#cybersecurity #infosec #CISO #ransomware #SafePay #StopRansomware #VPNSecurity #CTEM

More on this crew in Ep. 27, The Evolution of ShinyHunters: https://www.safebreach.com/podcast/the-evolution-of-shinyhunters/
And on Jaguar Land Rover in Ep. 34: https://www.safebreach.com/podcast/inside-the-jaguar-land-rover-cyberattack/

#cybersecurity #infosec #CISO #ShinyHunters #ScatteredSpider #FBI #SaaSSecurity #BAS

#cybersecurity #infosec #CISO #EUAIAct #AIsecurity #AIgovernance #adversarialtesting #NIS2

Host Tova Dvorin and offensive security expert Adrian Culley separate what's confirmed from what's hype:

• What's actually new here — the autonomy and the speed, not the individual techniques
• The dwell-time gap: hours to break in, a week to notice
• The guardrail asymmetry — Hugging Face's commercial AI models refused to analyze the attack, forcing a fallback to open-weight GLM 5.2 on their own hardware. The attacker had no guardrails. The defenders were locked out of their tools.
• Why the ML supply chain — datasets, loaders, package proxies — is now a first-class attack surface
• What the EU AI Act's August milestones mean for regulated industries
• Three questions every CISO should be able to answer in writing today

Read more in our blog: https://www.safebreach.com/blog/openai-hugging-face-ai-breach-security-testing/

Meet us at Black Hat: book a meeting now: https://www.safebreach.com/black-hat-usa-2026

#cybersecurity #infosec #CISO #detectionengineering #SafeBreach #Anvilogic #BAS #CTEM #SOC

#cybersecurity #infosec #CISO #ZeroTrust #VaultTyphoon #APT41 #AgenticAI #PostQuantum #CTEM #SafeBreach

#cybersecurity #infosec #CISO #FiveEyes #CISA #NSA #GCHQ #adversarialexposurevalidation #cyberresilience #SafeBreach

Adrian and Tova walk through five critical mitigation layers your organization needs to implement today: hardening the human firewall through Continuous Automated Red Teaming (CART), enforcing adaptive MFA that Scattered Spider's session token theft and fatigue attacks can't bypass, locking down cloud and SaaS platforms — Salesforce, Snowflake, Okta — against FSB-linked privilege escalation, validating network segmentation against BlackCat ransomware's exact behavioral signatures, and disrupting intelligence sharing between GRU, SVR, FSB, and their criminal proxy networks by tracking IOC convergence in real time.

The central thesis: don't guess, test. Every control your team thinks is working needs to be validated against real adversarial behavior — because if SafeBreach can simulate the bypass, so can they.

In this episode, Tova Dvorin and Adrian Culley expose the group that breaks every rule of traditional espionage: how the MSS built an elite hacker force by letting them run their own criminal enterprise on the side, how APT 41 turned the video gaming industry into a personal ATM worth millions, and why China's 2026 cybersecurity law has given these groups a 48-hour head start on every new exploit.

They break down all five pillars of CTEM — scoping, discovery, prioritization, validation, and mobilization — and explain exactly why most organizations stall before operationalizing any of them. You'll learn why nearly 40% of actionable exposures aren't CVEs at all, why CVSS scores without context are dangerous, and how an LLM-driven engine can turn 10,000 vulnerabilities into 12 surgical priorities — validated against your actual environment.

Whether you're a CISO trying to prove security ROI, a security engineer drowning in alerts, or a practitioner exploring CTEM frameworks, this episode delivers the blueprint for moving from theoretical risk to proven, validated exposure management.

Topics covered:

• What CTEM actually means and why the detect-and-patch model is broken
• How AI-powered scoping keeps pace with a dynamic attack surface
• Why toxic combinations of misconfigs and identity risks outrank many high-CVSS CVEs
• Adversarial Exposure Validation (AEV): testing controls, not just checking boxes
• How Helm bridges the IT/security communication gap to accelerate remediation

Learn more about how SafeBreach supports CTEM: https://www.safebreach.com/solution-brief/ctem-by-safebreach/

In Part 2 of our deep dive into Chinese cyber operations, Tova Dvorin and Adrian Culley unpack the “Typhoon” threat groups—Volt Typhoon, Salt Typhoon, and Flax Typhoon—and how they’re quietly reshaping modern cyber warfare.

This isn’t about stealing data.

It’s about staying hidden, pre-positioning, and being ready to strike.

In this episode, you’ll learn:

• How hackers are living inside networks for years without detection
• What “living off the land” really means—and why security tools miss it
• How compromised home routers became a global proxy network
• Why telecom systems—and even lawful surveillance tools—were targeted
• The real strategy behind China’s cyber operations: preparing for future conflict
  

From power grids to personal devices, this episode reveals how the battlefield has already expanded—and why most organizations still aren’t ready.

In this episode of The Cyber Resilience Brief, host Tova Dvorin and cybersecurity expert Adrian Culley break down the CRA in plain terms—and explain why the shift to continuous security validation is unavoidable.

You’ll learn:

• What the CRA means by “products with digital elements (PDEs)”—and why almost everyone is in scope
• The real obligations manufacturers, importers, and distributors must meet
• How CRA connects to DORA and TIBER—and why this is just the beginning of a broader regulatory wave
• Why point-in-time testing is officially obsolete
• How BAS, CART, and Adversarial Exposure Validation (AEV) enable continuous compliance and real resilience

With enforcement deadlines approaching and significant penalties on the horizon, the message is clear: If your security testing isn’t continuous, it’s not CRA-ready.

Whether you're selling into the EU or building digital products anywhere in the world, this episode will help you understand what’s coming—and how to stay ahead of it.

Listen now to learn how to shift from reactive security to continuous cyber resilience.

Read more about EUCRA in our blog: https://www.safebreach.com/blog/eu-cyber-resilience-act-readiness/

In this premiere episode of our series on Chinese threat actors, we uncover how China transformed from noisy, smash-and-grab hackers into the world’s most sophisticated cyber power—one focused not just on espionage, but on pre-positioning inside critical infrastructure.

Through a chilling real-world scenario, we explore a new kind of threat: digital landmines—subtle, invisible changes inside power grids, telecommunications networks, and industrial systems that can be triggered at any time.

You’ll learn:

• How China’s cyber strategy evolved from IP theft to operational control
• The role of the PLA’s Strategic Support Force and the “Three Dominances”
• Why recent campaigns like Volt Typhoon signal a shift to long-term persistence
• How new Chinese cybersecurity laws are reshaping the global threat landscape
• What “living off the land” means—and why it’s so hard to detect
  

This isn’t about ransomware or data breaches. It’s about access, leverage, and timing.

Because in today’s cyber battlefield, the most dangerous attack… is the one that hasn’t happened yet.

What many organizations mistakenly treat as a single “Russian threat” is actually a complex ecosystem of competing intelligence agencies—each with distinct goals, tactics, and operational philosophies.

• The GRU (military intelligence) acts as the sledgehammer, driving destructive campaigns like NotPetya and operating groups such as Fancy Bear and Sandworm.
• The SVR (foreign intelligence service) is the scalpel, specializing in stealth, long-term espionage, and persistent access through groups like Cozy Bear.
• The FSB (domestic security) plays a unique role—bridging the gap between nation-state operations and the cybercriminal underground, recruiting and leveraging hackers to extend its reach.
  

We also explore how FSB-linked actors use advanced social engineering and persona development, how their tactics compare to groups like Scattered Spider, and why this convergence of espionage and cybercrime poses a growing risk to organizations worldwide.

Understanding these distinctions is critical for accurate threat attribution, effective defense strategies, and cyber resilience planning.

🎧 In this episode, you’ll learn:

• The key differences between GRU, SVR, and FSB cyber operations
• How Russian intelligence agencies compete—and why that matters
• The role of cybercriminal groups in nation-state campaigns
• Emerging risks from the blending of high-volume attacks and targeted espionage
  

🔐 Whether you’re a CISO, security practitioner, or cyber threat intelligence professional, this episode will help you better understand—and defend against—modern Russian cyber threats.

Host Tova Dvorin and offensive security expert Adrian Culley analyze the latest Iranian cyber threat activity, including groups like Handala (Void Manticore) and MuddyWater (Mango Sandstorm), and how their tactics are evolving.

You’ll learn how attackers are using malwareless techniques like Microsoft Intune device wipes, blockchain-based command-and-control via Ethereum, and Telegram-driven infrastructure to bypass traditional defenses. We also explore how IRGC-linked operations are targeting critical infrastructure, including water and power systems.

Finally, we cover what this means for defenders, including why Continuous Threat Exposure Management (CTEM), Breach and Attack Simulation (BAS), and Continuous Automated Red Teaming (CART) are now critical for modern security teams.

This episode delivers a practical breakdown of the 2026 cyber threat landscape and how organizations can better prepare.

In this episode of the Cyber Resilience Brief, Tova Dvorin and Adrian break down President Trump’s 2026 Cyber Strategy—and why it signals a massive shift from reactive defense to proactive, offensive cybersecurity.

What does this mean for CISOs, security leaders, and the private sector?

We unpack the strategy’s most critical pillars, including:

• Why “checklist compliance” is officially dead
• The rise of offensive cybersecurity and adversary disruption
• How AI and agentic systems are reshaping cyber defense
• The growing mandate for Continuous Threat Exposure Management (CTEM)
• What Zero Trust and post-quantum cryptography really require in practice
• Why critical infrastructure and supply chains are now front and center
• How this strategy pulls the boardroom into cybersecurity accountability

This isn’t regulation—it’s a call to action. And for organizations that fail to validate their defenses continuously, the risks have never been higher.

If you’re a CISO, security practitioner, or executive, this episode will help you understand what’s coming—and how to prepare.

Read the full blog here: https://www.safebreach.com/blog/the-2026-white-house-cyber-strategy/

In this final episode of our Iran cyber series, we explore how Iranian APT groups are evolving — leveraging AI, targeting supply chains, and bypassing the billion-dollar security stacks built to stop them.

Hosts Tova Dvorin and Adrian Culley break down the emerging threats shaping 2026, including:

• Autonomous malware powered by localized LLMs

• “Skeleton key” attacks targeting MSPs and IT providers

• Adversarial AI collaboration between Iran, Russia, and North Korea

• Why identity trust is collapsing in the age of deepfakes

• The role of continuous automated red teaming in modern cyber defense

The perimeter is gone.

Your weakest vendor may now be your biggest risk.

Learn how security leaders can adapt before the next generation of attacks arrives.

In this episode of The Cyber Resilience Brief, Tova Dvorin and offensive engineer Adrian Cully break down the cyber escalation that followed Operation Rising Lion — what some analysts now describe as Iran’s 12 days of cyber war.

As missiles struck Iranian strategic targets, coordinated hacktivist groups like Cyber Avengers and Handala launched psychological operations, mass SMS spoofing campaigns, and attacks targeting operational technology (OT) systems — including Unitronics PLCs used in water and industrial facilities worldwide.

The impact quickly spread beyond the Middle East. U.S. water utilities were targeted, supply chain vulnerabilities were exploited, and retaliatory cyberattacks struck financial infrastructure.

In this episode, we explore:

• How hybrid warfare is collapsing the gap between physical and cyber attacks
• The rise of state-linked hacktivist groups
• Why OT and critical infrastructure are increasingly global targets
• How adversaries exploit the IT/OT bridge to reach industrial systems
• What security leaders must learn from the June 2025 escalation
  

Cyber conflict is no longer a secondary theater — it’s where escalation begins.

In this episode of the Cyber Resilience Brief, we break down how Iranian state-sponsored threat actors are using AI-powered phishing, MFA fatigue attacks, credential harvesting, and hack-and-leak operations to target journalists, political campaigns, academics, and enterprise executives.

You’ll learn:

• How APT42 builds months-long AI-generated relationships before deploying malware
• How deepfake voice notes are being used to bypass verification
• How compromised email accounts fuel election interference and information warfare
• Why MFA fatigue and session token abuse remain critical enterprise risks
• How adversarial exposure validation (AEV) and continuous automated red teaming help security teams detect post-phishing lateral movement
  

As AI becomes agentic and scalable, social engineering attacks are evolving from mass phishing to precision psychological operations.

This isn’t just cyber espionage. It’s AI-driven influence warfare.

Stay safe. Stay resilient.

From intellectual property theft and aerospace breaches to DNS tunneling, living-off-the-land techniques, cloud-based command-and-control (C2), and wiper malware, we unpack how these groups evolved into stealthy, high-end cyber espionage operators.

You’ll also learn how adversarial exposure validation (AEV), breach and attack simulation (BAS), and continuous automated red teaming (CART) help security leaders validate defenses against real-world nation-state threats.

If you're a CISO, security architect, threat intelligence analyst, or cyber resilience leader, this episode delivers actionable insight into defending against advanced persistent threats (APTs).

Subscribe for expert analysis on cyber resilience, exposure management, and defending against state-sponsored cyber attacks.

We examine Scattered Spider, LAPSUS$, and Shiny Hunters, and how social engineering, SIM swapping, MFA bypass, and AI-driven voice spoofing are breaching Fortune 100 companies — without zero-days.

Learn how access brokers commoditize breaches, why help desks are prime targets, and what this shift means for CISOs and security teams.

If you’re only testing firewalls, you’re missing the real risk.

Listen now to understand how modern ransomware campaigns succeed — and what your security program must test to stay ahead.

First detected in late December 2025, DynoWiper has been linked to attacks on Polish wind farms and combined heat and power (CHP) plants, signaling a shift away from financially motivated ransomware toward pure disruption of critical infrastructure.

The episode explores:

• How DynoWiper operates without command-and-control infrastructure
• Why attribution points to Russian state-linked actors, including FSB Centre 16 (Static Tundra) and GRU Unit 7445 (Sandworm)
• Why traditional, point-in-time security testing fails against internally staged attacks
• How Continuous Threat Exposure Management (CTEM) and Adversarial Exposure Validation (AEV) help organizations identify and close exposure gaps before destructive payloads are deployed
  

While activity has been observed in Poland, the tactics discussed are highly relevant to energy and critical infrastructure operators worldwide.

Cyber resilience isn’t a one-time achievement — it’s a continuous process of validation.

The discussion highlights the difference between state-sponsored cyber activity and financially motivated cybercrime—and why defenders must rethink traditional assumptions. The episode closes with a look at why continuous threat exposure management is critical for staying ahead of evolving cyber threats.

Topics include: Russian cyber threats, proxy actors, attribution challenges, and modern cybersecurity strategy.

In Iran’s Cyber Shadow War: IRGC, MOIS, and the Battle for Control, we continue our deep-dive into Iran’s cyber operations by exposing the internal power struggle driving its most dangerous digital attacks.

Iran does not operate a single, unified cyber command. Instead, two rival organizations—the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS)—run competing cyber missions with very different goals, tactics, and tradecraft. One favors loud, destructive attacks designed to intimidate and disrupt. The other specializes in quiet cyber espionage, long-term access, and intelligence collection.

In this episode, we break down how this rivalry fuels Iranian state-sponsored cyber activity, why both agencies often target the same victims, and how their competition creates real risk for Western governments, critical infrastructure, energy, finance, and private enterprises. We also explore Iran’s use of contractor-based hacking groups, providing speed, innovation, and plausible deniability—while making attribution and defense significantly harder.

For CISOs and security teams, this episode explains what Iran’s divided cyber command means for detection, dwell time, and continuous adversarial exposure validation—and why defenders must be prepared for both stealthy intrusions and sudden, destructive attacks.

🎧 In this episode:
• Iran’s cyber shadow war explained
• IRGC vs. MOIS: rivalry, missions, and tactics
• State-sponsored hacking and contractor ecosystems
• Cyber espionage vs. cyber disruption
• What Iran’s internal competition means for defenders

This is Episode 2 of a 6-part series unpacking how Iran builds, deploys, and evolves its cyber power—and what organizations must do to stay ahead.

In this episode of Cyber Resilience Brief, SafeBreach Senior Sales Engineer Adrian Culley breaks down who Emennet Pasargad really is, how they operate through shell companies and phishing campaigns, and why their tactics pose both cybersecurity and geopolitical risks.

You’ll learn how this Iranian nation-state group abuses email, malware delivery, and command-and-control infrastructure — and why traditional security awareness training isn’t enough. More importantly, we explore how adversary emulation, continuous control validation, and real-world attack simulation can help organizations identify gaps, harden defenses, and stop IRGC-linked attacks before they cause damage.

Key topics include:

• Who Emennet Pasargad is and their ties to the IRGC

• Common tactics, techniques, and procedures (TTPs), including phishing and lateral movement

• The difference between cyber simulation vs. adversary emulation

• How organizations can proactively defend against Iranian cyber threats

• Why continuous cyber resilience testing is now a regulatory and business imperative

For more information on protective measures against Iranian threat actors, check out our SafeBreach blog post.

Join hosts Tova Dvorin and Adrian Culley as they connect the dots between Breach and Attack Simulation (BAS), Adversarial Exposure Validation (AEV), and Continuous Automated Red Teaming (CART) — revealing how these validation layers work together to create a unified framework for cyber resilience.

Discover how organizations can:

• Continuously validate their security controls against real-world threats

• Prioritize remediation with threat-driven exposure validation

• Operationalize resilience with automated red teaming

• Transform cyber awareness into measurable resilience all year long

This episode goes beyond compliance and awareness training — it’s a blueprint for security teams to prove and improve their defenses, optimize spend, and keep their organizations resilient against evolving threats.

We break down:

• How the Jaguar Land Rover breach unfolded

• Why third-party and fourth-party risk is now first-party risk

• The rise of coordinated cybercrime collectives

• Why “trust but validate” must be the new supply chain mantra

• Actionable steps to strengthen resilience and visibility across vendors

• What the JLR incident means for national security, global operations, and the future of supply chain cybersecurity

Whether you're a CISO, resilience leader, threat analyst, or supply chain security professional, this episode delivers essential insights into one of the most significant cyberattacks in UK history.

Together, they break down:

• What Breach and Attack Simulation (BAS) actually means in practice
• How Advanced Persistent Threats (APTs) operate — and why persistence matters
• What Adversarial Exposure Validation (AEV) is (and what it isn’t)
• How CTEM (Continuous Threat Exposure Management) connects these concepts
• The difference between attack simulation and adversary emulation

This episode focuses on plain-language explanations, real-world context, and why these terms exist in the first place.

If you’ve ever heard these acronyms used interchangeably — or wanted a grounded explanation you can actually reuse — this episode is for you.

SafeBreach offensive security engineer Adrian Culley joins host Tova Dvorin to unpack:

• How BianLian evolved from ransomware to exfiltration-based extortion.

• The TTPs behind their attacks, from compromised RDP credentials to stealthy “living off the land” techniques.

• Why traditional defenses struggle to keep pace with their adaptive methods.

• How organizations can counter them with Breach and Attack Simulation (BAS), Adversarial Exposure Validation (AEV), and Continuous Automated Red Teaming (CART) to test resilience across the full attack chain.

If you want to understand how adversaries like BianLian stay ahead—and how you can flip the advantage back to defenders—this episode is for you.

💡 Special Note: In honor of Cybersecurity Awareness Month, we’re releasing two episodes each week throughout October 2025—so be sure to subscribe and catch them all!

SafeBreach experts Jonathan Tillman and Shachaf Raviv share how parsers transform raw logs into actionable insights, enabling organizations to scale detection engineering, customize security validation, and integrate seamlessly across SIEMs and security controls. ---

This episode is also a teaser for our upcoming webinar, “Elevate Detection Engineering at Scale”, where we’ll showcase the brand-new Parsers UI, walk through practical use cases, and answer your questions live.

🔗 Register here: safebreach.com/elevate-detection-engineering-at-scale

We break down Dragonfly’s latest tactics, including:

• Exploiting unpatched vulnerabilities in legacy systems

• Deploying custom malware (SinfulNOC) for long-term persistence

• Conducting reconnaissance inside victim networks

Most importantly, we explore how Breach and Attack Simulation (BAS), Adversary Exposure Validation (AEV), and Continuous Red Teaming (CART) can help organizations defend against Dragonfly’s TTPs (tactics, techniques, and procedures) and proactively test defenses against real-world threats.

Whether you’re a CISO, SOC analyst, or security engineer, this episode offers practical, intelligence-led insights to strengthen your cyber resilience strategy.

Tova and Adrian break down the advisory’s latest findings, including expanded targeting of government and IT sectors, advanced persistence mechanisms, and new insights into how attackers leverage VMware environments to maintain full, covert control of compromised systems.

The conversation underscores a central message: these tactics aren’t static. BRICKSTORM is evolving, and organizations must evolve their defenses too. That means shifting from occasional checks to continuous validation, embracing Breach and Attack Simulation (BAS), and operationalizing threat exposure management to match the pace of modern threat actors.

• Key updates from the CISA/NSA/CCCS advisory on BRICKSTORM

• Evolving persistence and communication-hiding techniques

• How attackers continue to exploit VMware and web-facing infrastructure

• Why high-value organizations remain prime targets

• The growing need for continuous, proactive security validation

• How BAS helps validate Zero Trust and uncover blind spots before adversaries do

For more information on SafeBreach's BRICKSTORM coverage, click here to read our blog. 

We explore:

• Why resilience — both toughness and rapid recovery — is now the apex of cybersecurity

• How DORA is pushing continuous testing and validation on live production systems, not just lab environments

• What it means to have a “cyber canary in the coal mine” for early breach detection

• The global ripple effect, with similar legislation already emerging in the UK and beyond

Whether or not your business is based in the EU, DORA is reshaping expectations for operational resilience. Tune in for actionable insights on evolving from incident response to instant anticipation, staying ahead of attackers, and meeting tomorrow’s regulatory demands today. Check out Our DORA whitepaper for more information on how SafeBreach helps you meet DORA compliance.

We explore:

1. How NIS2 builds on DORA and connects to the upcoming Cyber Resilience Act
2. Key sectors impacted, from critical infrastructure to digital providers
3. Executive accountability, supply chain security, and audit requirements
4. Why Breach and Attack Simulation (BAS) is a powerful enabler for NIS2 compliance and continuous cyber resilience

Whether you operate inside the EU or engage with regulated industries abroad, NIS2 compliance is becoming a business-critical issue. Tune in to understand the directive’s global impact—and how to turn regulation into a resilience advantage. For more information on NIS2, check out our blog: NIS2: A Blueprint for Cyber Resilience

Learn how AEV helps organizations move beyond endless vulnerability lists to validate exposures that real adversaries exploit, prioritize based on active threat intelligence, and shift from reactive defense to continuous cyber readiness.

Featuring insights on SafeBreach’s attack library, MITRE ATT&CK mapping, and why “patch and proceed is dead,” this episode reveals how AEV empowers security teams to focus on risk-driven validation that truly strengthens cyber resilience.

Backed by a rapidly evolving, financially motivated threat group, Interlock ransomware isn’t just encrypting systems—it’s stealing sensitive data first, then holding victims hostage with a powerful double-extortion model. From major healthcare systems in the U.S. to public schools in Scotland, Interlock is making an outsized impact across sectors.

We unpack:

• Why Interlock is not just another ransomware variant

• The social engineering tactics like “ClickFix” that are fooling even savvy users

• How the dark web’s affiliate model is fueling this operation

• The chilling tactics used to bypass defenses and disable recovery

• What every organization must do today to test, validate, and close security gaps

And yes—we’re revisiting that childhood wisdom with a modern twist: don’t accept code from strangers. Whether it’s a fake Captcha or a suspicious command prompt, one careless click can be all it takes.

Discover how attackers are “living off the blind spot” by exploiting critical infrastructure gaps in VPNs, VMware vCenter servers, and ESXi hosts — areas traditional security tools can’t see. Adrian breaks down their use of Go-based malware, delayed activation, and a genius offline credential theft technique that clones virtual machines to exfiltrate data undetected.

The episode also explores the strategic implications of this new evolution in supply chain attacks, where adversaries steal today to weaponize tomorrow, and how organizations can defend themselves through proactive security testing, Breach and Attack Simulation (BAS), and Continuous Automated Red Teaming (CART).

Key topics:

• UNC5221’s long-term espionage and data exfiltration tactics

• How attackers evade EDR and traditional defenses

• Why BrickStorm represents the “next level” in nation-state cyber operations

• How BAS and CART expose and close blind spots before attackers do

We dive deep into the limitations of point-in-time manual penetration testing and why modern security teams and CISOs need to shift toward proactive risk management and continuous threat exposure management (CTEM). Adrian explains how tools like SafeBreach’s Propagate go beyond simulating known threats to dynamically generate new attack paths—including zero-day exploits—using AI-driven logic, validating your attack surface in real-time.

This episode covers:

• The future of penetration testing in cybersecurity

• How BAS and CART deliver true cyber resilience

• Why automated red teaming is critical for critical live production systems

• How attack path validation and blast radius analysis are redefining security strategies

Whether you're a CISO, security leader, or red teamer, this episode will help you understand why continuous security validation is no longer optional—and why legacy penetration testing is no longer enough.

Tune in and find out how to hack yourself—before someone else does.

In the first episode of our Iran threat series, we trace the pivotal moments that shaped Iran’s modern cyber doctrine — from the Stuxnet attack on Natanz to the rise of destructive wiper malware like Shamoon and today’s era of stealthy, persistent access operations.

Host Tova Dvorin is joined by Adrian Culley, Offensive Cyber Security Engineer at SafeBreach, to unpack how Iran turned humiliation into capability, embraced a contractor-based APT model, and weaponized cyber operations as a tool of retaliation and asymmetric warfare.

You’ll learn:

• Why Stuxnet was Iran’s cyber “Big Bang” moment

• How Shamoon marked the birth of destructive, message-driven attacks

• The evolution from noisy disruption to long-term persistence

• Why Iranian APTs target financial services, energy, and supply chains

• What today’s geopolitical instability means for Western enterprises and critical infrastructure

• How CTEM, BAS, and Continuous Automated Red Teaming (CART) help organizations detect and stop Iranian threat actors before they strike

If you’re a CISO, security leader, or threat intelligence professional, this episode explains why guessing is no longer an option — and why continuous adversarial exposure validation is now essential to defending against Iranian cyber operations.

Listeners will learn:

• How state-sponsored threat groups are targeting multiple industries—including finance, healthcare, retail, education, manufacturing, and energy.

• The malware techniques involved, from malicious loaders to reassembled encoded chunks.

• The critical role of Indicators of Compromise (IOCs), YARA rules, and Sigma rules in proactive defense.

• Why upgrading Ivanti EPMM, treating MDM as critical infrastructure, and deploying phishing-resistant MFA are the top recommendations from CISA.

Finally, we share how SafeBreach Labs has already built the attack simulation—available within three hours of CISA’s release—so partners and customers can test, detect, and remediate this threat immediately.

🔒 Stay ahead of attackers. Learn how to protect your organization against one of today’s most pressing Ivanti EPMM threats.

Salt Typhoon has been quietly infiltrating critical infrastructure worldwide using outdated routers, weak credentials, and “living off the land” techniques like PowerShell, WMI, and scheduled tasks—often remaining undetected for years. This episode explores:

• Key TTPs & IOCs called out in the advisory, including router exploits, credential abuse, and stealthy exfiltration techniques.

• Mitigation strategies every organization should implement now: patching, MFA enforcement, segmentation, and proactive monitoring.

• How Breach and Attack Simulation (BAS), Adversarial Exposure Validation (AEV), and Continuous Automated Red Teaming (CART) can help organizations proactively defend against advanced, long-term adversaries.

Whether you’re a CISO, security practitioner, or resilience leader, this episode provides actionable intelligence to strengthen your defenses against one of today’s most persistent and dangerous cyber threats.

From abusing Windows RPC for devastating DoS and DDoS attacks, to exploiting Google Gemini through nothing more than a calendar invite, to hijacking RPC endpoints before privileged services even launch — these exploits highlight how creativity, not just technical skill, can redefine the threat landscape.

Tune in for live-demo insights, real-world attack scenarios, and actionable takeaways you can use today to strengthen your defenses.

. . .  Curious about the research we reveal in this episode?  Learn more in our blogs: Invitation is All You Need: Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite You Snooze You Lose: RPC-Racer Winning RPC Endpoints Against Services Win-DoS Epidemic: A Crash Course in Abusing RPC for Win-DoS & Win-DDoS

Discover how organizations can move from tabletop exercises to quantifiable, data-driven resilience metrics, bridging the gap between security plans and operational reality. Learn how continuous validation transforms cyber defense from a cost center into a measurable return on security investment (ROSI) — and why resilience should be treated as a living capability that evolves alongside adversaries.

Learn how their “living off the land” techniques bypass traditional defenses, what indicators of compromise to hunt for, and how adversary emulation can proactively expose your gaps.

Packed with real-world threat intelligence and practical defense strategies, this conversation is a must-listen for CISOs, security teams, and critical infrastructure operators seeking to build resilience against nation-state threats.

In this episode of the Cyber Resilience Brief, co-hosts Tova Dvorin and Adrian Culley explore how Scattered Spider operates and what makes them so dangerous. We break down their favorite attack methods, including SIM swapping, MFA push bombing, and IT helpdesk impersonation — and reveal why “they don’t break in, they log in.”

Listeners will learn:

• The top TTPs Scattered Spider uses across the kill chain

• Why identity and access management is their prime target

• How companies can harden defenses against human-centric threats

• Why continuous security validation is critical to resilience

If you’re a CISO, security leader, or anyone focused on protecting people, processes, and data, this episode is a must-listen.

Learn how Breach and Attack Simulation (BAS) can safely test IT/OT boundaries, validate segmentation controls, and transform compliance efforts from “check-the-box” to “prove-the-box.” Discover how SafeBreach empowers critical infrastructure organizations to achieve resilient, safe, and measurable security efficacy without disrupting operations.

They break down how CART extends beyond traditional red teaming and breach simulation, combining automation and intelligence to deliver 24/7, real-time attack validation. Learn how CART helps organizations:

• Continuously test and optimize their security controls

• Detect misconfigurations and vulnerabilities before adversaries do

• Strengthen overall cyber resilience and operational readiness

Whether you’re a CISO, SOC leader, or security engineer, this conversation offers practical insights into how CART and AEV can work together to create a truly continuous defense strategy. Read more about CART on our blog. 

You’ll learn:

• How The Com evolved from Lapsus$ chaos into a professionalized extortion machine

• Why help desks—not firewalls—are their favorite initial access vector

• Their signature TTPs: vishing, MFA bypass, living-off-the-land, cloud data theft, and ephemeral IOCs

• How adversarial exposure validation (AEV), BAS, CART, and phishing-resistant MFA (FIDO2/WebAuthn) shut them down

• Practical resilience steps you can implement today

A must-listen for CISOs, security leaders, and anyone tracking modern identity-based cyber threats. Stay safe. Stay safe with SafeBreach.

In this episode of The Cyber Resilience Brief, host Tova Dvorin and SafeBreach Senior Sales Engineer Adrian Culley explore the evolution of offensive security — from early hacking and penetration testing to modern Breach and Attack Simulation (BAS) and continuous adversarial exposure validation.

You’ll learn why point-in-time testing is no longer enough, how BAS enables safe testing of live production environments, and what CISOs need to build measurable, continuously validated cyber resilience.

In this eye-opening episode, host Tova Dvorin sits down with Tomer Bar, VP of Security Research at SafeBreach, and Shelly Zucker, Product Manager at SafeBreach, to unravel the alarming ways AI is transforming the cyber threat landscape—and what it means for defenders.

The conversation kicks off with jaw-dropping findings from Palo Alto Networks: AI-powered ransomware attacks that complete from breach to data theft in just 25 minutes, slashing attack timelines by 100x, and fueling forecasts of $57 billion in damages in 2025 alone. Pair that with an 890% surge in enterprise AI app usage, and it's clear: the attack surface has never been more exposed.

But this episode doesn’t stop at the headlines. Tomer and Shelly reveal how adversaries are leveraging generative AI to lower the bar for cybercrime, creating tailored malware with a simple prompt—no coding expertise required. From spyware that logs keystrokes and steals files to ransomware that evades half of today’s security tools on first try, they break down how traditional defenses are falling dangerously behind.

More importantly, you’ll hear how SafeBreach is turning the tables by building AI-generated malware scenarios—carefully crafted with the same techniques attackers use—so organizations can safely test if their defenses can withstand this new wave of threats.

Plus, get a tantalizing sneak peek at upcoming research that crosses the line from cyberspace to the physical world, showing how AI could manipulate smart homes with a single indirect prompt.

If you’re in cybersecurity, risk, or IT, this is an essential listen to understand why your current detection stack might not be enough—and how to prepare for the AI-enabled future.

Discover:

• How AI-enhanced vishing is bypassing even multi-factor authentication (MFA).

• Why identity and OAuth tokens are now the new security perimeter.

• How supply-chain exploitation is redefining enterprise risk.

• What organizations can do using Breach and Attack Simulation (BAS), Continuous Automated Red Teaming (CART), and Adversarial Exposure Validation (AEV) to stay resilient.

This is more than a cybercrime story — it’s a blueprint for defending against the next generation of trust-based attacks.

Adrian explains how AEV models third-party attack paths and validates resilience across shared dependencies, while Tova highlights the widening IT/OT gap and why Continuous Automated Red Teaming (CART) is essential to maintaining ongoing protection.

Tune in to learn how to move beyond “point-in-time” testing and keep your organization’s defenses resilient in a constantly evolving ecosystem.

From misconfigurations and overly-permissioned identities to insider threats, social engineering, and zero-days, adversaries are exploiting far more than just published vulnerabilities. Discover why an assumed breach mindset and proactive adversarial simulation are critical for building resilience—long after your systems are fully patched.

Tune in to learn:

• Why 100% patch compliance still won’t stop ransomware or data exfiltration

• The hidden risks in identity, configuration, and insider threats

• How “assumed compromise” thinking shifts organizations from reactive to proactive security

• Practical lessons from years of breach and attack simulation across Fortune 500 environments

If you’re a CISO, security leader, or practitioner navigating today’s threat landscape, this episode is a must-listen.

We discuss:

• What makes this vulnerability so dangerous (hint: there's no patch for SharePoint 2016 yet)

• Why Microsoft is advising customers to assume breach

• How SafeBreach Labs responded within 24 hours with new BAS coverage

• Specific indicators of compromise (IoCs) and mitigation advice

• Why this attack demands urgent attention from security teams and CISOs alike

Whether you're a SafeBreach customer or just trying to stay ahead of emerging threats, this episode delivers the critical insights you need — fast.

🔗 For more information on today's CVE, check out our post on the SafeBreach blog. 

As geopolitical tensions escalate—especially involving China and Iran—their cyber activity isn’t slowing down. It’s converging. In this episode of The Cyber Resilience Brief, Tova Dvorin and Adrian Culley unpack CRINK: an intelligence-community term rarely used in the commercial market, but critical for defenders to understand now.

CRINK isn’t a formal alliance so much as it’s a shared playbook. Chinese pre-positioning, Russian disruption, Iranian sabotage, and North Korean cybercrime combine into a full-spectrum, asymmetric threat targeting critical infrastructure and enterprises.

If your security strategy relies on alerts, assumptions, or patching alone, you’re already behind.

This episode explains why—and how to move from guessing to proving your defenses work.

In this episode of The Cyber Resilience Brief, host Tova Dvorin and cybersecurity strategist Adrian Culley explore how escalating global tensions are redefining modern warfare and what that means for CISOs and security teams today.

We break down how nation-state cyber threats from Russia, China, Iran, and North Korea are operating in a state of persistent engagement — planting access, stealing data, disrupting critical infrastructure, and preparing for future conflict.

Learn why reactive security is no longer enough and how Breach and Attack Simulation (BAS), Continuous Automated Red Teaming (CART), and Adversarial Exposure Validation (AEV) help organizations defend against advanced persistent threats.

The Shadow War isn’t coming — it’s already here.

As geopolitical tensions rise and Russia’s hybrid cyber warfare intensifies, Scattered Spider’s public “declaration of war” marks a chilling shift: from quiet ransomware operations to open intimidation of Western governments and Fortune 500 companies.

Tova and Adrian unpack how this group combines social engineering, identity theft, and psychological warfare to paralyze organizations — and how companies can fight back using Breach and Attack Simulation (BAS) and Continuous Automated Red Teaming (CART).  Don't forget to check out our earlier episodes as well on Scattered Spider (Ep. 15) and on Adventures in the Dark Web (Ep. 17) for more context for this red-hot topic. 

We also published blogs on Scattered Spider and on what it's like to talk to hackers on the Dark Web.

Adrian and Tova break down:

• Why awareness ≠ readiness — and the critical role of validation

• How Breach and Attack Simulation (BAS) turns cyber hygiene into measurable resilience

• The alarming reality: 30% of security controls fail the first time they’re tested

• Why ransomware remains more dangerous than ever

• How organizations can continuously test defenses without risking downtime

Whether you’re a CISO, security practitioner, or business leader, this episode uncovers why continuous, automated validation is the only way to prove your defenses work against real-world threats.

Stay tuned for upcoming episodes on Adversary Exposure Validation (AEV), ransomware trends, and the EU Cyber Resilience Act

We explore how these pressures risk crippling CISA’s ability to issue timely, actionable threat alerts—and what that means for CISOs trying to protect their networks today. Beyond CISA, we highlight the domestic agencies and international partners stepping up to fill the gap, from the FBI to the Five Eyes alliance.

This episode is a must-listen for security leaders navigating a moment where US cyber resilience hangs in the balance. Disclaimer: SafeBreach, The Cyber Resilience Brief, and hosts Tova and Adrian do not hold any particular views regarding the US government shutdown. This analysis is provided solely to inform cybersecurity leaders with objective insights.

Discover:

• How cybercrime groups like Conti operate more like corporations than chaos-driven collectives.

• Why the psychology of hacking—speed, opportunism, and human exploitation—matters as much as technology.

• How penetration testing and adversary simulation can help security teams counter evolving tactics.

• Why AI is supercharging cybercrime—and how defenders must adapt to keep pace.

Whether you’re a CISO, red team leader, or security practitioner, this episode will reshape how you think about threat intelligence, human risk, and proactive defense.

In this episode of The Cyber Resilience Brief, host Tova Dvorin is joined by Adrian Culley, SafeBreach’s offensive security expert for Europe and the UK, to break down the TIBER-EU framework and why it’s reshaping how financial institutions and critical infrastructure organizations approach cyber defense.

Originally developed by the European Central Bank, TIBER-EU (Threat Intelligence-Based Ethical Red Teaming) goes far beyond traditional penetration testing. It simulates real-world adversaries, real attack paths, and real operational pressure — aligning tightly with modern regulations such as DORA, NIS2, and the EU Cyber Resilience Act.

In this episode, we cover:

• What TIBER-EU is and why regulators are embracing intelligence-led red teaming

• How DORA and TIBER-EU work together to enforce continuous operational resilience

• Why point-in-time penetration tests are no longer enough

• The evolving role of Breach & Attack Simulation (BAS) in preparing for TIBER-EU assessments

• How Adversary Exposure Validation (AEV) reveals real blast radius and business impact

• Why Continuous Automated Red Teaming (CART) is emerging as the “always-on” complement to regulator-mandated tests

Whether you’re a CISO, security architect, red teamer, or risk leader, this episode explains how Europe’s regulatory frameworks are pushing the industry toward continuous, adversary-centric security validation — and why organizations outside the EU should be paying close attention.

🎙️ If cyber resilience is a journey — TIBER-EU defines the terrain.