In this episode of the Malspace Podcast, I sit down with Cris Kittner, Senior Manager of Threat Research Engineering at Proofpoint, for a deep and personal conversation about her remarkable journey through the world of cyber threat intelligence.
From growing up in Brazil during times of political unrest to working her way into the U.S. defense sector, Cris shares how her passion for understanding violent extremism and security evolved into a career at the forefront of cybersecurity — including over a decade at Mandiant, Google Cloud, and now Proofpoint.
Together, we explore:
How curiosity and persistence shaped Cris’s unconventional path into cyber intelligence
Lessons from working with legendary figures in APT research at Mandiant
The growing overlap between nation-state and e-crime operations — and why breaking down silos is vital for modern threat analysis
Her leadership philosophy around psychological safety, mentorship, and preventing burnout
How human connection — and even friendship bracelets — can strengthen cybersecurity teams
It’s an inspiring conversation about adaptability, empathy, and the evolving landscape of threat intelligence — told through the lens of one of the field’s most passionate voices.
10 Jul 2025TRANSCRIPT
Multiple Actors, One Breach - Rethinking Threat Models in 2025
In this episode, Julien sits down with Chi En (Ashley) Shen, a distinguished threat researcher at Cisco Talos.
Ashley shares her fascinating journey from hacking forums in Taiwan to leading threat intelligence at global giants like Google and Mandiant.
Together, they explore the rising trend of compartmentalized cyberattacks, the evolving role of Initial Access Brokers (IABs), and Ashley’s proposed enhancements to the Diamond Model. The episode also dives into her work promoting diversity in cybersecurity through initiatives like HITCON Girls and Raclette.
Links:
Ashley on Bluesky (https://bsky.app/profile/ashl3y-shen.bsky.social)
Ashley’s podcast Hacks Between Us (我們之間的駭) (https://open.firstory.me/user/hacksbetweenus)
Blog article: Redefining IABs: Impacts of compartmentalization on threat tracking and modeling (https://blog.talosintelligence.com/redefining-initial-access-brokers/)
Diamond Model (https://apps.dtic.mil/sti/tr/pdf/ADA586960.pdf)
HITCON Girls (https://hitcon.org)
Raclette Switzerland (https://defcon.ch) (Cybersecurity Community)
Ashley’s upcoming talk at Black Hat USA (https://www.blackhat.com/us-25/briefings/schedule/#hacking-the-status-quo-tales-from-leading-women-in-cybersecurity-47489)
8 Dec 2024TRANSCRIPT
Operation Crimson Palace
On this episode, Mark Parsons, Senior Threat Hunter at Sophos MDR, discusses his team's investigation into Operation Crimson Palace, which uncovered Chinese state-sponsored cyberespionage targeting a Southeast Asian government. Mark explains how they identified three distinct clusters of activity using advanced malware and evasion techniques, including previously unreported tools like CCoreDoor and PocoProxy.
Show Notes
Operation Crimson Palace: Sophos threat hunting unveils multiple clusters of Chinese state-sponsored activity targeting Southeast Asian government (https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-sophos-threat-hunting-unveils-multiple-clusters-of-chinese-state-sponsored-activity-targeting-southeast-asia/)
Surfacing a Hydra: Unveiling a Multi-Headed Chinese State-Sponsored Campaign Against a Foreign Government (https://www.blackhat.com/us-24/briefings/schedule/index.html#surfacing-a-hydra-unveiling-a-multi-headed-chinese-state-sponsored-campaign-against-a-foreign-government-39319)
Crimson Palace returns: New Tools, Tactics, and Targets (https://news.sophos.com/en-us/2024/09/10/crimson-palace-new-tools-tactics-targets/)
10 Nov 2024TRANSCRIPT
Doppelgänger
Pierre Delcher, Head of Cyber Threat Research at HarfangLab, reveals the dark techniques behind Russian disinformation campaigns and the role of European companies in spreading fake news.
7 Oct 2024TRANSCRIPT
The Darkside of TheMoon
On this episode, Chris Formosa and Steve Rudd of Lumen’s Black Lotus Labs share their research on a multi-year campaign targeting end-of-life (EoL) small home/small office (SOHO) routers and IoT devices, associated with an updated version of TheMoon malware. TheMoon, which emerged in 2014, has been operating quietly, while growing to over 40,000 bots from 88 countries in January and February of 2024.
Show Notes
Darkside of TheMoon Blog Article (https://blog.lumen.com/the-darkside-of-themoon/)
Giving a Face to the Malware Proxy Service Faceless (https://krebsonsecurity.com/2023/04/giving-a-face-to-the-malware-proxy-service-faceless/)
IOCs on Github (https://github.com/blacklotuslabs/IOCs/blob/main/Moon_Faceless_IOCs.txt)
BSides Las Vegas Talk (https://www.youtube.com/live/ZY26xH9nim8?si=yTsNURAMLaZkmyPY&t=32042)
8 Sept 2024TRANSCRIPT
Vertex Project´s Journey and the APT1 Report´s Legacy
In this special episode of Malspace, we celebrate the 8th anniversary of the Vertex Project and the 11th anniversary of the APT1 report release together with Visi Stark himself. Join us for fascinating anecdotes, insights, and a forward-looking discussion on the future of threat intelligence.
Show Notes
Visi Stark (https://x.com/invisig0th)
Vertex Project (https://vertex.link/)
Vertex Project´s 8 Year Anniversary (https://invisig0th.substack.com/p/happy-8th-birthday-to-the-vertex)
APT1 Report (https://www.mandiant.com/resources/reports/apt1-exposing-one-chinas-cyber-espionage-units )
PLA - Public Liberation Army (https://en.wikipedia.org/wiki/People%27s_Liberation_Army )
Vivisect (https://vivisect.readthedocs.io/en/latest/vivisect/intro.html)
NCAJTF (https://www.fbi.gov/investigate/cyber/national-cyber-investigative-joint-task-force)
Airforce OSI (https://www.osi.af.mil/)
UNC (https://cloud.google.com/blog/topics/threat-intelligence/how-mandiant-tracks-uncategorized-threat-actors)
4 Aug 2024TRANSCRIPT
From GReAT to greater Good
In this episode, I chat with Costin Raiu, former Director of Kaspersky's GReAT and now working as an independent researcher. Costin shares his journey into threat research, key career highlights, and current volunteer work aiding victims of the Pegasus malware. He also offers insights into possible future threats and potential visibility gaps to consider.
Show Notes
Costin Raiu (https://x.com/craiu)
Kaspersky GReAT (https://en.wikipedia.org/wiki/Kaspersky_Lab)
ED011 (https://arstechnica.com/features/2018/08/the-secret-history-of-ed011-the-obscure-computer-lab-that-hacked-the-world/)
RAV AntiVirus (https://news.microsoft.com/2003/06/10/microsoft-to-acquire-antivirus-technology-from-gecad-software/)
Red October (https://securelist.com/the-red-october-campaign/57647/)
Wild Neutron (https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/)
Equation Group (https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf)
Lazarus Group (https://malpedia.caad.fkie.fraunhofer.de/actor/lazarus_group)
Noh Theater (https://www.japan-guide.com/e/e2091.html)
Staying Safe from Pegasus (https://medium.com/@costin.raiu/staying-safe-from-pegasus-chrysaor-and-other-apt-mobile-malware-a923b56d645f)
7 Jul 2024TRANSCRIPT
PIVOTcon
Join me as I sit down with Pasquale and Bartosz, the organizers of PIVOTcon. In this episode, we'll delve into the fascinating origin story of this groundbreaking conference on Threat Research, which made its debut in May 2024 in the beautiful city of Malaga. Discover the inspiration, challenges, and triumphs, and learn why the art of coffee placement is an important detail to consider at such an extraordinary event.
Show Notes
Bartosz Jerzman (https://x.com/secman_pl)
Pasquale Stirparo (https://twitter.com/pstirparo)
PIVOTcon (https://pivotcon.org/)
PIVOTcon Song (https://soundcloud.com/argonix/pivotcon)
19 Jun 2024TRANSCRIPT
North Korean APTs and Russian Rockets
Aleksandar Milenkoski joins us in this Episode to share insights about his recent PIVOTcon talk on previously undisclosed details about several North Korean APT activities.
Show Notes
Aleks Profile (https://milenkoski.com/)
PIVOTcon Talk (https://x.com/pivot_con/status/1788941086192214168)
Lazarus Group (https://en.wikipedia.org/wiki/Lazarus_Group)
ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals (https://www.sentinelone.com/labs/a-glimpse-into-future-scarcruft-campaigns-attackers-gather-strategic-intelligence-and-target-cybersecurity-professionals/)
PIVOTcon (https://pivotcon.org/)
Inside a recent episode
Multiple Actors, One Breach - Rethinking Threat Models in 2025
Published 10 Jul 2025 · Transcript excerpt
[…] So the answer here is like more like when we are able to identify this kind of compartmentalized attack and to be able to have the profile of the threat actors is easier for us to assess what are the risks coming next and what kind of approach that we can prepare for defense against them. […]
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
