The Darkside of TheMoon

Breaking Silos in Threat Intelligence

In this episode of the Malspace Podcast, I sit down with Cris Kittner, Senior Manager of Threat Research Engineering at Proofpoint, for a deep and personal conversation about her remarkable journey through the world of cyber threat intelligence. From growing up in Brazil during times of political unrest to working her way into the U.S. defense sector, Cris shares how her passion for understanding violent extremism and security evolved into a career at the forefront of cybersecurity — including over a decade at Mandiant, Google Cloud, and now Proofpoint. Together, we explore: * How curiosity and persistence shaped Cris’s unconventional path into cyber intelligence * Lessons from working with legendary figures in APT research at Mandiant * The growing overlap between nation-state and e-crime operations — and why breaking down silos is vital for modern threat analysis * Her leadership philosophy around psychological safety, mentorship, and preventing burnout * How human connection — and even friendship bracelets — can strengthen cybersecurity teams It’s an inspiring conversation about adaptability, empathy, and the evolving landscape of threat intelligence — told through the lens of one of the field’s most passionate voices.

Multiple Actors, One Breach - Rethinking Threat Models in 2025

In this episode, Julien sits down with Chi En (Ashley) Shen, a distinguished threat researcher at Cisco Talos. Ashley shares her fascinating journey from hacking forums in Taiwan to leading threat intelligence at global giants like Google and Mandiant. Together, they explore the rising trend of compartmentalized cyberattacks, the evolving role of Initial Access Brokers (IABs), and Ashley’s proposed enhancements to the Diamond Model. The episode also dives into her work promoting diversity in cybersecurity through initiatives like HITCON Girls and Raclette. Links: * Ashley on Bluesky [https://bsky.app/profile/ashl3y-shen.bsky.social] * Ashley’s podcast Hacks Between Us (我們之間的駭) [https://open.firstory.me/user/hacksbetweenus] * Blog article: Redefining IABs: Impacts of compartmentalization on threat tracking and modeling [https://blog.talosintelligence.com/redefining-initial-access-brokers/] * Diamond Model [https://apps.dtic.mil/sti/tr/pdf/ADA586960.pdf] * HITCON Girls [https://hitcon.org] * Raclette Switzerland [https://defcon.ch] (Cybersecurity Community) * Ashley’s upcoming talk at Black Hat USA [https://www.blackhat.com/us-25/briefings/schedule/#hacking-the-status-quo-tales-from-leading-women-in-cybersecurity-47489]

Operation Crimson Palace

On this episode, Mark Parsons, Senior Threat Hunter at Sophos MDR, discusses his team's investigation into Operation Crimson Palace, which uncovered Chinese state-sponsored cyberespionage targeting a Southeast Asian government. Mark explains how they identified three distinct clusters of activity using advanced malware and evasion techniques, including previously unreported tools like CCoreDoor and PocoProxy. Show Notes * Operation Crimson Palace: Sophos threat hunting unveils multiple clusters of Chinese state-sponsored activity targeting Southeast Asian government [https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-sophos-threat-hunting-unveils-multiple-clusters-of-chinese-state-sponsored-activity-targeting-southeast-asia/] * Surfacing a Hydra: Unveiling a Multi-Headed Chinese State-Sponsored Campaign Against a Foreign Government [https://www.blackhat.com/us-24/briefings/schedule/index.html#surfacing-a-hydra-unveiling-a-multi-headed-chinese-state-sponsored-campaign-against-a-foreign-government-39319] * Crimson Palace returns: New Tools, Tactics, and Targets [https://news.sophos.com/en-us/2024/09/10/crimson-palace-new-tools-tactics-targets/]

Doppelgänger

In this episode of Malspace, Pierre Delcher, Head of Cyber Threat Research at HarfangLab, discusses the alarming rise of Russian disinformation campaigns targeting European and US media. We explore how cloned websites of outlets like Der Spiegel, Le Monde, and The Washington Post are being used to spread fake news, manipulating public opinion. Pierre sheds light on the techniques behind these operations and the role European companies play in keeping them online. Show Notes * EU Disinfo Lab on Doppelgänger [https://www.disinfo.eu/doppelganger] * Qurium - Under the hood of a Doppelgänger [https://www.qurium.org/alerts/under-the-hood-of-a-doppelganger/] * Correctiv - How Russia uses EU companies for its propaganda [https://correctiv.org/en/fact-checking-en/2024/07/22/inside-doppelganger-how-russia-uses-eu-companies-for-its-propaganda/] * BayLfV report (German) [https://www.verfassungsschutz.bayern.de/ueberuns/medien/pressemitteilungen/desinformationskampagne-doppelgaenger/] * Mid-year Doppelgänger information operations in Europe and the US [https://harfanglab.io/insidethelab/doppelganger-operations-europe-us/]

The Darkside of TheMoon

On this episode, Chris Formosa and Steve Rudd of Lumen’s Black Lotus Labs share their research on a multi-year campaign targeting end-of-life (EoL) small home/small office (SOHO) routers and IoT devices, associated with an updated version of TheMoon malware. TheMoon, which emerged in 2014, has been operating quietly, while growing to over 40,000 bots from 88 countries in January and February of 2024. Show Notes * Darkside of TheMoon Blog Article [https://blog.lumen.com/the-darkside-of-themoon/] * Giving a Face to the Malware Proxy Service Faceless [https://krebsonsecurity.com/2023/04/giving-a-face-to-the-malware-proxy-service-faceless/] * IOCs on Github [https://github.com/blacklotuslabs/IOCs/blob/main/Moon_Faceless_IOCs.txt] * BSides Las Vegas Talk [https://www.youtube.com/live/ZY26xH9nim8?si=yTsNURAMLaZkmyPY&t=32042]