The Hackle Box

We're BACK with another live Hackle Box episode to break down what's trending in cyber attacks and incident response. This month, the crew discussed: New Evil Tokens attack and its implications for cybersecurity The importance of comprehensive vulnerability management programs for IoT devices Insights into the FBI surveillance system breach and what it means for global cybersecurity The rise of ph...

We're BACK with another live Hackle Box episode to break down what's trending in cyber attacks and incident response. This month, we're discussing: Hackers abusing .arpa domain to evade phishing detection President Trump's Cybersecurity Strategy for America Seedworm and Iranian APTs Armadin Series A Funding Tune in for insights on these topics, and the latest trends, tactics, lures, and fixes that...

2026 is off to quite the start! After a New Year's break, we're BACK with another Hackle Box episode to discuss what we've seen so far in the offensive services and incident response sides of the infosec industry!  This month, Oscar, Eric, and special guest Matt Findlay discussed: Notepad++ Vulnerabilities Phishing from legitimate Microsoft inboxes Solarwinds Remote Code Execution Ring's New Surve...

In this quarterly live Q&A session, the gang dives into the recent CISA budget cuts and hands it over to the audience for discussion. Tune in to get your updates, hear what folks are talking about, and a little on boats! To stay updated on all things The Hackle Box, sign up to receive our newsletters: https://frsecure.com/cyber-threat-intel-series/ Please like, subscribe, and follow us on soci...

Join us for our May Hackle Box session! The crew explores the emerging concept of "vibe coding", also known as vulnerability as a service, and unpacks its implications for cybersecurity. The team discusses how large language models (LLMs) may unknowingly import malicious code, raising critical concerns about training data integrity and AI trustworthiness. Links: "AI-Hallucinated Code Dependencies...

In this month's edition of the Hackle Box, the guys are joined by Kevin Gunter, a penetration tester at FRSecure, to discuss "Xanthorox AI," a record-breaking $75M ransomware demand, a US Treasury breach going back to 2023, and Neptune RAT. Links: "Autonomous, GenAI-Driven Attacker Platform Enters the Chat" https://www.darkreading.com/threat-intelligence/autonomous-genai-attacker-platform-chat  "F...

Approaching the end of Q1, this special-edition episode answers questions from the audience including the U.S. Cyber Command's suspended operations against Russia and some essential beard maintenance. Security Analyst Tim Boyer sits in for Pinky to fill the blue team perspective. Now happening quarterly, listeners can ask all things security to our expert crew! The next Q & A Session will be h...

Oscar, Pinky, and Eric dive into DeepSeek, the downward trend of Ransomware extortions, and new, actively exploited vulnerabilities. Links: "DeepSeek App Transmits Sensitive User and Device Data Without Encryption" https://thehackernews.com/2025/02/deepseek-app-transmits-sensitive-user.html "DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked" https://thehackernews.com/2025/...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits.  This special holiday episode, Pinky shares a reading of "The Night Before Breachmas", the gang talks encrypted texting, Microsoft's MFA flaw - aka "AuthQuake", and hackers bypassing AntiVirus protections with BYOVD. Links: "FBI Warns iPhone And And...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits.  This month, Oscar and the crew focus on SolarWinds cyber attack and the resulting charges from the SEC, guidance from OWASP on AI Security, and CISCO's security patch. Links: "Google Cloud to Enforce Multi-Factor Authentication by 2025 for All User...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits.  This month, the hosts talk about personal preparation for emergency events like natural disasters, the DDOS attacks of Internet Archive, newest CISA warnings, and Zero Day Alert for Ivanti exploitation. They also open up to the live audience for qu...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits. With Oscar out traveling, Pinky and Eric lead the discussion this month. Together, they discuss: A worm-driven USB attack strategy, Microsoft's disclosure of four zero-days in their September update, and the Scattered Spider ransomware group's sophi...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits.  This time, they discuss Midnight Blizzard, a zero-click Outlook vulnerability, and CISA's takedown of Ivanti Systems. Links:  Network Segmentation Saved TeamViewer From APT29 Attack https://www.darkreading.com/cyberattacks-data-breaches/teamviewer-...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits.  This time, they discuss critical Citrix flaws, fake journalists stealing data, Microsoft holding execs accountable for security, police trolling a ransomware gang, and more. Links:  Citrix Addresses High-Severity Flaw in NetScaler ADC and Gateway h...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits. This time, they discuss AI-written malware, XZ Utils, and attackers targeting hospital IT help desks. Links: XZ Utils scare  https://www.darkreading.com/application-security/xz-utils-scare-exposes-hard-truths-in-software-security Change Healthcare h...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits. This time, they discuss security risks in ChatGPT plugins, a major flaw in Google's Gemini AI, typosquatting, and a worldwide vishing epidemic. Links: ChatGPT Plugin Security https://www.infosecurity-magazine.com/news/security-risks-chatgpt-plugins/...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits. This time, they discuss compromised job boards where millions of resumes were stolen, AnyDesk's actions post-hack, an exploited SSRF flaw in Ivanti, and more. Links: Millions of resumes stolen via exploited job boards https://thehackernews.com/2024/...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits. This time, they discuss the reduced cybersecurity funding observed in 2023 as well as new vulnerabilities, patches, and more. Links: Cybersecurity Funding Reduced https://www.securityweek.com/cybersecurity-funding-dropped-40-in-2023-analysis/ Critic...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits. This time, they discuss common social engineering attacks carried out around the holidays when key team members are out of the office or organizations are shut down for seasonal breaks. Links Social Engineering https://thehackernews.com/2023/12/hack...

The guys are back for another episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits. This time around, they discuss recent vulnerabilities in Confluence and Apache ActiveMQ. Follow us on social! Facebook: https://www.facebook.com/frsecure/ Twitter: https://twitter.com/frsecure/ Instagram: https://www.instagram.com/frsecureofficial/...

The guys are back for a special, Friday the 13th episode of the Hackle Box—a monthly conversation between information security experts about new and noteworthy exploits. This time around, we're getting in the spooky spirit and telling scary stories from real-life IR cases. 🎃 Please like, subscribe, and follow us on social! Facebook: https://www.facebook.com/frsecure/ Twitter: https://twitter.com/...

Oscar and Pinky are back for this month's session of the Hackle Box—a monthly conversation between the information security experts about new and noteworthy exploits. DISCUSSED THIS MONTH: Scattered Spider (MGM attack) https://hackdojo.io/articles/E59P05LKQ/-scattered-spider-behind-mgm-cyberattack-targets-casinos Caesers confirms ransomware https://hackdojo.io/articles/73WL5VP9N/caesars-confirms-r...

Eric and Pinky are back with another session of the Hackle Box—a monthly conversation between the information security experts about new and noteworthy exploits. Discussed this month DEFCON Recap EvilProxy campaign https://www.techrepublic.com/article/evilproxy-phishing-attack/ QR Codes used for credential theft https://www.darkreading.com/attacks-breaches/qr-code-phishing-campaign-targets-top-u-s...

This month, we're doing a crossover episode with the Unsecurity Podcast! For those who are not yet aware, Unsecurity is another FRSecure podcast focused on the business impact of current events and happenings within the security industry. It's hosted several times a month by Oscar and Brad Nigh, FRSecure's Principal Information Security Consultant. Discussed this month: MOVEit Attacks Microsoft Pa...

Oscar, Eric, and Pinky are back with another session of the Hackle Box—a monthly conversation between the information security experts about new and noteworthy exploits. Discussed this month Do's and don'ts of SIEM implementation The recent Dragos incident https://www.bleepingcomputer.com/news/security/cybersecurity-firm-dragos-discloses-cybersecurity-incident-extortion-attempt/ Please follow us o...