Untangling Botnets

You're back home celebrating the holidays with friends and family, sharing stories, catching up, and discussing your plans for the year ahead. Next thing you know, that cousin who wouldn't stop sending you emails about the "future of bitcoin" and coin mining kicks the door open, and he's ready to spread some holiday knowledge. Oh yeah, he's also going to cut you in on a sweet deal he has going on with his buddy Carl, who he met at dollar wing night. Unfortunately, Carl is one of the bad guys. He is secretly infecting multiple devices with botnets, collecting crypto-cash at the expense of the naive device owners who don't know that their machines are being used.   In this episode of Security Unlocked, hosts Natalia Godyla and Nic Fillingham are re-joined by Microsoft Defender 365 threat intelligence team member Elif Kaya, whose current primary focus is with botnets, commodity threats, and phishing delivered malware. Elif explains some of the new techniques from botnets, how they're being used for financial theft via cryptocurrency mining, and the impact on the defender's view of these actions.  In This Episode You Will Learn:  An overview and detailed description of what botnets are The fundamentals of cryptocurrency mining & botnets on a machineBest practices when trying to identify new botnetsSome Questions We Ask:    How can Microsoft contribute to helping take down these botnets?  What direction are the new botnets moving towards? How common is competition-killing activity within new botnets and crypto mining? Resources: Phorpiex morphs: How a longstanding botnet persists and thrives in the current threat environment When coin miners evolve, Part 1: Exposing LemonDuck and LemonCat, modern mining malware infrastructure When coin miners evolve, Part 2: Hunting down LemonDuck and LemonCat attacks View Elif Kaya on LinkedInView Natalia on LinkedIn View Nic on LinkedIn  Related:   Listen to: Security Unlocked: CISO Series with Bret Arsenault Listen to: Afternoon Cyber Tea with Ann JohnsonDiscover and follow other Microsoft podcasts at microsoft.com/podcastsSecurity Unlocked is produced by Microsoft and distributed as part of The CyberWire Network.  Hosted on Acast. See acast.com/privacy for more information.