Josh Shepard

Josh Shepard

Josh has spent his career hunting for and neutralizing nation-state threat actors targeting critical infrastructure. During his time with the USAF, he led a team of threat hunters pursuing advanced persistent threats (APTs) targeting the defense industrial base, energy, transportation, and water/wastewater sectors. From there he transitioned to Ro, a startup in the healthcare sector, where he built and led a threat intelligence and threat hunt program operating on a multi-cloud, multi-operating system environment.

Posts by Josh Shepard
VIP Keylogger
We explore how the VIP Keylogger makes use of two interesting defense evasion techniques – remote template injection and steganography.
Jan 28, 2025 2 min read
VS Code Remote Tunnels
We explore how threat actors use VS Code remote tunnels and how you can go about detecting them before it’s too late.

VS Code Remote Tunnels

Jan 07, 2025 2 min read
More_Eggs Malware
We’ll be diving into a recent more_eggs campaign that The DFIR report covered.
Dec 18, 2024 2 min read
Smuggling with HTML
HTML smuggling is a technique that allows malicious payloads to be delivered to a victim's endpoint using HTML files.

Smuggling with HTML

Dec 02, 2024 2 min read
Phishing with Fabric - A “Universal Workspace”
RADICL recently observed a phishing campaign that leverages tried and true techniques with a new cloud service.

Phishing with Fabric - A “Universal Workspace”

Nov 27, 2024 2 min read
Tracking Lumma Stealer
Lumma Stealer is a type of malware designed to steal information.

Tracking Lumma Stealer

Nov 15, 2024 2 min read

THE DIB CYBERSECURITY MATURITY REPORT 2025 EDITION

Read Full Report
RADICL_ DIB Report_Part 5

Regulatory Compliance

Read More  
How a 2-Person IT Team Passed CMMC and Won Their Biggest Contract Ever
JohnE Mullin is the Director of IT at Trenton Systems, who passed their CMMC assessment after working with RADICL.

How a 2-Person IT Team Passed CMMC and Won Their Biggest Contract Ever

Sep 10, 2026 16 min read
What the CMMC Phase II Pause Means for Your Compliance Program
Following the DoW CMMC Phase II pause, RADICL held a webinar about what may come next.

What the CMMC Phase II Pause Means for Your Compliance Program

Aug 12, 2026 35 min read
What is SPRS? How Defense Contractors Are Scored on Cybersecurity
Beyond contracting officers and primes, your SPRS score is on file with the federal government. If a cyber incident occurs and DoD investigators are examining your compliance history, your SPRS submission is part of the record.

What is SPRS? How Defense Contractors Are Scored on Cybersecurity

May 26, 2026 8 min read

Threat Hunting & Intelligence

Read More  
Cyberthreats Credit Unions Need to Watch For

Cyberthreats Credit Unions Need to Watch For

Sep 14, 2026 5 min read
Your Streaming Device Could Be Hiding More Than You Think

Your Streaming Device Could Be Hiding More Than You Think

Sep 14, 2026 5 min read
Volt Typhoon: The Threat Hiding in Plain Sight

Volt Typhoon: The Threat Hiding in Plain Sight

Sep 04, 2026 5 min read

Industry Analysis

Read More  
Signal & Noise, Volume 11

Signal & Noise, Volume 11

Sep 18, 2026 4 min read
Signal & Noise, Volume 10

Signal & Noise, Volume 10

Sep 11, 2026 4 min read
Signal & Noise, Volume 9

Signal & Noise, Volume 9

Sep 04, 2026 4 min read

Incident Response

Read More  
What Are Incident Response Solutions?

What Are Incident Response Solutions?

Apr 13, 2026 7 min read
A Day in the Life: Our vSOC Responds to the CrowdStrike Incident
On the evening of 7/25/24, CrowdStrike pushed a content update which caused Windows systems to crash and/or enter a reboot loop, rendering the systems unusable.

A Day in the Life: Our vSOC Responds to the CrowdStrike Incident

Jul 24, 2024 2 min read
I Spy a Ransomware Attack
Ransoming an espionage victim carries several advantages that can make it an ideal move for nation-state threat actors.

I Spy a Ransomware Attack

Jul 16, 2024 2 min read

Attack Surface & Vulnerability Management

Read More  
Iranian APT Actors Are Targeting Your PLCs — Here's What to Do
There was a joint advisory this week (AA26-097A) warning of active exploitation of internet-facing Programmable Logic Controllers (PLCs).

Iranian APT Actors Are Targeting Your PLCs — Here's What to Do

Apr 09, 2026 2 min read
CMMC Enclave: What It Is, When It Works, and How to Build the Right Compliance Boundary

CMMC Enclave: What It Is, When It Works, and How to Build the Right Compliance Boundary

Mar 26, 2026 11 min read
EP 9 - Palo Alto Networks' Daryan Dehghanpisheh on Vulnerability Management

EP 9 - Palo Alto Networks' Daryan Dehghanpisheh on Vulnerability Management

Jan 23, 2026 1 min read

Security Operations & vSOC

Read More  
MDR vs. MSSP vs. vSOC: What's the Difference?

MDR vs. MSSP vs. vSOC: What's the Difference?

Sep 09, 2026 4 min read
SOC Cost in 2026: What It Costs to Build vs Outsource a 24/7 Security Operations Center

SOC Cost in 2026: What It Costs to Build vs Outsource a 24/7 Security Operations Center

Jul 13, 2026 7 min read
SOC Automation: AI-Driven Security Operations Centers Explained

SOC Automation: AI-Driven Security Operations Centers Explained

Jul 09, 2026 7 min read

Operational Resilience

Read More  
EP 57 - Cyber Resilience at the Crossroads

EP 57 - Cyber Resilience at the Crossroads

Apr 10, 2025 2 min read
EP 1 - Micro-Ant's Charles McCarrick on Innovation and Opportunity in the DIB
Micro-Ant's Charles McCarrick on Innovation and Opportunity in the DIB

EP 1 - Micro-Ant's Charles McCarrick on Innovation and Opportunity in the DIB

Dec 08, 2023 2 min read

The DIB Innovators

Celebrating the brilliant minds driving innovation in the Defense Industrial Base. Join host David Graff as he speaks with DIB leaders championing our nation’s security and shaping the future of defense technology.

EP 121 — Tidal Flight's Jude Augustine On Building The First Clean Sheet Seaplane In Decades

EP 121 — Tidal Flight's Jude Augustine On Building The First Clean Sheet Seaplane In Decades

Sep 17, 2026 1 min read
EP 120 — Crow Industries' James Crowell On Why The U.S. Army Is Betting On Smaller Ground Robots

EP 120 — Crow Industries' James Crowell On Why The U.S. Army Is Betting On Smaller Ground Robots

Sep 10, 2026 1 min read
EP 119 — Baker Institute's Ashley Zumwalt-Forbes On Why Critical Minerals Are The Weakest Link In Western Defense Supply Chains

EP 119 — Baker Institute's Ashley Zumwalt-Forbes On Why Critical Minerals Are The Weakest Link In Western Defense Supply Chains

Sep 03, 2026 1 min read