Adversary Universe Podcast

CrowdStrike has long said, “You don’t have a malware problem — you have an adversary problem.” Much like we analyze the malware and tools used in cyberattacks, we must also learn about the people who orchestrate them. Adam and Cristian are joined by Cameron Malin, a behavioral profiler who specializes in understanding adversaries and the “why” behind their activity. Cameron built the FBI’s Cyber Behavioral Analysis Unit, which works to understand the motivations for cybercrime across different types of offenses and has focused for years on exploring why adversaries do what they do. In this episode, he discusses how the discipline of cyber behavioral profiling emerged, how experts approach interviewing and analyzing adversaries, and the “dark triad” and “dark tetrad” of personality traits commonly observed in cyberattacks.

Though the inner workings of North Korea remain a mystery to much of the world, its global cyber activity has been tracked and analyzed for years. CrowdStrike’s Counter Adversary Operations team, which tracks five North Korean threat actors, has a unique perspective on the country’s evolution as a global cybersecurity threat and the many ways it has used cyber capabilities to achieve its goals. In this episode, Adam and Cristian trace the history of North Korean cyber operations from its early days of destructive attacks to its focus on financial gain and espionage. Tune in for the answers to questions such as: How does North Korea discover its cyber talent? When did it pivot to cryptocurrency theft? And why does CrowdStrike track North Korean adversaries under the name CHOLLIMA? Come for the history, stay for Cristian’s singing skills in this conversation about the complex and changing world of North Korean cyber activity.   Check out some the CHOLLIMAs we track here:  https://www.crowdstrike.com/adversaries/silent-chollima/ https://www.crowdstrike.com/adversaries/labyrinth-chollima/ https://www.crowdstrike.com/adversaries/ricochet-chollima/ https://www.crowdstrike.com/adversaries/velvet-chollima/ https://www.crowdstrike.com/adversaries/stardust-chollima/ 

Cristian is joined by CrowdStrike Global CTO Elia Zaitsev to revisit the world of AI and large language models (LLMs), this time from the perspective of modern defenders. While this space has seen explosive growth in the past year, most organizations are still working to determine how LLM technology fits into their cybersecurity strategies. In this episode, Cristian and Elia unpack the rapid evolution of AI models — a trend the two consider both exciting and frightening — and examine how LLMs are empowering defenders, their effect on automation in the enterprise and why humans will continue to be part of the picture even as AI-powered tools evolve. Additional Resources: Five Questions Security Teams Need to Ask to Use Generative AI Responsibly Introducing Charlotte AI, CrowdStrike’s Generative AI Security Analyst: Ushering in the Future of AI-Powered Cybersecurity

Russian adversary VOODOO BEAR targets Ukrainian telecom provider Kyivstar, using it as a testing ground for cyber attacks. The hosts discuss the disruptive behavior and history of VOODOO BEAR, as well as the broader context of Russian intrusion operations. They explore the tactics and targets of the threat actor group Voodoo Bear, highlighting their involvement in destructive attacks on power infrastructure. The podcast also examines the impact of Russian cyber operations on the world stage and raises questions about the need for reassessment of security programs and partnerships.

It has been a whirlwind year for the cybersecurity industry. In this episode of the Adversary Universe podcast, we revisit clips from standout episodes of 2023. Tune in to catch pieces of our conversations on the evolution of cloud-focused cyberattacks, the rise of cyber activity from Iran and China, the process of discovering and mitigating vulnerabilities, the role of AI in the cyber threat landscape and more. For those who want to listen to the full episodes related to each of these clips, the episodes highlighted here are in the following order: Adversaries and AI: Today’s Reality and Tomorrow’s Potential Data Extortion Dethrones Ransomware as the Threat to Watch Cloud Is the New Battleground Invisible Threats: Discovering, Tracking and Mitigating Vulnerabilities Have You Been Breached? Urgent Care Required: The State of Healthcare Cybersecurity Iran’s Rise from Nascent Threat Actor to Global Adversary Inside China’s Evolution as a Global Security Threat

Exploring the complexities of cyber incident reporting regulations with guest Drew Bagley. Discussing SEC policies on reporting breaches, weaponization of disclosure policies by adversaries, market reactions to incident reports, defining material incidents, and navigating the evolving regulatory landscape.

Today’s adversaries are working smarter, not harder — and it’s clear in the way their tactics are evolving. In this episode, Adam and Cristian explore the way adversaries are shifting their focus to data extortion. Instead of deploying noisy ransomware, more threat actors are quietly stealing data and threatening to publicly leak it if they’re not paid. Tune in to learn what’s driving this change, why data extortion is successful and what it means for organizations of all sizes and industries. Get your copy of the CrowdStrike 2023 Overwatch Threat Hunting Report. Read this blog to learn about why threat hunting and intelligence are essential to detect and disrupt today’s adversaries, ultimately raising their cost of doing business: https://www.crowdstrike.com/blog/crowdstrike-debuts-counter-adversary-operations-team/ 

At a time when breaches make headlines daily, the healthcare sector is among the most popular adversary targets. Cyberattacks against healthcare organizations have spiked in recent years, disrupting patient care, jeopardizing safety and privacy, and obstructing compliance with industry regulations. In this episode, Cristian is joined by Dennis Egan, director of healthcare services for CrowdStrike, and Drex DeFord, executive healthcare strategist at CrowdStrike, to discuss the impact of cyber threats against healthcare, challenges we see in the space, the urgent need for healthcare providers to strengthen their security and the steps they should take to defend against modern attacks. Discover the targeting healthcare: AQUATIC PANDA: https://www.crowdstrike.com/adversaries/aquatic-panda/ LABYRINTH CHOLLIMA: https://www.crowdstrike.com/adversaries/labyrinth-chollima/ Learn more about the cybersecurity issues Healthcare experiences: https://www.crowdstrike.com/blog/healthcare-experiences-cybersecurity-emergencies/

“Iran’s digital presence is something we don’t want to underestimate.” Though its cyber activity has been making headlines during a dynamic past few weeks, Iran’s history as a major player in the threat landscape spans decades. In this episode, Adam and Cristian take you back to the days of Stuxnet and trace Iran’s evolution from nascent threat actor to prominent nation-state adversary. Tune in to learn how hacktivism has played a role in its history, why CrowdStrike uses “KITTEN” to categorize adversaries who operate on behalf of Iran, and how key political events and cyber threat activity have shaped its growth.

China is the source of some of the most prolific and aggressive nation-state cyber activity organizations face. Every business vertical, across every geography, is affected by China’s unrelenting focus on growth and power. In this episode, Adam and Cristian take you through the evolution of Chinese threat activity from the early 2010s through today, closely examining the myriad ways they seek to build influence, the industries they target along the way and the threat actors linked to Chinese cyberattacks. Additional resources:  Download your copy of the 2023 Global Threat Report Get your custom threat landscape Read CrowdStrike's Research and Intel blogs