11. Responding to a Cyberattack

The Dark Dive

#Tech #Business #News #Tech News #Searchlight Cyber

35:12

Sidhu Moose Wala explodes onto the Canadian music scene. His sound is a fusion of two worlds - hip-hop with the poetic language of rural Punjab, where he is from. After years of struggle he’s making it. But with the spotlight comes a dark side. As his fame grows, so do the threats. "We will kill you." Presented by broadcaster and DJ Bobby Friction and investigative journalist Ishleen Kaur. Season 8 of World of Secrets, The Killing Call, is a BBC Eye investigation for the BBC World Service. Archive audio credits: Lovepreet Waraich, Malwa TV, BritAsia TV, MPHONE Canteeni Mandeer, GK Digital, Thakur Media, Capital Extra, Famous Punjab TV, ModernSings, Dheeth.jeha, RealRohitBlogs, Mirror Now, India Today. Here’s a link to the BBC Eye two-part documentary films, which we recommend you watch after listening to this podcast: https://bit.ly/thekillingcall If you are in the UK, you can watch on iPlayer: https://www.bbc.co.uk/programmes/m002f18y…

about a year ago 47:04

MP3•Episode home

Caleb and Luke share war stories, talk about what progress has been made in the cybersecurity industry (and areas of improvement!), and each give their own take on how organizations can best prepare for the fateful day that their network is breached.

Along the way we discuss how incident response has changed over the years, where threat intelligence and - in particular - dark web intelligence on cybercriminals fits into the incident response process, and why a eight-year-old Ted Talk now seems remarkably prescient.

The Ted Talk discussed at the 39 minute mark is "Where is Cybercrime Really Coming From?": https://www.ted.com/talks/caleb_barlow_where_is_cybercrime_really_coming_from?

Want to find out more or have a suggestion for future podcast episodes?

Email: thedarkdive@slcyber.io

Website: www.slcyber.io

LinkedIn: www.linkedin.com/company/searchlight-cyber

X: www.twitter.com/SLCyberSec

Weekly newsletter: www.slcyber.io/beacon/

18 episodes

11. Responding to a Cyberattack

The Dark Dive

published about a year ago

MP3•Episode home

The Ted Talk discussed at the 39 minute mark is "Where is Cybercrime Really Coming From?": https://www.ted.com/talks/caleb_barlow_where_is_cybercrime_really_coming_from?

Want to find out more or have a suggestion for future podcast episodes?

Email: thedarkdive@slcyber.io

Website: www.slcyber.io

LinkedIn: www.linkedin.com/company/searchlight-cyber

X: www.twitter.com/SLCyberSec

Weekly newsletter: www.slcyber.io/beacon/

18 episodes

#Tech #Business #News #Tech News #Searchlight Cyber

All episodes

The Dark Dive

1
17. Hacktivism 46:43

4 weeks ago46:43

46:43

This month's episode of The Dark Dive tackles the thorny issue of hacktivism: hackers that are driven by ideological - rather than financial - motivations. Threat intelligence experts Luke Donovan and Vlad join the podcast to discuss how hacktivism has evolved from the "digital utopia" era, to the anti-establishment antics of Anonymous, to the state-aligned activities we observe today. Along the way, we cover the defining tenets of modern day hacktivist groups, including their targets, tactics, and use of Telegram to promote their attacks and causes. We also discuss how hacktivism has escalated from acts of protest and defacement to more sophisticated attacks, including the use of ransomware. Further reading: - "Hacking in the Name Of", article on the history of hacktivism authored by Diana Selck-Paulsson in The Hacker News (discussed at 04:30): https://thehackernews.com/expert-insights/2025/02/hacking-in-name-of.html - "Encrypted Communication Apps: From Telegram to EncroChat" our podcast episode on Telegram and other messaging apps (discussed at 25:27): https://slcyber.io/podcasts/encrypted-communication-apps-from-telegram-to-encrochat/ - "The Rise of the Hacktivist Supergroup", previously published threat intelligence from Vlad on hacktivist group team-ups (discussed at 36:45): https://techinformed.com/the-rise-of-the-hacktivist-supergroup/ Want to find out more or have a suggestion for future podcast episodes? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber…

The Dark Dive

1
16. Attack Surface Management 101 48:06

11 weeks ago48:06

48:06

This bumper episode of The Dark Dive features no fewer than four co-founders, as the CEO and CTO of Searchlight Cyber (Ben Jones and Gareth Owenson) are joined by their counterparts from the Attack Surface Management company Assetnote (Michael Gianarakis and Shubham Shah). Together, we discuss the background of Assetnote and origins of its founders in the offensive security and bug bounty world, the rationale behind the Searchlight Cyber's recent acquisition of Assetnote, and the fundamentals of Attack Surface Management (ASM). We take a deep dive into the tenets of Attack Surface Management, including viewing ASM as a process rather than a technology, nuances in the ASM market, and the role of vulnerability research. Further reading: Press release on Searchlight Cyber's acquisition of Assetnote (discussed 12:00 - 21:34): https://slcyber.io/press/searchlight-cyber-acquires-assetnote/ Visit the Assetnote Security Research Center for the most recent vulnerability research from Assetnote (discussed 35:32 - 42:33): https://slcyber.io/assetnote-security-research-center/ Assetnote's ServiceNow vulnerability research (discussed 37:40 - 38.35): https://www.assetnote.io/resources/research/chaining-three-bugs-to-access-all-your-servicenow-data Assetnote's Citrix Bleed vulnerability research (discussed 41.06 - 42.33): https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966 Visit this page more information on the Assetnote Attack Surface Management platform: https://slcyber.io/dark-web-security-products/attack-surface-management-tool/ For more insights from the Assetnote co-founders on Attack Surface Management check out their own podcast, Surfacing Security: https://youtu.be/LEcFfC6OrYk?feature=shared Want to find out more or have a suggestion for future podcast episodes? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/…

The Dark Dive

1
15. Dark Web Threats Against Individuals 48:41

14 weeks ago48:41

48:41

In this episode of The Dark Dive we look at how specific individuals - Executives, VIPs, and high-net worths - are targeted by cybercriminals and on the dark web. Ahead of the launch of their Digital Footprint Review service, NCC Group's Matt Hull joins us to discuss the threats facing individuals - including social engineering and Business Email Compromise (BEC) - and how these can be mitigated by auditing your personal online presence and monitoring the dark web. Meanwhile Searchlight Cyber's Ben Jones explains the threats facing individuals from the dark web - from doxxing to physical threats - and shares his own experiences as an executive of being the target of CEO Fraud. Visit www.nccgroup.com for more information on the NCC Group and resources for on securing your digital footprint. Marsh McLennan research report mentioned 15.38: https://slcyber.io/whitepapers-reports/the-correlation-between-dark-web-exposure-and-cybersecurity-risk/ . Want to find out more or have a suggestion for future podcast episodes? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/…

The Dark Dive

1
14. The Dark Web in 2025 54:11

17 weeks ago54:11

54:11

In the first episode back of the year we've assembled two of Searchlight Cyber's threat intelligence experts to give their take on what we can expect from the dark web in 2025. Louise Ferrett and Luke Donovan say what they think 2024 will be remembered for, choose one news story that might have gone under the radar, and (are forced into) making a prediction for a year ahead. Along the way we discuss the fragmentation of the cybercrime landscape, how law enforcement upped their takedown game last year, and the priorities for cybersecurity professionals in 2025. You can download Searchlight Cyber's report "Same Game, New Players: Ransomware in 2025" (discussed from 21.45) here: https://slcyber.io/whitepapers-reports/same-game-new-players-ransomware-in-2025/ Want to find out more or have a suggestion for future podcast episodes? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/…

The Dark Dive

1
13. Infostealers on the Dark Web 55:21

26 weeks ago55:21

55:21

In this episode of The Dark Dive we're looking at a particular type of malware called Information Stealers or "infostealers". This malware is designed to (you guessed it!) steal information from infected devices. Threat Intelligence Engineers Rob Fitzsimons and Joe Honey discuss exactly how infostealers work, why this malware has become so prolific, and where it can be spotted on the dark web. During the episode we cover the differences between different strains of infostealer, recent law enforcement action that has succeeded in taking infostealers offline, and how organizations should be protecting themselves. You can download Searchlight Cyber's infostealer report (discussed 26.53 - 29.40) here: https://slcyber.io/whitepapers-reports/infostealer-identified/ And find more information on Operation Magnus (discussed 38.18 - 47.06) here: https://www.operation-magnus.com/ Want to find out more or have a suggestion for future podcast episodes? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/…

The Dark Dive

1
12. Encrypted Communication Apps: From Telegram to EncroChat 41:36

29 weeks ago41:36

41:36

This episode of The Dark Dive focuses on encrypted communication apps, including Telegram, Tox, Signal, Session, and Jabber. While not strictly speaking part of the "dark web", these apps are used by the same criminals to perpetrate many of the same crimes. We start with the "mainstream", taking a close look at the popular messaging app Telegram in the wake of the arrest of its CEO in August 2024. Vlad, a threat intelligence analyst at Searchlight Cyber, then takes us through the alternative apps that criminals may migrate to, should the privacy changes to Telegram make in an inhospitable environment for cybercrime. We then take a look at the other end of the spectrum with the example of EncroChat - an enrcypted communication network that required a special device sold on subscription. Dave Osler, Head of Product at Searchlight Cyber, talks us through the type of crimes that took place on this "high end" encrypted network and the international law enforcement operation that brought the whole thing crashing down. Further reading: The arrest of Telegram's CEO: https://www.reuters.com/world/europe/telegram-messaging-app-ceo-pavel-durov-arrested-france-tf1-tv-says-2024-08-24/ Privacy changes on Telegram: https://thehackernews.com/2024/09/telegram-agrees-to-share-user-data-with.html Vice's reporting around the takedown of EncroChat: https://www.vice.com/en/article/how-police-took-over-encrochat-hacked/ Europol and Eurojust's figures around EncroChat: https://www.europol.europa.eu/media-press/newsroom/news/dismantling-encrypted-criminal-encrochat-communications-leads-to-over-6-500-arrests-and-close-to-eur-900-million-seized The Ghost app takedown: https://www.europol.europa.eu/media-press/newsroom/news/global-coalition-takes-down-new-criminal-communication-platform Want to find out more or have a suggestion for future podcast episodes? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/…

The Dark Dive

1
11. Responding to a Cyberattack 47:04

34 weeks ago47:04

47:04

In this episode of The Dark Dive we're joined by incident response heavyweight Caleb Barlow (former head of IBM X-Force and now CEO of Cyberbit) and Searchlight Cyber's Head of Threat Intelligence Luke Donovan to discuss the best ways to respond to a cyberattack. Caleb and Luke share war stories, talk about what progress has been made in the cybersecurity industry (and areas of improvement!), and each give their own take on how organizations can best prepare for the fateful day that their network is breached. Along the way we discuss how incident response has changed over the years, where threat intelligence and - in particular - dark web intelligence on cybercriminals fits into the incident response process, and why a eight-year-old Ted Talk now seems remarkably prescient. The Ted Talk discussed at the 39 minute mark is "Where is Cybercrime Really Coming From?": https://www.ted.com/talks/caleb_barlow_where_is_cybercrime_really_coming_from? Want to find out more or have a suggestion for future podcast episodes? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/…

The Dark Dive

1
10. The Correlation Between Dark Web Exposure and Cybersecurity Risk 48:11

38 weeks ago48:11

48:11

Can you quantify the risk the dark web poses to organizations? In this episode of the podcast, we discuss a landmark study that has tried to do just that. We're joined by Scott Stransky, Managing Director and Head of the Marsh McLennan Cyber Risk Intelligence Center and Ben Jones, CEO of Searchlight Cyber and Scott unravel the findings of the report "The Correlation Between Dark Web Exposure and Cybersecurity Risk". We discuss how cyber insurance loss data can be used to calculate the impact of dark web exposure on an organization's cybersecurity risk. We look at how different types of dark web exposure individually impact the chance of a cyberattack. Then we explore how multiple factors combined increase the chances of a cybersecurity incident. Download the research report discussed in the podcast: https://slcyber.io/whitepapers-reports/the-correlation-between-dark-web-exposure-and-cybersecurity-risk/ Apply for a Dark Web Risk Report on your organization: https://slcyber.io/dark-web-risk-report-find-out-your-dark-web-exposure/ Want to find out more or have a suggestion for future podcast episodes? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/…

The Dark Dive

1
9. The Qilin Ransomware Group vs The National Health Service 53:41

46 weeks ago53:41

53:41

This episode of the podcast looks at the Qilin ransomware group's attack on the UK's National Health Service. Or - more accurately - their ransomware attack against Synnovis, a third party pathology testing organization for a number of London hospitals. Guests Louise Ferrett and Joe Honey go through time timeline of the attack - discussing the group's history, whether to trust claims that the attack was politically motivated, and the reasoning behind leaking 400gb of stolen patient data. This episode also looks at the state of ransomware half a year into 2024 - including where some of the biggest groups from last year have disappeared off to, new groups that security professionals should be aware of, and the diversification of ransomware landscape as more groups emerge than ever before. Want to find out more or have a suggestion for future podcast episodes? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/…

The Dark Dive

1
8. Dark Web Data Leaks 54:04

51 weeks ago54:04

54:04

This episode of The Dark Dive takes a listener's question as a jumping off point to talk about the topic of data leaked on the dark web. Guests Luke Donovan and Adam Wilson discuss noteworthy data leaks from over the years - impacting organizations such as 23andMe, Ashley Madison, and Yahoo! - and bring things right up to the present day (June 2024) by looking at the data leaks on BreachForums impacting Ticketmaster and Santander customers. We look at how data such as credit card information, addresses, passwords, usernames, and even biometric information is stolen in the first place, how it is packaged and sold on the dark web, and the implications of highly sensitive data being leaked. Want to find out more or have a suggestion for future podcast episodes? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/ For more background on the cases we discuss: Ticketmaster: https://www.bbc.com/news/articles/cw99ql0239wo Santander: https://www.bbc.com/news/articles/c6ppv06e3n8o 23andMe: https://www.bbc.com/news/technology-67624182 El Salvador: https://securityaffairs.com/162790/data-breach/el-salvador-massive-leak-biometric-data.html Ashley Madison: https://www.forbes.com/sites/zakdoffman/2020/02/01/ashley-madison-hack-returns-to-haunt-its-victims-32-million-users-now-have-to-watch-and-wait/ Yahoo! 2013 data breach: https://www.bbc.co.uk/news/business-41493494 Nitro: https://www.bleepingcomputer.com/news/security/massive-nitro-data-breach-impacts-microsoft-google-apple-more/…

The Dark Dive

1
7. The LockBit Takedown 45:13

1 year ago45:13

45:13

In the first episode of season two, The Dark Dive takes a forensic look at Operation Cronos, the international law enforcement takedown of the notorious ransomware group LockBit. Dr. Gareth Owenson and Louise Ferrett give an overview of LockBit, explain how Operation Cronos has unfolded, and discuss why law enforcement has taken an unconventional approach (“the most epic trolling in cybersecurity history”) to this ransomware group takedown. Recorded on May 14, this episode includes the “unmasking” of LockBitSupp in early May, how LockBit has responded to the law enforcement action, and how this operation has (and could still) impact other groups - with the BlackCat ransomware gang choosing early retirement. Useful links: NCA press release, February 20, 2024: https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group/ LockBit statement: https://x.com/vxunderground/status/1761506370656825531 US DoJ sanctions, May 7, 2024: https://www.justice.gov/opa/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware Want to find out more or get in touch with us?: Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.x.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/…

The Dark Dive

1
1. How the Dark Web Works 46:21

1 year ago46:21

46:21

In this first episode of The Dark Dive we start at the beginning, with the question: what is the dark web? Renowned dark web academic Dr. Gareth Owenson and threat intelligence expert Jim Simpson define exactly what the "dark web" is in relation to the "clear web" and the "deep web", how dark web networks like Tor work, and why it's relevant to law enforcement and cybersecurity professionals. They also provide an overview of the types of traditional and cyber criminal activity that take place on the dark web, while busting (and confirming) some dark web myths. Want to find out more? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/…

The Dark Dive

1
2. Dark Web Marketplaces 38:35

1 year ago38:35

38:35

In this episode of The Dark Dive - the podcast that delves into the depths of the dark web - we take a forensic look at dark web markets. Guests Louise Ferrett and Dave Osler outline the different types of marketplaces that exist on the dark web, the illicit and criminal goods they sell, and the challenges they create for law enforcement. In the process, we discuss the difference between drug and digital goods markets (known as "autoshops"), the short lifespan of marketplace sites, and the strangest things they've seen sold on the dark web. Want to find out more? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/…

The Dark Dive

1
3. Dark Web Hacking Forums 43:17

1 year ago43:17

43:17

We're joined by threat intelligence experts Joe Honey and Vlad to delve into dark web hacking forums. The conversation covers how dark web forums differ from regular internet forums, the topics that users are discussing, and how forums manage to have such longevity in comparison to criminal marketplaces. On the way our guests explain the "barrier to entry" to getting onto these forums, the blurry line between Russian, English language, and Chinese forums, and how these sites act as a market for a specific type of cybercriminal known as "Initial Access Brokers". Want to find out more? Email: thedarkdive@slcyber.io Website: www.slcyber.io LinkedIn: www.linkedin.com/company/searchlight-cyber X: www.twitter.com/SLCyberSec Weekly newsletter: www.slcyber.io/beacon/ Report, "Combatting Initial Access Brokers With Dark Web Intelligence": https://www.slcyber.io/whitepapers-reports/combating-initial-access-brokers-with-dark-web-intelligence/…

The Dark Dive

1
4. Ransomware Gangs on the Dark Web 47:33

1 year ago47:33