App Store

Google Play

is Device Banner Block 894x1036

Stígðu inn í heim af óteljandi sögum

Hlustaðu og lestu

N2K Networks

Deception, influence, and social engineering in the world of cyber crime.

Hacking Humans

Please enjoy this encore of Word Notes. 

A set of services for managing identity and access management, or IAM across all of an organization's data islands.

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/identity-fabric⁠

Audio reference link: “⁠Leadership Compass Identity Fabrics - Analyst Chat 126⁠,” by KuppingerCole, YouTube, 30 May 2022.

Identity Fabric (noun) [Word Notes]

Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is ⁠⁠⁠⁠Selena Larson⁠⁠⁠⁠, ⁠⁠⁠⁠Proofpoint⁠⁠⁠⁠ intelligence analyst and host of their podcast ⁠⁠⁠⁠DISCARDED⁠⁠⁠⁠. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts ⁠⁠⁠⁠N2K Networks⁠⁠⁠⁠ ⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠ and ⁠⁠⁠Keith Mularski⁠⁠⁠, former FBI cybercrime investigator and now Chief Global Ambassador at ⁠⁠⁠Qintel⁠⁠⁠.

Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this spooky special episode, our hosts ponder which threat actor, malware, or campaign name would be the most terrifying — from the spectral stealth of GhostRAT silently haunting your systems, to the deceptively sweet lure of ILoveYou that once spread chaos across the globe. Along the way, they share some of their favorite “ghost stories” from the cyber underworld — legendary incidents and infamous operations that still haunt defenders today — and explore why these names and their real-world impacts have left such lasting scars on the digital landscape.

Plus, we’ve cooked up a fun, mystery-solving video to accompany this episode — complete with spooky clues, masked sleuths, and a few laugh-out-loud moments that fans of classic cartoon detectives will appreciate. Check it out on YouTube and see if you can unmask the culprit!

When malware goes bump in the night.

This week, our hosts ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠ , ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start off with a celebration of Cybersecurity Awareness Month. Joe's story is on how the North Wales Police are warning cryptocurrency holders after a victim lost £2.1 million in Bitcoin to a highly targeted scam, where criminals posing as police used a fake security breach story to trick them into entering their password on a fraudulent site. Dave has two stories this week, the first one from a Reddit user being targeted by the classic "White Van Scam," where scammers tried to sell cheap projectors as high-end equipment using a fake story and forged receipt. In his second story, the FBI is warning that cybercriminals are spoofing its official IC3 website to steal personal information and scam victims, urging users to type the URL directly and avoid suspicious links or fake social media pages. Maria has the story on two U.S. senators pressing Tinder parent company Match Group to step up efforts against romance scams, demanding details on how it detects fraud and protects users from criminals exploiting trust on its platforms. Our catch of the day comes from Reddit where a user was targeted by a scammer, but cleverly was able to get them to retreat. 

Resources and links to stories:

 Police issue warning after £2.1m Bitcoin 'scam'

 FBI Says Threat Actors Are Spoofing its IC3 Site

 Someone hit me with the "White Van Scam" - in this day and age!

 Two US senators urge Tinder parent to act against dating scams on its apps

 Sister died

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠hackinghumans@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.

Lock your doors and check your URLs.

Please enjoy this encore of Word Notes. 

A cybersecurity first principle strategy focused on disrupting known adversary activity at one of several phases of an attack sequence.

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/intrusion-kill-chain⁠

Audio reference link: "⁠Cybersecurity Days: A Network Defender's Future⁠," by Rick Howard, Integrated Cyber Conference, Integrated Adaptive Cyber Defense (IACD), YouTube, 26 October 2018.

Intrusion Kill Chain (noun) [Word Notes]

This week, while⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner is out, ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Listener Daniel shares a follow-up where scammers exploited details from a Texas car accident to pose as claim assistants, highlighting the importance of working only with your insurance or official state agencies. Joe follows the story of Iowa authorities uncovering a nationwide texting scam run from inside a Georgia prison, and a Cincinnati man pleading guilty to stealing over $2 million through dating app fraud. Maria covers two stories this week, one on how human trafficking victims are being forced to run online scams across Southeast Asia’s billion-dollar fraud industry, and another on cybercriminals using “SMS blasters” to push mass scam texts directly to nearby phones by impersonating cell towers. Our catch of the day comes from Reddit where a user received a deceiving letter by mail. 

Resources and links to stories:

 Crash reports and records

 Fredericksburg Texas Police Department's post

 Iowa judge sentences four for text scam run from Georgia prison

 Cincinnati man pleads guilty to scamming dozens out of over $2 million in dating app fraud

 Scammed into scamming

 Cybercriminals Have a Weird New Way to Target You With Scam Texts

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠hackinghumans@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.

The new weapon in text scams.

Please enjoy this encore of Word Notes.

A subset of security orchestration, the management of identities across an organization's set of digital islands. 

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/identity-orchestration

Identity Orchestration (noun) [Word Notes]

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with a scam warning from Michal, who is sharing the latest conference scam. Dave's got the story of a retired federal investigator who mapped out the “Scammer Psychological Kill Chain” and shared rules to help you spot and break it. Maria has the story of job scams surging over 1,000% in 2025, as scammers exploit a slowing labor market and desperate jobseekers with fake offers, texts, and bogus recruiter schemes. Joe follows the story on a $4 million forex scam where two men promised safe, high returns but instead ran a Ponzi scheme that defrauded 20 investors before landing in federal prison. Our catch of the day comes from listener Shannon who writes in to share a message from "Amazon" about a recall notice. 

Resources and links to stories:

 Job Scams Surge 1,000% As Americans Struggle to Find Work

 Forex Account: What It Means and How It Works

 Ex-NYPD Cop Gets 36 Months In $4M Forex Scam That Duped 20 Investors: Feds

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠hackinghumans@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.

Scammers are recruiting.

Please enjoy this encore of Word Notes. 

A cyber threat intelligence analysis model that defines relationship pairs between four core components in the shape of a diamond of adversary playbook activity across the intrusion kill chain: the adversary, their capability, the infrastructure used or attacked, and the victim.

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/diamond-model ⁠

Audio reference link: “⁠Diamond Presentation v2 0: Diamond Model for Intrusion Analysis – Applied to Star Wars’ Battles⁠,” Andy Pendergrast and Wade Baker, ThreatConnect, YouTube, 4 February 2020.

Diamond Model (noun) [Word Notes]

This week, our hosts⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Space Daily show) are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Maria's story is on her recent close encounter with a Facebook scam. Dave's story is on a new strain of spyware that automates sextortion by detecting when users watch pornography, then secretly capturing both browser screenshots and webcam photos to blackmail victims. Joe's story is on the power of metadata, sharing how even limited browsing data from his machine learning class revealed personal details like daily routines, house hunting, and financial institutions. Our catch of the day comes from the Scams subreddit, featuring a phony Illuminati recruitment email promising power, wealth, and recognition in exchange for personal information.

Resources and links to stories:

 Automated Sextortion Spyware Takes Webcam Pics of Victims Watching Porn

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠hackinghumans@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.

How little data reveals a lot.

Please enjoy this encore of Word Notes. 

A knowledge base of adversary tactics, techniques, and procedures established and maintained by the MITRE Corporation. 

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/mitre-attck⁠

Audio reference link: “⁠Attack Frameworks - SY0-601 CompTIA Security+ : 4.2⁠,” Professor Messer, YouTube, 29 April 2021.

MITRE ATT&CK (noun) [Word Notes]

Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by N2K Networks Dave Bittner and Rick Howard to uncover the stories behind notable cyberattacks.

Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode and since it is February (the month of love as Selena calls it), we talk about romance scams known throughout the security world as pig butchering. And, Rick's experiencing a bit of a Cyber Groundhog Day in his newly-realized retirement.

Cyber Groundhog Day and romance scams. [Only Malware in the Building]

Hlustaðu og lestu

Other podcasts you might like ...