Adversary Universe Podcast

CrowdStrike
Adversary Universe Podcast

Modern adversaries are relentless. Today’s threat actors target organizations around the world with sophisticated cyberattacks. Who are they? What are they after? And most importantly, how can you defend against them? Welcome to the Adversary Universe podcast, where CrowdStrike answers all of these questions — and more. Join our hosts, a pioneer in adversary intelligence and a specialist in cybersecurity technology, as they unmask the threat actors targeting your organization.

  1. 1D AGO

    Where AI Fits in the Adversary’s Toolbox

    Would you rather have an adversary profile you based on your AI chat history or tell your AI chatbot to forget everything it knows about you? That’s one of many questions Adam and Cristian explore in this episode on how adversaries are integrating AI into cyberattacks. These days, it seems AI is everywhere — and that includes the adversary’s toolbox. Adam and Cristian describe multiple forms of malware that use AI in different ways, from identifying text in photos to writing code. And while these attacks still require humans to stitch all the pieces together, there is a growing concern that adversaries will continue to improve. Tune in to learn how adversaries are baking AI into their tools, and about Adam’s latest adventures in baking bread, in this episode of the Adversary Universe podcast.

    21 min

  2. MAY 28

    Catching Up on Cloud Attack Paths with Cloud Threat Specialist Sebastian Walla

    Today’s adversaries are increasingly operating in the cloud — and Sebastian Walla, Deputy Manager of Emerging Threats at CrowdStrike, is watching them. In this episode, he joins Adam and Cristian to dive into the latest cloud attack techniques and the adversaries behind them. So, who are they? SCATTERED SPIDER and LABYRINTH CHOLLIMA are two of the threat actors targeting and navigating cloud environments, but they have distinct methods of doing so. This conversation explores the different ways they slip into organizations undetected, some of the tools they rely on, and how they operate under the radar. It also touches on the future of cloud threat activity and AI’s influence on how these attacks are evolving. Of course, no Adversary Universe episode is complete without guidance. Adam, Cristian, and Sebastian share best practices for protecting enterprise cloud environments from these threats as adversaries continue to take aim.

    29 min

  3. MAY 8

    Inside the CrowdStrike 2025 Latin America Threat Landscape Report

    Latin America has become a hotspot for cyber activity. Threat actors around the world, particularly eCriminals, are targeting organizations operating in Central and South America, Mexico, and the Caribbean. Latin America-based cybercriminals are emerging as well.   The CrowdStrike 2025 Latin America Threat Landscape Report provides key insights into this activity. In its pages, the CrowdStrike Counter Adversary Operations team details the eCrime, targeted intrusions, hacktivist disruptions, and cyber espionage targeting organizations that operate in Latin America. And in this episode of the Adversary Universe podcast, Adam and Cristian give listeners a snapshot of the key findings. These include:   A 15% increase in Latin America-based victims named on data extortion and ransomware leak sites in 2024 Over one billion credentials leaked from Latin American organizations last year The evolving presence of eCriminals such as OCULAR SPIDER The activity of nation-state adversaries such as LIMINAL PANDA and VIXEN PANDA, both linked to China   Tune in to learn how this report came to be and understand some of the critical trends shaping the Latin America threat landscape. And of course, check out the report to learn all the details.   Links: Read the CrowdStrike 2025 Latin America Threat Landscape Report: https://www.crowdstrike.com/en-us/resources/reports/latam-threat-landscape-report/   Listen to our full episode on OCULAR SPIDER, referenced in this episode: https://open.spotify.com/episode/3gJMkVKuSfKhqSAHwMb7NX?si=cf2e453ebc0843a5   🎧 Spotify: https://open.spotify.com/show/1ZYDiiBuJvTx7YsvuCenEZ   🎧 Apple Podcasts: https://podcasts.apple.com/us/podcast/adversary-universe-podcast/id1694819239   🎧 Our site: https://lnkd.in/etSAySBb

    21 min

  4. APR 10

    OCULAR SPIDER and the Rise of Ransomware-as-a-Service

    Ransomware has become more difficult for organizations to defend against, but easier for adversaries to deploy. The rise of ransomware-as-a-service (RaaS) — a model in which ransomware operators write the malware and affiliates pay to launch it — has lowered the barrier to entry so threat actors of all skill levels can participate and profit.   OCULAR SPIDER is one such operator. This adversary, newly named by CrowdStrike, is associated with the development of ransomware variants including Cyclops, Knight, and RansomHub. They targeted hundreds of named victims between February 2024 and March 2025, according to CrowdStrike intelligence, and they focus on industries such as professional services, technology, healthcare, and manufacturing in regions including the United States, Canada, Brazil, and some European countries.   But OCULAR SPIDER is one of many operators in the ransomware space. Adam and Cristian take listeners back to the early days of ransomware and track its evolution, variants, and key players from the mid-2010s through the launch of RansomHub in 2024. They explain how RaaS works, why it appeals to adversaries and complicates attribution, and how defenders can prepare to face today’s ransomware threats.   Come for an update on Adam’s adventures in bread-making; stay for a deep-dive into the RaaS evolution and the threat actors driving it.

    29 min

  5. MAR 27

    Meet LUNAR SPIDER: The Inner Workings of an eCrime Adversary

    To anticipate threat actors’ behavior, we must understand them. That’s why CrowdStrike closely tracks the evolution and activity of 257 named adversaries, including the eCrime actor LUNAR SPIDER. “They almost behave like a startup; they’re constantly testing and innovating and developing what they’re doing,” Adam says of the group. “It’s an interesting paradigm when you think about how these eCrime actors operate.” In this episode, Adam and Cristian take a deep dive into the inner workings of LUNAR SPIDER, discussing their role in the complex eCrime ecosystem, their collaboration with other adversaries, and the evolution of their techniques, including changes to the BokBot/IcedID malware over time and their eventual transition to the Lotus loader. Tune in to learn what defenders should know about this threat actor’s behavior and how to defend against their evolving activity. Learn more about the eCrime ecosystem in this infographic.

    24 min

  6. MAR 13

    NSOCKS: Insights into a Million-Dollar Residential Proxy Service

    When an adversary wants to target an organization, they want to make it look like they’re coming from a regional or local internet service provider. This makes their activity seem more legitimate and buys time until they get caught. Proxies, which adversaries can use to conceal the origin of malicious traffic, are essential to this process.   NSOCKS is a residential proxy provider that CrowdStrike researchers dug into to learn more about how it was constructed and proactively identify how adversaries were using it to mask their attacks. They found that a range of internet of things (IoT) devices, such as home routers and network-attached storage (NAS) devices, are targeted by proxy providers to build out infrastructure and provide access to residential internet connections. Many of these devices have basic misconfiguration issues that make them accessible to attackers, but the CrowdStrike team was also able to identify a range of zero-day and n-day vulnerabilities being used.     Joel Snape, Senior Security Researcher at CrowdStrike, is part of that team. In this episode, Joel and Adam get into the details of the researchers’ findings, from how NSOCKS works to its takedown in late 2024 and the steps listeners can take to identify suspicious activity on their networks. Joel has presented this research at multiple security conferences — and now he brings it to the Adversary Universe podcast.

    31 min

  7. FEB 27

    China’s Cyber Enterprise Grows: CrowdStrike 2025 Global Threat Report

    China’s cyber enterprise is rapidly growing: China-nexus activity was up 150% across industries in 2024, with a 200-300% surge in key sectors such as financial services, media, manufacturing, and industrials/engineering. CrowdStrike identified seven new China-nexus adversaries in 2024. “After decades investing in offensive cyber capabilities, China has achieved parity with some of the top players out there, and I think that is the thing that should terrify everybody,” Adam says.   China-nexus threat actors aren’t the only ones evolving their cyber operations. As the CrowdStrike 2025 Global Threat Report shows, nation-state and eCrime adversaries spanning regions and skill levels are gaining speed and refining their techniques. They’re learning what works and what doesn’t, and they’re scaling their effective tactics to achieve their goals. So what works? Voice phishing (vishing) skyrocketed 442% between the first and second half of 2024 as adversaries leaned on vishing, callback phishing, and help desk social engineering to access target networks. Generative AI played a key role in social engineering, where its low barrier to entry and powerful capabilities help adversaries create convincing content at scale. Compromised credentials also proved handy last year, helping threat actors enter and move laterally through organizations and operate as legitimate users.  What doesn’t work as well? Malware. 79% of detections in 2024 were malware-free, indicating a rise in hands-on-keyboard activity as adversaries face stronger security defenses.  Tune in to hear Adam and Cristian dig into the key findings of the CrowdStrike 2025 Global Threat Report, which also examines the latest on cloud-focused attacks, vulnerability exploitation, and nation-state activity around the world.

    34 min

  8. FEB 20

    A Deep Dive into DeepSeek and the Risks of Foreign LLMs

    DeepSeek took the internet by storm earlier this year, making headlines and sparking conversations about its development, use, and associated risks. Today, Adam and Cristian take a deep dive into the new AI model. At a time when new AI models are constantly emerging, the launch of DeepSeek has led to questions and concerns around AI model security, data security, and national security. What is DeepSeek, and how was it trained? What are the risk implications of using it? Are there safe ways to explore new AI models, or should they be avoided entirely? And how worried do we need to be about data poisoning? Tune in for the answers to these questions and more in this episode of the Adversary Universe podcast.

    27 min
See All (52)

Trailer

4.9
out of 5
75 Ratings

About

Modern adversaries are relentless. Today’s threat actors target organizations around the world with sophisticated cyberattacks. Who are they? What are they after? And most importantly, how can you defend against them? Welcome to the Adversary Universe podcast, where CrowdStrike answers all of these questions — and more. Join our hosts, a pioneer in adversary intelligence and a specialist in cybersecurity technology, as they unmask the threat actors targeting your organization.

Information

  • Creator
    CrowdStrike
  • Years Active
    2023 - 2025
  • Episodes
    52
  • Rating
    Clean
  • Copyright
    © Copyright 2023 All rights reserved.
  • Show Website
    Adversary Universe Podcast

You Might Also Like

To listen to explicit episodes, sign in.

Stay up to date with this show

Sign in or sign up to follow shows, save episodes, and get the latest updates.
Select a country or region

Africa, Middle East, and India

Asia Pacific

Europe

Latin America and the Caribbean

The United States and Canada
OSZAR »