The Cybersecurity Defenders Podcast

Intel Chat with Matt Bromiley and Chris Luft.

Show Notes

Intel Chat with Matt Bromiley and Chris Luft.

• Binance discloses the $6.34 billion heist attempt, the largest attempted crypto theft on record. The FBI and TRM Security attribute it to North Korea's TraderTraitor. It began in June with an engineer installing a malicious Homebrew, then a fake recruiter and two fake job interviews delivered a "coding assignment" that swapped out a dev-tool component and evaded endpoint detection. In October the attackers used that machine and an internal AI tool to reach two more engineering devices, took a credential for the container deployment platform, ran a malicious container against the wallet signing service, and abused Ethereum's EIP-7702 delegation with 50 signing transactions so funds moved outside normal withdrawals. Multi-party computation meant there was no single key to revoke the authorizations. Binance froze or intercepted about $2.85 billion. Matt: we've warned about fake-recruiter attacks for months, and who takes a job interview on their work laptop? Hats off to the responders for getting this far in a week, but it's a breakdown in a human process, and training your people is the real ROI. Chris did the math: in $100 bills it's 63.5 tons of cash, three semi-trailers.
• Refrigeration attacks hit supermarkets in seven European countries. Attackers flipped refrigeration controls into defrost mode, pushing temperatures as high as 50 °C, at Delhaize stores in Belgium and Luxembourg, Carrefour, Spar, Ikea Mons, ICA and Coop in Sweden, SuperValu in Ireland and more. Refrigeration firm Sabcobel confirmed the attack and says the fix needs physical modifications, not just software. Danfoss reported attacks at businesses in the Netherlands. The attackers are unidentified, and US authorities are looking at similar malfunctions at American military bases. Matt recorded from one of the affected countries: who is behind it and why, and was the fridge facing the internet or reached through the store's management plane? One of those is close to negligence.
• FrostyNeighbor (UNC1151): ESET documents the first destructive attack by a Belarus-aligned actor, against a Ukrainian manufacturer important to the transportation sector, using Chisel, UltraVNC, Cobalt Strike and a VBScript wiper pushed through Group Policy. ESET sees Belarus-aligned groups acting as proxies or force multipliers for Russia; Recorded Future cautions against assuming Russian operational control. Matt: UNC1151 is a very early Mandiant handle, so this group has been around a long time. Chris: hitting the drone supply chain shows how cyber supports kinetic operations on the front line.
• Google dismantles the XCPE botnet: more than 1.3 million devices, mostly Android TV set-top boxes, with the malware built in by the manufacturer, Videostrong Technology, and access sold to affiliates for ad fraud, residential proxies and more. A three-stage design started from a backdoor on the /oem/ partition. Google banned Videostrong from preloading Google apps, went after the infrastructure with Japan's National Police Agency and industry partners, and says it likely cut off at least 10 million more devices. Chris and Matt on smart TVs that watch you, and whether the toothbrush can run Doom.

Stories covered:
• https://arstechnica.com/information-technology/2026/11/binance-says-hackers-who-stole-billions-in-crypto-spent-months-planning-heist/
• https://www.bbc.com/news/articles/cq1kd1nee80eo
• https://www.darkreading.com/physical-security/russia-cyber-war-belarus-steps-forward
• https://www.securityweek.com/google-dismantles-xcpe-botnet-of-1-3-million-android-devices/

Chapters:
0:00 The robot Renaissance
1:02 Binance and the $6.34 billion elephant in the room
5:06 Who takes a job interview on their work laptop?
8:01 63.5 tons of cash, three semi-trailers
8:42 A modern-day Frankenstein of an attack
11:01 A breakdown in a human process: train your people
11:46 Paying back the losses
12:15 Refrigeration attacks on European supermarkets
14:43 Real-world impact, and who might be behind it
15:09 Matt is in one of the affected countries
17:04 Internet-facing fridge or the management plane?
19:07 FrostyNeighbor: Belarus's first destructive attack in Ukraine
22:47 UNC1151, a very early handle
25:02 Hitting the drone supply chain
26:23 Google dismantles the XCPE botnet
29:08 Your TVs are watching you
32:30 But can the toothbrush run Doom?
33:16 Chris's new studio

The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.

Subscribe wherever you listen:
• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740
• YouTube: https://www.youtube.com/@limacharlieio

Learn more about LimaCharlie: https://limacharlie.io

#cybersecurity #infosec #northkorea #ICS #botnet

What is The Cybersecurity Defenders Podcast?

An accessible but technical podcast about cybersecurity and the people who keep the internet safe. The podcast is built as a series of segments: we will be looking back at the last couple of weeks in cybersecurity news, talking to different people in the industry about areas of their expertise, we're going to break apart some of the TTPs being used by adversaries, and we will even cover a little bit of hacker history.