Ep. 59 - Russia's Cyber Arsenal Exposed: Defeating the FSB, GRU, and BlackCat Before They Strike

9 min · 20 mei 2026

Beschrijving

In the finale of our Russian intelligence and proxy threat series, SafeBreach engineer Adrian Culley joins host Tova Dvorin to turn five episodes of analysis into concrete, actionable defense. The threat is real — now here's how you stop it. Adrian and Tova walk through five critical mitigation layers your organization needs to implement today: hardening the human firewall through Continuous Automated Red Teaming (CART), enforcing adaptive MFA that Scattered Spider's session token theft and fatigue attacks can't bypass, locking down cloud and SaaS platforms — Salesforce, Snowflake, Okta — against FSB-linked privilege escalation, validating network segmentation against BlackCat ransomware's exact behavioral signatures, and disrupting intelligence sharing between GRU, SVR, FSB, and their criminal proxy networks by tracking IOC convergence in real time. The central thesis: don't guess, test. Every control your team thinks is working needs to be validated against real adversarial behavior — because if SafeBreach can simulate the bypass, so can they.

Reacties

Wees de eerste die een reactie plaatst

Meld je nu aan en word lid van de The Cyber Resilience Brief: A SafeBreach Podcast community!

Probeer gratis

Alle afleveringen

69 afleveringen

Ep. 69 - Slaying the Dragon: The West Finally Fights China's Cyber Machine at Machine Speed

The finale of the Dragon's Digital Shadow. After five episodes in the dark, host Tova Dvorin and co-host Adrian Culley turn to the light — how defenders are finally shrinking China's cyber shadow. Inside: why castle-and-moat is dead against Volt Typhoon, how agentic AI defense fights back at machine speed (Orange Cyber Defence clocks a ~70% drop in mean-time-to-remediate), the "digital NATO" seizing APT41's crypto and server farms, and prepping for the quantum cliff with post-quantum crypto (NIST FIPS 203/204/205) and CTEM. Subscribe to The Cyber Resilience Brief for more. #cybersecurity #infosec #CISO #ZeroTrust #VaultTyphoon #APT41 #AgenticAI #PostQuantum #CTEM #SafeBreach

22 jul 20269 min

Ep. 68 - Why OWASP's AIVSS Scores Agentic AI at Maximum Risk

OWASP just shipped AIVSS — an entirely new vulnerability scoring methodology built for autonomous AI agents, where a compromised orchestrator can score a perfect 10. Host Tova Dvorin and Adrian break down the "amplification principle": why a 2.1 CVSS finding becomes a 7.1 in the wrong agent, how persistent memory and broad tool access expand every blast radius, and what EchoLeak-style attacks already mean for real deployments. Plus where adversarial exposure validation and SafeBreach's agentic AI coverage fit in.

15 jul 202625 min

Ep. 67 - The Axis of Disruption: APT41, Volt Typhoon, and the China-Russia Cyber Alliance

For years, Beijing and Moscow kept their cyber tools apart. Not anymore. Hosts Tova Dvorin and Adrian Culley unpack the "no limits" partnership gone operational — the ESA/Galileo satellite attack where a Chinese Volt Typhoon cell opened the door and Russian AcidRain wiper code did the damage. We cover: APT41 running Russian exploit kits, Salt Typhoon pre-positioned in US telecom, China's 72-hour zero-day disclosure law feeding vulnerabilities to Russia, and the CVSS-10 Grimbolt flaw. Why continuous validation and a CTEM program are your best defense against the axis of disruption. #cybersecurity #infosec #CISO #VoltTyphoon #SaltTyphoon #APT41 #CriticalInfrastructure #CTEM #BAS

8 jul 202614 min

Ep. 66 - Poisoned Pipelines: TeamPCP and the FBI Flash on Weaponized Dev Tools

A criminal crew with APT-grade patience is trojanizing the very tools defenders trust. Host Tova Dvorin sits down with Adrian Culley to break down FBI FLASH-20260702-01 (coordinated with CISA) on TeamPCP — the group compromising Trivy, KICS, LiteLLM, and the Telnyx SDK to sit inside CI/CD pipelines. Inside: the CanisterWorm and SANDCLOCK credential stealers, the self-replicating "Mini Shai-Hulud" worm across npm and PyPI, npm account takeovers via expired recovery domains, and five concrete defenses — starting with searching your GitHub org for "tpcp-docs" right now. Read more on our blog: https://www.safebreach.com/blog/teampcp-supply-chain-attacks-fbi-flash-alert-20260702-01-safebreach-coverage/ [https://www.safebreach.com/blog/teampcp-supply-chain-attacks-fbi-flash-alert-20260702-01-safebreach-coverage/] #cybersecurity #infosec #CISO #supplychainsecurity #TeamPCP #CICD #BAS #SafeBreach

5 jul 202617 min

Ep. 65 - "Months, Not Years": The Five Eyes AI Warning and Your Security Program

On June 22, 2026, the heads of all six Five Eyes cyber agencies — GCHQ, CISA, the NSA, ASD, the Canadian Centre, and New Zealand's GCSB — signed a rare joint statement: AI has rewritten the cyber risk timeline, and it's months, not years. Host Tova Dvorin and offensive security expert Adrian Culley unpack why AI is collapsing the window between vulnerability and exploit, why "having controls" isn't the same as proven controls, and why legacy systems are now strategic liabilities for the board, not the IT team. A clear-eyed look at validation, assumed breach, and what CISOs should do Monday morning. Read the full Five Eyes statement on the CISA website: https://www.cisa.gov/news-events/news/five-eyes-cyber-security-agencies-statement [https://www.cisa.gov/news-events/news/five-eyes-cyber-security-agencies-statement] #cybersecurity #infosec #CISO #FiveEyes #CISA #NSA #GCHQ #adversarialexposurevalidation #cyberresilience #SafeBreach

1 jul 202618 min

Ep. 59 - Russia's Cyber Arsenal Exposed: Defeating the FSB, GRU, and BlackCat Before They Strike

Beschrijving

Reacties

Probeer 14 dagen gratis

Alle afleveringen