Research Saturday
Episodes
A new breed of RAT.
18 Apr 2026
Contributed by Lukas
Today we are joined by Dr. Darren Williams, Founder and CEO of BlackFog, to discuss his team's work on "Steaelite RAT Enables Double Extortion Attacks...
A wolf in admin clothing.
11 Apr 2026
Contributed by Lukas
Today we are joined by Selena Larson, Threat Researcher from Proofpoint research team and co-host of Only Malware in the Building, talking about thei...
Startup surge sparks spy interest.
04 Apr 2026
Contributed by Lukas
This week, we are joined by Santiago Pontiroli, Threat Intelligence Research Lead from Acronis TRU team, discussing their work on "New year, new secto...
When “safe” documents aren’t.
28 Mar 2026
Contributed by Lukas
Omer Ninburg, CTO of Novee Security, joins us on this episode of Research Saturday to discuss their work on "From PDF to Pwn: Scalable 0day Discovery ...
A subtle flaw, a massive blast radius.
21 Mar 2026
Contributed by Lukas
Yuval Avrahami from Wiz joins to share their work on "CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via ...
Your AI sidekick might be a spy.
14 Mar 2026
Contributed by Lukas
This week, we are joined by Or Eshed, Co-Founder and CEO from LayerX Security, discussing their work on "How We Discovered A Campaign of 16 Malicious ...
The scareware rabbit hole.
07 Mar 2026
Contributed by Lukas
This week we are joined by Marcelle Lee, cybersecurity consultant and researcher, discussing "CTI tradecraft: Investigating a mobile scareware campaig...
The parking lot of digital danger.
28 Feb 2026
Contributed by Lukas
This week we are joined by Dr. Renée Burton, Vice President of Infoblox Threat Intel, discussing "Parked Domains and Direct Search: An Underreported ...
Telegram for the throne.
21 Feb 2026
Contributed by Lukas
Today we have Tomer Bar, VP of Security Research at SafeBreach Labs, discussing their work on "Prince of Persia: A Decade of Iranian Nation-State APT ...
Stealer in the status bar.
14 Feb 2026
Contributed by Lukas
Today we have Ziv Mador, VP of Security Research from LevelBlue SpiderLabs discussing their work on "SpiderLabs IDs New Banking Trojan Distributed Thr...
The phishing kit that thinks like a human.
07 Feb 2026
Contributed by Lukas
Piotr Wojtyla, Head of Threat Intel and Platform at Abnormal AI, is discussing their work on "InboxPrime AI: New Phishing Kit Fueling Scalable, AI-Pow...
The link knows all.
31 Jan 2026
Contributed by Lukas
Muhammad Danish, University of New Mexico lead author and cybersecurity researcher, discussing his team's work on "Private Links, Public Leaks: Conseq...
Caught in the funnel.
24 Jan 2026
Contributed by Lukas
Today we have Andrew Northern, Principal Security Researcher at Censys, discussing "From Evasion to Evidence: Exploiting the Funneling Behavior of Inj...
Picture perfect deception.
17 Jan 2026
Contributed by Lukas
Today we are joined by Ben Folland, Security Operations Analyst from Huntress, discussing their work on "ClickFix Gets Creative: Malware Buried in Ima...
Walking on EggStremes.
10 Jan 2026
Contributed by Lukas
This week, we are joined by Martin Zugec, Technical Solutions Director from Bitdefender, sharing their work and findings on "EggStreme Malware: Unpack...
Don’t trust that app!
03 Jan 2026
Contributed by Lukas
While our team is out on winter break, please enjoy this episode of Research Saturday. Today we are joined by Selena Larson, co-host of ...
Excel-lerating cyberattacks.
27 Dec 2025
Contributed by Lukas
While our team is out on winter break, please enjoy this episode of Research Saturday. This week, we are joined by Tom Hegel, Principal Threat ...
The lies that let AI run amok.
20 Dec 2025
Contributed by Lukas
Darren Meyer, Security Research Advocate at Checkmarx, is sharing their work on "Bypassing AI Agent Defenses with Lies-in-the-Loop." Checkmarx Zero re...
Root access to the great firewall.
13 Dec 2025
Contributed by Lukas
Daniel Schwalbe, DomainTools Head of Investigations and CISO, is sharing their work on "Inside the Great Firewall." This two-part research project ana...
When macOS gets frostbite.
06 Dec 2025
Contributed by Lukas
Jaron Bradley, Director of Jamf Threat Labs, is sharing their work on "ChillyHell: A Deep Dive into a Modular macOS Backdoor." Jamf Threat Labs uncove...
A new stealer hiding behind AI hype.
29 Nov 2025
Contributed by Lukas
Please enjoy this encore of Research Saturday. This week, we are joined by Michael Gorelik, Chief Technology Officer from Morphisec, dis...
Two RMMs walk into a phish…
22 Nov 2025
Contributed by Lukas
Alex Berninger, Senior Manager of Intelligence at Red Canary, and Mike Wylie, Director, Threat Hunting at Zscaler, join to discuss four phishing lures...
When clicks turn criminal.
15 Nov 2025
Contributed by Lukas
Dr. Renée Burton, Vice President of Threat Intelligence from Infoblox, is sharing the team's work on "Deniability by Design: DNS-Driven Insights into...
A fine pearl gone rusty.
08 Nov 2025
Contributed by Lukas
Tal Peleg, Senior Product Manager, and Coby Abrams, Cyber Security Researcher of Varonis, discussing their work and findings on Rusty Pearl - Remote C...
Attack of the automated ops.
01 Nov 2025
Contributed by Lukas
Today we are joined by Dario Pasquini, Principal Researcher at RSAC, sharing the team's work on WhenAIOpsBecome “AI Oops”: Subverting LLM-driven I...
A look behind the lens.
25 Oct 2025
Contributed by Lukas
Noam Moshe, Claroty’s Vulnerability Research Team Lead, joins Dave to discuss Team 82's work on "Turning Camera Surveillance on its Axis." Team82 di...
Smile for the malware.
18 Oct 2025
Contributed by Lukas
Eclypsium researchers Jesse Michael and Mickey Shkatov to share their work on "BadCam - Now Weaponizing Linux Webcams." Eclypsium researchers disclose...
No honor among thieves.
11 Oct 2025
Contributed by Lukas
John Fokker, Head of Threat Intelligence at Trellix is discussing "Gang Wars: Breaking Trust Among Cyber Criminals." Trellix researchers reveal how th...
China’s stealthiest spy operation yet.
04 Oct 2025
Contributed by Lukas
Assaf Dahan, Director of Threat Research, Cortex XDR, at Palo Alto Networks, discussing Phantom Taurus, a new China APT uncovered by Unit 42. Unit 42 ...
Inside Curly COMrades.
27 Sep 2025
Contributed by Lukas
This week, we are joined by Martin Zugec, Technical Solutions Director from Bitdefender, sharing their work and findings on "Curly COMrades: A New Th...
Browser attacks without downloads.
20 Sep 2025
Contributed by Lukas
Today we are joined by Nati Tal, Head of Guardio Labs, discussing their work “CAPTCHAgeddon” or unmasking the viral evolution of the ClickFix brow...
Data leak without a click.
13 Sep 2025
Contributed by Lukas
Today we are joined by Amanda Rousseau, Principal AI Security Researcher from Straiker, discussing their work on "The Silent Exfiltration: Zero‑Clic...
Don’t trust that app!
06 Sep 2025
Contributed by Lukas
Today we are joined by Selena Larson, co-host of Only Malware in the Building and Staff Threat Researcher and Lead Intelligence Analysis a...
Cracks in the wall.
30 Aug 2025
Contributed by Lukas
This week, we are joined by Jamie Levy, Director of Adversary Tactics at Huntress, who is discussing their work on "Active Exploitation of SonicWall V...
Beyond the smoke screen.
23 Aug 2025
Contributed by Lukas
This week, we are joined by Dr. Renée Burton, VP of Infoblox Threat Intel, who is discussing their work on VexTrio, a notorious traffic distribution ...
The CVE countdown clock.
16 Aug 2025
Contributed by Lukas
Bob Rudis, VP Data Science from GreyNoise, is sharing some insights into their work on "Early Warning Signals: When Attacker Behavior Precedes New Vu...
When malware plays pretend.
09 Aug 2025
Contributed by Lukas
Nicolás Chiaraviglio, Chief Scientist from Zimperium's zLabs, joins to discuss their work on "Behind Random Words: DoubleTrouble Mobile Banking Troj...
nOAuth-ing to see here.
02 Aug 2025
Contributed by Lukas
This week, we are joined by Eric Woodruff, Chief Identity Architect at Semperis, discussing "nOAuth Abuse Alert: Full Account Takeover of Entra Cross-...
Muddled Libra: From Spraying to Preying in 2025 [Threat Vector]
26 Jul 2025
Contributed by Lukas
Please enjoy this Special Edition episode of the Threat Vector podcast with an update on our previous Muddled Libra coverage. Muddled Libra is bac...
Creeping like a spider.
19 Jul 2025
Contributed by Lukas
This week, we are pleased to be joined by George Glass, Associate Managing Director of Kroll's Cyber Risk business, as he is discussing their research...
Click here to steal.
12 Jul 2025
Contributed by Lukas
Today we are joined by Selena Larson, Threat Researcher at Proofpoint, and co-host of Only Malware in the Building, as she discusses their work on "Am...
Botnet’s back, tell a friend.
05 Jul 2025
Contributed by Lukas
Please enjoy this encore of Research Saturday. This week we are joined by Silas Cutler, Principal Security Researcher at Censys, asking ...
A tale of two botnets.
28 Jun 2025
Contributed by Lukas
This week we are joined by Kyle Lefton, Security Researcher from Akamai, who is diving into their work on "Two Botnets, One Flaw - Mirai Spreads Throu...
Signed, sealed, exploitable.
21 Jun 2025
Contributed by Lukas
Dustin Childs, Head of Threat Awareness at Trend Micro Zero Day Initiative, joins to discuss their work on "ZDI-23-1527 and ZDI-23-1528: The Potential...
Hiding in plain sight with vibe coding.
14 Jun 2025
Contributed by Lukas
This week, Dave is joined by Ziv Karliner, Pillar Security’s Co-Founder and CTO, sharing details on their work on "New Vulnerability in ...
A new stealer hiding behind AI hype.
07 Jun 2025
Contributed by Lukas
This week, we are joined by Michael Gorelik, Chief Technology Officer from Morphisec, discussing their work on "New Noodlophile Stealer Distributes Vi...
Triofox and the key to disaster.
31 May 2025
Contributed by Lukas
This week, we are joined by John Hammond, Principal Security Researcher at Huntress, who is sharing his PoC and research on "CVE-2025-30406 - Critical...
Pandas with a purpose.
24 May 2025
Contributed by Lukas
This week, we are joined by Deepen Desai, Zscaler's Chief Security Officer and EVP of Cyber and AI Engineering, taking a dive deep into Mustang Panda’...
Leveling up their credential phishing tactics.
17 May 2025
Contributed by Lukas
This week, Dave speaks with Max Gannon of Cofense Intelligence to dive into his team's research on "The Rise of Precision-Validated Credential Theft: ...
Hijacking wallets with malicious patches.
10 May 2025
Contributed by Lukas
This week, we are joined by Lucija Valentić, Software Threat Researcher from ReversingLabs, who is discussing "Atomic and Exodus crypto wallets targe...
When AI gets a to-do list.
03 May 2025
Contributed by Lukas
This week, we are joined by Shaked Reiner, Security Principal Security Researcher at CyberArk, who is discussing their research on"Agents ...
China’s new cyber arsenal revealed.
26 Apr 2025
Contributed by Lukas
Today we are joined by Crystal Morin, Cybersecurity Strategist from Sysdig, as she is sharing their work on "UNC5174’s evolution in China’s ongoin...
Crafting malware with modern metals.
19 Apr 2025
Contributed by Lukas
This week, we are joined by Nick Cerne, Security Consultant from Bishop Fox, to discuss "Rust for Malware Development." In pursuit of simulating real ...
The new malware on the block.
12 Apr 2025
Contributed by Lukas
This week, we are sharing an episode of our monthly show, Only Malware in the Building. We invite you to join Dave Bittner and cohost Selena Larson as...
Bybit’s $1.4B breach.
05 Apr 2025
Contributed by Lukas
Zach Edwards from Silent Push is discussing their work on "New Lazarus Group Infrastructure, Acquires Sensitive Intel Related to $1.4B ByBit Hack and ...
Breaking barriers, one byte at a time.
29 Mar 2025
Contributed by Lukas
This week, we are joined by Jon Williams, Vulnerability Researcher from Bishop Fox, discussing "Tearing Down (Sonic)Walls: Decrypting SonicOSX Firmwar...
Excel-lerating cyberattacks.
22 Mar 2025
Contributed by Lukas
This week, we are joined by Tom Hegel, Principal Threat Researcher from SentinelLabs research team, to discuss their work on "Ghostwriter | New Campai...
The ransomware clones of HellCat & Morpheus.
15 Mar 2025
Contributed by Lukas
Jim Walter, Senior Threat Researcher on SentinelLabs research team, to discuss their work on "HellCat and Morpheus | Two Brands, One Payload as Ransom...
Botnet’s back, tell a friend.
08 Mar 2025
Contributed by Lukas
This week we are joined by Silas Cutler, Principal Security Researcher at Censys, asking the important question of "Will the Real Volt Typhoon Please ...
Caught in the contagious interview.
01 Mar 2025
Contributed by Lukas
This week we are joined by Phil Stokes, threat researcher at SentinelOne's SentinelLabs, discussing their work on "macOS FlexibleFerret | Further Vari...
From small-time scams to billion-dollar threats.
22 Feb 2025
Contributed by Lukas
This week, we are joined by Selena Larson from Proofpoint, and co-host of the "Only Malware in the Building" podcast, as she discusses the research on...
Bot or not? The fake CAPTCHA trick spreading Lumma malware.
15 Feb 2025
Contributed by Lukas
Nati Tal, Head of Guardio Labs, discussing their work on "“DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dar...
Cleo’s trojan horse.
08 Feb 2025
Contributed by Lukas
Mark Manglicmot, SVP of Security Services from Arctic Wolf, is sharing their research on "Cleopatra’s Shadow: A Mass Exploitation Campaign Deploying...
A Digital Eye on supply-chain-based espionage attacks.
01 Feb 2025
Contributed by Lukas
This week, Dave Bittner is joined by Juan Andres Guerrero-Saade (JAGS) from SentinelOne's SentinelLabs to discuss the work his team and Tinexta Cyber ...
LightSpy's dark evolution.
25 Jan 2025
Contributed by Lukas
This week, we are joined by Ismael Valenzuela, VP of Threat Research & Intelligence, and Jacob Faires, Principal Threat Researcher, from Blackberry di...
A cute cover for a dangerous vulnerability.
18 Jan 2025
Contributed by Lukas
Nati Tal, Head of Guardio Labs, sits down to share their work on “CrossBarking” — Exploiting a 0-Day Opera Vulnerability with a Cross-Browser Ex...
The hidden cost of data hoarding.
11 Jan 2025
Contributed by Lukas
This week, we are joined by Kyla Cardona and Aurora Johnson from SpyCloud discussing their research "China’s Surveillance State Is Selling Citizen D...
Crypto client or cyber trap?
04 Jan 2025
Contributed by Lukas
Karlo Zanki, Reverse Engineer at ReversingLabs, discussing their work on "Malicious PyPI crypto pay package aiocpa implants infostealer code." Reversi...
On the prowl for mobile malware.
28 Dec 2024
Contributed by Lukas
This week, we are joined by Asheer Malhotra and Vitor Ventura from Cisco Talos, and they are discussing "Operation Celestial Force employs mobile and ...
Quishing for trouble.
21 Dec 2024
Contributed by Lukas
Adam Khan, VP of Security Operations at Barracuda, joins to discuss his team's work on "The evolving use of QR codes in phishing attacks." Cybercrimin...
Watching the watchers. IoT vulnerabilities exposed by AI.
14 Dec 2024
Contributed by Lukas
This week, we are joined by Andrew Morris, Founder and CTO of GreyNoise, to discuss their work on "GreyNoise Intelligence Discovers Zero-Day Vulnerab...
The JPHP loader breaking away from the pack.
07 Dec 2024
Contributed by Lukas
Shawn Kanady, Global Director of Trustwave SpiderLabs, to discuss their work on "Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader." ...
Leaking your AWS API keys, on purpose?
30 Nov 2024
Contributed by Lukas
Please enjoy this encore episode: Noah Pack, a SANS Internet Storm Center Intern, sits down to discuss research on "What happens when you accidentall...
Exposing AI's Achilles heel.
23 Nov 2024
Contributed by Lukas
This week, we are joined by Ami Luttwak, Co-Founder and CTO from Wiz, sharing their work on "Wiz Research Finds Critical NVIDIA AI Vulnerability Affec...
Credential harvesters in the cloud.
16 Nov 2024
Contributed by Lukas
This week we are joined by, Blake Darché, Head of Cloudforce One at Cloudflare, to discuss their work on "Unraveling SloppyLemming’s Operations Ac...
A firewall wake up call.
09 Nov 2024
Contributed by Lukas
Enjoy this special encore episode, where we are joined by Jon Williams from Bishop Fox, as he is sharing their research on "It’s 2024 and Over 178,0...
Velvet Ant's silent invasion.
02 Nov 2024
Contributed by Lukas
This week, we are joined by, Amnon Kushnir from Sygnia, who is sharing their work on "China-Nexus Threat Group ‘Velvet Ant’ Leverages a Zero-Day t...
LLM security 101.
26 Oct 2024
Contributed by Lukas
This week, we are pleased to be joined by Mick Baccio, global security advisor for Splunk SURGe, sharing their research on "LLM Security: Splunk & OWA...
New targets, new tools, same threat.
19 Oct 2024
Contributed by Lukas
This week we are joined by Chester Wisniewski, Global Field CTO from Sophos X-Ops team, to discuss their work on "Crimson Palace returns: New Tools, T...
Ransomware on repeat.
12 Oct 2024
Contributed by Lukas
In this episode, Trevor Hilligoss, VP of SpyCloud Labs at SpyCloud, discusses the increasing threat of ransomware, emphasizing the role of infostealer...
Podcast bait, malware switch.
05 Oct 2024
Contributed by Lukas
Joshua Miller from Proofpoint is discussing their work on "Best Laid Plans: TA453 Targets Religious Figure with Fake Podcast Invite Delivering New Bla...
Beyond the permissions wall.
28 Sep 2024
Contributed by Lukas
We are joined by Yves Younan, Senior Manager, Talos Vulnerability Discovery and Research from Cisco, discussing their work on "How multiple vulnerabil...
Hook, line, and sinker.
21 Sep 2024
Contributed by Lukas
Jonathan Tanner, Senior Security Researcher from Barracuda, discussing their work on "Stealthy phishing attack uses advanced infostealer for data exfi...
Spamageddon: Xeon Sender’s cloudy SMS attack revealed!
14 Sep 2024
Contributed by Lukas
Alex Delamotte, Threat Researcher from SentinelOne Labs, joins to share their work on "Xeon Sender | SMS Spam Shipping Multi-Tool Targeting SaaS Crede...
The playbook for outpacing China.
07 Sep 2024
Contributed by Lukas
This week, N2K's very own Brandon Karpf sits down with Kevin Lentz, Team Leader of the Cyber Pacific Project at the Global Disinformation Lab, and the...
Pop goes the developer.
31 Aug 2024
Contributed by Lukas
Tim Peck, a Senior Threat Researcher at Securonix, is discussing their work on "Threat actors behind the DEV#POPPER campaign have retooled and are con...
MaaS infrastructure exposed.
24 Aug 2024
Contributed by Lukas
Robert Duncan, VP of Product Strategy from Netcraft, is discussing their work on "Mule-as-a-Service Infrastructure Exposed." Netcraft's new threat int...
Essential tools with critical security challenges.
17 Aug 2024
Contributed by Lukas
Snir Ben Shimol from ZEST Security on their work, "How we hacked a cloud production environment by exploiting Terraform providers." In this blog, ZEST...
Prompts gone rogue.
10 Aug 2024
Contributed by Lukas
Shachar Menashe, Senior Director of Security Research at JFrog, is talking about "When Prompts Go Rogue: Analyzing a Prompt Injection Code Execution i...
Spinning the web of tangled tactics.
03 Aug 2024
Contributed by Lukas
This week, we are joined by Jason Baker, Senior Threat Consultant at GuidePoint Security, and he is discussing their work on "Worldwide Web: An Analys...
The Black Basta ransomware riddle.
27 Jul 2024
Contributed by Lukas
Dick O'Brien from Symantec Threat Hunter team is talking about their work on "Ransomware Attackers May Have Used Privilege Escalation Vulnerability as...
Olympic scammers go for gold.
20 Jul 2024
Contributed by Lukas
This week, we are joined by Selena Larson, Staff Threat Researcher, Lead Intelligence Analysis and Strategy at Proofpoint, as well as host of the "Onl...
On the prowl for mobile malware.
13 Jul 2024
Contributed by Lukas
This week, we are joined by Asheer Malhotra and Vitor Ventura from Cisco Talos, and they are discussing "Operation Celestial Force employs mobile and ...
Encore: Welcome to New York, it's been waitin' for you.
06 Jul 2024
Contributed by Lukas
Joshua Miller from Proofpoint joins Dave to discuss findings on "Welcome to New York: Exploring TA453's Foray into LNKs and Mac Malware." In mid May, ...
APT36's cyber blitz on India.
29 Jun 2024
Contributed by Lukas
Ismael Valenzuela, Vice President Threat Research & Intelligence, from Blackberry Threat Research and Intelligence team is discussing their work on "T...
Piercing the through the fog.
22 Jun 2024
Contributed by Lukas
Kerri Shafer-Page from Arctic Wolf joins us to discuss their work on "Lost in the Fog: A New Ransomware Threat." Starting in early May, Arctic Wolf's...
Exploring the mechanics of Infostealer malware.
15 Jun 2024
Contributed by Lukas
This week, we are joined by a Security Researcher from SpyCloud Labs, James, who is discussing their work on "Unpacking Infostealer Malware: What we’...
Riding the hype for new Arc browser.
08 Jun 2024
Contributed by Lukas
Jérôme Segura, Senior Director of Threat Intelligence at Malwarebytes, is discussing their work on "Threat actors ride the hype for newly released A...
1700 IPs and counting.
01 Jun 2024
Contributed by Lukas
Amit Malik, Director of Threat Research at Uptycs, is sharing their work on "New Threat Detected: Inside Our Discovery of the Log4j Campaign and Its X...
International effort dismantles LockBit.
25 May 2024
Contributed by Lukas
Jon DiMaggio, a Chief Security Strategist at Analyst1, is sharing his work on "Ransomware Diaries Volume 5: Unmasking LockBit." On February 19, 2024, ...