The CISO Signal: True Cybercrime Podcast

The Panama Papers | The Business of Hiding Wealth - The CISO Signal Episode 17

The Panama Papers | The Business of Hiding Wealth - The CISO Signal Episode 17 🎙 With Jeremy Ladner and guest co-host Michael Darling, CEO of Solstice Security For decades, the offshore financial system operated in near-total obscurity. Behind shell corporations, nominee directors, and offshore entities, fortunes moved quietly across borders through legal structures designed to conceal ownership, preserve privacy, and in some cases, avoid scrutiny altogether. Most people never saw the machinery. That was the point. Inside a law firm in Panama City called Mossack Fonseca, more than 200,000 offshore entities were managed on behalf of presidents, billionaires, celebrities, oligarchs, business leaders, and clients whose names rarely appeared on any public document. The system was built on one fundamental assumption: That secrecy would hold. Then someone broke in. Or perhaps someone on the inside decided the world needed to know. To this day, no one knows for certain. What is known is that 11.5 million confidential documents began flowing into the hands of journalists. Emails. Passports. Bank records. Corporate filings. Decades of hidden financial relationships suddenly exposed to public scrutiny. Prime Ministers resigned. Governments launched investigations. The world's most powerful people found themselves reading their own names in newspaper headlines. And a question still lingers years later: Was this one of the most important acts of whistleblowing in modern history? Or one of the most consequential data breaches ever recorded? In this episode of The CISO Signal | True Cybercrime Podcast, host Jeremy Ladner is joined by Michael Darling, CEO of Solstice Security and former Marine Corps cyber leader, to examine the mysterious leak that became known as the Panama Papers. Together they explore: • How the offshore financial system actually works • Why secrecy became one of the world's most valuable legal services • The cybersecurity failures that may have enabled the leak • Whether "John Doe" was a whistleblower, insider threat, or something else entirely • Why legality and ethics often occupy very different territory • What modern CISOs can learn from one of history's most consequential data exposures Because sometimes the most devastating cyber attacks don't lock your systems. They expose your secrets. 🎙 Guest CISO Co-Host Michael Darling CEO, Solstice Security Former Marine Corps Cyber Leader solsticellc.io Solstice Security helps organizations strengthen security programs, manage cyber risk, and build resilient security cultures capable of defending today's most complex digital environments. 🔎 Episode Topics • The Panama Papers • Mossack Fonseca • Offshore entities and shell companies • Insider threats vs whistleblowers • Data breaches and investigative journalism • Cybersecurity lessons from the world's largest financial leak • Legal secrecy, ethics, and accountability • How hidden systems become visible 🧩 About The CISO Signal True cybercrime storytelling with real CISO lessons. ▶️   [https://www.youtube.com/channel/UCmXu5LO2OwyFH1yQ02PD-Ew]https://www.youtube.com/channel/UCmXu5LO2OwyFH1yQ02PD-Ew / @thecisosignal  [https://www.youtube.com/channel/UCmXu5LO2OwyFH1yQ02PD-Ew] 💼   [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbWt0WnJxVjZpSC1Hdmp0cVVpQS1GOXFuVU5zUXxBQ3Jtc0tscTNnVGZ0dUV6UjNhOEtzXzhNcFJxSW1QaGN2ZTNCdlJTanJMelFsU2c3NmlXeGpXNm5iNVNWVmFwUW45RGpBT1VuZ2hnRklmdDlxYU80WjQ3SUlsRVJvRGhzaUR4Zzl5UWVMV3ZhN1A1VXlTNGpWNA&q=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fthe-ciso-signal&v=DbJz3u5RUMs]https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbWt0WnJxVjZpSC1Hdmp0cVVpQS1GOXFuVU5zUXxBQ3Jtc0tscTNnVGZ0dUV6UjNhOEtzXzhNcFJxSW1QaGN2ZTNCdlJTanJMelFsU2c3NmlXeGpXNm5iNVNWVmFwUW45RGpBT1VuZ2hnRklmdDlxYU80WjQ3SUlsRVJvRGhzaUR4Zzl5UWVMV3ZhN1A1VXlTNGpWNA&q=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fthe-ciso-signal&v=DbJz3u5RUMs / the-ciso-signal  [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbWt0WnJxVjZpSC1Hdmp0cVVpQS1GOXFuVU5zUXxBQ3Jtc0tscTNnVGZ0dUV6UjNhOEtzXzhNcFJxSW1QaGN2ZTNCdlJTanJMelFsU2c3NmlXeGpXNm5iNVNWVmFwUW45RGpBT1VuZ2hnRklmdDlxYU80WjQ3SUlsRVJvRGhzaUR4Zzl5UWVMV3ZhN1A1VXlTNGpWNA&q=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fthe-ciso-signal&v=DbJz3u5RUMs] 🌐 https://www.thecisosignal.com [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbUFHMUFWWlhYSk9aQmJWQ2JWVTZuaEJZRTg1Z3xBQ3Jtc0tsQU1CeWxYdHlOcUZ3bk1DaGxyd3hhUjYycl9TTUQ1X0NFZU55cGVaRjZzeHFGZjQ2M1dLVTl2VnhBU2VzaGM4cUVnV3p6N2pkUU1MWGhocmRVcUdJcE9ZQVUwN0VmbVZpdW5zN0tsczI1bGJ4UEI4Yw&q=https%3A%2F%2Fwww.thecisosignal.com%2F&v=DbJz3u5RUMs] 👥 Join the Conversation If an employee leaks confidential data because they believe they're exposing wrongdoing... Are they a whistleblower? Or an insider threat? Let us know in the comments. #CISOSignal [https://www.youtube.com/hashtag/cisosignal] #PanamaPapers [https://www.youtube.com/hashtag/panamapapers] #MossackFonseca [https://www.youtube.com/hashtag/mossackfonseca] #CyberSecurity [https://www.youtube.com/hashtag/cybersecurity] #DataBreach [https://www.youtube.com/hashtag/databreach] #Whistleblower [https://www.youtube.com/hashtag/whistleblower] #InsiderThreat [https://www.youtube.com/hashtag/insiderthreat] #OffshoreFinance [https://www.youtube.com/hashtag/offshorefinance] #CISO [https://www.youtube.com/hashtag/ciso] #TrueCybercrime [https://www.youtube.com/hashtag/truecybercrime]

The Change Healthcare Breach | Healthcare Hijacked

The Change Healthcare Breach | Healthcare Hijacked 🎙 With guest co-hosts Thomas Schwab and Scott Kisser   For most people, healthcare feels immediate. A doctor. A prescription. A moment of care. What they don’t see… is everything that has to happen before any of that is allowed to move. Claims must be approved. Payments must clear. Authorizations must pass through systems no patient has ever heard of. At the center of that system sat Change Healthcare. When it worked, no one noticed. In February 2024, it stopped. No zero-day. No advanced exploit. Just stolen credentials… and a remote access portal without multi-factor authentication. Attackers linked to ALPHV/BlackCat logged in. And from there, everything followed. They moved laterally. Exfiltrated sensitive data. And deployed ransomware inside one of the most critical financial pipelines in American healthcare.   Pharmacies could not process prescriptions. Providers could not submit claims. Payments froze. Care was not denied. But it was delayed. And delay, in healthcare, carries weight. What followed was not just a breach. It was a system-wide disruption that exposed a hard truth: Modern healthcare does not just depend on technology. It depends on a small number of systems working exactly as expected.   In this episode of The CISO Signal | True Cybercrime Podcast, host Jeremy Ladner is joined by Thomas Schwab of 1st Cyber Operations Group and Scott Kisser to examine how dependency becomes a weapon, why identity failures now carry systemic risk, and what leaders are forced to decide when every option comes with consequence.   Because in cybersecurity, the most dangerous attacks don’t break systems.   They use them exactly as designed. 🎙 Guest CISO Co-Host Scott Kisser: Chief Information Security Office @ SmithRx https://www.smithrx.com   🤝 Sponsor Expert Thomas Schwab: Managing Director, 1st Cyber Operations Group https://www.1stCyberOpsGroup.com   1st Cyber Operations Group helps organizations strengthen cyber resilience and incident response readiness, ensuring leaders can make confident decisions under pressure and recover quickly when disruption occurs.   🔎 Episode Topics • How a lack of MFA enabled one of the largest healthcare breaches in history • Why attackers target dependency and not endpoints • Identity as the true perimeter in modern enterprise environments • The operational consequences of ransomware in critical infrastructure • How leaders make decisions when every option carries risk   🧩 About The CISO Signal True cybercrime storytelling with real CISO lessons.   ▶️ https://www.youtube.com/@TheCISOSignal 💼 https://www.linkedin.com/company/the-ciso-signal 🌐 https://www.thecisosignal.com 👥 Join the Conversation   The CISO Signal Cybersecurity Leadership Forum https://www.linkedin.com/groups/17974008   #CISOSignal #ChangeHealthcare #CyberSecurity #Ransomware #HealthcareSecurity #CyberResilience #CISO #TrueCybercrime

The Equifax Breach | One of the Largest Data Exposures in History

The Equifax Breach | One of the Largest Data Exposures in History   🎙 With Jeremy Ladner and guest co-hosts Kavitha Mariappan and Mark Dorsi   For months, the warning was sitting in plain sight. A critical vulnerability. Publicly disclosed. Actively exploited. A patch was available. Inside one of the largest credit reporting agencies in the world, the system remained exposed. No zero-day. No advanced exploit chain. Just a missed update.   In May 2017, attackers began exploiting a known flaw in the Apache Struts framework. The vulnerability allowed remote code execution. Unauthenticated. Unrestricted. From the outside, it looked like routine traffic. Inside the network, it was something else. They accessed databases. Queried records. And began extracting one of the most sensitive datasets imaginable. Names. Social Security numbers. Birth dates. Addresses. The identity layer of nearly half the United States population.   For 76 days, the activity continued. No alarms. No interruption. Until it was too late. By the time Equifax disclosed the breach in September 2017, approximately 147 million individuals had been affected.   Executives resigned. Investigations launched. Congress intervened.   But the breach itself had already unfolded. Because this was not a story about attackers breaking through hardened defenses. It was a story about what happens when a known vulnerability remains unpatched inside a system that holds national-scale data.   In this episode of The CISO Signal | True Cybercrime Podcast, host Jeremy Ladner is joined by Kavitha Mariappan of Rubrik and Mark Dorsi, CISO at Netlify, to examine how a single missed control can cascade into systemic failure, why patch management must be operationalized not assumed, and what resilience actually means when prevention fails.   Because in cybersecurity, the most dangerous vulnerabilities are often the ones already documented. And already waiting.   🎙 Guest CISO Co-Host Mark Dorsi Chief Information Security Officer Netlify https://www.netlify.com   🤝 Sponsor Expert Kavitha Mariappan Chief Transformation Officer, Rubrik https://www.rubrik.com   Rubrik delivers cyber resilience by securing data across enterprise, cloud, and SaaS environments, enabling organizations to recover quickly from cyber incidents and maintain operational continuity.   🔎 Episode Topics • The Apache Struts vulnerability (CVE-2017-5638) and how it was exploited • Why patch management failures still drive catastrophic breaches • How attackers operated undetected inside Equifax systems for over two months • The difference between prevention failure and resilience failure • What security leaders must operationalize to avoid systemic exposure   🧩 About The CISO Signal True cybercrime storytelling with real CISO lessons. ▶️    / @thecisosignal   💼   / the-ciso-signal   🌐 https://www.thecisosignal.com 👥 Join the Conversation The CISO Signal Cybersecurity Leadership Forum   / 17974008     #CISOSignal #EquifaxBreach #CyberSecurity #DataBreach #PatchManagement #CyberResilience #CISO #TrueCybercrime

The Age of Agentic Attacks | The GTG-1002 Campaign and the Birth of AI-Directed Cyber Espionage Operations

The Age of Agentic Attacks The GTG-1002 Campaign and the Birth of AI-Directed Cyber Operations 🎙 With guest co-hosts Ev Kontsevoy, CEO and Co-founder of Teleport, and Marius Poskus Global VP of Cyber Security at Glow Financial Services For years, attackers have used artificial intelligence. It helped them write malware faster. Scan networks more efficiently. Refine phishing campaigns. Automate reconnaissance. But the humans were still in charge. They chose the targets. They wrote the scripts. They decided what happened next. That era has ended. The GTG-1002 campaign revealed something new on the cybersecurity battlefield: Agentic attackers. Not tools. Not assistants. Autonomous attackers capable of planning, testing, refining, and executing operational steps with minimal human direction. Armies of them. Once deployed, these systems do not pause. They iterate. And they move at a speed no human operator can match. In September 2025, security teams at Anthropic began noticing unusual activity inside Claude Code, the company’s powerful AI coding system designed to help engineers write software and automate development tasks. At first glance, the activity looked legitimate. Infrastructure validation. Authentication testing. Compliance reviews. But the sessions ran deeper than expected. Prompts chained together in recursive loops. Scripts generated, executed, refined, and redeployed in rapid succession. Reconnaissance disguised as routine engineering workflows. The system was not simply answering questions. It was executing operational sequences. Investigators eventually linked the activity to a threat cluster designated GTG-1002, touching organizations across technology, finance, manufacturing, and government environments. Human operators were still present. But they were no longer directing every move. Instead, the system generated scripts, mapped environments, refined exploit logic, and iterated through operational pathways at machine speed. Tasks that once required weeks compressed into cycles measured in minutes. Anthropic detected abnormal behavior patterns and suspended the accounts. On November 13, 2025, the company publicly disclosed what it described as the first known large-scale AI-orchestrated cyber espionage campaign. Attribution remains assessed rather than proven. Some analysts noted characteristics consistent with Chinese state-aligned operations. Chinese officials denied involvement. But the geopolitical debate may not be the most important part of this story. Because the real significance of GTG-1002 is not simply that attackers used AI. It is that agentic systems began managing parts of the operation themselves. In this episode of The CISO Signal | True Cybercrime Podcast, host Jeremy Ladner is joined by Ev Kontsevoy, Co-founder and CEO of Teleport, and Marius Poskus, Global VP of Cyber Security and CISO at Glow Financial Services, to examine how agentic AI systems can be manipulated into operational roles, why identity and infrastructure controls become critical in an agentic world, and what security leaders must understand when trusted automation begins directing attack workflows. Because once cyber operations move at machine speed, the rules change. And the age of agentic attacks has already begun. 🎙 Guest CISO Co-Hosts Marius Poskus Global Vice President of Cyber Security | CISO Glow Financial Services Limited https://www.glowservices.com [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa0NTckhXbVF5Q0FlVkhxdFhvRFhoLUlYQ0NZZ3xBQ3Jtc0trYUNaSW1JNmdPdFE5VkJKVkJ6cU1OT3JYX2RzUGZESWtmcVJFT2dXVW5PN01TcmxtN1Z3YllpWEc5T3lSS0FTckhaVnUxdEFsVWl3YWtKM0I0WV9wWHgtOGoyUHN6VUV1YTZJUHFTaGp0UEVxLTVGcw&q=https%3A%2F%2Fwww.glowservices.com%2F&v=ChBygrypxec] 🤝 Sponsor Expert Ev Kontsevoy Co-founder & CEO, Teleport https://goteleport.com [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbWJ6emh3X1F0RmhyUE9KN25NVDB4Q0xuUmlnUXxBQ3Jtc0trM2syRUF4Q1lnczlsOXhtTmVTdElNc25tZjFzVUg0MEUzUjlmTnQyQ0w2R1NKUzRvaTVRMTZlWXZLdE9BdmF0cnBCbnZoQi0yOTNzN3FpMEhxcTE0UDZwcUdiYnZYRXNmX0xJTldXS1RNMEVTU0hiaw&q=https%3A%2F%2Fgoteleport.com%2F&v=ChBygrypxec] Teleport is the AI Infrastructure Identity company, providing a unified identity layer that orchestrates identities for humans, machines, workloads, and AI agents while eliminating static credentials from infrastructure. 🔎 Episode Topics • The GTG-1002 AI-orchestrated espionage campaign • Claude Code and the rise of agentic attack workflows • How prompt manipulation can redirect autonomous AI systems • The difference between AI-assisted and AI-directed attacks • Why agentic systems compress attack timelines dramatically 🧩 About The CISO Signal True cybercrime storytelling with real CISO lessons. ▶️   [https://www.youtube.com/channel/UCmXu5LO2OwyFH1yQ02PD-Ew]https://www.youtube.com/channel/UCmXu5LO2OwyFH1yQ02PD-Ew / @thecisosignal  [https://www.youtube.com/channel/UCmXu5LO2OwyFH1yQ02PD-Ew] 💼   [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbkJuLUp4ZjBpUGpnQnNPUWlkbjlmRXNEUHVMUXxBQ3Jtc0tsRGFCd3ZaZS1fcmM3ZGd5SE9RYk1GcUhEb283RDNOM1Z6anFEOUw0WlhXVDBpaFNCMFFSeklES2V3R0tPWDFaUVY1WFppSUtzU2ttVGxCc0hoRDhzZDJ5VUtNM2JmZnBHZ1pXZV91SWtWblBkdTFlaw&q=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fthe-ciso-signal&v=ChBygrypxec]https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbkJuLUp4ZjBpUGpnQnNPUWlkbjlmRXNEUHVMUXxBQ3Jtc0tsRGFCd3ZaZS1fcmM3ZGd5SE9RYk1GcUhEb283RDNOM1Z6anFEOUw0WlhXVDBpaFNCMFFSeklES2V3R0tPWDFaUVY1WFppSUtzU2ttVGxCc0hoRDhzZDJ5VUtNM2JmZnBHZ1pXZV91SWtWblBkdTFlaw&q=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fthe-ciso-signal&v=ChBygrypxec / the-ciso-signal  [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbkJuLUp4ZjBpUGpnQnNPUWlkbjlmRXNEUHVMUXxBQ3Jtc0tsRGFCd3ZaZS1fcmM3ZGd5SE9RYk1GcUhEb283RDNOM1Z6anFEOUw0WlhXVDBpaFNCMFFSeklES2V3R0tPWDFaUVY1WFppSUtzU2ttVGxCc0hoRDhzZDJ5VUtNM2JmZnBHZ1pXZV91SWtWblBkdTFlaw&q=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fthe-ciso-signal&v=ChBygrypxec] 🌐 https://www.yo...

The AT&T Beijing Breach | Metadata Maps That Intelligence Services Want

The AT&T Beijing Breach | Metadata Maps That Intelligence Services Want With guest co-host John Carse, Field CISO at SquareX In 2024, attackers did not steal call recordings. They did not intercept encrypted text messages. They went after something quieter. Call detail records. The outlines of conversations. Phone numbers. Timestamps. Durations. Cell tower connections. Metadata that, on its own, seems technical. Harmless. Operational. But at telecom scale, metadata becomes something else. Between April and early June 2024, attackers accessed systems containing call and text metadata tied to approximately 86 million AT&T customers. The intrusion was traced to a third-party cloud environment associated with AT&T’s data operations. Investigators later pointed to compromised credentials discovered in a Snowflake environment after a phishing attack and infostealer infection inside a vendor ecosystem. No ransomware encryption. No service outage. No dramatic system shutdown. Instead, approximately $370,000 in cryptocurrency was reportedly paid in an effort to prevent public exposure of the dataset. Some analysts linked the activity to a cluster labeled UNC5537.  Other reporting mentioned data brokerage ecosystems such as ShinyHunters. Researchers, including those at Mandiant, urged caution on attribution, noting behavior consistent with criminal monetization rather than confirmed state-sponsored espionage. There is no public evidence that this dataset was used for intelligence operations. There is also no way to prove that it was not. Because telecom metadata does not just describe calls. It describes relationships. Who speaks to whom. How often. From where. Which towers were touched along the way. For criminals, that information enables SIM swapping, fraud, and targeted phishing. For nation states, it can illuminate social graphs, travel patterns, and networks of influence. In this episode of The CISO Signal | True Cybercrime Podcast, we examine how third-party access became the breach path, why metadata is often more strategically valuable than content, and what happens when operational data quietly becomes intelligence-grade material. This is not a story about encryption failing. It is a story about accumulation. 🎙 Guest Co-Host John Carse Field CISO, SquareX Three-time CISO and host of Be Fearless: The CISO Perspective 🔍 Episode Topics • What telecom metadata actually reveals beyond call content • Why large telecom providers are high-value intelligence targets • How third-party access and credential reuse created the breach path • Snowflake, vendor risk, and the anatomy of cloud miscalculation • The criminal data brokerage ecosystem and resale supply chains • Why metadata can be more operationally useful than call recordings • Inside the first 24 hours of executive response and board escalation • How security debt surfaces after a third-party breach • Why threat models must evolve when operational systems become intelligence repositories 🧊 The Aftershock On July 12, 2024, AT&T publicly acknowledged the breach, confirming that call and text content were not accessed. But the exposure shifted the conversation. Privacy experts noted that metadata can reveal business relationships, political activity, religious observance, romantic connections, and movement patterns, without ever recording a single word. Later reporting connected the broader Snowflake-related campaign to individuals including John Erin Binns and Connor Moucka, though attribution questions remain complex and evolving. What makes the AT&T breach different is not technical spectacle. It is the quiet reality that behavioral data, once accumulated at scale, becomes strategic. Every organization that logs user behavior now holds a map. And every map attracts attention. 🧩 About The CISO Signal True cybercrime storytelling with real CISO lessons. Subscribe so you never miss an investigation. 👉 @thecisosignal 👉 www.linkedin.com/company/the-ciso-signal 👉 www.theCISOsignal.com #CISOSignal #ATTBreach #Metadata #Snowflake #CyberEspionage #ThirdPartyRisk #TelecomSecurity #CISO #TrueCybercrime