<a target="_blank" href="https://www.buzzsprout.com/2445401/fan_mail/new">Send us fan mail!</a>What does it actually look like to bring AI into a threat intelligence program at one of the internet&apos;s most iconic companies? Hello to all our Cyber Pals!Host Selena Larson is joined by guest host, Sarah Sabotka as they chat with Sean Zadig, Chief Information Security Officer (and &quot;Chief Paranoid&quot;) at Yahoo, for a candid conversation about the evolving intersection of AI and cybersecurity.Sean shares how Yahoo&apos;s security team, the Paranoids, is navigating the agentic AI transformation: from running a company-wide &quot;skill-a-thon&quot; to get every team member building Claude-powered tools, to rethinking legacy infrastructure from the ground up. He also opens up about what keeps him up at night; including the looming threat of AI-powered exploit frameworks like Mythos, the growing signal-to-noise problem in threat intel feeds, and the very real risk of analyst burnout as the pace of the industry accelerates.But Sean&apos;s outlook is surprisingly optimistic. He argues that defenders have a home-field advantage, that the best code ever written is just 12–18 months away, and that the goal of AI in security shouldn&apos;t be doing more with fewer people–it should be building more resilient teams. For more information about Proofpoint, <a href='https://www.proofpoint.com/us/podcasts'>check out our website</a>.  Subscribe &amp; Follow:Stay ahead of emerging threats, and subscribe! Happy hunting!

<description>&lt;p&gt;&lt;a target="_blank" href="https://www.buzzsprout.com/2445401/fan_mail/new"&gt;Send us fan mail!&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;What does it actually look like to bring AI into a threat intelligence program at one of the internet&amp;apos;s most iconic companies?&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;&lt;br/&gt;Hello to all our Cyber Pals!&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Host Selena Larson is joined by guest host, Sarah Sabotka as they chat with Sean Zadig, Chief Information Security Officer (and &amp;quot;Chief Paranoid&amp;quot;) at Yahoo, for a candid conversation about the evolving intersection of AI and cybersecurity.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Sean shares how Yahoo&amp;apos;s security team, the Paranoids, is navigating the agentic AI transformation: from running a company-wide &amp;quot;skill-a-thon&amp;quot; to get every team member building Claude-powered tools, to rethinking legacy infrastructure from the ground up. He also opens up about what keeps him up at night; including the looming threat of AI-powered exploit frameworks like Mythos, the growing signal-to-noise problem in threat intel feeds, and the very real risk of analyst burnout as the pace of the industry accelerates.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;But Sean&amp;apos;s outlook is surprisingly optimistic. He argues that defenders have a home-field advantage, that the best code ever written is just 12–18 months away, and that the goal of AI in security shouldn&amp;apos;t be doing more with fewer people–it should be building more resilient teams.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;For more information about Proofpoint, &lt;/b&gt;&lt;a href='https://www.proofpoint.com/us/podcasts'&gt;&lt;b&gt;check out our website&lt;/b&gt;&lt;/a&gt;&lt;b&gt;.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt; &lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Subscribe &amp;amp; Follow:&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Stay ahead of emerging threats, and subscribe! Happy hunting!&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;&lt;br/&gt;&lt;/b&gt;&lt;br/&gt;&lt;/p&gt;</description>

Send us fan mail! What does it actually look like to bring AI into a threat intelligence program at one of the internet's most iconic companies?  Hello to all our Cyber Pals! Host Selena Larson is joined by guest host, Sarah Sabotka as they chat with Sean Zadig, Chief Information Security Officer (and "Chief Paranoid") at Yahoo, for a candid conversation about the evolving intersection of AI and cybersecurity. Sean shares how Yahoo's security team, the Paranoids, is navigating the agentic AI ...

"Always Intentional": A CISO's Pragmatic Take on the Agentic Era

<a target="_blank" href="https://www.buzzsprout.com/2445401/fan_mail/new">Send us fan mail!</a>Hello to all our Cyber Sunbeams!Host Selena Larson is joined by guest host, Sarah Sabotka as they chat with Jake Gionet to unpack one of the fastest-growing threats in today’s cyber landscape: device code phishing.What started as a niche technique used in red team exercises has quickly evolved into a widely adopted method for account takeover—fueled by publicly available phishing kits and accelerated by AI-assisted tooling. The trio breaks down how device code phishing works, why it’s suddenly everywhere, and how attackers are exploiting legitimate authentication flows to bypass traditional defenses.They also explore the rise of “phishing-as-a-service” platforms like Evil Tokens, the surprising lack of sophistication behind many campaigns, and how AI is both enabling attackers and exposing their mistakes. Along the way, they dig into real-world examples, threat actor missteps, and the blurry line between innovation and imitation in cybercrime.If you’ve been hearing the buzz around device code phishing and want a clear, grounded explanation—without the hype—this episode delivers. Plus, practical insights on what defenders should actually focus on as these techniques continue to evolve.Resources Mentioned:<a href='https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover'>https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover</a><a href='https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover'>https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover</a> For more information about Proofpoint, <a href='https://www.proofpoint.com/us/podcasts'>check out our website</a>. Subscribe &amp; Follow:Stay ahead of emerging threats, and subscribe! Happy hunting!

<description>&lt;p&gt;&lt;a target="_blank" href="https://www.buzzsprout.com/2445401/fan_mail/new"&gt;Send us fan mail!&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Hello to all our Cyber Sunbeams!&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Host Selena Larson is joined by guest host, Sarah Sabotka as they chat with Jake Gionet to unpack one of the fastest-growing threats in today’s cyber landscape: device code phishing.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;What started as a niche technique used in red team exercises has quickly evolved into a widely adopted method for account takeover—fueled by publicly available phishing kits and accelerated by AI-assisted tooling. The trio breaks down how device code phishing works, why it’s suddenly everywhere, and how attackers are exploiting legitimate authentication flows to bypass traditional defenses.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;They also explore the rise of “phishing-as-a-service” platforms like Evil Tokens, the surprising lack of sophistication behind many campaigns, and how AI is both enabling attackers and exposing their mistakes. Along the way, they dig into real-world examples, threat actor missteps, and the blurry line between innovation and imitation in cybercrime.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;If you’ve been hearing the buzz around device code phishing and want a clear, grounded explanation—without the hype—this episode delivers. Plus, practical insights on what defenders should actually focus on as these techniques continue to evolve.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Resources Mentioned:&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;a href='https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover'&gt;&lt;b&gt;https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover&lt;/b&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a href='https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover'&gt;&lt;b&gt;https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover&lt;/b&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;For more information about Proofpoint, &lt;/b&gt;&lt;a href='https://www.proofpoint.com/us/podcasts'&gt;&lt;b&gt;check out our website&lt;/b&gt;&lt;/a&gt;&lt;b&gt;.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt; &lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Subscribe &amp;amp; Follow:&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Stay ahead of emerging threats, and subscribe! Happy hunting!&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;</description>

Send us fan mail! Hello to all our Cyber Sunbeams! Host Selena Larson is joined by guest host, Sarah Sabotka as they chat with Jake Gionet to unpack one of the fastest-growing threats in today’s cyber landscape: device code phishing. What started as a niche technique used in red team exercises has quickly evolved into a widely adopted method for account takeover—fueled by publicly available phishing kits and accelerated by AI-assisted tooling. The trio breaks down how device code phishing wor...

A Device Code Explosion: The New Era of AI-Enabled Phishing

<a target="_blank" href="https://www.buzzsprout.com/2445401/fan_mail/new">Send us fan mail!</a>Hello to all our Cyber Pals, Cyber Centaurs, Cyber Stars, and listeners who have been with us for 100 episodes! It’s our 100th episode—and we’re raising a glass to celebrate. 🥂Host Selena Larson is joined by long-time guest hosts, Sarah Sabotka and Tim Kromphardt, and honorary host, VP of Proofpoint Threat Research Daniel Blackford, for this commemorative episode of Discarded! We reflect on the journey so far, revisit standout moments, and look ahead to what’s next in cybersecurity.From unforgettable guests and inside jokes to real lessons learned from years of tracking threat actors, this episode is part celebration, part reflection, and part unfiltered cyber chat.We dig into:<ul><li>Favorite podcast guests and the insights that stuck with us</li><li>The reality vs. hype of AI in cybersecurity (and what’s actually useful)</li><li>How threat actors are evolving—and where they’re… not</li><li>The surprising truth about targeting, myths in the industry, and why attackers don’t need to be sophisticated to be effective</li><li>Behind-the-scenes looks at the tools and research we’re building right now</li></ul>Plus, we answer listener questions, share a few laughs (and a few drinks), and talk about what the next 100 episodes might hold.Whether you’ve been with us since episode one or just discovered the show, this milestone episode is a thank-you to our listeners—and a reminder that cybersecurity is as much about people as it is about technology.Cheers to 100 episodes. 🍾 Resources Mentioned: <a href='https://www.nytimes.com/2026/04/04/technology/ai-chatbots-teen-roleplay.html'>https://www.nytimes.com/2026/04/04/technology/ai-chatbots-teen-roleplay.html</a> For more information about Proofpoint, <a href='https://www.proofpoint.com/us/podcasts'>check out our website</a>.  Subscribe &amp; Follow:Stay ahead of emerging threats, and subscribe! Happy hunting!

<description>&lt;p&gt;&lt;a target="_blank" href="https://www.buzzsprout.com/2445401/fan_mail/new"&gt;Send us fan mail!&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Hello to all our Cyber Pals, Cyber Centaurs, Cyber Stars, and listeners who have been with us for 100 episodes! It’s our 100th episode—and we’re raising a glass to celebrate. 🥂&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Host Selena Larson is joined by long-time guest hosts, Sarah Sabotka and Tim Kromphardt, and honorary host, VP of Proofpoint Threat Research Daniel Blackford, for this commemorative episode of Discarded! We reflect on the journey so far, revisit standout moments, and look ahead to what’s next in cybersecurity.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;From unforgettable guests and inside jokes to real lessons learned from years of tracking threat actors, this episode is part celebration, part reflection, and part unfiltered cyber chat.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;We dig into:&lt;/b&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;b&gt;Favorite podcast guests and the insights that stuck with us&lt;/b&gt;&lt;/li&gt;&lt;li&gt;&lt;b&gt;The reality vs. hype of AI in cybersecurity (and what’s actually useful)&lt;/b&gt;&lt;/li&gt;&lt;li&gt;&lt;b&gt;How threat actors are evolving—and where they’re… not&lt;/b&gt;&lt;/li&gt;&lt;li&gt;&lt;b&gt;The surprising truth about targeting, myths in the industry, and why attackers don’t need to be sophisticated to be effective&lt;/b&gt;&lt;/li&gt;&lt;li&gt;&lt;b&gt;Behind-the-scenes looks at the tools and research we’re building right now&lt;/b&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;b&gt;Plus, we answer listener questions, share a few laughs (and a few drinks), and talk about what the next 100 episodes might hold.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Whether you’ve been with us since episode one or just discovered the show, this milestone episode is a thank-you to our listeners—and a reminder that cybersecurity is as much about people as it is about technology.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Cheers to 100 episodes. 🍾&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Resources Mentioned:&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;a href='https://www.nytimes.com/2026/04/04/technology/ai-chatbots-teen-roleplay.html'&gt;&lt;b&gt;https://www.nytimes.com/2026/04/04/technology/ai-chatbots-teen-roleplay.html&lt;/b&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;For more information about Proofpoint, &lt;/b&gt;&lt;a href='https://www.proofpoint.com/us/podcasts'&gt;&lt;b&gt;check out our website&lt;/b&gt;&lt;/a&gt;&lt;b&gt;.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt; &lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Subscribe &amp;amp; Follow:&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Stay ahead of emerging threats, and subscribe! Happy hunting!&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;</description>

Send us fan mail! Hello to all our Cyber Pals, Cyber Centaurs, Cyber Stars, and listeners who have been with us for 100 episodes! It’s our 100th episode—and we’re raising a glass to celebrate. 🥂 Host Selena Larson is joined by long-time guest hosts, Sarah Sabotka and Tim Kromphardt, and honorary host, VP of Proofpoint Threat Research Daniel Blackford, for this commemorative episode of Discarded! We reflect on the journey so far, revisit standout moments, and look ahead to what’s next in cyber...

Champagne with Our Campaigns: A 100th Episode Happy Hour

<a target="_blank" href="https://www.buzzsprout.com/2445401/fan_mail/new">Send us fan mail!</a>Hello to all our Cyber Daffodils! Host Selena Larson, and guest Host, Tim Kromphardt, sit down with Stuart Del Caliz, Senior Threat Detection Engineer at Proofpoint, to unpack the stealthy world of backdoors, malware detection, and the “secret signals” threat actors use to stay hidden.From magic packets and port knocking to sophisticated backdoors like BPFdoor, Stuart shares how attackers design covert communication methods—and how defenders work to uncover them without overwhelming security teams with noise. The conversation blends deep technical insight with real-world analogies (think speakeasy knocks and undercover “internet cops”) to make complex detection strategies easier to understand. You’ll also hear:<ul><li>How detection engineers balance accuracy and performance when writing IDS/IPS signatures</li><li>Why some advanced malware can remain undetected for years—and whether we’re simply not seeing it</li><li>How historic leaks like Shadow Brokers still influence modern attack techniques</li><li>The role of “pattern matching” in identifying evolving malware behaviors</li><li>How file metadata and revoked certificates can reveal threats hiding in plain sight</li><li>Why community collaboration and feedback loops are critical to stronger detections</li></ul>Whether you’re a security practitioner or deep in the trenches, this episode offers a closer look at the craft of detection engineering—and the constant challenge of writing high-fidelity detections against increasingly evasive threat techniques. Resources Mentioned: <a href='https://community.emergingthreats.net/'>https://community.emergingthreats.net/</a><a href='https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/'>https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/</a><a href='https://www.wired.com/story/nsa-hacking-tools-stolen-hackers/'>https://www.wired.com/story/nsa-hacking-tools-stolen-hackers/</a><a href='https://github.com/x0rz/EQGRP'>https://github.com/x0rz/EQGRP</a> For more information about Proofpoint, <a href='https://www.proofpoint.com/us/podcasts'>check out our website</a>.  Subscribe &amp; Follow:Stay ahead of emerging threats, and subscribe! Happy hunting!

<description>&lt;p&gt;&lt;a target="_blank" href="https://www.buzzsprout.com/2445401/fan_mail/new"&gt;Send us fan mail!&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Hello to all our Cyber Daffodils! Host Selena Larson, and guest Host, Tim Kromphardt, sit down with Stuart Del Caliz, Senior Threat Detection Engineer at Proofpoint, to unpack the stealthy world of backdoors, malware detection, and the “secret signals” threat actors use to stay hidden.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;From magic packets and port knocking to sophisticated backdoors like BPFdoor, Stuart shares how attackers design covert communication methods—and how defenders work to uncover them without overwhelming security teams with noise. The conversation blends deep technical insight with real-world analogies (think speakeasy knocks and undercover “internet cops”) to make complex detection strategies easier to understand.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;You’ll also hear:&lt;/b&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;b&gt;How detection engineers balance accuracy and performance when writing IDS/IPS signatures&lt;/b&gt;&lt;/li&gt;&lt;li&gt;&lt;b&gt;Why some advanced malware can remain undetected for years—and whether we’re simply not seeing it&lt;/b&gt;&lt;/li&gt;&lt;li&gt;&lt;b&gt;How historic leaks like Shadow Brokers still influence modern attack techniques&lt;/b&gt;&lt;/li&gt;&lt;li&gt;&lt;b&gt;The role of “pattern matching” in identifying evolving malware behaviors&lt;/b&gt;&lt;/li&gt;&lt;li&gt;&lt;b&gt;How file metadata and revoked certificates can reveal threats hiding in plain sight&lt;/b&gt;&lt;/li&gt;&lt;li&gt;&lt;b&gt;Why community collaboration and feedback loops are critical to stronger detections&lt;/b&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;b&gt;Whether you’re a security practitioner or deep in the trenches, this episode offers a closer look at the craft of detection engineering—and the constant challenge of writing high-fidelity detections against increasingly evasive threat techniques.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Resources Mentioned:&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;a href='https://community.emergingthreats.net/'&gt;&lt;b&gt;https://community.emergingthreats.net/&lt;/b&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a href='https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/'&gt;&lt;b&gt;https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/&lt;/b&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a href='https://www.wired.com/story/nsa-hacking-tools-stolen-hackers/'&gt;&lt;b&gt;https://www.wired.com/story/nsa-hacking-tools-stolen-hackers/&lt;/b&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a href='https://github.com/x0rz/EQGRP'&gt;&lt;b&gt;https://github.com/x0rz/EQGRP&lt;/b&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;For more information about Proofpoint, &lt;/b&gt;&lt;a href='https://www.proofpoint.com/us/podcasts'&gt;&lt;b&gt;check out our website&lt;/b&gt;&lt;/a&gt;&lt;b&gt;.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt; &lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Subscribe &amp;amp; Follow:&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Stay ahead of emerging threats, and subscribe! Happy hunting!&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;&lt;br/&gt;&lt;br/&gt;&lt;/b&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;</description>

Send us fan mail! Hello to all our Cyber Daffodils! Host Selena Larson, and guest Host, Tim Kromphardt, sit down with Stuart Del Caliz, Senior Threat Detection Engineer at Proofpoint, to unpack the stealthy world of backdoors, malware detection, and the “secret signals” threat actors use to stay hidden. From magic packets and port knocking to sophisticated backdoors like BPFdoor, Stuart shares how attackers design covert communication methods—and how defenders work to uncover them without ove...

Magic Packets & Stealth Backdoors: The Art of Detection Engineering

<a target="_blank" href="https://www.buzzsprout.com/2445401/fan_mail/new">Send us fan mail!</a>Hello to all our Cyber Pals! Guest host Sarah Sabotka sits down with Senior Threat Researcher Jared Peck to unpack one of the most dynamic and persistent cybercrime groups operating today: TA2725, also known as “Grana.”From its roots in Latin America to its global reach, TA2725 stands out for its adaptability—and its relentless pursuit of financial gain. Jared shares how the group evolved from a high-volume malware operator into a multifaceted threat actor running phishing, fraud, and malware campaigns simultaneously. The conversation dives into how Grana targets regions like Brazil and Mexico, why their tactics shift across geographies, and what makes their operations uniquely complex.You’ll also hear:<ul><li>How threat actors “graduate” to official TA designations (and why it’s a big win for researchers) </li><li>The impact of law enforcement disruptions on major malware operations like Grandoreiro </li><li>Why Latin America’s banking infrastructure shapes cybercrime tactics differently </li><li>The rise (and fall) of RMM tools in TA2725’s playbook </li><li>What clues reveal whether activity comes from one group—or an entire cybercrime “service” ecosystem</li></ul>Whether you’re in cybersecurity or just curious about how modern cybercrime operates, this episode offers a fascinating look at a threat actor that refuses to stay in one lane—and what that means for organizations worldwide. For more information about Proofpoint, <a href='https://www.proofpoint.com/us/podcasts'>check out our website</a>. Subscribe &amp; Follow:Stay ahead of emerging threats, and subscribe! Happy hunting!

<description>&lt;p&gt;&lt;a target="_blank" href="https://www.buzzsprout.com/2445401/fan_mail/new"&gt;Send us fan mail!&lt;/a&gt;&lt;/p&gt;&lt;p&gt;Hello to all our Cyber Pals! Guest host Sarah Sabotka sits down with Senior Threat Researcher Jared Peck to unpack one of the most dynamic and persistent cybercrime groups operating today: TA2725, also known as “Grana.”&lt;/p&gt;&lt;p&gt;From its roots in Latin America to its global reach, TA2725 stands out for its adaptability—and its relentless pursuit of financial gain. Jared shares how the group evolved from a high-volume malware operator into a multifaceted threat actor running phishing, fraud, and malware campaigns simultaneously. The conversation dives into how Grana targets regions like Brazil and Mexico, why their tactics shift across geographies, and what makes their operations uniquely complex.&lt;/p&gt;&lt;p&gt;You’ll also hear:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;How threat actors “graduate” to official TA designations (and why it’s a big win for researchers)&lt;br/&gt;&lt;br/&gt;&lt;br/&gt;&lt;/li&gt;&lt;li&gt;The impact of law enforcement disruptions on major malware operations like Grandoreiro&lt;br/&gt;&lt;br/&gt;&lt;br/&gt;&lt;/li&gt;&lt;li&gt;Why Latin America’s banking infrastructure shapes cybercrime tactics differently&lt;br/&gt;&lt;br/&gt;&lt;br/&gt;&lt;/li&gt;&lt;li&gt;The rise (and fall) of RMM tools in TA2725’s playbook&lt;br/&gt;&lt;br/&gt;&lt;br/&gt;&lt;/li&gt;&lt;li&gt;What clues reveal whether activity comes from one group—or an entire cybercrime “service” ecosystem&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Whether you’re in cybersecurity or just curious about how modern cybercrime operates, this episode offers a fascinating look at a threat actor that refuses to stay in one lane—and what that means for organizations worldwide.&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;/p&gt;&lt;p&gt;For more information about Proofpoint, &lt;a href='https://www.proofpoint.com/us/podcasts'&gt;check out our website&lt;/a&gt;.&lt;/p&gt;&lt;p&gt; &lt;/p&gt;&lt;p&gt;Subscribe &amp;amp; Follow:&lt;/p&gt;&lt;p&gt;Stay ahead of emerging threats, and subscribe! Happy hunting!&lt;/p&gt;&lt;p&gt;&lt;br/&gt;&lt;br/&gt;&lt;/p&gt;</description>

Send us fan mail! Hello to all our Cyber Pals! Guest host Sarah Sabotka sits down with Senior Threat Researcher Jared Peck to unpack one of the most dynamic and persistent cybercrime groups operating today: TA2725, also known as “Grana.” From its roots in Latin America to its global reach, TA2725 stands out for its adaptability—and its relentless pursuit of financial gain. Jared shares how the group evolved from a high-volume malware operator into a multifaceted threat actor running phishing,...

Regional Threats, Global Impact: A TA2725 Case Study

DISCARDED: Tales from the Threat Research Trenches is a podcast for security practitioners, intelligence analysts, and threat hunters looking to learn more about the threat behaviors and attack patterns. Each episode you’ll hear real world insights from our researchers about the latest trends in malware, threat actors, TTPs, and more. Welcome to DISCARDED

DISCARDED: Tales From the Threat Research Trenches

Details

Recent Episodes