Digital Shadows Shadow Talk-logo

Digital Shadows Shadow Talk

Technology Podcasts >

More Information


United States




Episode 26: Mythbusting Vulnerabilities and Exploits

Simon Hall and Richard Gold join Rafael Amado to discuss misconceptions around vulnerabilities and exploits, other techniques for gaining code execution, and how organizations can prioritize the patching of vulnerabilities.


Episode 25: Combating Security Debt, Ticketfly Defacement And Data Breach

In this edition of Shadow Talk, Richard Gold joins us to discuss the issue of security debt, a term used to refer to the accumulation of security risks over time, such as missed patches, misapplied configurations, mismanaged user accounts. Richard looks into how many of the attacks we see on a regular basis are actually a result of security risks that build up over time, and how security debt is a ticking time bomb for most organizations. In Part II, Harrison Van Riper covers the recent...


Episode 24: Seize and Desist: Changes in the cybercriminal underground

Rafael Amado and Michael Marriott discuss how the criminal underground has evolved since the demise of AlphaBay and Hansa. No single marketplace has managed to fill the AlphaBay-shaped gap left behind, at least among the English-speaking community. Existing sites such as Dream and Trade Route have failed to consolidate this empty space, hampered by a combination of poor communication by administrators and suspicion that these sites could be police honeypots like Hansa had been. Grab a copy...


Episode 23: L0pht 20 years on and combating cyber threats with military-style tactics

In today’s edition of Shadow talk, Dr Richard Gold joins us to discuss the return of the L0pht hackers. In 1998 the L0pht members delivered a cybersecurity hearing to the United States Senate, warning that any one person in their group could take down the Internet within 30 minutes. 20 years on, we look back on what has and hasn’t changed in the world of information security. In Part II, the team covers recent reporting on the use of military-style tactics such as war gaming and...


Episode 22: VPN Filter targeting Ukraine, TRITON malware, Roaming Mantis, VBScript & Spectre vulns

In this week’s Shadow Talk, the pod unpacks the reporting on VPN Filter, a malware affecting half a million network devices. Reports have suggested that the malware is being prepped to perform imminent large scale disruptive attacks against Ukrainian infrastructure. We also cover new research on the TRITON malware targeting industrial control and SCADA systems, as well as new techniques for the Roaming Mantis malware family. Finally, we bring you updates on vulnerabilities related to...


Episode 21: eFail vulns affecting Open PGP and S-MIME, and interbank payment systems risks

In this week’s episode of Shadow Talk, Digital Shadows’ Head of Security Engineering, Dr Richard Gold, joins the pod to explain the EFAIL vulnerability affecting Open PGP and S-MIME, as well as other flaws identified in encrypted messaging platforms. Dr Gold also outlines the the factors you should be considering to prioritize your patching. In part two, we look at the $15 million theft in Mexico and outline the risks facing interbank payment systems.


Episode 20: Winnti Umbrella, DarkHotel, Office 365 Vulnerability, and Olympus Dark Web Marketplaces

In this week’s episode Shadow Talk we look at the Winnti Umbrella group, asking what this means for organizations. We discuss vulnerabilities in Microsoft Office (CVE-2018-8174) and basestriker. And, finally, we outline the fall out surrounding the Olympus dark web marketplace.


Episode 19: Loki Bot, LoJack, GPON Vulnerabilities, and Blackrouter Ransomware

In this week’s episode Shadow Talk, it’s a vulnerability extravaganza. We cover malicious use of legitimate software, as APT28 attributed to hijacking LoJack and Blackrouter delivered via AnyDesk software. Vulnerabilities found (and exploited) in GPON home routers, and Loki Bot exploits two remote code execution vulnerabilities in Microsoft Office (CVE-2017-8570 and CVE-2018-0802).


Episode 18: Healthcare hacking, BGP hijacking, crypto jacking, and more

In this week’s episode of Shadow Talk, we cover the targeting of healthcare organizations by Orangeworm, BGP hijacking, vulnerabilities in MikroTik routers, DDoS market shutdowns, and the profitability of cryptocurrency mining.


Episode 17: Network Infrastructure Compromise, Magnitude EK Development, the Gold Galleon, & more

In this week’s episode of Shadow Talk, we cover Russia’s attempts to ban the social messaging app, and also read between the lines of the joint US and UK advisory on network infrastructure compromises by Kremlin-backed actors. We also outline new ransomware payloads incorporated into the Magnitude exploit kit and we bring you the latest news on vulnerabilities in the Drupal Platform and Cisco’s Webex software.


Episode 16: Cisco Smart Install Client flaw, Microsoft Outlook vuln, OpIcarus, RSAC, and more

This week’s Shadow Talk discusses a Cisco Smart Install Client flaw exploited in disruption attack, an information leak vulnerability discovered in Microsoft Outlook, details on OpIcarus and OpIsrael, Verizon DBIR, and why you still should be excited about the RSA Conference.


Episode 15: 1.5 Billion Files Exposed Through Misconfigured Services

Rafael Amado and Michael Marriott join this week’s Shadow Talk, taking a deep dive into our recent report “Too Much Information”. The research discovered over 1.5 billion files from a host of services, including Amazon S3 buckets, rsync, SMB, FTP, NAS drives, and misconfigured websites. To learn more, download the full report at


Episode 14: Panera Breach Lessons, WannaCry’s Re-emergence, Genesis Marketplace, and more

This week’s Shadow Talk discusses what the re-emergence of WannaCry, exposure of Aggregate IQ data, exposure of 1.5 billion files through misconfigured services, as well as lessons learned from the Panera breach, an emerging new criminal market, and much more.


Episode 13: Cambridge Analytica, Trickbot Updates, SamSam Surge Continues, And Dragonfly Attributed

This week’s Shadow Talk discusses what the Cambridge Analytica revelations mean for disinformation and personal privacy, updates to Trickbot, Zeus Panda and Remnit trojans, City of Atlanta suffers from ransomware attack, and Dragonfly campaign attribution to Russian Government.


Episode 12: Tax Fraud, AMD Vulnerability, Slingshot Targets Mikrotik Routers, And Hermes Ransomware

This week’s Shadow Talk outlines the latest techniques in tax return fraud, claimed vulnerabilities in AMD chips, Slingshot malware targeting Mikrotik routers, and Greenflash Sundown Exploit Kit delivering Hermes ransomware. Watch are webinar with the FBI on the latest ransomware threats here:


Episode 11: Memcached attacks, disinformation in ME, Spectre exploit, German gov network intrusion

Digital Shadows’ Research team discusses record DDoS attacks using Memcached servers, disinformation campaigns, a proof of concept exploit for the Spectre vulnerability, and new details of a historical network intrusion affecting the German government.


Episode 10: Memecached Server DDoS, Flash Vuln in Spam Campaign, Trustico Cert Issues, & Ransomware

The Digital Shadows research team provides an overview of the latest news this week, including CVE-2018-4878 that’s now being used in a spam campaign, 23,000 website certificates set to be revoked, Memecached Server Used for DDoS Reflection, and updates on SamSam and DataKeeper ransomware variants.


Episode 9: SWIFT Attacks, Business Email Compromise, Return Of Thedarkoverlord, And APT - 37

The Digital Shadows research team provides an overview of the latest news this week, including new SWIFT attacks, more Business Email Compromise activity, the return of extortionist “thedarkoverlord”, Sam Sam and Saturn ransomware variants, and new reporting on APT-37.


Episode 7: Operation Pzchao, Threats To The Winter Olympics, Infraud Forum Arrests, And More

The Digital Shadows Research team provides our analysis of the espionage-driven campaign Operation Pzchao, an Adobe zero-day vulnerability, malware in Winter Olympics spearphishing campaign, a WordPress denial of service vulnerability, and the takedown of the notorious “Infraud Forum”.


Episode 5: $530 Million Cyber Heist, DDoS Against Dutch Banks, And The Future Of Anonymous

The Digital Shadows Research team provides our analysis of the $530 million Coincheck cryptocurrency heist, recent DDoS attacks against Dutch financial services organizations, renewed OpCatalunya activity, updates on the Spectre and Meltdown flaws, and a potentially serious vulnerability affecting Cisco VPNs.