How do you get under a cybercriminal’s skin? Sometimes you expose their operations. Sometimes you make every step through a network painfully slow. And sometimes, if you’re Azim, you join a dark web forum where they’re insulting you, and help them do it.

Azim and Nick join Hazel and Dave this week to discuss the fine art of frustrating adversaries, from ransomware-group paranoia to deception that wastes their time and gives defenders a chance to spot their activity. For more on this topic, check out our blog post https://blog.talosintelligence.com/the-fine-art-of-frustrating-the-adversary/

Plus: a listener question has us reflecting on the best parts of our job, we discuss the story of an insider threat whose browser history did the investigators a favor, and Dave makes a poetic tribute.

Adversaries are experimenting with AI-integrated malware, and today's guest, Talos researcher Ryan Fetterman has been looking at their working notes. He joins us to talk about CAIRN, his new open-source research toolkit for tracking that experimentation, and what he’s finding, including a C2 an implant that delegates its decisions to AI models, and malware that tries to persuade AI analysis tools to leave it alone. Putting AI in malware is one thing. Establishing whether any of it actually works takes rather more investigation.

A special segment with Joe (from 7.07 to 25.25) talks about his newly published Human IR Framework (published in a personal capacity on Joe's GitHub), the experiences that led him to build it, and why “burnout” doesn’t adequately describe what certain people who work in cybersecurity can go through.

Meanwhile, Dave definitely prepared his "Reason not to Quit" in advance, an attempt to make Hazel Philadelphian takes an unexpected turn towards Wales, and Bill's "Make Hazel a hacker" question sends Hazel once again into a pit of self despair.

Twenty-four hours before recording this episode, Martin Lee stopped being a Talos employee. Naturally, we made him come on the podcast anyway.

Martin talks about abandoning his early career aspirations of researching human viruses and curing cancer, so he could play on the internet. He also talks about how running very long distances in crazy conditions helps him to stop himself thinking about it.

He has some words of wisdom for aspiring practitioners, and why the rest of us should occasionally close our laptops and venture outside...dangerous business, we reckon.

Plus: Does saying please and thank you improve an AI’s answers? What did Agatha Christie have against Bletchley? And how quickly can a $245 million cryptocurrency theft unravel when someone starts buying Lamborghinis at a rate of one a day?

Martin's blog on 'Securing the unpatchable' can be found here https://blog.talosintelligence.com/securing-the-unpatchable-in-an-age-of-ai-driven-vulnerabilities/