About this episode

Matt and Chris discuss recent developments in threat intelligence, including Cisco CUCM exploitation and AI phishing tactics.

Matt and Chris break down four stories from the week in threat intel: • Cisco CUCM (CVE-2026-20230) — a web-dialer SSRF that chains to root-level RCE, exploited in the wild less than 24 hours after the PoC and full exploit chain were published. • The latest Ransomware Tool Matrix (RTM) / Ransomware Vulnerability Matrix (RVM) update, profiling three active groups — The Gentlemen, DragonForce and Warlock — and the BYOVD and legit-admin-tool tradecraft they increasingly share. • Gamaredon's upgraded toolkit against Ukraine (per ESET): new PowerShell downloaders like PteroPaste, Cloudflare tunneling and Workers for C2, and exfiltration to trusted cloud storage such as Amazon S3 and Dropbox. • Varonis Threat Labs phishing an AI email agent ("Pinchy") — why agents spot technical phishing better than humans yet hand over credentials to a convincing social request, and why you should treat them as privileged junior employees.

More episodes of The Cybersecurity Defenders Podcast

• AI Chat: Grok CLI data exfiltration, AI vs. patching, distillation wars & shadow AI [339] · July 14, 2026 · 23 min
• Intel Chat: Dialogflow Rogue Agent, ghost phishing, CISA KEV deadline & HalluSquatting [338] · July 9, 2026 · 34 min
• Ransomware in the age of agentic AI with Behnaz Karimi [337] · July 8, 2026 · 33 min
• Intel Chat: Hijacked AI backends, billboard hacks, Cursor DuneSlide & Claude export controls [336] · July 3, 2026 · 34 min
• The evolving fraud landscape in the age of AI with Tamas Kadar [#334] · June 30, 2026 · 43 min
• Anthropic restriction, ServiceNow incident, Fortinet credential harvesting & Ukraine accesses EU cyber reserve / Intel Chat [#333] · June 28, 2026 · 35 min

Explore listener stats, chart rankings, contacts and more on the The Cybersecurity Defenders Podcast podcast page.