Adversary Universe Podcast

Inside Russia’s Laboratory of Cyber Operations — and Beyond

In mid-December 2023, an adversary CrowdStrike tracks as VOODOO BEAR targeted Ukrainian telecom provider Kyivstar, wreaking havoc and disrupting thousands of systems and assets.
The Russia-linked adversary has for years treated Ukraine as its “lab of offensive cyber operations”, testing attack techniques and demonstrating the destructive behavior it has become known for since it emerged in late 2010.
In this episode, Adam and Cristian dive into the details of the recent Kyivstar attack and how it aligns with VOODOO BEAR’s history of disruptive cyberattacks, both in Ukraine and around the world. They also pull back the curtain on the broad, complex history of Russian intrusion operations, shedding light on adversaries operating within the country and what has motivated them over the years.

Adversary Universe: 2023 Highlights

It has been a whirlwind year for the cybersecurity industry.
In this episode of the Adversary Universe podcast, we revisit clips from standout episodes of 2023. Tune in to catch pieces of our conversations on the evolution of cloud-focused cyberattacks, the rise of cyber activity from Iran and China, the process of discovering and mitigating vulnerabilities, the role of AI in the cyber threat landscape and more. For those who want to listen to the full episodes related to each of these clips, the episodes highlighted here are in the following order:
Adversaries and AI: Today’s Reality and Tomorrow’s Potential Data
Extortion Dethrones Ransomware as the Threat to Watch
Cloud Is the New Battleground
Invisible Threats: Discovering, Tracking and Mitigating Vulnerabilities
Have You Been Breached?
Urgent Care Required: The State of Healthcare Cybersecurity
Iran’s Rise from Nascent Threat Actor to Global Adversary
Inside China’s Evolution as a Global Security Threat

Inside the ”Alphabet Soup” of Incident Reporting Regulations

Organizations around the world must navigate a growing number of cyber incident reporting regulations mandated by government bodies.
In the U.S., these regulations come from agencies including the Securities and Exchange Commission (SEC), Federal Trade Commission (FTC), Cybersecurity and Infrastructure Security Agency (CISA) and others. This “alphabet soup” of regulations, as Cristian puts it, can be tough for businesses to understand and follow — especially as the threat landscape evolves and compliance requirements change.In this episode, Cristian is joined by Drew Bagley, VP and Counsel for Privacy and Policy at CrowdStrike, to dig into the details of why these myriad regulations have emerged and shed some light on common questions: When does a breach need to be reported, and why is the timeline a hot debate topic? What is a “material breach”? How are adversaries using these regulations to their advantage? And most importantly, how should businesses respond to all of this? Tune in for these answers — and more.

Data Extortion Dethrones Ransomware as the Threat to Watch

Today’s adversaries are working smarter, not harder — and it’s clear in the way their tactics are evolving.
In this episode, Adam and Cristian explore the way adversaries are shifting their focus to data extortion. Instead of deploying noisy ransomware, more threat actors are quietly stealing data and threatening to publicly leak it if they’re not paid. Tune in to learn what’s driving this change, why data extortion is successful and what it means for organizations of all sizes and industries.
Get your copy of the CrowdStrike 2023 Overwatch Threat Hunting Report.Read this blog to learn about why threat hunting and intelligence are essential to detect and disrupt today’s adversaries, ultimately raising their cost of doing business: https://www.crowdstrike.com/blog/crowdstrike-debuts-counter-adversary-operations-team/ 

Urgent Care Required: The State of Healthcare Cybersecurity

At a time when breaches make headlines daily, the healthcare sector is among the most popular adversary targets.
Cyberattacks against healthcare organizations have spiked in recent years, disrupting patient care, jeopardizing safety and privacy, and obstructing compliance with industry regulations. In this episode, Cristian is joined by Dennis Egan, director of healthcare services for CrowdStrike, and Drex DeFord, executive healthcare strategist at CrowdStrike, to discuss the impact of cyber threats against healthcare, challenges we see in the space, the urgent need for healthcare providers to strengthen their security and the steps they should take to defend against modern attacks.
Discover the targeting healthcare:
AQUATIC PANDA: https://www.crowdstrike.com/adversaries/aquatic-panda/
LABYRINTH CHOLLIMA: https://www.crowdstrike.com/adversaries/labyrinth-chollima/
Learn more about the cybersecurity issues Healthcare experiences: https://www.crowdstrike.com/blog/healthcare-experiences-cybersecurity-emergencies/

Iran’s Rise from Nascent Threat Actor to Global Adversary

“Iran’s digital presence is something we don’t want to underestimate.”
Though its cyber activity has been making headlines during a dynamic past few weeks, Iran’s history as a major player in the threat landscape spans decades. In this episode, Adam and Cristian take you back to the days of Stuxnet and trace Iran’s evolution from nascent threat actor to prominent nation-state adversary. Tune in to learn how hacktivism has played a role in its history, why CrowdStrike uses “KITTEN” to categorize adversaries who operate on behalf of Iran, and how key political events and cyber threat activity have shaped its growth.

Inside China’s Evolution as a Global Security Threat

China is the source of some of the most prolific and aggressive nation-state cyber activity organizations face.
Every business vertical, across every geography, is affected by China’s unrelenting focus on growth and power. In this episode, Adam and Cristian take you through the evolution of Chinese threat activity from the early 2010s through today, closely examining the myriad ways they seek to build influence, the industries they target along the way and the threat actors linked to Chinese cyberattacks.
Additional resources: 
Download your copy of the 2023 Global Threat Report
Get your custom threat landscape
Read CrowdStrike's Research and Intel blogs

Have You Been Breached?

A cyberattack is any security team’s worst nightmare — but the earlier a breach is detected, the faster you can respond and mitigate the damage.
In this episode, we’ll share the warning signs that could indicate a breach has occurred, the immediate next steps to take in the incident response process, and why having the right data is essential to a successful recovery.
Please note that all references to "Falcon" in this episode refer to the CrowdStrike Falcon® platform.

The Rise of the Access Brokers

When an adversary seeks entry into an organization, they no longer need to develop their own vulnerability exploits or steal credentials.
Many turn to access brokers, the sellers of credentials, exploits and other tools threat actors can buy and use to gain initial access. In this episode, we discuss who access brokers are, how they gain and sell access, and their crucial role in the cybercrime ecosystem.

Inside the AI, Cloud and Platform Innovations Previewed at Fal.Con 2023

Adversaries are moving and innovating at a rapid pace — but so are we.
In this bonus episode, Adam and Cristian chat about the biggest announcements from Fal.Con, CrowdStrike’s annual conference, which took place last week in Las Vegas. Tune in to hear their take on new and developing technologies like Charlotte AI Investigator and Falcon Foundry, why they’re excited about the Bionic acquisition and some of the standout moments in an action-packed week.
Some brief disclaimers about products discussed in this episode:
Charlotte AI is a text-based interface in the Falcon platform; it does not support voice interaction at this time
Charlotte AI is currently available for private beta only. Watch CrowdStrike.com for future information about general availability
Charlotte AI Investigator is a feature of Falcon Raptor and designed for incident investigation. The Raptor release further accelerates the evolution of Charlotte AI, CrowdStrike’s generative AI cybersecurity analyst.