Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Evan Kohlmann
Unraveling the Dark Side of Crypto
At the Financial Times’ recent Crypto and Digital Assets Summit, the director of the FBI’s National Cryptocurrency Enforcement Team (NCET), Eun Young Choi, acknowledged that “We are seeing cryptocurrency and digital assets really touch every aspect of criminal activity we investigate.” This includes illicit actors across a very broad spectrum of activity, everything from ransomware to narcotics smuggling to rogue states to terrorist financing.
State of Crypto Week 2023
Opinion Regulatory Clarity Won’t Bring an End to Crypto Risk Even comprehensive crypto legislation won’t stop people from making bad investment decisions, says EY's blockchain leader. By Paul BrodyOct 24, 2023 Opinion The U.S. Risks Its Position as a Stablecoin Leader USD stablecoin transactions are rising fast, but most of the growth is happening outside of the United States, says Jason Somensatto, Head of North America Policy at Chainalysis.
The Beirut Port Explosion: Analysis of Potential Causes
By Evan Kohlmann In the hours and days following the massive August 4th explosion at the port in central Beirut that caused over 200 deaths and inflicted billions of dollars in economic damage, there have been persistent questions regarding the cause of the twin blasts.
A Look at Iran's Revolutionary Affiliate Groups in Middle East
By Evan Kohlmann As a central part of its military strategy, Iran maintains close relationships with a network of revolutionary affiliate groups across the Middle East that serve as its regional proxies.
Highlights from Exclusive Interview with Yemeni Official
Highlights from Exclusive Interview with Senior Yemeni Official Blog December 11, 2019 By Evan Kohlmann The U.S. Navy’s seizure, announced last week, of an alleged Iranian weapons shipment en route to Houthi rebels in Yemen has once again highlighted how Iran is backing the Houthis against its regional adversaries in the Kingdom of Saudi Arabia and the United Arab Emirates. However, Hisham Sharaf, foreign minister of the Houthi-led government in Yemen, countered recently: “We are not pro-Iran.
Vulnerability Intelligence Lessens Exposure to Weaponized Bugs
By Cheng Lu Microsoft’s monthly Patch Tuesday security updates and Oracle’s quarterly Critical Patch Updates bring some order to the chaotic world of vulnerability management. But for many organizations, these release days are still a fire drill of the most stressful magnitude as network and sysadmins around the world try to make sense of massive dumps of sometimes hundreds of Windows or Oracle patches.
Communities Datasets Deliver Far-Reaching Visibility into Cybercrime Underground
Communities Datasets Deliver Far-Reaching Visibility into Cybercrime Underground Blog September 18, 2019 By Steven Weinstein To effectively anticipate and mitigate threats, defenders must be able to monitor the illicit online communities where threat actors discuss tactics, techniques, and procedures (TTPs), exchange resources, and coordinate malicious activity.
Access to Compromised E-commerce Sites Solicited on DDW
By Abigail Showman Open source and commercial e-commerce platforms have been targeted for years by threat actors, often armed with commodity exploits for known and patched vulnerabilities. Their aim is to gain administrative access to these platforms which would then facilitate the theft of customers’ payment card data.
Intelligence Basics Archives - Flashpoint
Josh Lefkowitz Chief Executive Officer Josh Lefkowitz executes the company’s strategic vision to empower organizations with Business Risk Intelligence (BRI). He has worked extensively with authorities to track and analyze terrorist groups. Mr. Lefkowitz also served as a consultant to the FBI’s senior management team and worked for a top tier, global investment bank. Mr. Lefkowitz holds an MBA from Harvard University and a BA from Williams College.
Finished Intelligence: A Cornerstone for Effective Decision-Making
Finished Intelligence: A Cornerstone for Effective Decision-Making Blog August 29, 2019 By Matthew Howell Producing timely, relevant, and actionable intelligence at scale is integral to the success of an intelligence program, but it simply isn’t feasible for many organizations due to the extensive resources, bandwidth, and subject-matter expertise it requires. That’s why finished intelligence is a core component of Flashpoint’s Business Risk Intelligence (BRI) offerings.
Navigating Card Shops Data Essential for Fraud, Security Teams
By Matthew Howell Stolen payment card information may have had to make some room for credentials atop its perch as the most sought-after underground dataset, but it still stands tall for profit-seeking threat actors. The best evidence is the thriving world of card shops. These organized underground platforms continue to serve as the primary method by which cybercriminals seek and obtain stolen payment card data.
A Clean View of Vulnerabilities Helps Prioritize Patching
By Matthew Howell Prioritization is arguably the most consequential, time-sensitive, and challenging aspect of vulnerability management. And it’s easy to see why: Hundreds of new vulnerabilities are reported every month. Patching them all is rarely feasible, so instead, security teams must quickly figure out which need mitigation, and in what order, to minimize risk for their organizations.
ThreatConnect Releases Enhanced Integration with Flashpoint
ThreatConnect users can access near real-time Finished Intelligence and Technical Data from Flashpoint August 20, 2019 – Arlington, VA – ThreatConnect Inc.®, provider of the industry’s only intelligence-driven security operations platform, is proud to announce its updated integration with Flashpoint, the leader in Business Risk Intelligence (BRI).
Laying the Groundwork for Combating AI-Powered Cybercrime
Laying the Groundwork for Combating AI-Powered Cybercrime Blog August 14, 2019 By Delfina Chain Artificial intelligence (AI) is already being applied to diverse use cases, from consumer-oriented devices—such as voice-controlled personal assistants and self-directed vacuum cleaners—to groundbreaking business applications that optimize everything from drug discovery to financial portfolio management.
Access to Chat Services Data Imperative to Lowering Risk
By Mike Mimoso Good guys and bad are constantly testing each other. One zigs, and the other zags. It’s the essence of the chase for the white hat and the instinct to survive for the black hat. This scenario plays out with hackers all the time. Exploitable vulnerabilities get patched. Ransomware gets decrypted. In turn, new hacks are developed. Variants of malware pop up all the time. This also plays out within illicit communities on the deep and dark web (DDW), as well as the open web.
Collective Intelligence Podcast, Mathy Vanhoef on Dragonblood WPA3 Attacks
By Mike Mimoso LAS VEGAS—Vulnerabilities in the WPA3 WiFi protocol continue to surface, whereby resourced attackers would be able to leak memory from a client connection to a wireless access point and perform offline dictionary attacks to retrieve a user’s password to a wireless network.
Collective Intelligence Podcast, Akamai’s Tony Lauro at Black Hat USA 2019
By Mike Mimoso LAS VEGAS—Defenders inside the enterprise and within the public sector are facing a head-spinning array of threats. And with Black Hat, the industry’s biggest offensive security research conference, kicking off today, more weight in the form of new vulnerabilities and threat actor tactics is about to be placed on the shoulders of security teams worldwide.
BSides Las Vegas 2019 Preview: Visualizing Joker's Stash
This blog previews topics that will be discussed during Ian W. Gray and Max Aliapoulios’s upcoming “Giving Credit Where It’s Not Due: Visualizing Joker’s Stash” presentation, which will be held on August 6 at 3 p.m. in the Underground track at BSides Las Vegas. By Ian W.
Flashpoint’s Hunt Team: Shedding Light on the Cutting Edge of Cybercrime
By Christopher “Tophs” Elisan All too often, cyber-defense measures protect only against known threats. But since threat actors operating on the deep and dark web (DDW), encrypted chat services, and other covert channels are constantly developing new methods in order to catch their targets off guard, organizations assume considerable risk in taking a reactive stance.
The Challenges of Cobalt Strike Server Fingerprinting
By Jason Reaves and Joshua Platt The misuse of legitimate security tools by criminals and state-sponsored actors has been a dilemma for close to two decades. Penetration-testing software and red-teaming frameworks were built for the purpose of testing the defenses of enterprise networks, but that hasn’t stopped individuals and collectives with malicious intent from pirating or hacking these tools and using them to nefarious ends.
Newly Discovered Malware Framework Cashing in on Ad Fraud
By Jason Reaves & Joshua Platt A newly discovered malware framework is responsible for more than one billion fraudulent ad impressions in the past three months, generating its operators significant Google AdSense revenue on a monthly basis.
The Insider Threat Intelligence Cycle
By Eric Lackey A growing number of organizations across the public and private sectors are recognizing insider threat as a critical area of concern. In response, many are taking measures to defend assets from risks posed by employees and trusted third parties. Insiders pose unique challenges for defenders. Perimeter security tools, for example, are unlikely to hamper privileged insiders.
Flashpoint Add-On for Splunk Brings Context to Noisy Data
By Matthew Howell Security operations centers are noisy places. Even if the only audible sounds come from a clacking keyboard or an occasional expletive, the noise can be deafening for an analyst sitting in front of a screen watching alert after alert surface.
The Unique Challenges and Risks Posed by Insiders
The Unique Challenges and Risks Posed by Insiders Blog June 25, 2019 By Mike Mimoso Insiders should make private- and public-sector security teams nervous. Their access to critical IT systems, company assets such as intellectual property, and the personal information of customers and employees makes insiders a formidable risk that deserves the same level of attention as external threats. And insiders don’t have to act maliciously to be a risk to the business.
ATM Shimmers Supplanting Skimmers
By Isaac Palmer Automated tellers—literal money machines—cannot help but be a target for crime. Most are filled with money and run on software that contains exploitable security vulnerabilities or hardware that can be tampered with by hackers. Or bad guys can try to outright steal or blow them up.
The Physical Security Intelligence Cycle
By Ian W. Gray At first, the differences between cyber and physical security can seem stark. One is largely characterized by network security systems such as firewalls, software patches, and security operations center (SOC) personnel, and the other by physical deterrents such as guards, cameras, and barriers. But despite their inherent differences, these two functions share the common goal of defending against threats to manage risk.
Whether to Pay Ransomware Demands is Foremost a Business Decision
By Christopher “Tophs” Elisan For the better part of a month, the city government of Baltimore has been in the grip of a ransomware infection. Many essential services are in limbo and officials are holding firm against paying the attacker’s $100,000 ransom demand. This is a decision that business leaders whose organizations are victims of ransomware crash into headfirst every day: to pay or not to pay. And make no mistake, that is a business decision rather than an IT or IT security decision.
Looking at Darknet Marketplaces Through A Brazilian Lens
Looking at Darknet Marketplaces Through A Brazilian Lens Blog June 10, 2019 By Ian W. Gray Darknet marketplaces offering illicit goods and services have been integral to the underground economy since at least 2010. The success of these marketplaces has been largely dependent on their ability to provide a good user experience while also protecting users’ privacy and security.
Cybercriminals Continue to Target Online Gambling Platforms
By Luke Rodeheffer The size of the online gambling industry is expected to approach $75 billion by 2024, driven largely by technological advancements and favorable regulatory shifts. This projected growth presents ample opportunity to companies operating in the industry, but it comes with the drawback of attracting unwanted cybercriminal interest.
Peri Doerfler on Login Challenges and Account Takeover
By Mike Mimoso Given the billions of compromised and publicly leaked credentials available on the surface web and within illicit underground communities, account takeover attacks are being elevated as a pressing issue for fraud teams. Those defenders have a number of authentication methods at their disposal, and unsurprising to anyone, each has a varying degree of efficacy.
Targeted Ransomware Has Changed the Face of Incident Response
By Christopher “Tophs” Elisan It’s becoming increasingly rare to publicly learn about ransomware attacks carried out at any kind of scale. In two short years, we’ve gone from WannaCry and NotPetya piggybacking aboard NSA-built exploits in attacks hoping to hit many victims in many industries, to quieter and potentially more lucrative targeted attacks against individual organizations.
The Deep Implications of Dark Web Takedowns
The Deep Implications of Dark Web Takedowns Blog May 21, 2019 By Ian W. Gray The dark web is known for volatility, but within the past month, several planned shutdowns, exit scams, law enforcement takedowns, extortion attempts, and distributed denial-of-service attacks may have potentially changed the methods and venues by which cybercriminals conduct illicit activity. It is premature to accurately assess the long-term impact of prolonged dark web marketplace unavailability.
Tips for Building a Physical Security Plan for Corporate Events
Tips for Building a Physical Security Plan for Corporate Events Blog May 14, 2019 By Rob Cook Ensuring the safety and success of a corporate event starts with a physical security plan. Regardless of whether the event is an internal function or public gathering, the right plan can make all the difference when it comes to protecting staff, attendees, assets, and infrastructure from unruly guests, criminals, violent protesters, terrorists, and natural disasters, among myriad other threats.
David Maimon on the Dark Web Market for SSL/TLS Certs
Collective Intelligence Podcast, David Maimon on the Dark Web Market for SSL/TLS Certs Podcasts May 6, 2019 By Mike Mimoso Compromised, stolen, or forged TLS and SSL certificates open many doors to profit for a cybercriminal. In parallel, they are also a precursor to difficult times for victims, who may find themselves conducting transactions on spoofed ecommerce sites that are given legitimacy by the padlock that symbolizes the presence of a legitimate certificate and an encrypted connection.
Synthetic Identity Theft a Gateway to Business Fraud
By Ian Gray As losses directly attributable to synthetic identity theft mount, it’s inevitable that we see it leveraged for business fraud. For those unfamiliar, synthetic identity theft—also known in some circles as ghost profiles—is the process by which fraudsters create a fictitious identity using real and contrived personal information in order to defraud banks, retailers, government services, or individual consumers.
Flashpoint Strengthens Intelligence Platform with New Dashboards and Analytics, Expanded Collections and Tailored Alerting by Industry
Flashpoint Strengthens Intelligence Platform with New Dashboards and Analytics, Expanded Collections and Tailored Alerting by Industry Company Significantly Expands Use-Case Driven Business Risk Intelligence (BRI) Offerings New York, NY, April 24, 2019 — Flashpoint, the global leader in Business Risk Intelligence (BRI), today announced new innovations and enhancements that help multiple teams bolster cybersecurity, confront fraud, detect insider threats, enhance corporate and physical...
Intelligence Requirements for the Public Sector
Intelligence Requirements for the Public Sector Blog April 17, 2019 By Mike Mimoso Developing intelligence requirements for the public sector is a different experience than what commercial-sector counterparts endure. Entities that require intelligence to carry out a mission in the public sector collect data that supports long-term goals and addresses persistent threats.
Threat Actors Shifting from Opportunistic to Targeted Ransomware
By Mike Mimoso CryptoLocker, WannaCry, and the hundreds of other ransomware families that indiscriminately infected businesses and government agencies worldwide have been studied and in some cases neutralized by researchers who figured out how to decrypt data locked down by the respective malware. Nimble threat actors, however, have lately focused on a much more targeted approach to potential profits.
Flashpoint - Third-Party Risks to Consider—and Manage
By Josh Lefkowitz Acceptable business risks must be managed, and none more so than those associated with external vendors who often have intimate access to infrastructure or business data. As we’ve seen with numerous breaches where attackers were able to leverage a weakness in a contractor or service provider, third-party risk must be assessed and mitigated during the early stages of such a partnership, as well as throughout the relationship.
Flashpoint Gains Channel Momentum as Demand for Business Risk Intelligence Accelerates Worldwide
Partners Worldwide Turn to Flashpoint to Provide Customers with Intelligence to Support Unique Use Cases Across Multiple Sectors and Teams New York, NY, April 3, 2019 — Flashpoint, the global leader in Business Risk Intelligence (BRI), today announced that its Global Channel Program has grown 150 percent year-over-year since its formal introduction in 2017.
Flashpoint’s Use Case-Driven Approach to Intelligence Fuels 2019 Company Growth and Market Evolution
By Josh Lefkowitz The threat intelligence market has significantly evolved since we started Flashpoint in 2010. At that time, our founding team focused on applying what we had learned from our work supporting the public sector. Initially, we primarily provided intelligence gleaned from scouring the deep and dark web for malicious activity to cyber threat intelligence (CTI) teams, many in the financial services industry.
Bruce Schneier on Public-Interest Tech
Collective Intelligence Podcast, Bruce Schneier on Public-Interest Tech Podcasts April 1, 2019 Given the measure by which technology invades every aspect of our lives, the need to have technologists involved in crucial public-interest conversations is growing exponentially. But that isn’t happening today at any kind of significant scale, and leaders such as Bruce Schneier are trying to change that.
Expansive Access to Illicit Activity on Chat Services Platforms Lowers Risk
Expansive Access to Illicit Activity on Chat Services Platforms Lowers Risk Blog March 28, 2019 By Chris Camacho As threat actors continue to find a measure of security and anonymity away from illicit online forums, and operate more and more on encrypted chat services, the need for access to and monitoring of these platforms becomes an imperative for mitigating risk.
Collective Intelligence Podcast, Kris Mansson of Silobreaker
Collective Intelligence Podcast, Kris Mansson of Silobreaker Podcasts March 26, 2019 When the enterprise considers what threat intelligence is all about, it thinks in terms of technical, structured information: indicators of compromise, IP addresses, domains, hashes, and more. The journey to structure, however, begins with unstructured data, often vacuumed up from a quite sizable number of open and Deep & Dark Web sources.
Analysis of DDW Activity Brings Context to CVE Prioritization
By Cheng Lu The recently disclosed WinRAR vulnerability has reportedly spawned more than 100 working exploits since it was disclosed—and patched—in late February. Attackers can use the bug to exploit machines running the vulnerable Windows file-compression software and plant malware or other malicious code on devices that persists after reboots.
Cryptocurrency Risks to Consider: From Cryptomining to Money Laundering
Cryptocurrency Risks to Consider: From Cryptomining to Money Laundering Blog March 21, 2019 By Mike Mimoso In the not-so-distant past, cybercriminal use of cryptocurrency was largely limited to using Bitcoin or Monero as an anonymous means of collecting ransomware payments. Today, however, threat actors have discovered more direct ways of profiting off the yo-yoing valuation of various cryptocurrencies, which has profoundly impacted the underground economy.
Flashpoint Introduces Innovative Approach for Use Case-Driven Intelligence
Flashpoint Introduces Innovative Approach for Use Case-Driven Intelligence March 20, 2019 Company Uniquely Assesses Intelligence Requirements to Support Cybersecurity, Fraud, Insider Threat, Corporate & Physical Security, and Third-Party Risk Teams New York, NY, March 20, 2019 — Flashpoint, the global leader in Business Risk Intelligence (BRI), today introduced a new use case-driven approach to its packaged solutions that allows organizations to more effectively consume and automate threat...
FIN7 Revisited: Inside Astra Panel and SQLRat Malware
By Joshua Platt and Jason Reaves Despite the arrests of three prominent members of the FIN7 cybercrime gang beginning in January 2018, attacks targeting businesses and customer payment card information did not cease. The latest evidence involves the discovery of a new administrative panel and previously unseen malware samples that Flashpoint analysts are linking to this notorious group. Activity from this campaign dates from May to July 2018, but could go back farther to January 2018.
The Fraud Intelligence Cycle
By Chris Camacho Usage of the intelligence cycle in the commercial sector is often relegated—and in many cases, exclusively so—to cyber threat intelligence (CTI) teams. But because its core principles are easily adaptable to just about any use case requiring in-depth research and complex analysis, the intelligence cycle can also be beneficial for fraud teams by adding structure to key processes and ensuring an actionable and relevant finished product.
Collective Intelligence Podcast, Avi Rubin on IOT Security
Collective Intelligence Podcast, Avi Rubin on IOT Security Podcasts March 14, 2019 The glut of billions of devices connected to the internet has brought convenience—and often vulnerability—to our doorsteps. Homes, medical devices, and automobiles talk to the cloud, are updated remotely, and expose consumers and businesses to new opportunities and feature sets. The internet of things is also not immune to those with malicious intent.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Evan
Contact Evan, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack