Talos Takes

We’ve all seen the supposed stories online that promise to give you “The one secret to weight loss doctors WON’T tell you about.” Or “You won’t believe who Kim Kardashian is talking about now.” So how harmful are these malicious ads? Why do some of them deliver malware, and others don’t? In this episode of Talos Takes, Nick Biasini and Earl Carter dive into the basics of malvertising.

The holidays have come and gone, and so have the sales. Maybe you got a new drone, or a home AI assistant. So what should you do to make sure those new toys don’t turn against you? Nick Biasini and Earl Carter have some tips for you.

2019 was a huge year for ransomware. Cities across the U.S. had their government services attacked, and adversaries changed up their techniques in the hopes of making a larger profit and infecting more users. What other changes do we see coming to the ransomware space? Are adversaries’ motivations changing at all? And will defense techniques change along with them?

With the Equifax attack back in the headlines, we take a closer look at Big Game Hunting this week on Talos Takes. Why do threat actors look at these massive targets, and what do they hope to get out of it? Is there anything smaller organizations can learn from these high-stakes campaigns?

With the RSA conference just days away, notable vendors such as IBM and AT&T have withdrawn from the annual event over coronavirus concerns. The fast-spreading disease has captured headlines across the globe, and adversaries are trying to strike quickly. Continuing our look at attackers’ use of current events to spread malware, Nick Biasini and Earl Carter sit down to discuss malware campaigns...

In this episode of Talos Takes, content manager Jon Munshaw sits down with researcher Joe Marshall to discuss the recently discovered EKANS/SNAKE malware. This is one of the first ransomware strains to specifically target ICS systems. And Joe, who has experiencing protecting the ICS space, discusses what’s unique about this family and what it means for the future of cyber security in the infrastru...

On this week’s episode, Edmund Brumaghin joins the show again to talk about a recent blog post on Salfram . This threat actor is spreading lots and lots of spam and using it to deliver a variety of malware. Here’s why this threat specifically caught our eye and how it’s evolving over time.

Talos Takes is finally back with its own feed and a new episode. Nick Biasini and Earl Carter discuss the best password practices. Should you use a password manager? What are some best practices? And what does all of this have to do with Disney Plus?

Yes, adversaries are always looking for new ways to make money. But what’s their No. 2 priority? Information. In this episode of Talos Takes, Nick Biasini and Earl Carter break down the basics of information-stealers and why they’re so important to keep out.

Don’t attackers know we need a break right now? Alas, they’re doing everything they can to capitalize on the COVID-19 pandemic. This includes spreading fear, uncertainty and doubt with fake news, malicious advertisements and misleading information. In this Talos Takes episode, former journalist Jon Munshaw and researcher Nick Biasini discuss best practices for fact-checking, avoiding fake news and...

We’ve been covering several different generic types of malware over the past few weeks. Next up, we’ve got our overview of remote access trojans (or tools), also known as RATs. What goes into a RAT, and how is it different than other types of malware? What are some of their inherent capabiliites? We/ve got the rundown here.

Now that Cisco Incident Response has been a part of the Talos family for a few months now, we figured it was time to check back in with them. On this episode of Talos Takes, Brad Garnett from CTIR joins the show to talk about his organization’s new Cyber Range offering, part of the standard CTIR retainer. Brad discusses how a Cyber Range exercise can prepare your organization for the worst and how...

People across the world are working from home now, and employers are increasingly turning to VPN services and Windows Remote Desktop Protocol to make sure their workers have access to their files. In this Talos Takes episode, we run down some common security concerns with these services and discuss what employees should do to stay safe while accessing their files online.

Earlier this week, we released an in-depth blog post on fingerprint scanners used as physical security gates on devices. To save you a bit of time, and to summarize it for those non-technical folks out there, Nick Biasini and Jon Munshaw dedicate this episode to breaking down Talos’ research. What was the endgame of our research? And can you rely only on your fingerprint to keep your device secure...

Threat researchers like to throw around the acronym “FUD” a lot. But is FUD, exactly? Why should you look out for it? And why do attackers win when they sow FUD? Joe Marshall and Jon Munshaw walk you through fear, uncertainty and doubt and discuss why panic and misinformation play right into attackers’ hands.

Threat actors all over the place are trying to capitalize on COVID-19. We recently discovered a campaign we’re calling “PoetRAT” using lure documents themed around the pandemic attempting to trick victims into downloading malware. In this week’s Talos Takes episode, Nick Biasini chats with one of the researchers on the project, Warren Mercer, about this threat.

We published our findings on a ransomware family known as MedusaLocker last week. On its surface, it’s just like any other ransomware family — steals your stuff, encrypts it, and asks for some money to get it back. But there are some secret tricks hidden beneath the surface, and Edmund Brumaghin is here to talk about them.

The value of cryptocurrencies is nowhere near where it was just two years ago. So does that mean cryptominers have gone away as a threat? Jon Munshaw and Nick Biasini sit down in this episode of Talos Takes to discuss where cryptominers stand in 2020. Why aren’t we reading about them as much? And why is being hit with one a sign of worse things to come?

Everyone is meeting virtually now. Whether it be important business or the average happy hour with friends and family, there’s no shortage of invites to chat rooms, presentations and software you’ve never heard of before you started working from home. And, of course, this software comes with its own set of security concerns and vulnerabilities. So Matt Valites joins Jon Munshaw this week to talk a...

We use the term “APT” in cyber security a lot. But what does it mean, exactly? Does a group have to break a certain threshold to become an APT? Does the term refer to a specific malware family or a group of actors? On this week’s Talos Takes, Jon Munshaw talks to Azim from Talos’ Threat Intelligence team about this very topic.

The dark web sounds scary — and it is. But what exactly does this dark web consist of? Despite what the name may suggest, it’s actually not people selling organs or stolen video games that happened to fall off the back of a truck. But what is actually on these forums? Azim Khodjibaev joins Jon Munshaw this week to discuss his experience with the dark web.

The quick and dirty beginner’s guide to what Snort is and how to use. This the podcast accompaniment to the rest of our Snort 101 materials, which can be found on Snort.org/Resources.

This week’s episode is actually an excerpt from our recently released roundtable on disinformation and American election security. This is a small part of our larger discussion on fake news, state-sponsored actors using fake social media accounts, and what can be done to combat the spread of disinformation. To see the whole thing, click here .

LoLBins sound like they’d be funny, but they’re anything but. These “living-off-the-land binaries” make it so that attackers can more easily hide on your system as they disguise themselves as legitimate processes. On this episode of Talos Takes, Nick Biasini talks about what LoLBins are, exactly, how adversaries use them and how you can spot them on your environment.

Honeypots are an important part of threat research and detection. In this episode of Talos Takes, we talk to Christopher Evans, who is our resident honeypot expert at Talos. Chris talks about how he uses them every day, why they’re important to Talos’ overall mission and balancing the use of them with the potential for making attackers smarter.