Enterprise Security WeeklySubscribe
Vulnerability Management, Endpoint/Device Security, Patch/Configuration Management, Leadership, Breach, Acquisition, Threat Intelligence, Ransomware, Security Operations

Ransomware Attacks a Decade In: What Changed? What Didn’t? – benny Vasquez, Mike Mitchell – ESW #397

Full Audio

View Show Index

Segments

1. Ransomware Attacks a Decade In: What Changed? What Didn’t? – Mike Mitchell – ESW #397

2025 brings us close to an interesting milestone - ransomware attacks, in their current, enterprise-focused form, are almost a decade old. These attacks are so common today, it's impossible to report on all of them. There are signs of hope, however - ransomware payments are significantly down. There are also signs defenders are getting more resilient, and are recovering more quickly from these attacks.

Today, with Intel471's Mike Mitchell, we'll discuss what defenders need to know to protect against today's ransomware attacks. He'll share some stories and anecdotes from his experiences with customers. He'll also share some tips, and tricks for successful hunts, and how to catch attacks before even your tools trigger alerts.

Segment Resources:

Guest

Vice President of Threat Hunt Intelligence at Intel 471 at Intel 471

Mike Mitchell is Vice President, Threat Hunt Intelligence, of Intel 471. Prior to joining Intel 471, he was a co-founder of recently acquired threat hunting provider Cyborg Security. While at Cyborg, he was a cross-functional founder focused on technical implementation, sales, product architecture, and managing the content development team and its deliverables. Mike has more than 12 years of diverse cybersecurity experience in roles including senior solutions and security engineer, director of sales engineering to co-founder of Cyborg Security. Before his career in cybersecurity, Mike spent a number of years in pro baseball with the Colorado Rockies.

Hosts

Principal Researcher at The Defenders Initiative
Principal Analyst - Security at theCUBE Research
Product Marketer and Content Strategist at OX Security

2. AlmaLinux and the State of Open Source Enterprise Linux – benny Vasquez – ESW #397

And now, for something completely different!

I've always urged the importance for practitioners to understand the underlying technology that they're challenged with defending. When we're yelling at the Linux admins and DevOps folks to "just patch it", what does that process entail? How do those patches get applied? When and how are they released in the first place?

This is often one of the sticking points when security folks get nervous about "going open source", as if 90% of the code in their environments doesn't already come from some open source project. It's a legitimate concern however - without a legal contract, and some comfort level that a paid support team is actually going to fix critical vulnerabilities, how do we develop trust or a relationship with an open source project?

In this interview, benny Vasquez, the Chair of the board of directors for AlmaLinux, will fill in some of the gaps for us, and help us understand how an open source project can not only be trusted, but in many cases may be more responsive to security teams' needs than a commercial vendor.

Segment Resources:

Announcements

  • Identiverse 2025 is returning to Las Vegas, June 3-6. Hear from 250+ expert speakers and connect with 3,000+ identity security professionals across four days of keynotes, breakout sessions, and deep dives into the latest identity security trends. Plus, take part in hands-on workshops and explore the brand-new Non-Human Identity Pavilion. Register now and save 25% with code IDV25-SecurityWeekly at https://www.securityweekly.com/IDV2025

Guest

Chair of Board of Directors at AlmaLinux OS Foundation

benny is currently the Chair of the AlmaLinux OS Foundation, has a long history in business and community building, and a long and idealistic love of open source.

Hosts

Principal Researcher at The Defenders Initiative
Principal Analyst - Security at theCUBE Research
Product Marketer and Content Strategist at OX Security

3. Cybereason CEO quits, Skybox shuts down, More Bybit heist details – ESW #397

In the enterprise security news,

  1. Why is a consulting firm raising a $75M Series B?
  2. A TON of Cybereason drama just dropped
  3. Skybox Security shuts down after 23 years
  4. The chilling effect on security leaders is HERE, and what that means
  5. IT interest in on-prem, does NOT mean they’re quitting the cloud
  6. Updates on the crazy Bybit heist
  7. the state of MacOS malware
  8. Skype is shutting down
  9. Mice with CRISPR’ed woolly mammoth fur is NOT the real life Jurassic Park anyone was expecting

All that and more, on this episode of Enterprise Security Weekly.

Hosts

Principal Researcher at The Defenders Initiative
  1. 1. FUNDING: Provided by Security, Funded #183 – The Shutdown Blues

    This week's most interesting fundings!

  2. 2. UN-ACQUISITION: SoftBank-Backed Cybereason CEO Quits After Boardroom Turmoil

    The drama here is intense.

    Let's back up a bit and go through the whole story:

    • Cybereason was one of the original EDR vendors that emerged around the same time that next-gen AV started eating legacy AV's lunch. This resulted in Symantec, McAfee and several other security giants falling from grace and getting parted out by PE firms.
    • Cybereason had some great marketing and raised a lot of money - $800M, resulting in a $2.7B valuation at their peak - they were one of over 50 cybersecurity unicorns as recently as 2022.
    • Cybereason FILED FOR IPO in January 2022.
    • Then, they killed the IPO and were one of the first cybersecurity companies to announce layoffs, in mid 2022.
    • By April 2023, the news was that Cybereason cut their valuation by 90% (down to ~$250M)
    • In November 2024, we read press releases that Cybereason was set to merge with Trustwave.

    All right! Now we're all caught up to today's news. The main points here are that:

    • Cybereason's CEO is stepping down after fighting with investors for months
    • The merger with Trustwave has been terminated
    • The plan was to put an additional $100M into Cybereason, a deal that could still close within the next week, with the CFO stepping in as interim CEO.
  3. 3. SHUTDOWN: Skybox Security shuts down, lays off 300 employees as Tufin acquires assets

    There were once four firewall orchestration vendors: Firemon, AlgoSec, Tufin, and Skybox Security.

    Then the cloud happened.

    Now there are three.

    The End.

  4. 4. TRENDS: LLM Hacks Its Evals

    Agentic AI's amazing productivity hack? Cheat on the test.

    These things are getting WAY too human.

  5. 5. TRENDS: How to exploit top LRMs that reveal their reasoning steps

    As AI tools and models get more sophisticated, the problems get more complex and harder to solve.

  6. 6. TRENDS: Why Security Leaders Are Opting for Consulting Gigs

    Very few surprises in here, but interesting to see it called out as a larger trend. On a daily basis, I see folks laughing at even the IDEA of taking a CISO role.

  7. 7. TRENDS: Owen Rogers on LinkedIn: *Treat claims of cloud repatriation with caution*

    TL;DR - there are stories about orgs pulling workloads out of the cloud, but it's more of a redistribution of resources into a hybrid model, not a widespread trend of folks "quitting the cloud."

  8. 8. BREACHES: Bybit Hack Traced to Safe{Wallet} Supply Chain Attack Exploited by North Korean Hackers

    Here are the latest updates on the largest heist in history (digital currency or otherwise):

    1. Bybit wasn't compromised directly - a third party, Safe{Wallet} was the source of the attack
    2. The attack has been attributed to North Korea - crypto theft makes up a large portion of the country's GDP
    3. Bybit offered a $140M bounty to anyone that can trace the stolen funds (which it has already covered with private funds it had in reserve)
    4. Bybit announced that 3% of the stolen funds were frozen, 20% had 'gone dark' and 77% was still traceable, despite going through several tumblers and getting converted into Bitcoin.

    A great writeup here, from Elliptic, provides some insight on how it's even possible to steal $1.5B in cryptocurrency and potentially get away with it.

  9. 9. RESEARCH: The Mac Malware of 2024: A comprehensive analysis of the year’s new macOS malware

    If you're defending Macs, this is worth a read to understand what the latest Mac malware is up to!

  10. 10. RESEARCH: How We Hacked Multi-Billion Dollar Companies in 30 Minutes Using a Fake VSCode Extension

    I'm not a huge fan of security orgs testing theories in production, but this is a good reminder that your employees will do 0.3 seconds of due diligence before clicking on something, probably not even registering the misspelling.

    We just need to plan for that and be ready to protect them when they screw up.

  11. 11. EPITAPH: As Skype shuts down, its legacy is end-to-end encryption for the masses

    Skype was E2EE before it was cool

  12. 12. MEDIA: Zero Day (American TV series) – Wikipedia

    Just heard about this today, so I know nothing about it. I'll be back next week with reviews!

  13. 13. SQUIRREL: Scientists genetically engineer mice with thick hair like the extinct woolly mammoth
Principal Analyst - Security at theCUBE Research
Security Researcher
Product Marketer and Content Strategist at OX Security

Related

SignalGate and How Not To Protect Secrets – PSW #867

How do we handle scope creep for vulnerabilities?, find the bugs before it hits the real world, risk or hype vulnerabilities, RTL-SDR in a browser, using AI to hack AI and protect AI, 73 vulnerabilities of which 0 patches have been issued, Spinning Cats, bypassing WDAC with Teams and JavaScript, Rust will solve all the security problems, did you he...

You can skip this ad in 5 seconds