registers and supply chain worms reaching inside AI vendors themselves, defenders need a new operating model. Join hosts Tehman and John as they discuss:  How an AI agent surfaced a memory-safety...

What's driving the surge in weekly supply chain attacks, and why does the real defender problem start after the supplier gets hit? With 275 million records exposed and 8,809 institutions caught in the downstream fallout, organizations need a new playbook. Join hosts Alexandra and John as they discuss: How ShinyHunters abused admin sessions RansomHouse's hypervisor-focused automation How...

What factors have driven the top ransomware and extortion groups' success in early 2026? And how should organizations structure their defenses to protect against them? Join hosts Alexandra and John as they discuss: How Akira is exploiting unknown assets inherited through M&A Why ShinyHunters' vishing and SaaS misconfiguration models work How The Gentlemen grew 588% quarter-over-quart...

Black Basta disbanded in February 2025, but their playbook didn't go with them. In March 2026, 77% of observed incidents targeted executives and directors, and attackers moved from first contact to malicious script execution in as little as 12 minutes. The tactic has been automated, refined, and is now running faster than most SOCs can respond.  Join hosts Alexandra and John as they discuss:...

89% of organizations that suffered a SaaS breach last year believed they had appropriate visibility. They had the logs — what they lacked was detection on what mattered. The Vercel incident shows exactly how costly that gap can be.  Join hosts Brandon and John as they discuss: How a third-party OAuth chain may have exposed Vercel's internal data Why SaaS visibility gaps leave organizations ex...

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts John and Alex, alongside special guest and ReliaQuest CTO Joe Partlow, as they discuss: How Claude Mythos autonomously generated exploits Why AI is accelerating CVE volume Defense strategies organizations need now Joe Partlow: CTO of ReliaQuest, a leading Information Security provider and is currently involved with new product initiative...

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts John and Tehman as they break down two of the most consequential supply chain attacks of 2026: How DPRK actors socially engineered a NPM maintainer Why hijacked GitHub versions are a CI/CD wake-up call The three gaps every security team needs to close John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in r...

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts Alexandra and John, live from Exponent 2026, alongside top security leaders as they discuss: How organizations keep pace with attackers Why one in four incidents starts with social engineering How automated response is helping organizations Chris Thompson: CISO of Caris Life Sciences, a leading, next-generation AI TechBio company and pre...

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts Brandon and John as they discuss: How Handala wiped 200,000 devices by weaponizing a trusted platform Why your organization doesn't need to be a direct target to be at risk How AI-enhanced malware is helping attackers get faster John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber t...

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts John and Alex as they discuss: How a Chinese APT maintained access for over a year Why North Korean impersonation surged 116% Why attackers exploit the same foundational gaps John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong techni...

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts Tehman and John as they discuss: Why ransomware now prioritizes exfiltration over encryption  How attackers can exfiltrate your data in just 6 minutes Why proactive darkweb monitoring is critical John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers....

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts Brandon and John as they discuss: How attacker breakout times dropped to as little as 4 minutes  Why ClickFix surged 200% Why behavioral detection is critical John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background,...

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts John and Tehman as they discuss: What attackers prefer over custom malware How signature-based detection fails Proactive governance vs. reactive triage John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he prev...

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts Brandon and John as they discuss: Why extortion payment rates are the lowest ever Organizations paying ransomware but refusing data extortion demands Why defenders need both visibility and speed John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers....

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts Brandon and John as they discuss: Why traditional patch cycles can't beat attackers exploiting vulnerabilities in 24 hours The shift from reactive patching to predictive intelligence using EPSS and CISA KEV How to defend against zero-days when patching isn't an option John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest...

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts John and Tehman as they discuss: Why phishing emails are no longer the top malware delivery method Emerging social engineering tactics: vishing, copy and paste abuse, and software impersonation How campaigns have evolved from Black Basta to ShinyHunters John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in...

Resources: https://linktr.ee/ReliaQuestShadowTalk John and Tehman as they discuss: How AI is enabling large-scale, high-speed attacks Nation-states weaponizing AI for attack automation The rise of sophisticated AI-generated malware John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical...

Resources: https://linktr.ee/ReliaQuestShadowTalk Join hosts Brandon and John as they discuss: How supply-chain attacks evolved Campaigns targeting NPM package maintainers Actionable defense strategies Brandon Tirado : Director of Threat Research for ReliaQuest. A skilled cyber defense professional with a unique combination of management and hands-on experience. With a deep understanding of advers...