Risky Business Features

In this podcast Patrick Gray and The Grugq chat to Nazar Tymoshyk about Russia’s use of AI in recent state-back cyberattacks against Ukraine. Nazar is the founder and CEO of Ukraine-based cybersecurity firm UnderDefence. He also spent the first few years of the war working for Ukraine’s CERT. The three discuss the speed and impact of these automated attacks and how organisations can best prepare themselves against AI-scaled attacks. This episode is also available on YouTube.

In this solo Risky Business Features episode, James Wilson looks at the string of recent AI benchmark cheating escapades and how they’ve reshaped his thinking about LLMs and vulnerability research. He explores the current benchmarks and exactly how agents go about gaming the testing system to achieve their tasks. And why understanding that has changed the way he interacts with his agents.

In this solo Risky Business Features episode, James Wilson explains why “number of bugs” fixed in any given update is a misleading metric. We’ve seen up to 1,000 individual bug fixes in a single update recently, but that doesn’t give defenders the full picture they need to manage risks. Not all bugs are equally exploitable, so the industry needs to catch up to the bugpocalypse with more transparency. And maybe an entirely different approach to patching.

In this podcast episode, investigative journalist Geoff White joins James Wilson to talk about what happens to the money after ransomware gangs get a payday. The payment itself might be in the millions, but it’s difficult for gangs to convert their ill-gotten crypto gains into cash they can actually spend. Geoff explains the role of professional launderers and why cash-rich drug gangs are useful connections for crypto-rich cybercriminals. They also dive into who operates these international laundering networks, other types of crime they enable, and whether this affects the argument of whether victims should be allowed to pay.

In this podcast episode, OpenSourceMalware founder Paul McCarty joins James Wilson to explain how researchers find and analyse malicious packages, GitHub repositories and developer tools. Paul walks James through static analysis, deobfuscation and reconstructing multi-stage kill chains to identify what attackers are trying to steal. They also discuss how LLMs make malware development easier while introducing operational security mistakes. The pair examine DPRK tradecraft, blockchain-based payload delivery and what Paul calls Pollen Rider, which can reinfect developers through their own repositories.