Adversaries are relentless and they're only getting smarter, faster, and more sophisticated. Knowing their game is the only way to beat them. That's why we're here. Learn what it takes to protect against even the most sophisticated attacks. Welcome to the Adversary Universe Podcast.
Hey everyone, welcome to the 2026 kickoff episode of the Adversary Universe podcast. I'm your co-host Christian Rodriguez and with me as always is Mr. Adam Myers, the head of our counter adversary operations. Super excited about this. We actually had this guest on the podcast in March of 2024 and it was actually at the time our highest rated and listened to episode. And now fast forward to the beginning of 2026 and we have a fantastic guest coming back, Mr. Sean Henry. If you don't know Sean Henry, he serves as the executive adviser to the founder and CEO of CrowdStrike. He's one of the company's longest serving leaders. He joined back in 2012 after retiring from the FBI's senior executive service. He was previously CrowdStrike's chief security officer. He was also the president of CrowdStrike Services. He was instrumental in building the company security organization, including its world-renowned global incident response and professional services practices. He's a champion of CrowdStrike's one team, one fight ethos. And Sean is recognized for fostering a mission-driven culture here at CrowdStrike that unites a globally dispersed workforce. Sean Henry, thank you so much for joining the podcast.
Wow. Thank you very much for those wonderful words. I appreciate the opportunity to be here. I know there's been some great success here with the podcast and you know the two of you, Adam and Christian, just absolutely fantastic experience and I love chatting with you guys.
This is a really great episode because we had a lot of listeners reach out to us after an episode that was published back in December, December 18th. We covered basically everything from law enforcement's involvement to Game Over Zeus and Operation Endgame. And there's a lot of questions around what the e-crime ecosystem looks like. How does law enforcement get more involved? And we actually mentioned at the end of that episode like how do we get Sean Henry, you know, especially with Sean, your background, involved to share a little insight into what that looks like day-to-day when it comes to law enforcement getting involved with e-crime activity, nation state activity, activist activity. Before we get too deep into that, I'd love for you to maybe share a bit of your background, some of your experience, especially on the FBI side before coming to CrowdStrike because I think it lends itself better perspective for the listeners that aren't intimately familiar with what you did prior to coming on board with CrowdStrike.
Yep. Well, thanks. So, I spent 24 years in the FBI. I retired as executive assistant director and in that role, I was responsible for half of the FBI's operations globally. So all criminal investigations, cyber investigations, international operations and critical incident response. But prior to that I came on board as an agent and in 1999 I first got my taste of cyber investigations inside the bureau. I ran a cyber investigation squad. I was the chief of the computer intrusion unit in the National Infrastructure Protection Center. I was the assistant director of the cyber division. So kind of full gamut as it relates to cyber investigations up to and including leading and developing international relationships with our law enforcement partners around the world which are absolutely critical in these types of cases. So, it really was a great setup for me moving into the private sector and just a kind of a natural segue into CrowdStrike. And I think a lot of what we've done at the company and Adam being one of the primary leaders in this is taken a lot of the things that we were doing in law enforcement and in the intelligence community and really moving them into the private sector. And all of what Adam's done with building the intel program and then counter adversary operations, I think are just a natural match for the relationship between the public and the private sector.
And as we revisit Operation Endgame, for those of you listening that aren't familiar with what Operation Endgame was and is, it was this very globally coordinated law enforcement action against a network of cyber criminals. And it also included a lot of collaboration with the private sector including CrowdStrike. This is kind of an ongoing thing right where we've seen other operations like Game Over Zeus and our involvement with that, us helping with the takedown of major botnets. Maybe Adam if you want to share kind of your perspective on how important Operation Endgame was and I would love to hear Sean your perspective on what does it look like when the FBI gets involved in something like this massive.
Thanks for all the kind words Sean and it's been we've been working at the company for a while so it's always a pleasure to see you and to have you on the podcast so thanks for being here. Endgame I think was significant and what I really think has been important in the most recent disruptions is that law enforcement's now kind of starting to have a little bit of fun with it and using it to sew all kinds of challenges for the adversaries by seizing their infrastructure and then posting a countdown and threatening to disclose information about some of the threat actors on those dedicated leak sites that had previously been used to kind of shame victims of ransomware now become a forum to kind of expose those threat actors and to kind of start to tear apart the anonymity that they kind of hid behind. And so I think that this is really moving it from just the disruptions that we've seen over the years to actual psychological operations that are going to sew discord and maybe create some animosity between the threat actors. And you can use that to your advantage because if they're fighting with each other, it reduces their effectiveness. It reduces their ability to operate. And if they're suspicious and they think somebody's trying to make more money than them or do something to throw off their operations then that's going to take some of that capability off the table and really that infighting is what benefits the broader community.
I actually think that's very interesting because one of the things I've always said about chasing cyber criminals, there's more similarities between the physical world and the cyber world than there are differences in my opinion from certainly from an investigative perspective there are so many things that are consistent. So when you talk about that, Adam, we talk about organized crime groups in cyber, but when I think about what the bureau did and law enforcement back in the 70s and 80s, there was some fostering of animosity between the organized crime groups in New York City, the five families, the Colombos and the Gambinos. And it wasn't unusual, I think, for detectives to whisper to somebody that a competing family was moving in on their space. And those types of things happened. It's just very interesting to hear. When I think about kind of where we are today and what the FBI's role is and when you're talking about Endgame and how CrowdStrike was involved, there's very different roles for the private sector and the public sector law enforcement. The bureau's key role is identifying the human being behind the keyboard and by virtue of that they get to the infrastructure which allows for some of the disruption that Adam is talking about but to successfully get to those people and literally take them off the field out of the game you've got to put hands on them and use judicial process and that requires a collection of evidence. The private sector is the one most often that actually has the visibility into that infrastructure and they've got the ability to see, counter adversary operations is a perfect example. So much of what Adam's team has put out would be incredibly important for law enforcement agencies to have in order to build the proper case that allows them to put their hands on somebody. Infrastructure is cheap and what we've seen and Adam can talk a little bit more about this. I think when you see command and control channels that go down or different pieces of infrastructure that are impacted, they're pretty quickly spun back up. And what in the past used to have an impact of weeks or months in many cases now in 24 hours they may be able to migrate or pivot to other infrastructure. So physically touching the people that are doing this is the only way to have real no kidding long-term impact. And then what we're seeing now is people being replaced pretty quickly, even if law enforcement is able to put their hands on somebody.
It's an important point that having the human operators disrupted is what ultimately will disrupt the cyber operations because if you're going after infrastructure, it's not having lasting impacts. To Sean's point, law enforcement has a really hard time because a lot of them are hiding behind Russian and other national boundaries that aren't going to facilitate working with law enforcement or necessarily have the resources in the most altruistic cases to do that. But if you think about it from a counter intelligence perspective, think about what happened in the Soviet Union long ago when you could make some sort of case that somebody was supplying information to the British or the American intelligence services and they got taken off the field by their own side, right? And so that might be an area for us to be more creative when we think about, hey, and remember these are criminals, right? They do criminal stuff. And so if they think that somebody's a snitch, somebody's working with the security company, somebody's doing something that is not in the best interest of that criminal organization, they may take care of that problem themselves.
Like disruption through distrust basically. Yeah.
Yeah. I think there's a lot of things that could be done from a disruption perspective that involve using classic counter intelligence techniques and knowing what the psychology of these threat actors are and leveraging that against each other is an area where we might not be able to touch them as Sean says from a law enforcement perspective but if we apply the right pressure in the right place we can cause them to touch each other. Sean, I'm really curious. Law enforcement gets involved, they disrupt this activity. What does this activity do to the behavior of newer adversaries coming in, right? Because you've seen it in the physical side and in the cyber side, right? If you have law enforcement busting up some type of physical crime ring, that typically leaves a few folks apprehensive about getting into or associating themselves with a specific group, I'm assuming. What does that look like now on the cyber side? Do these takedowns act as a deterrent in some capacity? Is it an inspirational opportunity for someone to say, I'm going to beat law enforcement? What have you seen?
So, first of all, the word deterrent is really important. The rule of law and successful investigations is multifaceted. Certainly punishing people for crimes they commit is a big part of that and then subsequently it should be a deterrence for others. Unfortunately I think the return on investment for cyber criminals is pretty high and the risk of being caught is pretty low in this space right now. People certainly are being caught, but I think that the number of people that are walking into banks and robbing them, there's a pretty high conviction rate there. The number of people that are stealing from retail sites and are engaged in ransomware, etc., that are being arrested is a heck of a lot lower. So I don't know that we're seeing the deterrent as well as we'd like to because it requires a successful prosecution. Unfortunately what we see and this has been going on for a thousand years. Criminals are constantly going to adapt their playbook and make changes based on where they see law enforcement having some success. So, some of the things Adam's talking about, when I think about takedowns, what does that actually mean? Is it an arrest? Is it seizure of infrastructure? Is it sinkholing? Is it financial disruption? There's so many components to the adversary supply chain. But wherever that supply chain is impacted, they are going to make changes. That's one of the most important investigative techniques is follow the money. And we've done that in the physical world and we did that in cyber early on and cryptocurrency changed the dynamic of that because of the ability for so much of that to be anonymous and quickly changed and hiding behind multiple layers. So adversaries are absolutely watching what law enforcement is doing. They're absolutely changing their techniques both because of what cyber security is doing to disrupt them and also what law enforcement is doing to disrupt them. And this is a cat-and-mouse game that goes on indefinitely. Every time the private sector security team or law enforcement puts some technique in place that stymies them, they make changes and it's because the ROI is so substantial, it's financially prudent for them to do that.
I think part of the challenge too is that every time we do something right, we spend a lot of time thinking about what we did that was right and how can we do that again and trying to come up with what's the recipe for this thing where I think the real answer needs to be that you got to keep hitting them over and over fast right speed is important here because the more that you stop you have a successful operation or successful disruption and then you take a step back to kind of hotwash it and do the assessment and all of that. That's when they're moving. That's when they're changing. That's when they're adapting and kind of retooling and restructuring what they're up to. And as a result, we've seen from some of the earlier operations that these groups have become a lot more flexible. They've become less regimented. They've become less structured. So, I think we got to hit them and rather than take that operational pause and go through the whole cycle, I think we hit them again and we hit them again. And you keep that pressure on, that's when they're going to make even more mistakes. And that's perhaps where you could get bracelets on them and do something relevant. But you got to keep them on their back foot because if you give them an opportunity to get back up, dust themselves off, and figure out what they're going to do next, that's when you got to start the whole process over from scratch.
That's interesting because Operation Endgame specifically, I feel like there's a lot more emphasis put into the impact, right? There's like a whole website that it almost acts as an advertisement model to the good work that the authorities are doing in collaboration with the private space but specifically it's highlighting things like the amount of servers that were taken down, over a thousand servers that were taken down, authorities took down three large cyber enablers specifically, Venom Rat being one of them, remote access trojan for those of you who aren't familiar with Venom Rat, the Ailysium botnet was taken down and InfoStealer was taken down. I think it was Ratantha right was also taken down.
But then at the end of that, there was a few taken down, but there was a few that were taken up. Yeah. That most recently was the one I'm not even going to try to pronounce. But yeah, I think Endgame started off with this kind of concept of let's disrupt the ecosystem of e-crime and ransomware and that starts with info stealers and moves across the whole spectrum. And I think that's probably the thing that's most significant about Endgame was that this wasn't a one-time kind of operation. There's been, I think, three phases to date of Endgame that have kind of built on the previous one, but they keep the pressure up. They keep the pressure up. And I think now that we've seen the merit of that model, we need to figure out how do we do that at speed and at scale because we need to keep ratcheting up that pressure. And Sean, I remember in the early days of CrowdStrike talking about raising the cost of doing business to the adversary. And the more that we can make it expensive for them and make it more work for them, the less incentive they have to do it. And the economics of cyber crime in particular and this is not talking about nation state espionage or things like that but cyber crime particularly there is a lot of things that we're learning from each iteration and the more that we could keep that pressure on and the more we could have broader operational capabilities and bring more law enforcement from all around the globe into it. This isn't just FBI or NCA in the UK like this is Europol's been involved in leading the charge and we've got from all over the world there's lots of law enforcement that has phenomenal capabilities and so bringing them together in a way that they could share information in real time and actually have an operational mandate to apply pressure at a time and place of their choosing is really important.
So, this is actually really interesting and this is something I think the listeners would appreciate and may not know because Adam's right if in theory, the speed would be critical and the ability to keep hitting them again and again and that would be absolutely impactful. But I think what people need to understand is that a takedown isn't a single door kick moment. It's a months-long choreography of legal process and infrastructure mapping and partner synchronization. And when you think about who the people are that are involved in these types of things in addition to the case agents as it relates to the FBI or NCA, you've got folks in Canada, the RCMP. You've got intel analysts and you've got people that are doing engineering like reverse engineering of malware. You've got digital forensics, then you've got prosecutors, and you've got foreign attaches that are working in these other countries because in almost every one of these, you're going to have an international component. You've got those international counterparts. You've got the private sector infrastructure partners, ISPs. You might have folks that are working at registrars that you need to coordinate with. You've got people that are helping some NOSs, nonprofits that have gotten involved in this game to help do some of the attribution. And then you might even have private sector intel teams like CAO that are involved. So you've got this choreography of lots of moving parts and trying to coordinate all that and synchronize it and do it in a way that's surreptitious so that it doesn't get out what you're doing. If you want to, not only is it speed, but also surprise is part of the process. It could take many many months to pull one of these things off. And that I think that's something that would surprise a lot of listeners. All the bureaucracy, the legal administrative work behind this is really critical.
Well, and that's the part that I think is also worth mentioning is like you have US attorneys and you have all of the folks that are actually going to bring the case in front of a judge who's going to approve the action and then everything has to be potentially explained to a grand jury or explained to folks. So, there's a lot of education that goes into these operations as well. I've seen many of these operations that we've kind of come to the table and been like, Here's an idea. And it just didn't fly with the prosecutors, so it never got anywhere.
It's funny you say that. When I first started back in 99, I had been working a lot in the physical world, a lot of investigations that involved surreptitious matters like wire intercepts and undercover operations and the use of cooperators that were wearing recording devices. I was involved in a number of investigations and when I started working on the cyber side, I wanted to apply a lot of those techniques to the virtual world and we had to take this structure that was put in place that you're describing Adam where there's a review process and you've got to ensure that you're understandably and rightfully so complying with the law and the US Constitution and people's civil liberties etc. And then you want to use these techniques in a world that is moving at such a rapid pace, the virtual cyber world and then try to apply physical world constraints to that space. And it was really really challenging to do those intercepts and to do undercover operations. We did it. We built the process that allowed that to happen. But there's still a lot of drag in those investigations because of physical world limitations that are applied and it creates a lot of friction again understandably because you're protecting people's civil liberties but it makes it much harder for investigators and the bad guys don't operate using any rules especially the rule of law.
Sure. Or constraints. So, and a lot of the laws that are out there are pretty antiquated, right? Like you've got the Computer Fraud and Abuse Act of 1986 and you've got all of these things under USC 18 1030, I think. Keep me honest, Sean.
Yeah, 1030. So, like the Computer Fraud and Abuse Act of 1986, think about how people connected to the internet back then, right? Handset on and like Matthew Broderick was there and I still Yeah. So, a lot of the laws are still not helpful as they could be and not to say that if you rewrote them today that they wouldn't be completely out of date tomorrow, right?
Sure. Sure. But I mean 1986 to 2026 is a lot of opportunity for misinterpretation of what a cyber offense is, right? At the end of the day. So it seems like there's a great opportunity to update that.
And look around the globe. I mean the Scattered Spider operated with impunity for how many years and they were 19-year-old, 17-year-olds working in the United Kingdom and in the United States and so you've got all of these people that in theory for years we're like oh it's a hard problem because they're in Russia right and we can't work with them and the FSB won't help and yada yada yada but it turns out when they're domestic and in Five Eyes countries we're not that much better off, and you talk to law enforcement. A lot of that had to do with the age of the defendants and the ability to press charges.
