S2E04: Ransom Acts of Flyness

Christopher and Nick kicked-off the latest episode with recent updates to the MITRE ATT&CK framework, including several techniques that they submitted. During the episode they discuss Outlook add-in persistence, renamed binaries, and the high-level increase in execution guardrails observed - all of which were added in the May update to ATT&CK. They then spoke about CARBANAK Week; including how FireEye found the CARBANAK source code and the process behind releasing it. They also give a few new details on FIN7's on-going operations, post-indictment to include the new front company and tactics used in their latest round of phishing. And based on viewer request they chat about the groups that deployed Robbinhood and other targeted ransomware (extortionware) initial infection vectors and lateral movement techniques. They broke down the possible offensive foreign counterintelligence operation (OFCO) that is the new APT34 "leaks" and separate the quality of the information from the stories around why it's being shared. They also quickly spoke on the latest in the trend of U.S. government indictments against Chinese individual operators and their experience leading the investigations behind many of these indictments and how they could be improved. And lastly, they give a threat research blog round-up; including research from FireEye, Chronicle, Kaspersky, and ESET.