Adversary Universe Podcast

Modern adversaries are relentless. Today’s threat actors target organizations around the world with sophisticated cyberattacks. Who are they? What are they after? And most importantly, how can you defend against them? Welcome to the Adversary Universe podcast, where CrowdStrike answers all of these questions — and more. Join our hosts, a pioneer in adversary intelligence and a specialist in cybersecurity technology, as they unmask the threat actors targeting your organization.

Listen on:

  • Apple Podcasts
  • Podbean App
  • Spotify
  • Amazon Music
  • iHeartRadio

Episodes

6 days ago

Social engineering is not a new threat — adversaries have long used psychological manipulation to gain access, money, information and more. But as we learn in this episode from Shelly Giesbrecht, Director of Professional Services at CrowdStrike, it remains a top cybersecurity challenge for all organizations.
Today’s social engineers are more convincing than ever. Gone are the days of clunky phishing emails rife with spelling errors. Modern social engineering attacks arrive as convincing and well-crafted text messages, emails and voice calls. They prey on human emotion and instinct, creating situations where technology can’t always help.
“It really comes down to that human factor,” says Shelly. “We talk a lot about technology, and obviously CrowdStrike is a technology company, but we are fallible still at the human level — and that’s where social engineering is targeted.”
In a conversation that starts with impostor syndrome and quickly pivots to the impostors who are emailing employees and calling help desks, Adam, Cristian and Shelly explore the modern social engineering landscape. Shelly describes what her team is seeing on the front lines of incident response, how social engineering campaigns are evolving with the rise of AI, and guidance for organizations worried about this prolific technique.

Thursday May 09, 2024

The rise of hacktivism — the use of hacking techniques to make a statement supporting a political or social cause — is often associated with the Occupy Wall Street movement and the Anonymous hacktivist collective. But the practice of hacking as a form of civil disobedience goes back to the 1990s. It has taken many forms in the years since, driven by a wide range of hacktivists around the world.
In this episode, Adam and Cristian trace the history of hacktivism to its early days, dive into high-profile examples and explain the practice of “faketivism” often used among nation-states. They share why hacktivism is top of mind during a year in which 55 countries have held, or will hold, elections. And they disclose the meaning behind JACKAL, the name CrowdStrike broadly uses to track activists who operate online. Tune in for an engaging explanation of a complex and oft overlooked topic.

Thursday Apr 25, 2024

Organizations fear adversaries will attack. Threat hunters assume adversaries are already in the system — and their investigations seek unusual behavior that may indicate malicious activity is afoot.
Andrew Munchbach, CrowdStrike’s Global VP, Field Engineering, joins Adam and Cristian in this week’s episode to explore what threat hunting is, how it works, and what makes a good threat hunting program.
As CrowdStrike’s “Chief Reddit Officer”, Andrew also shares how he came to run CrowdStrike’s Reddit account and discusses the platform’s evolving role in communicating with the security community. Now with nearly 20,000 followers, CrowdStrike’s Reddit account is used to share information — from key data on active attacks to weekly threat hunting exercises — with CrowdStrike customers and the general public.

Thursday Apr 11, 2024

Today’s conversation explores a common question around adversary activity: Why does attribution matter? When a cyberattack hits, why go to the trouble of learning who is behind it? Each attempt at an intrusion can reveal a lot about an adversary — who they are, what they’re doing and what their motivations may be.
This information can not only inform your response to an attack but how you strengthen your security architecture against future attacks. In this episode, Adam and Cristian discuss the importance of knowing who the adversary is and what they’re after.
They go back to the early days of adversary attribution, explain how adversaries are tracked as their activity changes over time and examine the value of this intelligence in helping organizations succeed in the face of evolving cyber threats.
The tool Adam mentions at the end of this episode can be found at https://adversary.crowdstrike.com/

Thursday Mar 28, 2024

The National Security Agency’s Cybersecurity Collaboration Center (CCC) was created based on a growing need for the public and private sectors to work together and share insights to understand adversaries’ intentions, as well as the scope and scale of their activity. In this special episode of the Adversary Universe podcast, Adam and Cristian are joined by Morgan Adamski, Chief of the CCC and government security expert, onstage at CrowdStrike’s Gov Threat Summit in Washington, D.C.
“We both had different pieces of the puzzle,” said Adamski of the NSA and private sector organizations, which collect different types of data on adversaries and how they operate. In this conversation, she, Adam and Cristian discuss the CCC’s mission and its evolution, explain how it works with private sector partners, and go “around the world” to discuss their observations of modern nation-state adversary activity.

Thursday Mar 14, 2024

CrowdStrike Chief Security Officer Shawn Henry joined CrowdStrike as employee number 19 after a 24-year career at the FBI, where he retired as the Bureau’s Executive Assistant Director.
Today, he joins Adam and Cristian for a wide-ranging conversation exploring his early days at CrowdStrike and transition to the private sector, his perspective on the 2016 DNC breach and the risks modern elections face. Adversaries have numerous opportunities to sway voters’ opinions — and now they have the technology to wield greater influence through misinformation and disinformation campaigns.“I think we've just scratched the surface with AI from a deepfake perspective,” Shawn says of how artificial intelligence may play a role in this activity. Tune in to hear his perspective, stories and guidance as we navigate this election year.

Thursday Feb 22, 2024

The days of automated cyberattacks are dwindling: last year CrowdStrike saw a 60% jump in interactive intrusions, a type of attack in which a human is on the other side, working to break in and navigating their target environment as soon as they gain access. Most (75% of) attacks in 2023 didn’t involve malware at all — in nearly all cases, the adversary relied on identity-related techniques or exploited an unmanaged device.
 
The threat landscape is constantly evolving as adversaries explore new tactics. And as the CrowdStrike 2024 Global Threat Report shows, a lot can change in a year. We’re seeing more adversaries, operating at greater speed and conducting more attacks than ever.
 
In this episode, Adam and Cristian reflect on the early days of the Global Threat Report and examine the key findings of this year’s report. Highlights include:
62 minutes: The average time an adversary needs to move from an initial access point to another host in the target environment
232: The number of adversaries CrowdStrike tracks
75%: The year-over-year increase in attacks targeting cloud environments
76% increase in postings on data leak sites
Download your copy of the CrowdStrike 2024 Global Threat Report today at crowdstrike.com/global-threat-report

Thursday Feb 15, 2024

CrowdStrike has long said, “You don’t have a malware problem — you have an adversary problem.” Much like we analyze the malware and tools used in cyberattacks, we must also learn about the people who orchestrate them.Adam and Cristian are joined by Cameron Malin, a behavioral profiler who specializes in understanding adversaries and the “why” behind their activity. Cameron built the FBI’s Cyber Behavioral Analysis Unit, which works to understand the motivations for cybercrime across different types of offenses and has focused for years on exploring why adversaries do what they do. In this episode, he discusses how the discipline of cyber behavioral profiling emerged, how experts approach interviewing and analyzing adversaries, and the “dark triad” and “dark tetrad” of personality traits commonly observed in cyberattacks.

Thursday Feb 01, 2024

Though the inner workings of North Korea remain a mystery to much of the world, its global cyber activity has been tracked and analyzed for years. CrowdStrike’s Counter Adversary Operations team, which tracks five North Korean threat actors, has a unique perspective on the country’s evolution as a global cybersecurity threat and the many ways it has used cyber capabilities to achieve its goals.
In this episode, Adam and Cristian trace the history of North Korean cyber operations from its early days of destructive attacks to its focus on financial gain and espionage. Tune in for the answers to questions such as: How does North Korea discover its cyber talent? When did it pivot to cryptocurrency theft? And why does CrowdStrike track North Korean adversaries under the name CHOLLIMA? Come for the history, stay for Cristian’s singing skills in this conversation about the complex and changing world of North Korean cyber activity.
 
Check out some the CHOLLIMAs we track here: 
https://www.crowdstrike.com/adversaries/silent-chollima/
https://www.crowdstrike.com/adversaries/labyrinth-chollima/
https://www.crowdstrike.com/adversaries/ricochet-chollima/
https://www.crowdstrike.com/adversaries/velvet-chollima/
https://www.crowdstrike.com/adversaries/stardust-chollima/ 

Thursday Jan 18, 2024

Cristian is joined by CrowdStrike Global CTO Elia Zaitsev to revisit the world of AI and large language models (LLMs), this time from the perspective of modern defenders.
While this space has seen explosive growth in the past year, most organizations are still working to determine how LLM technology fits into their cybersecurity strategies. In this episode, Cristian and Elia unpack the rapid evolution of AI models — a trend the two consider both exciting and frightening — and examine how LLMs are empowering defenders, their effect on automation in the enterprise and why humans will continue to be part of the picture even as AI-powered tools evolve.
Additional Resources:
Five Questions Security Teams Need to Ask to Use Generative AI Responsibly
Introducing Charlotte AI, CrowdStrike’s Generative AI Security Analyst: Ushering in the Future of AI-Powered Cybersecurity

Copyright 2023 All rights reserved.

Version: 20240320