DISCARDED: Tales From the Threat Research Trenches

Send us fan mail!
Hello to all our Cyber Stars!
This week, Selena is joined by senior threat researcher Tim Kromphardt and special guest Pavlina Pavlova, founder of Critical Cyber and a cybercrime and policy expert. Together they dig into the human side of cyberattacks and what happens to real people long after the systems come back online.
Pavlina explains why she founded Critical Cyber, an organization that documents how attacks on hospitals, schools, transportation, and other vital services affect the people who depend on them. She also shares why victims’ voices are missing from so many policy conversations and why she considers these unaddressed attacks a human rights crisis.
The team discusses who should be held accountable for preventable harm, how attacks on one hospital can ripple out to its neighbors, and what AI is changing in cybercrime and defense (for the patient missing a surgery, it doesn’t matter whether AI was involved). 
Plus: Selena’s battle with a healthcare chatbot that wouldn’t let her book her vaccines.
In this episode:
How individual harm becomes a societal problem
The lasting impacts of attacks, from identity theft to psychological fallout
Why treating cyber incidents as individual failure misses the bigger picture
The normalization of ransomware attacks on hospitals
What policy can and can’t fix, including the UN cybercrime convention
What cybersecurity can learn from seatbelts and aviation safety
Why the resilience of victims gives Pavlina hope
Whether you’re a threat researcher, a policymaker, or someone who just wants your hospital to be open when you need it, the lesson is the same: cyberattacks aren’t just technical incidents, and their harm doesn’t end when the case closes. These attacks should never feel normal, and sharing the stories of those affected is a powerful step toward better support, accountability, and recovery.

Resources Mentioned:
https://www.youtube.com/watch?v=JF-bTUuYC6I&t=614s
https://criticalcyber.org/
https://www.bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries/
https://cyberhealth.ucsd.edu/_files/ransomware_cyberattack_associated_with_cardiac.15.pdf
https://criticalcyber.org/thestories/three-hospitals
https://www.unodc.org/unodc/en/cybercrime/convention/home.html

For more information about Proofpoint, check out our website.

Subscribe & Follow:
Stay ahead of emerging threats, and subscribe! Happy hunting!

Chapters:

01:01 Why Pavlina Founded Critical Cyber
06:52 Building Community and Sharing Victims’ Stories
11:05 What Policymakers Miss About Cyber Harm
14:47 Moving Blame From Individuals to Systems
18:14 Cyberattacks as a Human Rights Crisis
20:07 The Normalization of Hospital Ransomware Attacks
25:20 How Attacks Ripple Out to Neighboring Hospitals
28:27 Holding People Accountable for Preventable Harm
32:17 Is Policy Focused on the Right Problems?
37:04 AI in Cybercrime, Defense, and Healthcare
44:30 Safety Lessons From Seatbelts and Aviation
48:06 What Gives Pavlina Hope

Send us fan mail!
Hello to all our cyber spooks!  
This week, Selena is joined by senior threat researcher Tim Kromphardt and, for his first time on the show, threat intelligence analyst Aron Salzman-deis. Together they dig into the strange and surprisingly persistent world of West African fraud.
Tim breaks down his latest research on scammers targeting universities. The scheme starts with fake password-reset emails and eventually lands with too-good-to-be-true campus job offers that do not end well. Tim also explains how he engages directly with these actors and uses tracking links to trace them back to the Lagos, Nigeria area.
Aron walks through a business email compromise and advance fee fraud cluster that has impersonated dozens of U.S. government agencies. 
The team also discusses how much generative AI is really changing fraud (it’s making the lures shinier, but not the payout), why the payment step still needs a human, and practical tips to protect yourself and the people around you. Plus: an unexpected Doctor Who tangent.
In this episode:
How “word word” coaching helps phishing forms evade detection
Why compromised .edu accounts are so valuable to scammers
Fake check scams and the 24–48 hour window fraudsters exploit
Turning victims into money mules
U.S. government impersonation, lookalike domains, and freemail reply-to tricks
What AI is and isn’t doing for fraud actors
Red flags, MFA, and why you should always get a second set of eyes
Whether you’re a new college student hunting for a part-time gig or a vendor answering a government request, the lesson is the same: slow down, look closely, and when something feels off, ask someone you trust. Fraud can happen to anyone, and it’s never embarrassing to ask for help.

Resources Mentioned:
https://www.proofpoint.com/us/blog/threat-insight/edu-account-takeover-job-scam-abuse-west-african-fraud-actors-target

For more information about Proofpoint, check out our website.

Subscribe & Follow:
Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail!
Hello to all our cyber pals!  
This week, Selena is joined by Carsten Meywirth, head of the Cybercrime Division at Germany’s Bundeskriminalamt (BKA), to talk about how law enforcement is taking the fight to cybercriminals and why he believes the good guys are gaining ground.
With more than 40 years in policing, Carsten traces the BKA’s cybercrime work from a two-person team in the 1990s to a dedicated division of roughly 300 people (and growing). He explains how the threat landscape changed: the rise of the crime-as-a-service economy around 2015, COVID-19 pushing everyone onto remote infrastructure (and criminals taking advantage of it), and Russia’s war against Ukraine accelerating some parts of the ecosystem. . He also describes how investigating cybercrime turns the traditional approach upside down. Investigators start with a victim and a digital crime scene, then follow the traces back to a real person.
The conversation covers:
What the Conti leaks revealed about ransomware groups that run like corporations, with CEOs, HR departments and IT teams
The BKA’s four pillars for fighting cybercrime: targeting actors, taking down infrastructure, following the money and disrupting criminal communications
How the 2021 Emotet takedown became the model for modern disruption operations
Operation Endgame, the largest public-private partnership cyber operation to date, which goes after droppers and loaders early in the ransomware kill chain, and the anime-style videos designed to spread mistrust in the underground
Why personal trust is what makes international and public-private cooperation work
The AI-enabled threats that concern him most, and how investigators are using AI too
Why he stays optimistic, and the one thing he wants every business leader and government official to understand about cybercrime
Tune in to hear how law enforcement and the private sector are coming together to raise the stakes for cybercriminals. As Carsten reminds us, the good guys always win.

Resources Mentioned:
https://www.bmi.bund.de/SharedDocs/pressemitteilungen/EN/2026/05/lagebild-cybercrime.html
https://www.operation-endgame.com/
https://www.europol.europa.eu/how-we-work/operations/operation-poweroff
https://www.proofpoint.com/us/blog/threat-insight/stealc-you-later-proofpoint-and-ibm-x-force-support-operation-endgame
https://www.proofpoint.com/us/blog/threat-insight/sayonara-socgholish-operation-endgame-disrupts-major-cybercrime-operation

For more information about Proofpoint, check out our website.

Subscribe & Follow:
Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail!
Hello to all our cyber party pals!  
This week, Selena is joined by co-host Sarah Sabotka (and several very persistent, very uninvited pod crashers) to talk about a threat that's landed in a lot of listeners' personal inboxes lately: malicious event invitations.
Selena and Sarah walk through what these lures actually look like — polished, Evite- or Paperless Post-style invitations for birthdays, weddings, baby showers, housewarmings, and even generic "Celebrate with Me" surprises, sent from real, compromised accounts belonging to people the recipient actually knows. Sarah explains why the generic, low-detail invites may be the most effective: they don't require any specific knowledge of the target to feel plausible, and they lean on curiosity and FOMO rather than fear, a notable departure from traditional phishing psychology.
The conversation dives into ATO jumping, the mechanism that makes this threat spread so efficiently — once a threat actor compromises one inbox, they mine the contact list and send credential phishing to those contacts, who then get compromised themselves, expanding the reach with every hop. Sarah also connects this lure to established delivery chains like RMM tooling (ScreenConnect, Atera) and credential phishing panels such as TA4903 and "Evil Tokens," which use AI-assisted, sometimes vibe-coded automation to filter, organize, and scale compromised mailboxes rather than to improve the social engineering itself.
Selena and Sarah also dig into:
Why CAPTCHA and Cloudflare challenges are increasingly bundled into these lures — both to build a false sense of legitimacy and to slow down defenders and researchers trying to analyze the infection chain
Why Microsoft 365 and Google accounts are such high-value targets: they're the hub for cloud documents, financial access, social platforms, and a trusted contact list an attacker can impersonate
Practical recovery steps if you've already entered your credentials: revoke active sessions, change your password, enable MFA (passkeys where possible), freeze accounts if financial exposure is a concern, and give your contacts a heads-up
Why smart, security-aware people still fall for these — FOMO and curiosity are natural human responses, not a knowledge gap, and no lure is universal, but there's a lure for everyone
The FTC's May consumer alert on fake party invitations, and simple habits (a quick text or call to confirm an invite) that can blunt the whole scam
Plus: several unannounced podcast "guests" (Tim, Isaac, and Jared) who show up mid-episode having fallen for the very scam being discussed, a genuinely useful tangent on TA2725's shifting tool preferences, and a closing thought on why these lures work in the first place — people miss connecting with each other.
Resources Mentioned:
Asked to Enter Your Email Address and Password to Open a Party Invite? That's a Scam — Federal Trade Commission

https://www.proofpoint.com/us/blog/threat-insight/remote-monitoring-and-management-rmm-tooling-increasingly-attackers-first-choice

For more information about Proofpoint, check out our website.

Subscribe & Follow:
Stay ahead of emerging threats, and subscribe! Happy hunting!

Send us fan mail!
Hello to all our cybernauts!
This week Selena is joined by not one, not two, but three guests — Mark Kelly, Julia Paluch, and Dave Galazin — to unpack Proofpoint's latest research. Mark walks through how it started: on August 28, the China-aligned actor TA412 (aka Violet Typhoon), previously known mostly for device registration phishing, suddenly began delivering a Chrome exploit — kicking off a frantic cross-team investigation involving partners at Google and Microsoft. Within days, three more state-sponsored clusters adopted the same exploit chain, dubbed BlueMoon; by the time the blog published, that number had grown to seven distinct clusters, plus an eCrime actor and a brand-new espionage group picking it up since.
Julia breaks down the Chrome half of the chain — a type confusion bug in the V8 engine chained with a sandbox escape — and introduces the concept of the "patch gap": the roughly four-week window between when a fix is committed to the public Chromium codebase and when it's fully rolled out to stable Chrome releases. During that window, the regression test accompanying the fix effectively doubles as a roadmap for building an exploit, especially with an LLM doing the heavy lifting of interpreting it.
Dave then covers the Windows half: a kernel heap bug that lets an attacker escalate from Chrome's heavily sandboxed, untrusted-integrity renderer process straight to full privileges — without needing any file system access first. He and Mark also make the case that this particular Windows exploit had likely been sitting unused for over a year, based on consistent compilation timestamps across the payload's debug information.
Selena, Mark, Julia, and Dave also dig into:
Why the deployment looked rushed: exploit kits full of debug logging and comments, a downloader left behind indefinitely, and a Windows exploit that doesn't even check what OS the victim is running
Historical precedent for this kind of rapid multi-actor tool sharing among Chinese threat actors, including 2021's ProxyLogon and 2025's ToolShell activity
Evidence pointing toward AI-assisted exploit development — including leftover debugging comments and variable names lifted straight from the public regression test
Whether the open-source community's transparency (public commits, public regression tests) needs to change in light of this kind of patch-gap weaponization
Why Windows zero-days are much rarer to find "on the shelf" than browser bugs, and what that implies about how this one got used
Practical defensive takeaways: post-exploitation detection still matters most, since noisy, AI-assisted tradecraft is easier to catch than the initial exploit itself
Plus: a very enthusiastic Chrome-tab-hoarding discussion, Julia's advice to enable Chrome crash reporting, and a well-earned round of "you need a vacation, Mark."
Resources Mentioned:
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days


https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880

For more information about Proofpoint, check out our website.