Uploaded April 2026 | Updated September 2026, 2 weeks ago
In the cybercrime industry, initial access brokers specialize in break-ins. They pick digital locks and slide open electronic windows, and then sell that access to other threat actors who specialize in ransomware, exfiltration, and other crimes.
SocGholish is a widely used tool in the access broker toolkit. Typically disguised as a legitimate software update, SocGholish gives attackers a digital foothold and paves the way for additional malware and remote access trojans to be installed on target devices.
On today's show we talk with Anna Pham, who's been pursuing SocGholish as a threat hunter. She talks about the cybercrime industry and the role of initial access brokers, how SocGholish works, indicators of potential compromise to watch out for, and more.
Anna is Senior Tactical & Response Analyst at Huntress Labs. She presented on SocGholish at the 2026 RSA Conference. This episode was recorded on site at the conference.
Links:
SocGholish Unmasked: Lessons from 100+ SocGholish Cases - Anna Pham - path.rsaconference.com/flow/rsac/us26/FullAgenda/page/catalog/session/1755826697213001lGeF
Anna Pham on LinkedIn - linkedin.com/in/anna-p-868921105
Packet Protector is part of the Packet Pushers network. Visit our website to find more great networking and technology podcasts, along with tutorial videos, the Human Infrastructure newsletter, and loads more resources for building your IT career. packetpushers.net
In the cybercrime industry, initial access brokers specialize in break-ins. They pick digital locks and slide open electronic windows, and then sell that access to other threat actors who specialize in ransomware, exfiltration, and other crimes.
SocGholish is a widely used tool in the access broker toolkit. Typically disguised as a legitimate software update, SocGholish gives attackers a digital foothold and paves the way for additional malware and remote access trojans to be installed on target devices.
On today's show we talk with Anna Pham, who's been pursuing SocGholish as a threat hunter. She talks about the cybercrime industry and the role of initial access brokers, how SocGholish works, indicators of potential compromise to watch out for, and more.
Anna is Senior Tactical & Response Analyst at Huntress Labs. She presented on SocGholish at the 2026 RSA Conference. This episode was recorded on site at the conference.
Links:
SocGholish Unmasked: Lessons from 100+ SocGholish Cases - Anna Pham - path.rsaconference.com/flow/rsac/us26/FullAgenda/page/catalog/session/1755826697213001lGeF
Anna Pham on LinkedIn - linkedin.com/in/anna-p-868921105
Packet Protector is part of the Packet Pushers network. Visit our website to find more great networking and technology podcasts, along with tutorial videos, the Human Infrastructure newsletter, and loads more resources for building your IT career. packetpushers.net
