The Defender's Advantage Podcast

The episode delivers a few genuinely substantive concepts - the enabler-targeting logic, the four-pillar disruption taxonomy, and the Google Sheets C2 mechanism - but the density is reduced by PR framing around a newly-public team announcement and several mid-interview recaps. Smart defenders will extract real ideas but will also wade through promotional positioning.

“we found hundreds of threat actors using IP ideas, residential proxy networks, specifically everything from you know, apt crime, hacktivism, information operations. Uh, we observed uh, model distillation attacks against our uh, LLMs, uh transiting that infrastructure”

“building up this capability that the threat actor had of you know, essentially uh, maintaining live connections to 70 plus uh, telecommunications companies worldwide likely took quite a bit of effort for the threat actor to build over time”

The enabler-targeting rationale and the tactic of hitting adversary commercial storefronts rather than just C2 infrastructure are modestly fresh angles. Most other framing - intel gain-loss tradeoffs, 'adversaries are bolder now,' sunlight-as-disinfectant - recycles widely circulated industry positions without adding new reasoning.

“by going after one, you can potentially impact a wide array of threat actors who are relying on those enablers”

“sheets is just another mechanism to upload and download arbitrary data. Uh, there's lots of places attackers can misuse uh, products. For C2. It's clearly becoming a common tactic to use the products of popular kind of cloud and all online technologies”

Charlie Snyder is the operational head of a newly stood-up disruption unit inside one of the most capable threat intelligence groups in the industry; he speaks from first-hand involvement in specific operations, not from advisory distance. His credibility is grounded in what the transcript reveals he has actually executed, not credential-signalling.

“I think we are the first team who's primary focus is on disrupting the actor behind that activity”

“This started uh, with a Managed Threat Defense investigation. And what that is is you know we have a product that will, on behalf of Google Cloud customers, monitor their uh, security telemetry”

The episode is reasonably concrete by B2B podcast standards: named threat actors (UNK 2814, IP Idea, Salt Typhoon, Volt Typhoon, Shiny Hunters), a specific C2 mechanism (Google Sheets), a hard victim count (70+ telcos), and named legal instruments (court orders, domain registrar cooperation). It falls short of exceptional because there are no timelines, dollar figures, or hard before/after metrics on disruption impact.

“maintaining live connections to 70 plus uh, telecommunications companies worldwide”

“the attacker would communicate from an attacker owned server to um, the victim, in this case the customer we were investigating to uh, issue commands to the compromise machine and to uh, upload data from uh, the compromise machine to uh, the attacker all through uh, Google Sheets basically”

Luke McNamara asks structurally sound questions - the impact-measurement question and the intel gain-loss framing are the strongest - but he never pushes back on a claim, never asks Charlie to quantify success, and closes with a predictable 'what are you excited about' softball. The interview reads as facilitated storytelling rather than genuine interrogation.

“there's also this dynamic where at times the very act of disruption, of taking down infrastructure, of forcing an actor to retool might mean that we lose some visibility into their operation”

“Where are you kind of excited about in terms of, you know, potential future areas, you know, without getting into specifics, of course”