Department of Know: VoidLink threatens multi-cloud, flaw threatens Claude extension, China practices on infrastructure

·33 min·3 clips

Sarah Lane kicks off with John Collins and Adam Palmer sharing their hectic cybersecurity priorities after the holidays.

This episode of the Department of No features hosts Sarah Lane with guests John Collins, field CTO at GigaOM, and Adam Palmer, CISO at First Hawaiian Bank. The show operates as a virtual Monday strategy meeting for cybersecurity professionals. The episode is structured around a "no or no" segment where guests give quick takes on recent security stories. The first discussed story involves attackers exploiting vulnerabilities in SolarWinds Web Help Desk. The specific vulnerability is CVE-2021-35247, which allows for SQL injection. Attackers are using this flaw to deploy a web shell called "Solarmarker" on compromised servers. This activity represents a resurgence of attacks targeting a known SolarWinds product. The discussion then shifts to a new threat actor named "VoidLink" targeting multi-cloud environments. VoidLink employs a sophisticated technique called "living-off-the-land" to abuse legitimate cloud tools. Their attacks specifically target Kubernetes clusters and Docker containers for cryptocurrency mining. The group is notable for using encrypted tunnels to hide command-and-control traffic within normal cloud protocols. A key insight is that the SolarWinds attack exploits a vulnerability patched years ago, highlighting problems with update cycles. The guests note that VoidLink's method makes detection exceptionally difficult as it blends with administrative traffic. They emphasize that multi-cloud complexity inherently expands the attack surface for such threats. The conversation reveals that many organizations still struggle with basic vulnerability management for widely used software. The VoidLink tactics suggest a deep understanding of cloud architecture and native security tools. The segment underscores that legacy systems in modern environments create persistent risks. The tone is a fast-paced, conversational debate among seasoned industry practitioners. The style is educational but direct, focusing on immediate practical implications for security leaders. This episode is ideal for CISOs, cloud architects, and IT managers concerned with operational threat intelligence. Listeners seeking deep technical exploit analysis or non-cloud security topics might find the scope too narrow.

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Cybersecurity Headlines