# PP104: How SocGholish Picks Locks to Let In Ransomware

Page: https://stenobird.com/podcast/packet-protector-6781347/pp104-how-socgholish-picks-locks-to-let-in-ransomware
Text version: https://stenobird.com/podcast/packet-protector-6781347/pp104-how-socgholish-picks-locks-to-let-in-ransomware.md
Podcast: [Packet Protector](https://stenobird.com/podcast/packet-protector-6781347)
Published: 2026-04-07T17:48:47+00:00
Episode link: https://packetpushers.net/podcasts/packet-protector/pp104-how-socgholish-picks-locks-to-let-in-ransomware/
Audio file: https://feeds.packetpushers.net/link/23910/17315346/PP104.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/packet-protector-6781347/episodes/pp104-how-socgholish-picks-locks-to-let-in-ransomware
Duration seconds: 1699

## Resource

In the cybercrime industry, initial access brokers specialize in break-ins. They pick digital locks and slide open electronic windows, and then sell that access to other threat actors who specialize in ransomware, exfiltration, and other crimes. SocGholish is a widely used tool in the access broker toolkit. Typically disguised as a legitimate software update, SocGholish ... Read more »

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/packet-protector-6781347/episodes/pp104-how-socgholish-picks-locks-to-let-in-ransomware/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/packet-protector-6781347/pp104-how-socgholish-picks-locks-to-let-in-ransomware.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.