• Click, Call, Compromise: Inside the Latest Loader Campaigns
    Sep 10 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Microsoft researchers Kelsey Clapp and Anna Seitz to examine two major cybercrime campaigns. The team unpacks Storm 2561’s use of SEO poisoning to distribute Trojanized software like SilentRoute and Bumblebee, stealing VPN credentials and paving the way for ransomware brokers. They also dive into Storm 1811’s ReadBed malware, a loader deployed through bold social engineering tactics, such as fake IT help desk calls via Teams, that enable lateral movement and ransomware deployment. The discussion highlights how modern threat actors exploit trust, extend attack chains, and continually evolve their techniques, underscoring the importance of vigilance, strong security controls, and verifying before trusting. In this episode you’ll learn: How Storm 2561 uses SEO poisoning to trick users into downloading Trojanized software The role of trust, urgency, and habit in social engineering tactics Practical steps organizations can take to block these threats and strengthen defenses Some questions we ask: Why are initial access loaders such a big risk for organizations? How are threat actors using fake IT help desk calls to gain access? What steps should defenders take to cut off these entry points? Resources: View Anna Seitz on LinkedIn View Kelsey Clapp on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    29 mins
  • Live from Black Hat: Ransomware, Responsible Disclosure, and the Rise of AI
    Aug 27 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is live from Black Hat 2025 with a special lineup of Microsoft security leaders and researchers. First, Sherrod sits down with Tom Gallagher, VP of Engineering and head of the Microsoft Security Response Center (MSRC). Tom shares how his team works with researchers worldwide, why responsible disclosure matters, and how programs like Zero Day Quest (ZDQ) are shaping the future of vulnerability research in cloud and AI security. He also announced the next iteration of ZTQ with $5 million up for grabs. Next, Sherrod is joined by Eric Baller (Senior Security Researcher) and Eric Olson (Principal Security Researcher) to unpack the fast-changing ransomware landscape. From dwell time collapsing from weeks to minutes, to the growing role of access brokers, they explore how attackers operate as organized ecosystems and how defenders can respond. Finally, Sherrod welcomes Travis Schack (Principal Security Researcher) alongside Eric Olson to examine the mechanics of social engineering. They discuss how attackers exploit urgency, trust, and human curiosity, why AI is supercharging phishing campaigns, and how defenders can fight back with both training and technology. In this episode you’ll learn: How MSRC partners with researchers across 59 countries to protect customers Why Zero Day Quest is accelerating vulnerability discovery in cloud and AI How ransomware dwell times have shrunk from days to under an hour Resources: View Sherrod DeGrippo on LinkedIn Zero Day Quest — Microsoft Microsoft Security Response Center Blog Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    44 mins
  • How Microsoft Stays Ahead of the World’s Most Dangerous Hackers
    Aug 7 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Aarti Borkar, Simeon Kakpovi, and Andrew Rapp for a behind-the-scenes look at how Microsoft Threat Intelligence and Microsoft Incident Response teams collaborate as part of a closed-loop system, the emotional toll of breaches, and how organizations of any size can build resilience through preparation and psychological safety. By listening to this segment, you’ll get a preview of what this group brought to the main stage of Black Hat this year. Later, Sherrod chats with Snow, co-founder of the Social Engineering Community Village at DEF CON, about her journey from special effects makeup to elite social engineer, and how empathy, creativity, and even a ladder can be powerful tools in physical security testing. In this episode you’ll learn: How Microsoft’s Digital Crimes Unit uses legal tactics to disrupt threat actors Why rehearsing your incident response plan can save weeks of recovery time How AI is being trained to make social engineering phone calls on its own Some questions we ask: How would you describe the overall health of the global cybersecurity landscape? Why does tailoring AI prompts sometimes feel like social engineering? What is the feedback loop between incident response, intelligence, and product protections? Resources: View Aarti Borkar on LinkedIn View Simeon Kakpovi on LinkedIn View Andrew Rapp on LinkedIn View Sherrod DeGrippo on LinkedIn Microsoft at Black Hat USA 2025 Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    1 hr and 18 mins
  • Inside Microsoft’s Global Operation to Disrupt Lumma Stealer’s 2,300-Domain Malware Network
    Jul 23 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Richard Boscovich and Derek Richardson from Microsoft’s Digital Crimes Unit to unpack the global takedown of Lumma Stealer, one of the world’s largest infostealer malware operations. They discuss how creative legal tools like RICO and centuries-old trespass laws, deep collaboration with global partners, and innovative technical strategies came together to seize 2,300 domains and protect nearly 400,000 victims. The episode explores how the DCU is shifting toward persistent, cost-imposing disruption of cybercrime as a service, and what this means for defenders everywhere. In this episode you’ll learn: How Microsoft took down one of the world’s largest infostealer malware operations The global partnerships with Europol, Japan, and private companies in cyber takedowns What happens to stolen victim data during a takedown operation Some questions we ask: How did you first identify Lumma as a high-priority threat? Is persistent disruption now the new normal for DCU operations? Do you see more operations like this coming from DCU in the future? Resources: View Richard Boscovich on LinkedIn View Sherrod DeGrippo on LinkedIn Disrupting Lumma Stealer: Microsoft Leads Global Action Against Favored Cybercrime Tool Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    45 mins
  • Tips from Grifter and Lintile for Attending Hacker Summer Camp
    Jul 9 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Grifter, the legendary Black Hat NOC lead, and Lintile, host of Hacker Jeopardy, to go behind the scenes of DEF CON and Black Hat. They unpack the chaos of managing the world’s most hostile networks, share advice for first-time attendees, and explore the vibrant hacker community that thrives on connection, contests, and lifelong friendships. The conversation also covers how to submit compelling CFP abstracts, why live events matter, and the controlled mayhem that defines Hacker Jeopardy each year in Las Vegas. Heading to Black Hat? Join us at booth #2246 where we will be recording new episodes, and request to attend the VIP Mixer. We’ll also be hosting the BlueHat podcast, our friends from GitHub, and experts from our incident response team. In this episode you’ll learn: Why skipping talks at DEF CON to join contests and villages can be more valuable Tips for crafting compelling CFP abstracts that stand out among 1,000+ submissions The importance of connection and niche technical discussions in the hacker community Some questions we ask: What advice would you give to someone who has never been to DEF CON? How does the team plan traps and misdirection in Hacker Jeopardy questions? What do you think the community should focus on getting out of DEF CON? Resources: View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    1 hr and 33 mins
  • The Art and Science of Microsoft’s Red Team
    Jun 25 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Craig Nelson, who leads the elite Microsoft Red Team. Together, they dive into the art and impact of red teaming at Microsoft: what it means to simulate real-world attacks, how threat intelligence informs operations, and why collaboration between red and blue teams is crucial for organizational resilience. Craig shares the surprising mission that blurred the lines between physical and cyber security, reflects on how AI is reshaping attacker tactics and defensive strategies, and offers advice for aspiring red teamers. From stories of early hacker days in the ’90s to navigating the complexities of securing cloud and AI systems, this conversation is packed with insights on how Microsoft stays ahead of evolving threats. In this episode you’ll learn: The role of human behavior in real-world security breaches How Microsoft’s Secure Future Initiative impacts security culture What the Microsoft Red Team does and what it doesn’t do Some questions we ask: How do you feel about getting caught during a red team operation? What do you wish people paid more attention to in red team findings? Is this new AI complexity good or bad for red teaming? Resources: View Craig Nelson on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    41 mins
  • A Peek Inside Microsoft’s Global Fight Against Cyber Threats
    Jun 11 2025
    Recorded live at RSAC 2025, this special episode of the Microsoft Threat Intelligence Podcast, hosted by Sherrod DeGrippo, brings together Jeremy Dallman from the Microsoft Threat Intelligence and Steven Masada from Microsoft’s Digital Crimes Unit. The panel explores the psychology and techniques behind nation-state and criminal cyber actors, how Microsoft innovatively uses legal and technical disruption to dismantle threats like Cobalt Strike and Storm-2139, and the growing trend of adversaries leveraging AI. From North Korean fake job interviews to China's critical infrastructure infiltration, this episode highlights how Microsoft is staying ahead of the curve—and sometimes even rewriting the playbook. In this episode you’ll learn: How targeting attacker techniques is more effective than chasing specific actors The surprising ways threat actors use AI—for productivity, not just deepfakes Why North Korean threat actors are building full-blown video games to drop malware Some questions we ask: What’s the role of Microsoft’s Digital Crimes Unit and how is it unique in the industry? Why should cybersecurity professionals read legal indictments? What impact did Microsoft’s legal actions have on tools like Cobalt Strike and Quakbot? Resources: View Jeremy Dallman on LinkedIn View Steven Masada on LinkedIn View Sherrod DeGrippo on LinkedIn Bold action against fraud: Disrupting Storm-1152 Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    46 mins
  • Call of the Cyber Duty (A Global Cyber Challenge)
    May 28 2025
    In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by Henning Rauch, to discuss Call of the Cyber Duty is a 42-hour global cybersecurity challenge hosted by Microsoft’s Kusto Detective Agency. The competition runs from 12:00 AM Coordinated Universal Time (UTC) on June 8, 2025, and ends at 12:00 AM UTC on June 18, 2025, at 10:00AM UTC. Once a team member opens the first case, they have 42 hours to complete it.Participants will solve a series of investigative puzzles using Kusto Query Language (KQL) — no prior Kusto experience required. This free, gamified threat-hunting experience is open to individuals and teams, with a $10,000 grand prize, an interactive mystery plot, and a Hall of Fame for the top solvers. Expect fun twists, real-world security skills, and even a surprise appearance by mentalist Lior Suchard or the illusive Professor Smoke! Later in the episode, Sherrod is joined by security researchers Anna Seitz and Rebecca Light to explore two evolving cyber threats. Anna breaks down the unprecedented collaboration between Russian state-affiliated threat actors Aqua Blizzard and Secret Blizzard, who are combining efforts to target Ukrainian military systems. Rebecca dives into the resurgence of DarkGate malware—this time delivered through a deceptive technique called ClickFix, which uses fake CAPTCHA-like prompts to trick users into activating malicious payloads. In this episode you’ll learn: What Kauzar V2 malware is and how it enables long-term remote access and data theft How Russian threat groups Aqua Blizzard and Secret Blizzard are collaborating Why DarkGate malware remains relevant thanks to its adaptability and evasion tactics Some questions we ask: Are Russian threat actors adopting cybercriminal tactics like initial access brokers? How does Kauzar V2 malware function, and why is it significant in this campaign? What is ClickFix, and how does it differ from typical malware delivery methods? Resources: View Henning Rauch on LinkedIn View Rebecca Light on LinkedIn View Anna Seitz on LinkedIn View Sherrod DeGrippo on LinkedIn 🕵️‍♀️ Register for the challenge (free!) https://detective.kusto.io/register 🎬 Official trailer featuring Lior Suchard https://youtu.be/sPmTX0ZrnE 🌐 Event homepage (info hub) https://detective.kusto.io Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show More Show Less
    32 mins