Intel Chat: DoppelBrand, Android malware Keenadu, attackers expand AI use & AI-driven threats [295]

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community. Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform. This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows.

How Netwrix DSPM complements Microsoft 365

Netwrix DSPM enhances Microsoft 365 security with unified data discovery, context-aware risk prioritization, automated remediation, and continuous compliance monitoring. While M365 provides foundational security through Purview and Entra ID, it lacks visibility into shadow data and automated risk response. Netwrix closes these gaps, helping organizations discover sensitive data, enforce least privilege, and respond faster to threats.

Container Registry Security in 2026: What Actually Matters

What is container registry security? Container registry security is the set of practices, tools, and policies that protect container images from tampering, unauthorized access, and vulnerability exploitation. It covers four core areas: access control (who can push, pull, and delete images), vulnerability scanning (identifying known CVEs in image layers), image signing (cryptographic verification that images haven’t been modified), and content trust (ensuring images come from verified publishers).

Security Roles in SharePoint Architecture: SharePoint Security Matrix

Microsoft SharePoint has a mature, well-structured security model. It gives organizations control over who can access sites, libraries, and documents, and for most day-to-day needs, it works well. But there is a fundamental limitation built into how SharePoint security works: it controls access based on role, not on the sensitivity of the content itself.

Best Kubernetes Security Tools in 2026: A Runtime-First Guide

Why do most Kubernetes security tools miss runtime threats? Most Kubernetes security tools were built to scan configurations and images, not to watch what’s actually happening in clusters. They tell you what might be wrong but can’t show what’s actually being attacked. Static scanning finds theoretical risks—a CVE exists somewhere in your container image.

How likely is a man-in-the-middle attack?

Security vendors love the man-in-the-middle attack. It’s the boogeyman of every TLS marketing page. Some shadowy figure intercepting your traffic, reading your secrets, stealing your data. A man-in-the-middle attack is when an attacker positions themselves between two parties on a network to intercept the traffic flowing between them. In the context of TLS, that means an attacker who can present a valid certificate can read everything in plaintext and proxy it on to the real server.

Difference between Network DLP vs Endpoint DLP vs Cloud DLP

When it comes to protecting business-sensitive data, understanding the difference and the scope of Network DLP, Endpoint DLP, and Cloud DLP is essential. Each of these Data Loss Prevention solutions (DLP) plays a unique role in securing data across various environments, whether it is on the Network, on individual devices, or in the Cloud. Knowing how each solution works can help you determine the best approach to safeguard your organization's sensitive information.

Key Lessons from the Major Ransomware Attacks in Recent Months

The biggest ransomware attacks of 2025 have shown that this threat remains critical for organizations across all sectors. Incidents such as the Change Healthcare attack, which compromised the data of nearly 190 million individuals, and the attack on Jaguar Land Rover, which forced production lines to halt and caused losses amounting to hundreds of millions of dollars, show that a single incident can impact both operational continuity and information confidentiality.