Salt Typhoon IOCs, Google floats ‘cyber disruption unit’, WhatsApp 0-click
About this episode
Three Buddy Problem - Episode 60: We dissect a fresh multi-agency Salt Typhoon advisory (with IOCs and YARA rules!), why it landed late, why the wall of logos matters (and doesn’t), and what’s actually usable for defenders: new YARA, tool hashes, naming ambiguity across reports, the mention of Chinese vendors, and a Dutch note that smaller ISPs were hit.
Plus, Costin details his hunting stack and philosophy (historic IOC/malware hoarding, fast pivots, and AI as analyst “wingman”) and a new Chinese APT report that may intersect with LightBasin and the murky PSOA world.
We also debate Google’s proposed “cyber disruption unit” versus Microsoft’s DCU (legal vs. “ethical” takedowns, PR, and business models); react to Anthropic’s report on real attacker use of Claude; note Amazon’s APT29 watering-hole disruption; and close on a fresh WhatsApp-to-ImageIO zero-click chain and practical phone OPSEC.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.
Get every episode summarized
Each time Three Buddy Problem publishes, we email you a written briefing from the transcript — the topics, who appeared, and any specific claims, with the ad reads skipped.
Email me new episodesFree for 3 shows. No card needed.
Hosts & guests
No transcript yet
This episode has not been transcribed. Request it and it moves to the front of the queue.
More episodes
More from Three Buddy Problem
A Thousand Agents Walk Into Hugging Face
Three Buddy Problem
Inside the EncroChat law-enforcement implant, Irregular's AI sandbox failure
Three Buddy Problem
A tiny 12 KB Windows backdoor, one victim, and a dead domain
Three Buddy Problem
Inside OpenAI's Black Hat Confession
Three Buddy Problem