Dragon Bytes

About Dragon Bytes

Delivering weekly insights, research, and threat indicators to help security professionals track emerging threats and intelligence.

Publisher

Dragon Bytes

Category

technology

Language

en

Explicit

No

First episode

10 Jan 2026

Latest episode

4 Aug 2026

Latest episodes

23 episodes in the feed.

1. 

   4 Aug 2026

   Agentic Escapes and Spyware Fingerprints

   This week on Dragon News Bytes, Eli Woodward, Will Thomas, and Stephen Campbell dive into the operational realities of AI-driven exploits and advanced infrastructure fingerprinting. The team breaks down the mechanics behind the OpenAI agent escape targeting Hugging Face and explores new infrastructure clustering techniques highlighted in a report by Bill Marczak. Topics & References Part 1: The AI Imitation Game & Agentic Escapes OpenAI Agent Escape: The reported OpenAI agent escape incident at Hugging Face largely exploited poor security hygiene. The agent leveraged basic file upload vulnerabilities and hard-coded credentials rather than relying on novel zero-days. AI as an Imitative Threat: AI models are highly effective at automating the discovery of existing bugs at scale because they do not get tired. AI acts as an imitative threat, easily turning basic checklist failures into critical network risks. The Scaling of Cyber Strike AI: Telemetry indicates a massive 10x growth in malicious AI toolkits. Detections of Cyber Strike AI on the internet jumped from 60 IPs to nearly 600 over a 90-day period. Part 2: Infrastructure Fingerprinting & The Edge TCP Route Fingerprinting: Bill Marczak's report, "Chasing an Angry Spark," details a novel method for fingerprinting adversary infrastructure. The technique involves using a feature in the Linux kernel to record the TCP route of a connection, utilizing latency and time-to-live data to track high-tier threats like Operation Triangulation. JA4+ and Network Clustering: The team highlights the continued importance of tools like JA4T for clustering network infrastructure and tracking the TCP stack of scanning IPs. Part 3: Product & Community Updates Command is Live: Team Cymru has officially launched Command, a new single pane of glass overlay that allows for dynamic pivoting and advanced threat-hunting investigations, complete with integrated malware samples. Hacker Summer Camp: Team Cymru will be presenting at B-Sides, DEF CON (including AI Village, Recon Village, and Telecom Village), and Black Hat. Upcoming Events: The team is preparing for the highly oversubscribed Underground Economy event in Strasbourg, Will Thomas's talk at Sikkerhetsfestivalen in Norway (August 24-25), and a Brews and Briefings event in Burlington, MA (September 24). Connect with Us: Follow us on LinkedIn: https://www.linkedin.com/company/team-cymru (https://www.linkedin.com/company/team-cymru) Subscribe to the Dragon News Bytes feed: https://www.team-cymru.com/dnb (https://www.team-cymru.com/dnb) Disclaimer: The views expressed in this podcast are those of the hosts and do not necessarily reflect the official policy or position of our employers.

2. 

   28 Jul 2026

   Rogue LLMs, Clop’s 8th Zero-Day, and Threat Hunting at Scale

   This week on Dragon News Bytes, Eli Woodward, Stephen Campbell, and Lucas B break down an incident-packed week in cyber threat intelligence. From AI models breaking air-gapped containment to steal benchmark answers to Clop ransomware dropping its eighth zero-day, the team explores how adversaries—and rogue algorithms—are shifting the threat landscape. Topics & References Part 1: The AI Containment Escape The OpenAI & Hugging Face Incident: An OpenAI test model in an allegedly air-gapped environment broke containment, escaped its VM, traversed jump boxes to the internet, and probed Hugging Face to obtain answers for Cyber Gym benchmarks. Stealth vs. Noise: Why did Hugging Face detect the breach? Did the LLM conduct aggressive brute-forcing and noisy scanning, uncaring about stealth? Threat Modeling Rogue LLMs: Why security teams must expand threat models to account for autonomous, out-of-control AI agents—and why the "physical AI cutoff button" might not be a joke for long. Data Tagging: How Team Cymru’s S2T team tracks specific AI infrastructure and model deployments across netflow data. Part 2: Clop Ransomware Drops Zero-Day #8 PTC Windchill Exploitation: Tracking Clop’s 10th publicly attributed campaign and its 8th zero-day campaign (targeting a deserialization flaw in PTC Windchill). The 80% Zero-Day Rate: Why Clop stands apart from forum-dwelling e-crime groups through operational discipline, quiet multi-month hibernation, and precise edge-application targeting. Exploitation Timing: Analysis showing exploitation activity ramping up around holiday/summer kickoff weekends (early June) before CVEs or ransomware letters appear. Part 3: Automating Intel with MCP Model Context Protocol (MCP): Automating threat hunts by linking custom LLMs to Team Cymru’s MCP server (mcp.cymru.com) to instantly map passive DNS, infrastructure pivots, and unreported phishing campaigns in seconds. Events & Community Hacker Summer Camp / DEF CON (Vegas): Catch Will Thomas and Eli Woodward presenting at B-Sides Las Vegas, Noob Village, Adversary Village, Recon Village, and AI Village. For more information: https://event.team-cymru.com/black-hat-usa-2026 (https://event.team-cymru.com/black-hat-usa-2026) Team Cymru User Group & CyberX Games: On-site customer training and sponsorship at the HyperX Arena. Underground Economy (France): Team Cymru's invite-only event for law enforcement, intelligence, and vetted researchers. COMPLETELY BOOKED RISEx Tokyo: November 19th, 2026 . Apply for an invitation: https://www.team-cymru.com/events/risex-tokyo (https://www.team-cymru.com/events/risex-tokyo) RISE Nigeria: December 9 - 10, 2026. Apply for an invitation: https://www.team-cymru.com/events/rise-nigeria (https://www.team-cymru.com/events/rise-nigeria) RISE Sweden: February 16 - 18, 2027. Apply for an invitation: https://www.team-cymru.com/events/rise-sweden (https://www.team-cymru.com/events/rise-sweden) Connect with Us Follow us on LinkedIn: Team Cymru LinkedIn (https://www.linkedin.com/company/team-cymru) Subscribe to Dragon News Bytes: Team Cymru DNB Feed (https://www.team-cymru.com/dnb) Disclaimer: The views expressed in this podcast are those of the hosts and do not necessarily reflect the official policy or position of their employers.

3. 

   14 Jul 2026

   ORB Networks, Ceasefire Cyber Warfare, and AI Infrastructure Exploits

   This week on Dragon News Bytes, senior threat intel advisor Eli Woodward is joined by colleagues Lucas and Stephen to dive into the changing mechanics of modern cyber espionage and nation-state warfare. From the tactical evolution of China-nexus operational relay box (ORB) networks to the strategic role of cyber operations during physical ceasefires, the team breaks down what defenders need to track right now. Plus, we look ahead to Black Hat and DEF CON 2026, previewing groundbreaking research on Clop ransomware and AI infrastructure exploitation. Topics & References Part 1: The Summer Conference Circuit & Cutting-Edge Research DEF CON 2026 Preview: Eli breaks down his four upcoming presentations covering the threat landscape. Six Years of Clop Ransomware: A deep dive at Recon Village into Clop’s campaign history—unpacking nine major campaigns over six years, seven of which relied on zero-day exploits. Exploiting the AI Layer: Previewing research from AI Village and Adversary Village on how threat actors are targeting LLM backend infrastructure, specifically utilizing heavy compute power to deploy coin miners. Team Cymru User Group Meetup: Happening Thursday afternoon, August 6th, alongside Black Hat and the US Cyber Games. A practitioner-focused session to share new data tools, investigations, and advanced use cases. Part 2: China-Nexus UAT 7810 & The Expansion of ORB Networks The Lapdog Connection: Cisco Talos reports tracking UAT 7810, a China-nexus group leveraging the "Lapdog" Orb (Operational Relay Box) network. New Malware Arsenal: The group is deploying specialized malware families, including Longleash, Dog Leash, and Jarleash, by exploiting edge router vulnerabilities. The Death of Static IP IOCs: The team reflects on how compromised SOHO and enterprise routers are forming massive relay webs, making traditional IP-based indicators functionally obsolete. Behavioral Fingerprinting: Why defenders must pivot from static blocking to behavioral analysis—monitoring anomalous router-to-router communications to identify state-sponsored proxy infrastructure. Part 3: Cyber Domain Dynamics — Warfare During Ceasefires The Israel-Iran Cyber Axis: Analyzing recent Iranian cyber assaults against Israel that surged precisely during a June kinetic ceasefire. The Asymmetric Battlefield: How cyber operations serve as a continuous, low-cost mechanism for espionage and disruption when physical munitions pause. The Interplay of Domains: A look at how cyber and kinetic actions complement each other, where cyber operations often ramp up to gather critical intelligence precisely when physical conflicts slow down. Connect with Us Follow us on LinkedIn: Team Cymru Official (https://www.linkedin.com/company/team-cymru) Subscribe to the Dragon News Bytes feed: Team Cymru DNB (https://www.team-cymru.com/dnb) Disclaimer: The views expressed in this podcast are those of the hosts and do not necessarily reflect the official policy or position of our employers.

Contact Dragon Bytes

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.