Josh Shepard

Josh Shepard

Josh has spent his career hunting for and neutralizing nation-state threat actors targeting critical infrastructure. During his time with the USAF, he led a team of threat hunters pursuing advanced persistent threats (APTs) targeting the defense industrial base, energy, transportation, and water/wastewater sectors. From there he transitioned to Ro, a startup in the healthcare sector, where he built and led a threat intelligence and threat hunt program operating on a multi-cloud, multi-operating system environment.

Posts by Josh Shepard
VIP Keylogger
We explore how the VIP Keylogger makes use of two interesting defense evasion techniques – remote template injection and steganography.
Jan 28, 2025 2 min read
VS Code Remote Tunnels
We explore how threat actors use VS Code remote tunnels and how you can go about detecting them before it’s too late.

VS Code Remote Tunnels

Jan 07, 2025 2 min read
More_Eggs Malware
We’ll be diving into a recent more_eggs campaign that The DFIR report covered.
Dec 18, 2024 2 min read
Smuggling with HTML
HTML smuggling is a technique that allows malicious payloads to be delivered to a victim's endpoint using HTML files.

Smuggling with HTML

Dec 02, 2024 2 min read
Phishing with Fabric - A “Universal Workspace”
RADICL recently observed a phishing campaign that leverages tried and true techniques with a new cloud service.

Phishing with Fabric - A “Universal Workspace”

Nov 27, 2024 2 min read
Tracking Lumma Stealer
Lumma Stealer is a type of malware designed to steal information.

Tracking Lumma Stealer

Nov 15, 2024 2 min read

THE DIB CYBERSECURITY MATURITY REPORT 2025 EDITION

Read Full Report
RADICL_ DIB Report_Part 5

Regulatory Compliance

Read More  
What the CMMC Phase II Pause Means for Your Compliance Program
Following the DoW CMMC Phase II pause, RADICL held a webinar about what may come next.

What the CMMC Phase II Pause Means for Your Compliance Program

Aug 12, 2026 35 min read
What is SPRS? How Defense Contractors Are Scored on Cybersecurity
Beyond contracting officers and primes, your SPRS score is on file with the federal government. If a cyber incident occurs and DoD investigators are examining your compliance history, your SPRS submission is part of the record.

What is SPRS? How Defense Contractors Are Scored on Cybersecurity

May 26, 2026 8 min read
What is DFARS 252.204-7012? A Guide for Defense Contractors

What is DFARS 252.204-7012? A Guide for Defense Contractors

May 14, 2026 8 min read

Threat Hunting & Intelligence

Read More  
Why You Can't Wait to Patch the Latest SharePoint Vulnerabilities
A vSOC expert monitors account activity to keep customers safe.

Why You Can't Wait to Patch the Latest SharePoint Vulnerabilities

Jul 22, 2026 3 min read
Cross-Platform Rust Loader Delivers Modified Sliver Implant via Cloud Storage Abuse
RADICL threat intelligence report: Cross-platform Rust loader delivers modified Sliver implant via cloud storage abuse

Cross-Platform Rust Loader Delivers Modified Sliver Implant via Cloud Storage Abuse

Jul 20, 2026 9 min read
One Email, Five Layers: Anatomy of an AiTM Phishing Kill Chain

One Email, Five Layers: Anatomy of an AiTM Phishing Kill Chain

Jul 16, 2026 7 min read

Industry Analysis

Read More  
Signal & Noise, Volume 7
Signal & Noise is RADICL's weekly vSOC newsletter containing the latest threat hunts and cybersecurity tips.

Signal & Noise, Volume 7

Aug 21, 2026 4 min read
Signal & Noise, Volume 6
Signal & Noise is RADICL's weekly vSOC newsletter containing the latest threat hunts and cybersecurity tips.

Signal & Noise, Volume 6

Aug 14, 2026 4 min read
Signal & Noise, Volume 5
Signal & Noise is your weekly brief on the latest in cybersecurity. Here's Volume 5.

Signal & Noise, Volume 5

Aug 07, 2026 4 min read

Incident Response

Read More  
What Are Incident Response Solutions?

What Are Incident Response Solutions?

Apr 13, 2026 7 min read
A Day in the Life: Our vSOC Responds to the CrowdStrike Incident
On the evening of 7/25/24, CrowdStrike pushed a content update which caused Windows systems to crash and/or enter a reboot loop, rendering the systems unusable.

A Day in the Life: Our vSOC Responds to the CrowdStrike Incident

Jul 24, 2024 2 min read
I Spy a Ransomware Attack
Ransoming an espionage victim carries several advantages that can make it an ideal move for nation-state threat actors.

I Spy a Ransomware Attack

Jul 16, 2024 2 min read

Attack Surface & Vulnerability Management

Read More  
Iranian APT Actors Are Targeting Your PLCs — Here's What to Do
There was a joint advisory this week (AA26-097A) warning of active exploitation of internet-facing Programmable Logic Controllers (PLCs).

Iranian APT Actors Are Targeting Your PLCs — Here's What to Do

Apr 09, 2026 2 min read
CMMC Enclave: What It Is, When It Works, and How to Build the Right Compliance Boundary

CMMC Enclave: What It Is, When It Works, and How to Build the Right Compliance Boundary

Mar 26, 2026 11 min read
EP 9 - Palo Alto Networks' Daryan Dehghanpisheh on Vulnerability Management

EP 9 - Palo Alto Networks' Daryan Dehghanpisheh on Vulnerability Management

Jan 23, 2026 1 min read

Security Operations & vSOC

Read More  
SOC Cost in 2026: What It Costs to Build vs Outsource a 24/7 Security Operations Center

SOC Cost in 2026: What It Costs to Build vs Outsource a 24/7 Security Operations Center

Jul 13, 2026 7 min read
SOC Automation: AI-Driven Security Operations Centers Explained

SOC Automation: AI-Driven Security Operations Centers Explained

Jul 09, 2026 7 min read
SOC Alert Triage in Cybersecurity: Guide to Incident Response

SOC Alert Triage in Cybersecurity: Guide to Incident Response

Jul 07, 2026 6 min read

Operational Resilience

Read More  
EP 57 - Cyber Resilience at the Crossroads

EP 57 - Cyber Resilience at the Crossroads

Apr 10, 2025 2 min read
EP 1 - Micro-Ant's Charles McCarrick on Innovation and Opportunity in the DIB
Micro-Ant's Charles McCarrick on Innovation and Opportunity in the DIB

EP 1 - Micro-Ant's Charles McCarrick on Innovation and Opportunity in the DIB

Dec 08, 2023 2 min read

The DIB Innovators

Celebrating the brilliant minds driving innovation in the Defense Industrial Base. Join host David Graff as he speaks with DIB leaders championing our nation’s security and shaping the future of defense technology.

EP 117 — NODA AI's Phil Duong On Building Mission Command For Autonomous Forces

EP 117 — NODA AI's Phil Duong On Building Mission Command For Autonomous Forces

Aug 18, 2026 1 min read
EP 116 — Carbonix's Dario Valenza On Building 10-Hour Flight Drones That Compete With Helicopters

EP 116 — Carbonix's Dario Valenza On Building 10-Hour Flight Drones That Compete With Helicopters

Aug 13, 2026 1 min read
EP 115 — WAR Inc's Jon Williams On Building a Defense Company Backwards, From IP to Factory

EP 115 — WAR Inc's Jon Williams On Building a Defense Company Backwards, From IP to Factory

Aug 11, 2026 1 min read