Free Daily Podcast Summary
Research Saturday: Daily Summaries Delivered
by N2K Networks
Every Saturday, we sit down with cybersecurity researchers to talk shop about the latest threats, vulnerabilities, and technical discoveries.
Latest Episodes
The most recent episodes — sign up to get AI-powered summaries of each one.
- 1 weeks ago20 min
The long road to root.
Today we are joined by Subhajeet Singha, Senior Security Researcher at Acronis Threat Research Unit, discussing their work on "Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit." A Chinese-speaking threat actor tracked as Red Heron exploited a critical Gitea remote code execution vulnerability, CVE-2026-60004, within days of its public disclosure, compromising organizations across five countries and stealing source code, credentials, and sensitive infrastructure data. The campaign involved deploying persistent backdoors and a newly identified Linux implant called JITTERLY, which contains an undocumented rootkit, SIXZUT, capable of hiding files, processes, and network connections while protecting the malware from removal. Acronis assesses with moderate confidence that Red Heron operates within a PRC-linked context, highlighting how quickly attackers can weaponize newly disclosed vulnerabilities and turn exposed development platforms into gateways for broader network compromise. The research and executive brief can be found here: Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit Learn more about your ad choices. Visit megaphone.fm/adchoices
- 2 weeks ago28 min
The middlemen of cyber espionage.
Today we have Damon Rouse, Threat Intelligence from Lumen's Black Lotus Labs, discussing their work on "The infrastructure quartermaster: inside a China-nexus state enablement model." Black Lotus Labs identified a China-nexus cyber infrastructure provider, dubbed a “quartermaster,” that supplies reconnaissance, proxy routing, and obfuscation services to Chinese cyber espionage actors. Its interconnected systems, including QScan and Fast Labyrinth, help identify high-value targets, conceal malicious traffic, and support potential exploitation of government, military, research, and critical infrastructure networks. Researchers warn that this shared infrastructure makes traditional IP-based defenses less effective and recommend following CISA and NCSC guidance, reducing external attack surfaces, and keeping routers, firewalls, and IoT devices updated. The research and executive brief can be found here: The infrastructure quartermaster: inside a China-nexus state enablement model Learn more about your ad choices. Visit megaphone.fm/adchoices
- 3 weeks ago28 min
The wrong kind of access.
Dan Lisichkin, AI Security Researcher from Pillar Security, discussing their work on "A WIF Of Fresh Access, How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise." Researchers at Pillar Security uncovered a vulnerability in Google’s Gemini CLI workflows that could allow an attacker to turn a malicious GitHub issue into remote code execution and gain elevated access to a Google Cloud Platform (GCP) project. The exploit chain combined a misconfigured tool allowlist that allowed unrestricted command execution with exposed Workload Identity Federation credentials and overly broad service account permissions, potentially enabling attackers to impersonate privileged accounts. Google promptly addressed the issues by tightening tool restrictions, blocking the agent’s access to credential files, and limiting service account impersonation permissions, highlighting the risks of connecting AI agents to untrusted input and sensitive infrastructure. The research and executive brief can be found here: A WIF Of Fresh Access: How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise Learn more about your ad choices. Visit megaphone.fm/adchoices
- 4 weeks ago17 min
Contents may be malicious.
Adam Meyers, Head of Counter Adversary Operations at CrowdStrike, is discussing their work on "PhantomRaven, An LLM-Generated Information Stealer Developed for Bug Bounty Hunting." PhantomRaven, a JavaScript-based information stealer distributed through malicious npm packages by a financially motivated threat actor posing as a bug bounty hunter. The malware targets system information and continuous integration and continuous deployment (CI/CD) environment variables, likely seeking credentials, with analysis suggesting its code was generated using a large language model. The report explores how AI-generated tools may lower the barrier to cybercrime and outlines steps organizations can take to mitigate risks, including restricting package installation scripts, using private npm registries, and monitoring dependencies. The research and executive brief can be found here: PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting Learn more about your ad choices. Visit megaphone.fm/adchoices
- Oct 3, 202623 min
Play to win, pay to lose.
Today we are joined by Jean-Pierre Mouton, Senior Threat Intelligence Consultant at GuidePoint Security, discussing their work on "How Play Achieves Encryption." Play ransomware, also known as PlayCrypt, continues to target organizations across multiple sectors using a consistent double-extortion playbook that combines data theft with widespread encryption. A recent investigation details how the group gained access through a SonicWall VPN, moved laterally using tools such as Mimikatz and PsExec, exfiltrated sensitive data, and used the victim’s own SentinelOne uninstallation utility to disable endpoint protection. The findings highlight several behavioral indicators defenders can monitor, including tool staging through SYSVOL and SystemBC for command and control, event log clearing, and suspicious WinSCP activity. The research and executive brief can be found here: How Play Achieves Encryption Learn more about your ad choices. Visit megaphone.fm/adchoices
- Sep 26, 202624 min
An apple a day, a phish away.
Today we are joined by Ensar Seker, VP of Research and CISO at SOCRadar, discussing their work on "Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain." An investigation into AnonyMousKIT reveals an AI-powered Phishing-as-a-Service platform designed to steal Apple credentials and disable Activation Lock on stolen devices. The platform uses email, SMS, WhatsApp, and AI-driven voice calls to impersonate Apple Support, with researchers uncovering a broader ecosystem spanning 506 domains, 168 storefront brands, and 30 backend installations. Despite its sophisticated social-engineering capabilities, basic coding flaws exposed extensive operational logs and revealed the shared infrastructure, developer activity, and reseller network behind the criminal operation. The research and executive brief can be found here: Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain Learn more about your ad choices. Visit megaphone.fm/adchoices
- Sep 19, 202625 min
All about that proxy.
Today we are joined by Dr. Renée Burton, VP of Threat Intelligence at Infoblox, discussing their work on Lurking Lizard, "Fake Installers, Fake Reviews, Fake Services – Real Proxies, Real." The research uncovers Lurking Lizard, a threat actor that has operated since at least 2022 by using fake software installers, VPNs, and lookalike domains to secretly turn victims’ devices into residential proxy nodes. Researchers identified more than 230 related domains and connected seemingly separate campaigns—including fake 7-Zip, downloader tools, and WireVPN—through shared infrastructure, tracking URLs, deployment patterns, and APIs. The investigation suggests the actor runs an end-to-end proxy operation, recruiting compromised devices and then monetizing their bandwidth through proxy services and fake review sites, with WireVPN appearing to be the latest evolution of the campaign. The research and executive brief can be found here: Fake Installers, Fake Reviews, Fake Services - Real Proxies, Real Victims
- Sep 12, 202623 min
A beast by any other name.
Today we are joined by Brigid O Gorman, Senior Intelligence Analyst on Symantec Threat Hunter team, discussing their work on “GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses." GodDamn ransomware, the latest rebrand from the Hyadina group behind Monster and Beast, is using increasingly sophisticated techniques to evade defenses. In a recent attack, the threat actors used AnyDesk for remote access, a broad credential-harvesting toolkit, and the PoisonX malicious kernel driver to disable endpoint security before deploying the ransomware. The activity highlights Hyadina’s continued development of its ransomware operations and an escalation in its defense-evasion capabilities. The research and executive brief can be found here: GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses
Get Research Saturday summaries in your inbox
Free AI-powered daily recaps. Key takeaways, quotes, and mentions — in a 5-minute read.
Get Free Summaries →Free forever for up to 3 podcasts. No credit card required.
You Might Also Like
Listeners also like.
Risky Bulletin
Cybersecurity news updates from the Risky Business team.
Cyberside Chats: Cybersecurity Insights from the Experts
Cybersecurity experts discuss emerging threats, AI-driven attacks, and defense strategies for professionals and executives.
Security Now (Audio)
A weekly deep dive into cybersecurity news, hacking trends, and digital defense strategies for professionals and individuals.
The Low Down
A podcast about hacking.
Hacked
Stories of hacking, tech scams, and digital mysteries explored by two hosts diving into how systems are built and broken.
Random Access Memories
Conversations with tech professionals reveal the personal stories behind their careers in cybersecurity, AI, startups, and leadership.
Plaintext with Rich
Explains cybersecurity topics in simple terms to help listeners stay safer online.
Interconnects
Exploring AI advancements through in-depth interviews with scientists and critical analysis of the technology beyond the hype.
Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure
Expert discussions on cybersecurity, national security, and threats to critical infrastructure like energy and water systems.
The Watchtower
Cybersecurity, data, and AI leaders share candid insights on real-world challenges and innovations beyond the headlines.
dot com: The Hacking
A journalist investigates the rise of cyberattacks in the post-Cold War era, exploring who is behind them and their global impact.
Darknet Diaries
True stories of hacking, data breaches, and cyber crime from the dark side of the Internet.
About Research Saturday
Every Saturday, we sit down with cybersecurity researchers to talk shop about the latest threats, vulnerabilities, and technical discoveries.
Customized Recaps
AI-powered recaps with compact key takeaways, quotes, and insights.
Straight to Your Inbox
Get key takeaways from Research Saturday in a 5-minute read.
Save Hours Every Week
Stay current on your favorite podcasts without falling behind.
Frequently Asked Questions
What is Podzilla's Research Saturday daily summary?
It's a free AI-powered email that summarizes new episodes of Research Saturday as soon as they're published. You get the key takeaways, notable quotes, and links & mentions — all in a quick read.
How does the Research Saturday podcast summary work?
When a new episode drops, our AI transcribes and analyzes it, then generates a personalized summary tailored to your interests and profession. It's delivered to your inbox every morning.
Is this an official Research Saturday product?
No. Podzilla is an independent service that summarizes publicly available podcast content. We're not affiliated with or endorsed by N2K Networks.
Can I get summaries of other podcasts too?
Absolutely! The free plan covers up to 3 podcasts, any in the catalog. Basic raises that to 15, Pro to 40 and Max to 100. Browse our full catalog at /podcasts.
How often does Research Saturday release new episodes?
Research Saturday publishes weekly. Our AI generates a summary within hours of each new episode.
What topics does Research Saturday cover?
Research Saturday covers topics including News, Technology. Our AI identifies the specific themes in each episode and highlights what matters most to you.
Start getting Research Saturday summaries tomorrow morning.
Free forever for up to 3 podcasts. No credit card required.
Free forever for up to 3 podcasts. No credit card required.