Risky Bulletin

In this sponsored interview James Wilson chats with Airlock Digital co-founders David Cottingham and Daniel Schell about how attackers are using LLMs to enumerate EDR detections.

LLMs dramatically reduce the time and specialist labour needed to extract rulesets out of EDR products. What once might have taken months of manual reversing can now be accelerated by “burning tokens”. The takeaway is that defenders increasingly need to assume attackers have visibility into how their endpoint security products work.



Show notes

A Russian hacking campaign targets Zimbra servers, the US accuses Moonshot AI of distillation attacks, Iran targets more PLC vendors, and Google adds selfie video to its login options.



Show notes



Risky Bulletin: Western cyber agencies warn of Russian hacks of Zimbra servers

Tom Uren and James Wilson talk about the future of open-weight models. For different reasons, both the Chinese and American governments have reasons to crack down on them.

They also talk about arrests of several members of the Scattered Spider juvenile cybercrime collective.

This episode is also available on YouTube



Show notes

Rogue OpenAI models were behind last week’s Hugging Face breach, the Linux kernel discloses 442 vulnerabilities as the AI bugpocalypse settles in, France becomes the first EU country to pass a social media age limit, and Germany takes down the Kratos phishing service.



Show notes



Risky Bulletin: Linux kernel discloses 442 CVEs as AI bugpocalypse settles in

In this edition of Between Two Nerds Tom Uren and The Grugq discuss what mainland Chinese analysts think about Russia’s use of cyber operations in the war in Ukraine.

This episode is also available on YouTube.



Show notes



Cyber Lessons from Russia's War in Ukraine