The 443 - Security Simplified

The 443 - Security Simplified features host Mark Laliberte interviewing Ryan Wilgus, a cybersecurity engineer for the Seattle Kraken, about protecting a professional sports organization.

The 443 - Security Simplified examines CVE-2025-55241, a Microsoft Entra ID vulnerability that could let an attacker impersonate global administrators across tenants with little logging.

Mark Liliberti and Corey Griner examine Google's report on UNC6040, a financially motivated voice-phishing cluster targeting IT support staff and Salesforce tenants with modified Data Loader applications.

The 443 - Security Simplified recaps Black Hat 2024 Day 2 through Moxley Marlinspike’s keynote and talks on deepfake provenance and immutable backups.

The 443 - Security Simplified presents WatchGuard Threat Lab's six cybersecurity predictions for 2026, including the decline of crypto ransomware, autonomous AI attacks, and wider Zero Trust Network Access adoption.

The 443 - Security Simplified examines malicious executables hidden in DNS text records, AI-assisted website cloaking, and Proofpoint’s report on attacks against Taiwan’s semiconductor sector.

Mark Laliberte and Corey examine a 10.0-CVSS authentication bypass in the PAC4JWT Java library, where a null-handling error allowed unsigned claims to skip validation.

The 443 - Security Simplified examines WatchGuard’s Q1 2025 Internet Security Report with host Corey Nockreiner and guest Ryan Estes.

The 443 - Security Simplified reviews WatchGuard Threat Lab’s Q1 2024 Internet Security Report using telemetry from Firebox appliances and endpoint products.

The 443 - Security Simplified examines the FCC’s addition of new foreign-made consumer routers to the Secure Networks Act covered list, leaving existing devices allowed but requiring exceptions for new products.

Mark Laliberte and Corey review The 443's 2024 cybersecurity predictions and grade each as a win, fail, or meh, with half credit for partial hits.

Mark and Corey examine JFrog's revival hijack technique, in which attackers reclaim deleted PyPI package names, including a Pingdomv3 update that attempted to retrieve a payload from Jenkins environments.

Mark Laliberte and Corey examine reports that CISA acting director Madhu Gaudamakala uploaded “for official use only” contract documents to public ChatGPT after receiving permission to use it.

Mark Belliberty and Corey examine Cisco ASA 5500X zero-days that attackers used against VPN appliances, including persistence in ROMMON that could survive reboots and normal upgrades.

The 443 - Security Simplified examines Chinese state-sponsored hacking allegations, CISA's proposed CIRCIA reporting rules, and Microsoft's 2023 Exchange Online intrusion.

The 443 - Security Simplified examines Change Healthcare's February 12 ransomware intrusion through a Citrix gateway without multi-factor authentication, which affected about 150 million customers and cost an estimated $872 million.

The 443 - Security Simplified examines three actively exploited VMware vulnerabilities, including CVE-2025-22224, which can let an attacker escape a guest virtual machine and execute code on the hypervisor.

The hosts discuss de-anonymizing the Tor network, banning Chinese tech in cars, and chaining low-severity vulnerabilities.

This episode covers recent attacks on edge networking equipment, including the WatchGuard Firebox vulnerability and Fortinet patches, plus a malicious Firefox extension.

This episode covers SharePoint zero-day vulnerabilities and a campaign of malicious Chrome extensions affecting 2.3 million users.

Mark Laliberte and Corey Bahumbug examine a surge of attacks against edge networking equipment, including Fortinet, Firebox, SonicWall, and Cisco systems.

Anthropic's Cloud Mythos preview and Project Glasswing anchor this episode, with Mark the Liberty and Corey Ironlegs-Knockreiner debating a model that Anthropic says found thousands of high-severity vulnerabilities in major operating systems and browsers.

Mark Laliberte and Corey Notleaky-Knockreiner open with Anthropic's Claude Code 2.1.88 leak, where a source map exposed more than 500,000 lines across about 2,000 TypeScript files.

The 443 Security Simplified covers the FCC's ban on new foreign-made consumer routers, Huntress's report on a 344-organization phishing campaign, and Google Cloud's H2 2025 Threat Horizons data.

Corey Nachreiner hosts The 443 Security Simplified podcast and talks with Kristen Yang, a lead in WatchGuard's Managed Detection and Response SOC, about her path from help desk to red teaming.

["The 443 Security Simplified episode centers on Stryker's network disruption, a weaponized Chrome extension called Shotbird, and Microsoft's Defender report on AI-assisted attacker workflows.", "Mark Laliberte and Corey Nachreiner say Stryker attributed a network disruption in its Microsoft environment to the Iran-linked Handala Group, with claims about 200,000 affected systems, 50 terabytes of data, and offices in 79 countries.", "The middle section examines Shotbird, a Chrome extension researchers say was transferred to a new Gmail address and then used to strip CSP and X-Frame-Options headers, register with command-and-control, and push fake Google update prompts.", "The close focuses on Microsoft's Defender team and the North Korea-linked threat actors Jasper Sleet and Coral Sleet, where AI was used for reconnaissance, phishing, fake personas, malware development, and post-compromise analysis."]

Mark Laliberte and Corey examine a 10.0-CVSS authentication bypass in the PAC4 JWT Java library, where an unsigned token inside a publicly encrypted payload could skip validation.

Mark the Liberty and Corey Friay-Knockreiner examine Cisco’s 10/10 Catalyst SD-WAN zero-day, which UAT8616 had reportedly exploited since at least 2023.

The 443 - Security Simplified examines WatchGuard Threat Labs' second-half 2025 Internet Security Report with hosts Mark Laliberte and Corey.

The 443 - Security Simplified examines Ring’s default-enabled Search feature, which uses nearby camera footage and AI to help locate lost dogs while raising surveillance and consent concerns.

Mark Laliberte and Corey Lobster-Knockreiner examine a Notepad++ supply-chain compromise attributed by Rapid7 to the Chinese threat actor Lotusbloom and its Chrysalis backdoor.

Mark Laliberte and Corey examine a Politico report that CISA acting director Madhu Gautamakala allegedly uploaded sensitive, for-official-use-only contract documents to public ChatGPT.

The 443 - Security Simplified examines a phishing campaign that used SEO poisoning and fake VPN clients to target WatchGuard, SonicWall, Check Point, Fortinet, F5, and other providers.

The 443 - Security Simplified examines a botnet estimated at 1.8 million devices whose command-and-control domain reportedly ranked first on Cloudflare's global domain popularity rankings, above Google.

The 443 - Security Simplified examines a two-week surge of attacks against edge devices, including Fortinet, Firebox, SonicWall, and Cisco systems.

The 443 - Security Simplified examines a two-week wave of attacks against edge networking equipment, beginning with Fortinet’s December 9 patch and Arctic Wolf’s report of exploitation three days later.

The 443 - Security Simplified presents six WatchGuard Threat Lab predictions for 2026, including the claim that crypto ransomware will largely give way to data theft and extortion.

Mark Laliberte and Corey Gobble Gobble Knockreiner examine ESET research on Plush Damon, a China-aligned APT using compromised network equipment, Edge Stepper, and Slow Stepper for adversary-in-the-middle attacks.

Mark Laliberte and Corey Super Tired Knockiner grade six WatchGuard cybersecurity predictions for 2025 using win, fail, and meh scores.

Mark Laliberte and Ryan Estes review ransomware activity that Ryan estimates is 30–40% higher than the previous year, with roughly 90–100 groups tracked.

The 443 - Security Simplified examines Salesforce customer compromises, including a claimed theft of about one billion records by the group calling itself Scattered Lapses Hunters.

The 443 - Security Simplified interviews WatchGuard MDR Data Science leader Luke Walcarp about traditional machine learning, neural networks, transformers, and cybersecurity applications.

The 443 - Security Simplified examines Cisco ASA 5500X zero-days that attackers used to implant malware, exfiltrate data, disable logging, and persist through ROMMON on devices without secure boot.

Mark the Liberty and Corey examine CVE-2025-55241, an Entra ID vulnerability that could grant global administrator access across tenants with little or no logging.

The 443 - Security Simplified examines an npm supply-chain attack affecting more than 20 packages with 2.67 billion combined weekly downloads.

Mark Filiberti and Corey Can't Be Trained Knockreiner examine a UC San Diego study of 20,000 employees, 10 simulated phishing campaigns, and an eight-month training experiment.

The 443 - Security Simplified examines Google's plan to extend developer verification to sideloaded apps on certified Android devices, with rollout beginning in Brazil, Indonesia, Singapore, and Thailand in 2026.

The 443 - Security Simplified, hosted by Mark Laliberte with Corey the Machine Knockriner, examines a Norwegian hydroelectric dam attack, Microsoft Copilot audit logs, and IBM and the Ponemon Institute’s 2025 breach report.

Mark Laliberte and Corey TotalBust Knockreiner review Amber Wolf’s DEF CON talk, which found authentication, traffic-steering, configuration-theft, and client-bypass flaws in Check Point, Netskope, and Zscaler ZTNA products.

The 443 - Security Simplified covers RomCom's exploitation of a WinRAR zero-day, SonicWall SSL VPN attacks, and the Agent Flayer prompt-injection research presented by Michael Bargery and Tamir Eshay-Sharbat at Black Hat.

Mark Laliberte and Corey discuss Microsoft’s 2025 SharePoint vulnerabilities, which enabled unauthenticated remote code execution on Internet-exposed on-premises servers.

The 443 - Security Simplified covers DNS-based file hiding, AI-assisted website cloaking, and phishing against Taiwan's semiconductor supply chain.

Corey Nockreiner and Ryan Estes analyze WatchGuard’s Q1 2025 Internet Security Report, including 4,204 blocked malware attempts per Firebox and a 171% quarter-over-quarter increase.

The 443 - Security Simplified revisits Microsoft's Windows Endpoint Security Ecosystem Summit after the CrowdStrike update caused millions of Windows endpoints to blue-screen.

The 443 - Security Simplified examines a phishing campaign that targeted nearly 70 organizations, about 95% in the United States, through Microsoft 365 Direct Send and QR-coded PDF lures.

Mark Liliberti and Corey Griner examine Google’s reporting on UNC6040, a financially motivated voice-phishing actor targeting IT support staff and Salesforce tenants with modified Data Loader applications.

Mark Laliberte and Adam Winston examine how attackers use AI for deepfakes, phishing, reconnaissance, vulnerability discovery, and polymorphic malware.

Mark for Liberty and Corey Autocomplete examine Coinbase's disclosure of a data-extortion incident involving contractors who accessed customer records without business need.

Mark Laliberte interviews Ryan Estes of the WatchGuard Threat Lab about the 2025 ransomware landscape and the WatchGuard tracker’s milestone of 250 annotated operators.

The 443 - Security Simplified hosts Mark Laliberte and Adam Winston examine whether AI can automate security operations while meeting compliance and privacy requirements.

Mark Laliberte and Corey examine the April 15 MITRE letter warning that the CVE program’s contract could expire on April 16, disrupting vulnerability numbering infrastructure.

Mark the Liberty and Corey’s Soapbox Polisher Knockriner examine Oracle’s notifications about a breach involving two obsolete servers, hashed passwords, and a $20 million ransom demand.

The 443 - Security Simplified examines Lucid, a phishing-as-a-service platform that supports RCS and iMessage campaigns, custom domains, APIs, and dashboards for stolen payment data.

The 443 - Security Simplified examines malware delivered through free online file converters, browser cache smuggling, and a cascading GitHub Actions supply-chain attack.

Mark Lillibriddy and Corey examine six NPM packages linked by Socket to North Korea's Lazarus group, including packages that imitated legitimate validators and carried information-stealing code.

The 443 - Security Simplified examines three active-threat stories: VMware ESXi, Workstation, and Fusion vulnerabilities; an Akira ransomware intrusion through a network camera; and Microsoft's analysis of Silk Typhoon targeting MSPs.

The 443 - Security Simplified examines Apple disabling Advanced Data Protection for new UK users after a UK government demand for access to encrypted data.

The 443 - Security Simplified examines PirateFi, a Steam game that reportedly unpacked Howard.exe, an information stealer linked by users to drained Roblox accounts and compromised Microsoft accounts.

The 443 - Security Simplified examines Chainalysis's finding that ransomware payments fell 35% in 2024 to roughly $815 million, despite a $75 million Dark Angels payment.

The 443 - Security Simplified examines whether CVSS can represent vulnerability risk after CISA rated a narrowly scoped Curl credential-leak issue 9.1 while Curl assessed it as low risk.

Mark Laliberte and Corey Islandbound Knockreiner examine a late-2024 campaign that hijacked roughly three dozen Google Chrome extensions, including Cyber Haven's data-loss-prevention extension.