Microsoft Threat Intelligence Podcast

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo speaks with Jarrod Forgues Schlenker of the FBI’s Cyber Division about the pattern's investigators see in cyber incidents and how initiatives like Operation Winter Shield aim to close the gap between knowing what to do and actually implementing it.   They discuss the importance of foundational controls like phishing-resistant authentication, secure logging, and strong identity protection, as well as the role threat intelligence and prevention play in strengthening organizational defenses. The conversation highlights how small, practical security improvements can significantly disrupt attackers and help organizations reduce risk before an incident occurs.  In this episode you’ll learn:       How the FBI identifies recurring patterns in cyber-attacks across investigations  Why phishing-resistant authentication and MFA are critical for stopping credential theft  What Operation Winter Shield is and how it encourages organizations to move from awareness to action   Some questions we ask:      Which security control themes in the program stand out to you the most?  Why are log retention and protection so critical during investigations?  How can threat intelligence programs help organizations strengthen their defenses?    Resources:   View Jarrod Forgues Schlenker on LinkedIn View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts     Get the latest threat intelligence insights and guidance at Microsoft Security Insider    The Microsoft Threat Intelligence Podcast is produced by Microsoft, Hangar Studios and distributed as part of N2K media network. 

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Greg Schlomer and Vlad H. to discuss new research on Jasper Sleet, a North Korean–aligned threat actor incorporating AI into active operations.  The conversation examines how AI is being integrated across the attack lifecycle — from highly tailored phishing lures and fabricated job applicant personas to accelerating malware development and refining operational workflows. Rather than treating AI as a novelty, Jasper Sleet is using it to increase speed, scale, and adaptability while reducing many of the friction points that once slowed campaigns.  They also explore what this shift means for defenders. As AI compresses iteration cycles and lowers barriers to entry, traditional attribution signals evolve, influence operations become more convincing, and defensive teams must tighten the loop between intelligence, detection, and response. This is less about experimentation and more about the operationalization of AI as part of modern tradecraft.  In this episode you’ll learn:       How AI is changing the speed at which cyber operations evolve  Why jailbreaking AI models is often trivial for motivated adversaries   The strategic implications of AI leveling the playing field between threat actors  Some questions we ask:      Is there resistance among experienced malware authors to adopting AI?  Are we seeing fully AI-written malware in the wild?  What stands out about Jasper Sleet’s use of AI?    Resources:   View Greg Schloemer on LinkedIn   View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks      Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Get the latest threat intelligence insights and guidance at Microsoft Security Insider    The Microsoft Threat Intelligence Podcast is produced by Microsoft, Hangar Studios and distributed as part of N2K media network. 

In this episode of the Microsoft Threat Intelligence Podcast, Sherrod DeGrippo speaks with Microsoft security and AI researchers Giorgio Severi and Noam Kochavi about a newly observed trend in AI abuse: recommendation poisoning through memory manipulation.  While looking into prompt injection and reprompt-style behaviors, the team uncovered something quieter but potentially more persistent—websites embedding hidden instructions inside Summarize with AI links that attempt to influence what an AI assistant remembers and recommends over time.  Rather than focusing on immediate exploitation, this technique aims to shape long-term behavior inside AI systems. Giorgio and Noam explain how it works, why it’s spreading across industries, where legitimate marketing tactics can blur into security risk, and what defenders and users should understand about managing AI memory in an increasingly agent-driven environment.  In this episode you’ll learn:       How AI memory poisoning differs from traditional prompt injection  Why legitimate businesses are using memory manipulation tactics  What threat hunters can look for inside enterprise telemetry   Some questions we ask:      How is memory poisoning different from prompt injection?  What are the long-term risks of embedding bias into AI memory?  Could this technique be used for more harmful influence beyond marketing?    Resources:   View Giorgio Severi on LinkedIn   View Noam Kochavi on LinkedIn   View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts     Get the latest threat intelligence insights and guidance at Microsoft Security Insider      The Microsoft Threat Intelligence Podcast is produced by Microsoft, Hangar Studios and distributed as part of N2K media network. 

Anna Seitz, a Microsoft researcher tracking financial‑services threats, and Megan Stalling, a researcher focused on intrusion tradecraft, unpack actor tactics. They describe Storm‑0727’s use of maldocs, credential theft and living‑off‑the‑land scripts. The conversation covers BEC, ransomware with data extortion, phishing‑as‑a‑service, social engineering, and why simple techniques remain effective.

Chloe Mesdaghi, AI governance and cybersecurity risk lead focused on oversight and resilience. Crane Hassold, security researcher tracking how adversaries adopt tech. They cut through hype to show where AI actually helps: detection, triage, automated recon, and workflows. They flag real risks like prompt injection, agent manipulation, and AI systems becoming targets. Practical, practitioner-focused conversation.

Join threat experts Jonathan Checchi and Anna Seitz as they delve into the dangerous world of cloud-native ransomware. Jonathan explores how Storm-0501 has evolved its tactics, leveraging hybrid cloud environments to maximize impact. Meanwhile, Anna reveals the insidious SesameOp backdoor, which abuses trusted AI platforms for covert command-and-control operations. The conversation highlights the importance of monitoring identity behavior and implementing robust defenses like MFA to combat these sophisticated threats.

Jeff McDonald, a Microsoft security research lead specializing in ML model protections, and Jonathan Barr Orr, a hacker and vulnerability researcher, discuss Whisper Leak. They explain how token-by-token streaming and packet size/timing patterns can reveal topics in encrypted AI traffic. The conversation covers which models show signals, real-world adversaries, and developer mitigation approaches.

Matt Duncan, Vice President of Security Operations and Intelligence at E-ISAC, dives into the critical world of power grid security. He discusses how AI is evolving the threat landscape, making it easier for attackers to target outdated systems. Severe weather events increase cyber vigilance, while harrowing insights into hacktivists reveal unique motivations and tactics. Matt emphasizes the importance of industry collaboration and real-life success stories to fortify defenses. Learn why foundational security practices are essential for keeping our electricity safe and resilient.

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by security researchers Tori Murphy and Anna Seitz to unpack two financially motivated cyber threats. First, they explore the Payroll Pirates campaign (Storm 2657), which targets university payroll systems through phishing and MFA theft to reroute direct deposits. Then, they examine Vanilla Tempest, a ransomware group abusing fraudulent Microsoft Teams installers and SEO poisoning to deliver the Oyster Backdoor and Recita ransomware.   Together, they discuss how attackers exploit trust in identity, code signing, and SaaS platforms and share practical steps organizations can take to strengthen defenses, from phishing-resistant MFA to stricter executable controls and out-of-band banking verification.  In this episode you’ll learn:       How Payroll Pirates diverted university salaries through SaaS HR phishing schemes  Why universities are prime targets for identity-based cyberattacks  How Vanilla Tempest evolved from basic ransomware to complex multi-stage attacks  Some questions we ask:      How are attackers stealing credentials and paychecks?  Why do attackers create inbox rules after compromising accounts?  What alerts should organizations monitor for these types of attacks?  Resources:   View Tori Murphy on LinkedIn   View Anna Seitz on LinkedIn  View Sherrod DeGrippo on LinkedIn   Investigating targeted “payroll pirate” attacks affecting US universities  Microsoft Threat Intelligence healthcare ransomware report highlights need for collective industry action    Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts     Get the latest threat intelligence insights and guidance at Microsoft Security Insider    The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network. 

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Zack Korman, CTO of cybersecurity startup Pistachio. They explore the reality of AI in security, cutting through hype to discuss where AI is both brilliant and flawed, how vendors AI-wash outdated tech, and why Zack believes AI won’t replace jobs but instead scale human creativity. They also dive into phishing simulations, human psychology behind social engineering, AI-powered attacks, jailbreak chaining between AI systems, and the future risks and opportunities AI introduces in cybersecurity.   In this episode you’ll learn:       How to evaluate whether a vendor is truly using AI in their product  The psychology behind why people fall for phishing attacks  Why human judgment will remain essential in the era of AI-driven security.  Some questions we ask:      How can AI unlock new capabilities in cybersecurity?  What questions should people ask AI security vendors?  Why do trained security professionals still fall for phishing attacks?  Resources:   View Zack Korman on LinkedIn   View Sherrod DeGrippo on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts     Get the latest threat intelligence insights and guidance at Microsoft Security Insider    The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.