Best Mandiant Podcasts (2025)

1
The Rise of ClickFix 23:33

Play Pause

10d ago23:33

23:33

Dima Lenz (Security Engineer, Google Threat Intelligence Group) joins host Luke McNamara to discuss how threat actors have been using ClickFix to socially engineer users. Dima recounts the growth of this technique in 2024, some of the campaigns and actors that have leveraged it, and where it may be headed next.…

1
Carlos Lozano - Founder @ BugCon 🇲🇽 1:04:54

1M ago1:04:54

1:04:54

https://bugcon.org/

1
Vishing in the Wild 37:48

2M ago37:48

37:48

Nick Guttilla and Emily Astranova, from Mandiant Consulting's Offensive Security team, join host Luke McNamara for an episode on voice-based phishing, or "vishing." Nick and Emily cover their respective blogs and experiences, diving into how they employ vishing techniques to social engineer organizations--both organically and using AI-powered voice…

1
Responding to a DPRK ITW Incident 16:35

2M ago16:35

16:35

JP Glab (Mandiant Consulting) joins host Luke to discuss responding to activity from North Korean IT workers. He walks through what initially triggered the investigation at this organization, how it progressed in parallel with an HR investigation, and ultimately what was discovered. For more on the DPRK IT workers and trends in incident response, c…

1
Giovanni Cruz - Founder @ BSides Colombia 48:31

3M ago48:31

48:31

Una conversación con Giovanni Cruz, fundador de BSides Colombia https://bsidesco.org/ https://www.linkedin.com/in/cruzgio/

1
UNC5221 and The Targeting of Ivanti Connect Secure VPNs 27:55

3M ago27:55

27:55

Matt Lin (Senior Incident Response Consultant, Mandiant) and Daniel Spicer (Chief Security Officer, Ivanti) dive into the research and response of UNC5221's campaigns against Ivanti. They cover how this threat actor has evolved from earlier campaigns, the continued focus of edge infrastructure by APT actors, and the shared responsibility of securit…

1
Windows Remote Desktop Protocol: Remote to Rogue 34:27

3M ago34:27

34:27

Host Luke McNamara is joined by GTIG Senior Security Researcher Rohit Nambiar to discuss Rohit's recent blog on some interesting usage of RDP by UNC5837. Rohit covers the discovery of the campaign, and the novel functionalities they were using to likely support cyber espionage goals. He delves into these findings and the usage of RemoteApps and vic…

1
Cybersecurity Conversations with the C-Suite and Board 36:14

5M ago36:14

36:14

Imran Ahmad (Senior Partner, Canadian Head of Technology and Canadian Co-Head of Cybersecurity and Data Privacy at Norton Rose Fulbright) joins host Luke McNamara to discuss how executives are thinking about cyber risk in a changing and evolving landscape. He touches on the importance of training before a breach, how ransomware has changed security…

1
What to Watch For in 2025 44:31

5M ago44:31

44:31

Kelli Vanderlee, Kate Morgan, and Jamie Collier join host Luke McNamara to discuss trends that are top of mind for them in tracking emergent threats this year, from nation state intrusions to financially motivated ransomware campaigns. https://cloud.google.com/security/resources/cybersecurity-forecast https://cloud.google.com/blog/topics/threat-int…

1
Signals of Trouble 26:03

5M ago26:03

26:03

Dan Black (Principal Analyst, Google Threat Intelligence Group) joins host Luke McNamara to discuss the research into Russia-aligned threat actors seeking to compromise Signal Messenger. Dan lays out how this latest evolution of Russia's usage of cyber in Ukraine compares to previous phases of the conflict, how this activity is likely supporting ba…

1
Agentic AI in Cybersecurity 26:40

6M ago26:40

26:40

Steph Hay (Senior Director for Gemini Product and UX, Google Cloud Security) joins host Luke McNamara to discuss agentic AI and its implications for security disciplines. Steph walks through how generative AI is already impacting the finding of threats, reduction of toil, and the scaling up of workforce talent, before discussing how agents will inc…

1
The Art of Remediation in Incident Response 40:59

8M ago40:59

40:59

Jibran Ilyas (Consulting Leader, Mandiant Consulting) joins host Luke McNamara to discuss remediation as part of incident response. Jibran covers various scenarios (espionage and ransomware) and how they may differ in approaching remediation, how types of architecture could shape remediation efforts, non-technical components of the remediation phas…

1
How to Run an Effective Tabletop Exercise 29:14

9M ago29:14

29:14

Mandiant Senior Consultant Alishia Hui joins host Luke McNamara to discuss all things tabletop exercise related. Alishia walks through the elements of a tabletop exercise, important preparatory steps, the success factors for a good exercise, and how organizations can implement lessons learned. https://cloud.google.com/transform/the-empty-chair-gues…

1
Using LLMs to Analyze Windows Binaries 36:40

10M ago36:40

36:40

Vicente Diaz, Threat Intelligence Strategist at VirusTotal, joins host Luke McNamara to discuss his research into using LLMs to analyze malware. Vicente covers how he used Gemini to analyze various windows binaries, the use cases this could help address for security operations, technical challenges with de-obfuscation, and more. For more on this to…

1
How Threat Actors Bypass Multi-Factor Authentication 27:20

10M ago27:20

27:20

Josh Fleischer, Principal Security Analyst with Mandiant's Managed Defense organization sits down with host Luke McNamara to discuss trends in MFA bypass and how threat actors are conducting adversary in the middle (AiTM) attacks to gain access to targeted organizations. Josh walks through a case study of MFA bypass, how token theft occurs, the inc…

1
TAG's Work Tracking Commercial Surveillance Vendors 23:58

11M ago23:58

23:58

Host Luke McNamara is joined by Clement Lecigne, security researcher at Google's Threat Analysis Group (TAG) to discuss his work tracking commercial surveillance vendors (CSVs). Clement dives into the history and evolution of the CSV industry, how these entities carry out operations against platforms like mobile, and the nexus of this problem into …

1
What Iranian Threat Actors Have Been Up To This Year 36:13

12M ago36:13

36:13

Mandiant APT Researcher Ofir Rozmann joins host Luke McNamara to discuss some notable Iranian cyber espionage actors and what they have been up to in 2024. Ofir covers campaigns from suspected IRGC-nexus actors such as APT42 and APT35-related clusters, as well as activity from TEMP.Zagros. For more on this topic, please see: https://blog.google/tec…

1
Mandiant's Approach to Securely Using AI Solutions 32:00

1y ago32:00

32:00

Mandiant Consultants Trisha Alexander, Muhammed Muneer, and Pat McCoy join host Luke McNamara to discuss Mandiant's recently launched services for securing AI. They discuss how organizations can proactively approach securing the implementation of AI workloads, red-team and test these security controls protecting generative AI models in production, …

1
Lessons Learned from Responding to Cloud Compromises 30:16

1y ago30:16

30:16

Mandiant consultants Will Silverstone (Senior Consultant) and Omar ElAhdan (Principal Consultant) discuss their research into cloud compromise trends over 2023. They discuss living off the land techniques in the cloud, the concept of the extended cloud attack surface, how organizations can better secure their identities, third party cloud compromis…

1
The ORB Networks 29:54

1y ago29:54

29:54

Michael Raggi (Principal Analyst, Mandiant Intelligence) joins host Luke McNamara to discuss Mandiant's research into China-nexus threat actors using proxy networks known as “ORBs” (operational relay box networks). Michael discusses the anatomy and framework Mandiant developed to map out these proxy networks, how ORB networks like SPACEHOP are leve…

1
Investigations Into Zero-Day Exploitation of the Ivanti Connect Secure Appliances 27:47

1y ago27:47

27:47

Mandiant Principal Analysts John Wolfram and Tyler McLellan join host Luke McNamara to discuss their research in the "Cutting Edge" blog series, a series of investigations into zero-day exploitation of Ivanti appliances. John and Tyler discuss the process of analyzing the initial exploitation, and the attribution challenges that emerged following t…

1
M-Trends 2024 with Mandiant Consulting Vice President Jurgen Kutscher 25:53

1y ago25:53

25:53

Jurgen Kutscher, Mandiant Vice President for Consulting, joins host Luke McNamara to discuss the findings of the M-Trends 2024 report. Jurgen shares his perspective on the "By the Numbers" data, the theme of evasion of detection in this year's report, and how Mandiant consultants have been leveraging AI in purple and red teaming operations. For mor…

1
Assessing the State of Multifaceted Extortion Operations 40:54

1+ y ago40:54

40:54

Kimberly Goody, Head of Mandiant's Cyber Crime Analysis team and Jeremy Kennelly, Lead Analyst of the same team join host Luke McNamara to breakdown the current state of ransomware and data theft extortion. Kimberly and Jeremy describe how 2023 differed from the activity they witnessed the year prior, and how changes in the makeup of various groups…

1
Hunting for "Living off the Land" Activity 42:32

1+ y ago42:32

42:32

Host Luke McNamara is joined by Mandiant consultants Shanmukhanand Naikwade and Dan Nutting to discuss hunting for threat actors utilizing "living off the land" (LotL) techniques. They discuss how LotL techniques differ from traditional malware based attacks, ways to differentiate between normal and malicious use of utilities, Volt Typhoon, and mor…

1
Director of NSA's Cybersecurity Collaboration Center on Trends in 2024 25:48

1+ y ago25:48

25:48

Morgan Adamski, Director of the NSA's Cybersecurity Collaboration Center (CCC) joins host Luke McNamara to discuss the threat posed by Volt Typhoon and other threat actors utilizing living off the land (LotL) techniques, zero-day exploitation trends, how the CCC works with private sector organizations, and more.…

1
The North Korean IT Workers 34:40

1+ y ago34:40

34:40

Principal Analyst Michael Barnhart joins host Luke McNamara to discuss Mandiant's research into the threat posed by the Democratic People's Republic of Korea's (DPRK) usage of IT workers to gain access to enterprises. For more on Mandiant's analysis of North Korea's cyber capabilities, please see: https://www.mandiant.com/resources/blog/north-korea…

Mandiant Podcasts

1
The Defender's Advantage Podcast

Mandiant

1
Security Perspectives

Nikolas Behar

1
The Rise of ClickFix 23:33

1
Carlos Lozano - Founder @ BugCon 🇲🇽 1:04:54

1
Vishing in the Wild 37:48

1
Responding to a DPRK ITW Incident 16:35

1
Giovanni Cruz - Founder @ BSides Colombia 48:31

1
UNC5221 and The Targeting of Ivanti Connect Secure VPNs 27:55

1
Windows Remote Desktop Protocol: Remote to Rogue 34:27

1
Cybersecurity Conversations with the C-Suite and Board 36:14

1
What to Watch For in 2025 44:31

1
Signals of Trouble 26:03

1
Agentic AI in Cybersecurity 26:40

1
The Art of Remediation in Incident Response 40:59

1
How to Run an Effective Tabletop Exercise 29:14

1
Using LLMs to Analyze Windows Binaries 36:40

1
How Threat Actors Bypass Multi-Factor Authentication 27:20

1
TAG's Work Tracking Commercial Surveillance Vendors 23:58

1
What Iranian Threat Actors Have Been Up To This Year 36:13

1
Mandiant's Approach to Securely Using AI Solutions 32:00

1
Lessons Learned from Responding to Cloud Compromises 30:16

1
The ORB Networks 29:54

1
Investigations Into Zero-Day Exploitation of the Ivanti Connect Secure Appliances 27:47

1
M-Trends 2024 with Mandiant Consulting Vice President Jurgen Kutscher 25:53

1
Assessing the State of Multifaceted Extortion Operations 40:54

1
Hunting for "Living off the Land" Activity 42:32

1
Director of NSA's Cybersecurity Collaboration Center on Trends in 2024 25:48

1
The North Korean IT Workers 34:40