# Media

url: localhost
title: This is a test PDF document
type: document
author: Gene Brumblay
ingestion_date: 2024-08-18
transcription_model: None
content:
  ## Page 1





  ### ### ### ### ### This is a test PDF document. If you can read this, you have Adobe Acrobat Reader installed on your computer.


  ---


url: https://www.youtube.com/watch?v=z8gqBTphMJk
title: Half in the Bag - Alien: Romulus
type: video
author: RedLetterMedia
ingestion_date: 2024-08-26
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=z8gqBTphMJk",
    "title": "Half in the Bag - Alien: Romulus",
    "description": "Aliens\nFacehuggers\nGet away from her, you b*tch!\nThe Nostromo\nReebok shoes\nCGI deepfake dead actor deepfakes\nEvil android that's loyal to the company\nblack goo\nMU/TH/ER\nWeyland Yutani\nThe Engineers\nPeople in Alien Queen wall cocoons but there's no Alien Queen to put them in the cocoons; it just happens\nProtagonist getting into underwear then having to get into space suit\nOpening hole in the ship to shoot the alien out of the ship\nEvery day is an endless nightmare",
    "channel_url": "https://www.youtube.com/channel/UCrTNhL_yO3tPTdQ5XgmmWjA",
    "duration": 1829,
    "channel": "RedLetterMedia",
    "uploader": "RedLetterMedia",
    "upload_date": "20240817"
  }

  This text was transcribed using whisper model: large-v2

   Well.  Did you see the new Alien film?  I like Alien.  I did see it.  And I don't have any questions anymore.  Cause I don't care!  Finally!  The Hollywood grave robbers are at it again!  Just when you thought it was safe to go back into space, the Alien franchise has returned...  again!  Remember Prometheus?  Remember Alien Kavanagh?  Remember being done with all that crap?  It's back.  Again, it happened again.  Remember when Groundhog Day was just a movie?  My life is a nightmare.  With the long, slimy fingers of studio executive notes,  alien Romulus shows us that your family  can't live in good intentions, Marge.  Well, it's about time we got half in the bag  for a half in the bag joke.  It's been a while.  Oh, look at this.  Oh, look at this.  It's the Prometheus Disc Companion Guide.  This is a prop we made when Prometheus gave it  on DVD like 26 years ago.  And you know what?  We put that up for one of our auctions,  but whoever bought it never paid us, so.  Oh, really?  Yeah.  Well, that's good.  I'm glad we held on to it.  Yeah, yeah.  It is now coming handy again all these years later.  Well, that sad amount of money we  made from all of our auctions helped build this company  from the ground up, Jay.  That's true.  This is VCR Repair Company we have.  So today, we're here back again.  This is like a half bag, I mean, VCR Repair Shop Hangout  talk about movies extravaganza.  Three movies in the theater in one month.  We sat in the same seats.  In the same theater as Borderlands.  It was weird.  And literally, the poster was wrong.  Oh, yeah.  And it's not even a real poster anymore.  It's like a digital image, right?  And so they didn't bother to change that.  So I was like, oh, no, the nightmare started all over again.  It was still the poster for Borderlands.  Yeah, it's like, oh, God, what happened?  Did I buy tickets at the wrong theater?  And then we went in there, and we're like, oh, OK.  Fingers crossed Borderlands doesn't start playing.  It's a kind of digital glitch.  Because we're contractually obligated.  If we went into that theater and Borderlands was playing,  we had to sit there and just watch it again.  Yes.  That's the contract you make when you buy a movie ticket.  You can't leave.  Right.  Which is very, very unfortunate sometimes.  Mm.  But my question is, who's to blame for this film?  Well, this movie was a roller coaster of emotions.  Yes.  Because it started off literally about 30 minutes through.  I thought, wow, this is like the best movie  I've seen this year.  And then that goodwill suddenly turned to,  this is the worst movie I've seen this year.  And how they, was it Fede Alvarez?  Fede Alvarez.  He did that?  I don't know.  It's like a magician.  I know, yeah, I know when we talked about Borderlands,  I said, I know at this point it's  cliche to say a movie feels like it was written by AI.  I'm not going to say this movie feels  like it was written by AI.  But what I will say is, it also feels like a cliche  to call a film a fan film.  And this felt like an alien fan film  with all the worst indulgences of that type of,  like Rogue One-ish on steroids type movie.  Yeah, well, let me, I have one more statement  to make, opening statement before the trial begins.  But I just want to, because it's going to get into spoilers.  Because I want to follow up on your AI point.  Because I really didn't feel quite that same way  about Borderlands.  Borderlands just felt like lame.  This, different.  So the movie starts off, and I loved it.  I thought it was fantastic for the first, like, 30 minutes.  Aesthetically great.  It starts off on a Weyland-Yutani mining planet.  I think it's around little, somewhere in the alien.  It's post-aliens, or post-alien, pre-aliens.  Because Ripley's in the cryotube for like 80 years or something.  So this takes place 20 years after Alien.  I think they say two decades.  So we meet characters on this planet.  They're the younger generation of generational miners  that live on this planet.  And they live in such horrible conditions  that they are getting, like, I don't know,  cancerous diseases and dying.  Because the human body is not made for work in space.  And that's kind of the general premise of the background plot.  But we have a girl, Rain.  Rain.  Rain.  And she has an android buddy named  Andy, who's brilliant in the film.  Much like the last two Ridley Scott movies,  the best character in this movie is the android.  Yeah.  Watch me.  I'll do the fingering.  I mean, I don't know who that actor is,  but he deserves an Academy Award for portraying  an android brilliantly.  Lots of subtleties in the performance,  because he switches back and forth between good android  and bad android.  For simplicity's sake.  So we meet these characters.  And there are, like, actual, just actual stakes involved.  And I actually care.  And they spent a lot of time building that up.  Because the girl wants to go to this planet that's  nine light years away.  Or I don't know, takes nine years to get to.  And she's worked all of her working hours  to get a travel.  Her working credits with Weyland-Yutani.  Yeah.  She has a contract.  The evil corporation.  Up to the amount of hours you have to work.  So she can't go to that planet.  It's like indentured servitude.  She's under contract to work.  And they're just like, oh, we just added seven more years  to your contract.  Because whoops, we have a labor shortage.  So it's really, like, depressing and miserable.  And it feels in world with the earlier alien movies.  It's like, oh, this is an interesting little pocket  that we haven't seen before of this environment  and the, like, Weyland-Yutani corporation.  Yes, yes.  Genuinely interesting.  Right, right.  It's just like, yeah, a little corner of the galaxy  where these people are 56 light years away from Earth,  it says at the beginning.  Something like that.  But I'm like, oh, god.  You know, her parents both died of cloud space cancer.  I don't know.  And then there's a little, like, thing,  which there's a voice that comes on the speaker  in the beginning.  It's like, if you feel sick or have a cough, have a fever,  head to the medical bay.  And it sounded like Brian Butterfield.  So I laughed.  And I don't know if that was intentional.  But it made me think it sounded just  like Brian Butterfield.  And I just pictured Brian Butterfield on a microphone.  You have a fever or cough.  Call now.  Call now.  The Butterfield Diet Plan.  Order it exclusively online at www.fullstop.  Weyland-Yutani.  Weyland-Yutani.  So and then her Android friend is, like,  an older discontinued model of Android who's been damaged.  But her father gave it directives to protect her  because he was dying.  And so it's like, oh, you know, I feel a little something.  And they have a, this is the plot.  They have a plan.  There's a space station in orbit, which originally,  initially, they think is a spaceship.  This is her group of friends plan.  Yes.  They're all young people.  Mush-mouthed British friends.  Yes.  Yes.  This is the movie with the, there's something in the water  trailer.  There's something in the water.  Every time I say, oh, no, it's, there's something in the water.  There's something in the water.  But those characters get our main character tied up.  One of them has a plan to go up to space with some kind  of spaceship they have, I don't know,  and steal six cryopods and then take their spaceship  and fly it for nine years to their wonderful planet  that they want to get to.  That's not part of the Weyland-Yutani corporation.  It's outside their jurisdiction.  And they can see the sun and live a happy life.  All the supporting characters are  a little, like, one dimensional.  Yeah.  There's not much to them.  They don't give them time.  But they're alien fodder.  You kind of go into expecting that.  As long as the main character is strong  and she starts, you know, interesting enough.  If they didn't spend 180 minutes of schlock at the end,  they could have preloaded the movie with characterization.  That's true.  There's something in the water.  There's something in the water.  There's something in the water.  There's something in the water.  There is something in the water.  What do you mean there's something in the water?  I don't know.  There's something in the fucking water.  You said, Jay, this, I don't know if your opinion is  that Borderlands felt more like it was written by an AI or this?  No, Borderlands felt AI.  This felt fan film.  This, to me, felt AI as in you type into an AI  and say, make a movie that combines  alien, aliens, Prometheus, alien covenant,  alien three, and alien, or what's it called?  Resurrection.  Resurrection.  You combine all those movies into a movie.  Make it.  Yeah, and it just kind of does it randomly.  The penal colony nature, the planet, the thing at the end,  many, many things, which I don't want to get into right yet.  But yeah, sure, let's do it.  Spoilers.  Spoilers.  I'm all fired up today because I actually  felt many things because I felt sad.  Well, it was disappointing.  I didn't have super high hopes for this movie.  The trailers were pretty good.  But it's like, oh, another alien movie.  But then when the movie starts, and it's like, oh, this  is actually an interesting setup.  I like the world that they're building.  So I actually started to get invested.  And that's why it was disappointing.  Because after that, it just goes completely off a cliff  into a pastiche of every previous alien movie,  sometimes nonsensically, as far as line callbacks.  I guess if we're in spoilers.  Get away from her, you bitch.  For absolutely no reason, Andy the android  says, get away from her, you bitch.  Why did he say that?  Because she said it in Aliens.  Listen.  There's so much like, there's so much  more to that line in Aliens.  She doesn't just say it.  It's not just like a dumb action movie line.  She's a mother.  And then she becomes a surrogate mother to Newt.  And she said it to the queen alien, who's also a mother.  There's like a point behind it.  It's an ultimate girl fight.  Yeah.  Oh, no, I get that.  Trust me.  He just says it in this.  To a random alien.  In defense of the movie, he kind of  says it almost, it's almost like fourth wall breaking.  Because he's like, get away from her, you bitch.  Like, he doesn't know why he's saying it.  Like, the AI told him.  I mean, the screenwriter told him to say it.  But if he just said get away from her,  it'd be like, OK, that's an homage.  But that's something someone would say.  It was like an outtake.  Like, the actor said it.  And they forgot to cut it out of the movie.  And they just left it in there.  So yeah, before the movie started,  we were talking about, like, I think it was the Disney  convention going on.  Yeah, D23.  So they announced all their movies.  And it's just like, Toy Story 5.  I don't know, it's just like the same, like, endless, like.  Lion King prequel.  Yes, we saw a prequel for Lion King.  Like, here's this backstory of Scar.  And I'm just like, I said, oh, fuck off.  Like, I'm just getting so sick of just regurgitating IP.  You know, here's this thing.  And it's like, I don't know, just, you know.  That's what we complain about all the time.  And there was like a little moment  where I was like, Fede Alvarez did Don't Breathe  in the Evil Dead reboot.  So it's like, OK, you know, they brought in, like, a filmmaker.  And he's taking his time with this.  We're having character.  And like, all the first, like, 30 minutes,  like, they go into that cryo room  to steal the fuel for the things.  There's the face hugger sequence.  And I was like, this is all really good.  And then all kind of, like, was building.  And it was hitting all the beats.  And then it happened.  Well, that's why I say, who's to blame?  Did Fede Alvarez?  Because story-wise, this could just  be its own little standalone alien movie.  It doesn't need all these callbacks, and references,  and deepfakes of fucking Ian Holm.  He's not even the same alien, or same android.  Why does it need to be him other than you recognize him?  So we get this distracting CGI deepfake.  See, I was happy.  Like, that's where the, that was like the point,  where the movie died, was when I saw that.  I was like, oh, god.  How do we kill it, Ash?  There's gotta be a way of killing it.  How, how do we do it?  That's why I wonder, like,  because it's like Peter Cushing in Rogue One.  So it's like, oh, is this a Disney decision?  Did Fede Alvarez not want this to be so, like,  fan-service-y and full of callbacks?  And that was just like, got kind of pushed on him?  I don't know.  And then he even had to say those lines.  Like, what's his line from the first one?  I'm afraid I'm going to have to deny your request.  Something, yeah.  And then she's like, I'm afraid I'm gonna have  to deny your request, bitch.  Like, okay, that's the line.  Like, it was gross.  Like, it turned into, like, something I had no idea,  I couldn't even fathom that would happen  to this movie halfway through.  That's the thing is, is I was,  I was so, like, happy with this movie,  and I thought the, what's in the trailer?  The one girl gets a chestburster, right?  The tech person.  She gets the chestburster.  And I thought, okay, we have a situation  where there's an alien on this research science station.  And that's it.  And I'm like, that's, I'm happy.  Everything up until then was great.  Let's make this 90, a tight 90 and get out of here  and have some cool chase scenes.  And the android saves the girl  because that's what he was programmed to do.  And they have emotional ending.  And then her and the guy and the other girl  who's pregnant get off on the spaceship  and they make their way to their happy planet.  I mean, I know alien movies traditionally  don't have a happy ending usually, but.  So for aliens.  Yeah, yeah, until you get to Alien 3.  That's an important thing to point out is like,  yeah, okay, Fede Alvarez, he has a style.  He has kind of his own sort of directorial voice  and the original, not including like Alien versus Predator,  but those original four movies,  what's always been interesting to me about them  is that they're all basically the same movie.  People in a confined space  and they have to run away from aliens,  but they all have such a distinct like voice behind them,  a distinct style.  And they're all very, very different from each other.  So that was kind of like what I was expecting from this,  even though like,  that's one thing I'll say against the first half  is it's almost like slavishly devoted  to replicating the style of Ridley Scott  in the original movie.  But then even when Ridley Scott came back  for Prometheus and Alien Covenant,  he tried to like, he took big swings.  It didn't completely work,  but he tried to turn this franchise  into like more of a philosophical thing  about like the creation of humankind and bioengineering  and lots of big ideas.  Doesn't completely work.  So then you get to this movie and it's like,  okay, new director, new voice,  but then it just becomes like a hodgepodge of references  and callbacks and-  Almost as if an AI scrounged up all these parts  and made it into a movie.  Even like visual callbacks,  like she's wearing the Reebok shoes,  she's holding the big gun.  It's like the exact same shot.  Like the yellow warning light, the smoke and-  The first attack of the face huggers,  I thought was pretty effective.  Yeah.  Cause it's like an amped up version of the aliens scene.  I always think the face huggers are like creepier  than the full blown alien.  And there's that scene in, yeah,  aliens when they're in the room  and the sprinklers are going off and it's attacking them.  And it's like that, but a little bit bigger,  but not in a obnoxious way.  It's like, oh, if he just keeps going with these like  tightly executed kind of set pieces.  When the full grown alien got birthed,  I thought that was awesome.  Yeah.  And that was kind of different visually.  Yeah. Yeah.  And then it's coming out and it's got those big things  on its back and the tail.  And I'm like, okay-  And it's coming out of like a gigantic vagina  that's like mounted to the wall.  Continuing the weird sort of like sexual undertones  of these movies.  Well, I mean, I don't know.  At this point, I think the whole alien biological process  is confusing to me now, like completely because-  I was surprised when they brought  Prometheus' black goo into this.  I thought this was going to be just like,  this is a prequel or this is a sequel to alien  and we're going to keep it simple.  But they tried to incorporate stuff from everything.  And I don't know, I was okay with that  just cause it was like, oh, the black goo.  Sure.  No, but like, yeah.  I mean, I guess they fucked around with stuff in their lab.  So all rules are out the window, but yeah.  Like the first one, it's like, yeah,  the face hugger comes out of an egg.  The egg is laid by a queen.  And then the face hugger implants an embryo into your chest  and that bursts out.  And that's a little baby alien.  You know, with the top hat.  Hello, my baby.  Hello, my honey.  Hello, my ragtime gal.  That thing, and that thing, I guess, grows up.  Like sheds its skin a bunch of times  and grows up into a big black alien.  And this, the process was very expedited.  She gets that face hugger on her and 15 minutes later,  you know, and then the alien,  it's like a full-size alien in like a minute.  And then they don't show a queen,  but I always thought the queen is the one that grabs people  and puts them on the wall and then webs them up there  so that its eggs can get you.  Yeah, no, here it's just in there  because it's a thing you recognize from aliens.  I was really expecting the way this movie plays out  with all the constant irritating callbacks.  I was waiting because we have the one pregnant character  and then she also gets impregnated by the alien.  I was like, this is gonna be the origin  of the queen from aliens, isn't it?  They didn't do that, thankfully.  No, it just turned into Marilyn Manson.  That was frightening.  That thing was ugly and creepy.  It just turns into the third act of Alien Resurrection.  But it's the same thing as Alien Resurrection.  But it kind of looks more like  the engineers from Prometheus.  It does, because it has their DNA.  And the premise was kind of like interesting, I guess.  Like all of Ripley's efforts were for naught  in the beginning of Alien,  because I guess the alien survived.  Yeah, well, that's continuing Ripley's tradition  of all of her efforts being for naught  if you include Alien 3.  The happy ending of Alien 2 is just eradicated.  She's just fucked no matter what she does.  Well, and she tried to kill herself,  but then they just scooped up a little bit of her DNA  and cloned her so that she could make more.  I mean, it's just like the classic case  of a concept that starts off really  like a simple effective horror movie  and then the writers have to expand on a mythology  or a lore that was not intended to be expanded on.  And so then you get just like junk,  like people not knowing which direction you're going in,  just adding shit and taking it away  and then rewriting this and blah, blah, blah, blah, blah.  Well, that's what's interesting about this movie  is that story-wise it is pretty simple and self-contained.  It's just all the execution  and all the details that they added  that muck it up and make it obnoxious.  Well, and that it just wouldn't end.  Yeah.  It was just like, it felt laborious at the end.  It's just like, I don't know.  She's like, where are we on now?  We're on this other ship.  She's got to climb down to the cargo bay, blah, blah, blah.  And it wasn't even like a, I don't know,  it wasn't even like a surprise  that the pregnant girl was gonna have an alien baby.  Yeah.  It was a surprise that the queen stowed away  on the drop ship, you know?  Yes.  Everything's calm, you think it's over.  Oh my God, we have a fourth act to the movie now.  And this they tell you  because she has the black goo ejection thing  and she does it.  And then, so you're just waiting.  Yeah.  Like, I know it's not over yet.  You're gonna do the thing where,  and then she even like, she gets down in her sleeping shorts.  It's, runs around and-  She gets into the space suit, just like aliens.  It's just like, I don't know Fede Alvarez at all.  I don't know anything about him.  I don't even know what he looks like.  And I've never heard him speak.  All I've seen is those two movies.  I'd like to think that as anyone  who has any kind of artistic integrity or leanings  as a storyteller or an artist would say,  do we have to do that?  Can I do this totally different ending  like and explore these-  I mean, this is a part of the Disney machine now.  Fox is Disney, so I don't know  if that's the cause of it or what.  It's a shame with this too,  because production wise, it's so great.  All those like old, that like seventies future look  of the CRTV, CRT TVs and the set design.  Like it's all great.  And practical monsters for the most part that I could tell,  you know, lots of slime, lots of good effects.  And it made me kind of like the first half was like,  I was kind of, I was, it was a good horror movie.  I was like scary.  I was like, it made space like frightening.  It's shots out the window and you see this,  all these like the asteroids going by  and just how desolate and like creepy it is and dangerous.  And it was all super effective until  you just felt that meddling.  And like that Android, the synthetic was like ripped  in half a different one and its face is down  and it's like, and like they go back to it.  And I was like, oh, okay.  It's just going to be a synthetic that they talk to.  And then.  There's no reason for it to be the same model  as Ian Holm or whatever.  And you put a deep fake Ian Holm face on it  where the mouth feels like disconnected  from the rest of the head.  Didn't look right.  Yeah.  Just have it be a new character.  That movie is like 50 years old.  Like no one cares.  I mean, people care about the movie,  but the only people like over,  certainly over 40 are going to go,  oh, that's, you know, Ash from the first alien movie.  Like no one's going to care.  Who's like under 30.  No one's going to care at all.  So why bother?  Just make it a random Android.  Right.  And who's in charge of the bio lab.  Get a new interesting actor to play that part.  Maybe have an interesting performance  from a new Android character.  I just get that feeling like,  and this is becoming a cliche at this point  where he plops the script down and the camera pans back  and there's a boardroom, 30 people in business suits.  And then they say,  we need to maximize efficiency for this movie product.  When it goes into theaters,  it has to remind people of this movie and this movie  and this movie and this movie.  Our charts and our analytics and biometric data  shows that if people remember that,  they'll still recommend it to a friend  because it had the scene in it from alien  where she climbs down a ladder  and you see her close up of her Reebok shoes.  And then she's trying to hit the button of an elevator  while the creature's coming.  They'll remember that scene from alien  and our psychiatric division says that they will recommend,  you know, you got to put that in.  You got, she's got to be in,  she didn't have like as revealing of underwear  as Corny Weaver did.  No, no, no.  We have to blur that out for YouTube.  It's so revealing,  but she just had like little sleeping shorts on.  And you know, so it's like, that's that scene.  The character is in her most vulnerable.  That's what works so much about that.  She's like barely wearing any clothes.  She's caught off guard and she thinks it's over.  Ready to get in bed.  She's got her butt crack panties showing.  And then she realizes there's an alien  just kind of like curled up in the wall, like a bug.  It's like dead silence.  Yeah, and it's, oh fuck.  Slips into the, into the space suit.  So we got to have that scene because that's iconic.  And, and, and then just Fede Alvarez going,  how much are you going to pay me?  I'll do it.  You know, it's, it's, it's all gross.  Yeah.  And then I, then I wonder about Ridley Scott too.  Cause he produced this.  And I wonder if that was like his idea to incorporate  the Prometheus like mutation shit  and bring back the engineer.  Like, was that his contribution?  And it's like one of like 15 voices.  Like an ego thing?  Giving notes.  Yeah.  I mean, we could be totally wrong  and this could be a 100% Fede Alvarez screenplay.  100%.  I just wanted to pay homage to the entire franchise.  We could be wrong.  Yeah.  But our cynical nature takes over  and our cynical nature is probably correct.  I admire its purity.  I really don't have any super attachment  to the alien franchise.  I think it's like an interesting franchise.  Just cause it's kind of an anomaly.  Yeah.  It doesn't have, I mean, Sigourney Weaver, I guess,  is like the lead of the franchise for the first four movies.  But like I was saying,  the fact that they are all like so different  from each other makes them unique.  Like I know a lot of people don't like Alien 3.  I like it quite a bit, but that is,  I know it had a lot of meddling,  but it is a David Fincher movie.  Like visually, it's, it's such a great looking movie.  And then even Alien Resurrection,  they brought in that weird French guy  and every scene between Sigourney Weaver and Winona Ryder,  it looks like they're just about  to start making out at any moment.  This is weird, like sexual undercurrents  and bringing in the half human, half alien baby thing.  Weird, it takes swings, weird ideas.  And then, like I said, even Prometheus.  But then this movie comes along and it's just like,  I don't know, it just becomes mush.  It becomes like baby food.  I just, I just hate being exhausted watching a movie.  I hate being exhausted.  And that's, that's, I think that's the takeaway here  is so much effort, so much, so many great sets,  even great performances.  The guy who played the android was so good.  And that, that idea of him being like a,  almost like a simpleton in the beginning,  like a, like a dummy and he's made fun of,  and then him switching by a chip to this like,  you know, evil, evil corporate character.  Yeah.  And then.  And our main character loses her connection with him  and she's basically the only family she has left.  It's interesting.  Yeah, and then that, I think that he should have  been the main character, but it has to be  the Ripley character running around at the end  because it has to be that.  Yeah.  You know, you're talking about taking swings  and this is not it.  But the opening was like a dead silent,  like two and a half minute long shot in space.  Just dead silence and credits and all in space.  Everyone can hear you chew nachos with your mouth open.  So Jay would recommend Alien Romulus  and I didn't make one Star Trek reference the whole time.  I was waiting for one.  That's fine.  I don't think I would.  I think I'd rather watch the Ridley Scott,  like Prometheus and Alien Covenant movies again  before this thing.  At least they feel like original.  They feel like their own thing.  Yeah, that's true.  This was just obnoxious.  An AI fan film.  Yeah.  Yeah, I would say the same thing.  Like, I don't know, maybe leave at the 30 minute mark  like all the critics did.  Well, that's shaping up to be a good movie.  I've seen enough.  I assume the rest of it's good.  I'm going to go right by review.  Great performances, great scenery, great sets.  Wow, what an amazing picture.  I've got an appointment with my doctor.  A plus.  Got 15 other movies to see today.  Yeah.  15 other Disney products to see today.  Maybe that's it.  You only watch the first 30 minutes  and then they move on to the next Disney product.  Or like they're going to review another movie  and it's in like the theater next door  that starts at like, you know,  in 30 minutes after this one started.  Then they just like, okay, you know.  Got it.  The new entry of the Alien franchise  by our tour director, Fede Alvarez  is brilliant and dark and disturbing.  Has many scares and creepy monster effects  to wow your senses.  A plus.  I'm going to go on the next theater watch.  I assume that's where little do they know  it fell off the cliff worse than anything  I've ever seen in my entire life.  So yeah, I guess we're the suckers.  Stayed for the whole thing.  Yeah.  What are next?  Questions will be answered.  I'm still waiting.  I'm still waiting for questions to be answered Ridley Scott.


url: https://www.youtube.com/watch?v=idssoTmERw8
title: Building Our Nemesis
type: video
author: SpecterOps
ingestion_date: 2024-08-26
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=idssoTmERw8",
    "title": "Building Our Nemesis",
    "description": "This webinar delves into the recent release of Nemesis 1.0, our offensive-focused data enrichment pipeline years in the making. Nemesis aims to unify all post-exploitation data from offensive engagements in order to improve operator workflows, provide tradecraft assistance, and uncover new data-driven research opportunities.\n\nThe presenters cover various red team challenges that influenced Nemesis\u2019 architectural decisions, as well as collection scenarios, and the advantages Nemesis can grant you on engagements. The offensive industry is about exploring what\u2019s possible - explore the new possibilities Nemesis unlocks!",
    "channel_url": "https://www.youtube.com/channel/UCWMKKqCCQkUjU8dIyiL1yhQ",
    "duration": 3542,
    "channel": "SpecterOps",
    "uploader": "SpecterOps",
    "upload_date": "20240701"
  }

  This text was transcribed using whisper model: large-v2

   All right, Lee, do you want to kick us off?  Yeah, welcome, everybody. We're excited to be here talking about Nemesis. So,  our title of this presentation is Building Our Nemesis,  talking about the latest Nemesis 1.0 release and just kind of what Nemesis is.  So, just as a little agenda of what we're going to be talking about,  go over some introductions. We'll talk about the background behind what Nemesis  is and some of its architecture, and we'll talk about some new features that we've added  in the 1.0 release over the last couple months, and then show off some demos of some of its  capabilities. Also, just kind of a heads up for everybody, feel free to drop questions,  you know, in the Q&A and all that kind of stuff during the presentation. We're aiming to kind of  save those till the end, but feel free to drop them kind of while we're talking, but we will  address whatever. We'll address as many questions as we can, time permitting.  So, just as some introductions. So, Nemesis is created by us three people on this call right  now. So, my name is Lee Chigoye-Christensen. I go by Tifkin on Twitter, and I do research here at  Spectrops. That being said, I have a long history of doing penetration testing, red teaming,  application security, that's all kind of my background. I've been involved with a lot of  projects and speaking engagements in the past at various conferences, have a handful of CVEs.  Most recently, one of the bigger pieces of research we're known for is the ADCS  research, the certified pre-owned paper that I helped to do with Will as well. Max?  My name is Max. I'm an AdSim consultant here at Spectrops. I do a lot of consulting. Mostly,  I do a lot of software engineering though. I wrote our internal infrastructure automation  tooling, and then author of a few different tools, Satellite, Jot3 Transport, GoFish Notifier,  and most importantly, Nemesis.  Yeah. He is our Kubernetes and Helm expert, which we will dive into. So, my name is Will  Schroeder. My handle is Harmjoy on Twitter and GitHub and all that fun stuff. I'm also a  researcher with Lee Christensen here at Spectrops. I've spoken at a lot of conferences over the years,  helped deliver a lot of training. I was formerly the course architect for the red team operations  course. I'm also a co-developer of PowerShell Empire, PowerSploit, specifically PowerView  and PowerUp. Bloodhound, I was one of the original authors. Ghostpack, which is kind  of a collection of security tool sets. Originally kind of C-sharp, but kind of morphed a little bit  beyond that, as well as a co-author for the certified pre-owned research with Lee.  So, I've written a lot of code over a lot of the years, and for the last year, year and a half,  we've had a lot of focus here on Nemesis. So, I'm going to talk about Nemesis's genesis  from kind of red team challenges to data analysis. So, I'm going to kind of set the stage for  everything of why we believe that Nemesis was kind of necessary for what we were trying to do,  and kind of where the whole inspiration for this whole project kind of came from.  Also, apologies for my webcam not working. Just had a little bit of malfunction,  but you at least can look at Max and Lee's beautiful faces. So, I'm going to start with  just kind of a real quick red team story time with our definitely not AI generated  little super cool cyber red team graphic here. But I wanted to highlight one of the problems,  a kind of prototypical problem that we tend to see on some engagements. So, Lee and I,  specifically, we've been red teaming together for close to a decade. We've done hundreds of  engagements, and one of the kind of the prototypical problems that we'll see is this kind of  file triage, and like system file system, file share, and like file itself triage. I'm going to  just go through a quick example of that to kind of set the stage. So, let's say we have our Cobalt  Strike instance here. We have a ton of files that we're trying to triage, you know, on a particular  host where we have an agent, we have an implant. We can't necessarily download everything. So,  we're like, well, you know, this one particular thing might be kind of interesting. We download  this program.exe. It's going to download from the agent to the actual team server itself. That might  be a multi-part piece of like infrastructure with jump boxes and all this kind of stuff.  Then, somehow, I need to sync. Then, the next step is I would synchronize that file that I  downloaded down to my kind of attacker host. So, I'm doing, you know, implant to team server,  control server, control server back down to my actual like op VM, things like that. Then, I'm  going to do some like super really basic triage of just initial basic examination of this and like,  okay, I see that this is a .NET assembly, which is something that we'd like to target because  there's often a wealth of deserialization volumes and things like that. So, from there, I need to  take that and transport it to a non-Internet connected Windows analysis system to do more  specific Windows .NET analysis. I'm going to pull this apart with a number of different programs. So,  I have to move this to a different VM as well. I can pull it apart into something like de-inspire,  do some automatic tooling. I can say, okay, in this case, this is a toy example for some  JavaScript evaluates, a little snippet that lets me get code execution. There's actually a  recreation of something we saw in a real engagement. But there's a lot of steps here, you know, right?  And if we're having to do this, you know, hundreds or thousands or more times, that takes a lot of,  it's just the workflow isn't efficient. It was just kind of one example of something we tend  to go through a lot. So, I'll pass it over to Lee. Yeah, and that's like the reality of what  red teaming is. If you haven't done like red teaming or penetration testing or, you know,  hacking into things, a lot of that is that process there. You're downloading files or  you're running tools and you're having to analyze the output. Sometimes you do it on your current  machine or you have to go to other machines. You have to open up different tools and it just takes  a lot of time to do all this triage. And so, that's some of the problems that we have as we're  doing assessments. Another aspect of this is, you know, as a red team, Tradecraft is difficult to  scale. So, at our company, at least we have like 20 to 30 red team operators and, you know,  everybody has different skill sets. Like some people might be good at phishing, some are really  good at cloud stuff, some are really good at Windows stuff. But nobody's an expert in literally  everything. That's just the reality of security testing. And so, when new stuff comes out or like  there's new technologies that we haven't come across before, how do we ensure that everybody  on our team kind of has that knowledge? So, how can we scale up knowledge? Another aspect of this  is, as Will showed, oftentimes we're using a bunch of different tools on a bunch of different systems  as we're analyzing a network. And we could be using, you know, maybe Cobalt Strike as our C2  framework. Or you could be using Mythic or you could be using Stage One or Nighthawk or Brutal  or all these frameworks, Metasploit. And they're all collecting data about the same network,  but they're all kind of siloed off on their own machines. And the data about the network is stuck  in all of those different systems. And so, it's not being kind of aggregated and being looked at  as a whole. Instead, you're kind of locked into those different platforms or the output of those  tools. Finally, when you run those tools or when you're performing your assessments, the reality  is sometimes there's just a lot of data that you're dealing with. And sometimes it's really  tedious to do. So, anybody who's done penetration testing or red teaming knows that file share  triage is extremely beneficial, but it's extremely boring. You're literally just going to a machine  and you're downloading files for hours until you find something that's maybe useful.  And as a result of that, not just with file share mining, but in other aspects of red teaming and  penetration testing, sometimes things get tedious and our analysis becomes a little inconsistent.  And that's just because we're human. We can't be perfect all the time. Or maybe our skills,  I was a lot more experienced, maybe able to see something in a file or recognize an API token,  but maybe somebody with less experience doesn't realize that.  Also, to kind of add real quick, there's also kind of a temporal aspect to where maybe something  you saw on the first or second day of an engagement isn't relevant to you then,  but it could be relevant later. So, not having all this output in one place that's searchable  can be a downside as well, because maybe a particular code name or something that you're  trying to think of or look for later on actually showed up earlier on when you didn't really  realize what it was. So, that's kind of like a little additional half thing to kind of add on  to all that. So, we built Nemesis to try and address some of these challenges that we have.  So, Nemesis has some long-term goals, some of which we've achieved right now,  and some of which we're still working towards. So, one of these long-term goals is to empower  analytic capabilities. So, we want to take all the output from these tools that we're running from  different C2 frameworks or whatever tools we're using and centralize it. And then we can model  the target network that we're trying to assess. And as we model this network, we can then perform  analysis on the data that we're modeling. So, like when we download a file out of any platform  or do a process listing, it'll get centralized and then we can analyze it and do consistent  data analysis across all of those different file types. So, irregardless of where we download or  upload a file from into Nemesis, it's going to get analyzed the same. We also want to provide  down the line some workflow-specific operator assistance. So, trying to scale some of the  tradecraft. If we see maybe there's an attack technique that's possible, we can give a suggestion  to the security tester of what to do. And ultimately, that's going to help enhance  our knowledge sharing and coordination and reporting practices that we do here.  So, we can suggest new tradecraft or we can suggest tradecraft for operators,  also integrate some tradecraft playbooks that we have into the operator workflow.  So, for example, some type of attacks are multi-step and they can get a little bit complicated.  So, we document some different tools that we use internally in Confluence or in other areas.  And rather than having to go externally to these other sources to get information, we can then  integrate that into the assessment or the operator's workflow. So, in a tool that they're  using on an engagement. And this will hopefully allow us to track progression and  do better reporting as we're doing assessments. And then finally, because we're aggregating  all this data, one of the reasons we want to do this is to support some of our future research  efforts. So, one kind of cool thing that you can do with this is then look back on previous  assessments and do things like maybe look for, by analyzing multiple networks, you can maybe  look for vulnerabilities retroactively that might be in a network or look for different, maybe  things that we missed while we were doing an assessment. So, it's kind of like a platform  that we can use for discovering new attack techniques or different  post-exploitation techniques that we could use during an assessment.  So, Nemesis' vision then, basically it's a centralized data processing platform that  ingests, enriches, and performs analytics on offensive security assessment data. So,  we're ingesting data from the various tools we're using on assessments. It's getting centralized.  And then once it's there, we're going to start analyzing it in a lot of different ways. So,  some of that's going to be automated. And then some of that will also be the output to the  operator, the user of Nemesis, so that they can see the output and analyze it manually as well.  And obviously this is not a new concept that we invented. People have been doing this for a while,  particularly on the blue side. We're just wanting to apply this for more offensive operations. So,  collect as much data as you can, centralize everything, contextualize it, and so operators  can make better decisions. So, Nemesis actually came out at BlackHat last year, right Lee?  Yep. Yeah. So, we released it at BlackHat last year, at BlackHat Arsenal. We're actually going  to be at Arsenal again this year too. So, if you want to come and say hi to us, we'd love to chat  with you there. So, it was released last year and then we just released the 1.0 release just,  what is it, a month ago, a month or two ago. And with a lot of new features that have been added  since BlackHat last year. And we'll touch on some of those features here in just a few slides.  But first, I'll pass it to Max to kind of talk about some of the architecture.  All right. So, going to talk about the architecture a bit, spend a couple minutes talking about how  all the components work, how the data flows, all that kind of fun stuff.  So, you need to memorize this, every component here if you're going to use Nemesis.  Now, we're going to, you don't, we're just going to talk about some of the pieces here  because there is obviously a lot. There's a lot of small components that go into Nemesis.  The main thing I want to show here is the kind of infrastructure design pattern we're using.  So, we have data coming into, from Nemesis web API, coming into this message queuing system.  And then we have individual analysis components that are grabbing data from this message queue,  performing some sort of analysis, and then passing data back into the message queue.  Then the data gets returned into one of the sinks, one of the two sinks we have, either the  Elasticsearch connector or the Postgres connector. The data flows through the sinks,  outputs to some sort of data source like Postgres or Elasticsearch, and then operators can view that  data in the dashboard, or if they really need to get into the nitty gritty, they can use Kibana  to analyze it. So, that's generally the design pattern we have, you know, analysis being performed  or a message is going through a queue, analysis being performed, and then data coming back into  that queue and then displayed later. And one of the things I just want to mention here with some  of the connectors and stuff on the left is we have connectors for a lot of major C2 platforms.  So, if you set these things up, so you have your Cobalt Strike or OST Stage 1 or Mythic or whatever  C2 connected up with the proper connector for Nemesis, your files and data and information will  just automatically flow into the analysis platform, and then you can just view it popping  up in a dashboard. So, we try to make things as end-to-end seamless as possible. Again,  you definitely don't have to know how all these pieces work.  Yeah. And then one last thing to note is that we're kind of orchestrating all of that with  Kubernetes. Very useful tool. So, here's what an example looks like of how data flows through  the network. So, we start, an operator will download a .NET assembly from the target  environment using one of those connectors that Will just talked about. So, for example, we might  use Cobalt Strike, run the download command, the Cobalt Strike connector will upload that file to  Nemesis, and then now in Nemesis we have a .NET assembly with some metadata about it and then  the actual assembly binary itself. That file is uploaded to MinIO, and then we pass that metadata  into the message queue, and then the file processor will take it, the file analysis processor,  the file analysis like container will see that that exists, see a file that's a .NET assembly  exists, grab it, say, and then perform some analysis on it. So, inside the file processor  for .NET assemblies, we have three separate analyses. We have metadata extraction. So,  it'll grab things like the version info, the imports, type ref signatures, things like that.  We'll also run MatHand's inspect assembly tool to check for deserialization vulnerabilities  on every single assembly that gets passed through Nemesis. And then also for every .NET assembly,  we'll use ILSPY to decompile the binary and get C sharp out. So, for every single binary that goes  through, these types of analysis are being performed automatically every single time.  Then we reach the data sinks. So, after the analysis is performed, it goes back into  RabbitMQ, back into our queuing system. The data reaches the sink. We get to either Postgres  or Elasticsearch. And then Kibana or the Nemesis dashboard will reach out to these data stores  and then display data to the operator. So, from the operator's perspective, most of this is  transparent. From an operator's perspective, you download the file in your C2 platform of choice,  and then you look at the Nemesis dashboard to see what sort of intelligence Nemesis gathered from  that. So, this is what an enriched file looks like. So, after a .NET assembly is passed through,  this might be what you see. So, at the top, you can see we found Jscript evaluate  being executed inside the binary. It says has command execution true. So, this will be super  useful for us to go and triage and see where is that potential command execution called.  We have the extracted source URL you can see in there. Download it and grab the source.  And then we also have all this metadata at the bottom about where that binary came from,  what's the host, when was it downloaded, and so on and so forth. One of the important pieces,  because we get this question all the time, is there's this metadata.expiration field.  Obviously, there's data retention policies that companies have, and we can't just download  people's files forever and keep them. We have to abide by the data retention policy.  So, this field is configurable, and after the expiration date has passed, data will be deleted  from Nemesis in any sort of persistent store. So, you don't have to worry. If you configure this  field, data will be expired and expunged. Sorry, go ahead, Lee.  Lee-Anne. Raw data, too. The kind of raw view of the data that gets fully enriched inside of  Nemesis. There's a much prettier UI dashboard that we'll show you in a little bit that displays a lot  of this information in a much friendlier way than just the raw data that you're seeing here.  And then, tool integrations. So, integrating a tool. Now, we're going to talk about the left-hand  of that diagram. So, this is ingesting data into Nemesis. It's super easy. There's two post requests.  If you can make two post requests, you can integrate your tool with Nemesis. There's the file  API that uploads files, and then there's the data API, where all you have to do is follow this  Operational Data Reference, which is a schema that we use for data that gets uploaded. You can  integrate your tool with Nemesis. So, the ODR, or Operational Data Reference, again, it's just a  schema. It includes things like file listings, file data, process listings, so on and so forth.  We also have a raw data type in there. So, if there's a particular data type that you want to  work with, or you have that you want Nemesis to work with, you can use that to start. And if you  find that data type to be extremely useful, make a PR and try to integrate that into Nemesis.  We also have a number of connectors, so you don't have to write these tool integrations.  You're not starting at square one. We have integrations for Cobalt Strike and Mythic,  Metasploit, OST Stage 1, Sliver, and we have a couple weird ones. We have a Chrome plugin,  that uploads files. It's a Chrome extension. Anytime there's a file downloaded in the browser,  where the extension is installed, it'll upload it to Nemesis. And then we also have a BoF  for registry collection. I believe this BoF only works with Cobalt Strike,  but it's also there and might be able to be adapted to other platforms.  Great. So, Nemesis does all this analysis, and some of our goals behind this is, we want to  collect this information to help automate some of the boring work that we have to do. So, we kind of  view this as the equivalent of level one analysis of offensive data. So, there's a lot of boring and  tedious things that we have to look at, and we want to be able to automate that. So, Nemesis  that we have to look at and remember to do on assessments. So, let's just try and automate away  as much of that as we possibly can. We can also do this offline rather than doing it in the target  network, which is nice. Another nice thing about this is, because we're building this data model,  we can also analyze the relationships between data sources that maybe weren't as easy to do  previously. So, a simple example of some relationships on a host are like,  think of a Windows service. So, a Windows service is backed by a registry key, and in that registry  key, it defines the path to a binary on disk. So, these are all different types of data types in  Nemesis. You have a service, a registry key, and a file on disk. And you can see that there's  relationships and there's value in those relationships, in that you may be able to,  by analyzing them, you can find things like privilege escalation opportunities. And that  applies elsewhere in the network. So, for example, you have a host. Well, a host is individual by  itself, but you also have hosts in Active Directory, and there might be users on those hosts,  for example. So, we're building relationships in this way, too, for different systems.  And then, as we do this analysis, you know, down the line, one of our goals is to provide  feedback to operators and give them suggestions based off of what we're seeing in the network. So,  oh, they're using Active Directory. We see that SCCM is registered. Maybe we queried the registry  and we saw SCCM is registered as being used on the host. So, maybe you should use, do something  do some of the SCCM-related attack paths, like sharp SCCM, to discover credentials or escalate  your privileges. Things like that. It's a simple example of how we can provide feedback to an  operator. Yeah. And to be clear, we're not, this is one of the long-term goals. There's a lot of  plumbing that went into getting to this particular point, which Lee will get into in a second,  particularly around some of the host-based abstraction modeling that we'll talk about.  But this is kind of the ultimate goal that we want to get to, is contextualizing  your operations with existing data and integrating playbooks and things like that. So,  not quite there yet, but that's where we're working towards it.  All right. So, we're going to talk about some of the new Nemesis 1.0 features,  starting with that host modeling thing with Lee. Yeah. So, one of the things that Nemesis tries to  do is it's responsible for processing and enriching data and building a data model that  we can use, irregardless of the tool it comes from. So, like we said, we support a lot of C2  platforms, like Metasploit, CobaltStrike, Mythic, et cetera. And this is great because it allows us  to get data from a lot of different sources, but it comes with its own problems because  every platform identifies hosts in a different way. And so, this problem... So, for example,  some platforms may use the NetBIOS name. They could use the IP address. They could use both.  They could use the FQDN. Sometimes when you get an agent back, when we're doing red teams,  we may not even know what the host name is because we're using DNS C2. Other platforms  try and generate a unique artifact per host that you get on using things like the serial number  in the hard drive. And so, how you do host identification can vary. And so, we had to  solve that problem of given that we have data coming in from multiple sources and we're trying  to aggregate it and build a data model, how do we aggregate that and uniquely identify hosts?  So, we may have a Mythic agent running on a machine and a CobaltStrike agent running  on the machine returning data about the same host, and we basically need to collapse that  into a single host. Well, a single host representation. Sometimes, though, it's not always easy to do that  and mistakes happen. So, I've seen other projects try and solve this and they map things incorrectly.  So, a very simple example is let's say we have two agents running on two different machines  and they have the same NetBIOS name. So, let's just say like computer one, but they're running  in different domains. So, computer1.corp.local versus computer1.acme.local. The agents, though,  may only be returning the NetBIOS name and it's actually two different machines. So, sometimes  errors happen and we wanted to be able to support remapping either manually or automatically  to the correct host representation. We also have some what we call temporal problems.  So, when we're collecting data, the ground truth of things can be composed of various  pieces of information. So, imagine a file system. A file system like a Windows file system. It's  huge. There's a lot of different data there. And when we're doing our collection, a lot of times  we're doing it kind of piece by piece. We're going to list a directory here, list a directory  over there. And you may be doing that through multiple platforms. And the tools you're using  may be returning data immediately or it could be very delayed. So, you can imagine like when  you're using DNS C2, it takes a long time to exfiltrate data from the network. So, data might  arrive in a delayed fashion or it may just be partial data. You're not seeing all of the file  system. You're just seeing a part of it. So, when you're building a data model, you have to take  these things into consideration. Like, you know, what if we're receiving data? We listed the file  system and we don't get a response until five days from now. We have to be able to model that  correctly. Another problem is how do you differentiate and track data that's collected  on one host versus, you know, I as an attacker might be on a host and then querying a remote  host and collecting data from a remote host. So, how do we differentiate between data on the  current machine versus a remote machine in the network? And that creates some very interesting  host modeling challenges. And we did a lot of whiteboarding to try and figure this out,  as you can see. This is some of our brainstorming sessions. We'd say it definitely wasn't easy,  but we have a solution. We don't know if it's the best solution, but it's a solution.  So, that is all. It's in Nemesis. And now we're going to start building on top of that  to build out some more analytics, some more powerful analytics that we'll be able to use  in the future. Yeah, this was a surprisingly hard problem. But again, we think we have a solution  and we're actually going to be releasing a blog post probably in the next like month or so,  I think, Lee, that kind of details and some of the specifics on this. So,  if host modeling is just, you know, is just your jam, then be on the lookout for that.  We also streamlined the installation for Nemesis. So, this was the, I mean, by far  the biggest piece of negative feedback we got about Nemesis, you know, pre-version one,  which is totally understandable. One thing that I loved was Checky Mander or Scotty Austin wrote  this giant blog post detailing how to install it. It was like, you know, huge document. And he very  politely called it an intimidating install, which is just the understatement of the century. I mean,  it was not an installation that was for the faint of heart. Things are a lot better now.  So, we got rid of Nemesis CLI. So, if you've installed Nemesis before, you had to use Nemesis  CLI to configure it. We're now using Helm, which is an industry standard. It's a,  how would you call it, like Kubernetes package manager, essentially for deployments. So,  we're using that significantly easier there. We also published the Docker images. So,  you don't have to rebuild them every single time. And we dropped Minikube in favor of K3s. K3s is  awesome if you've never used it before. Very easy to set up and use. Has a ton of features built in.  And we're pretty much entirely integrated with, we can deploy Nemesis on top of K3s easily.  The installation process is, you know, significantly streamlined.  The installation is now technically five steps. I'll say it's five steps. The quick start guide  has eight. Eight steps listed, but three of those are how to access Nemesis. So, from nothing to  being installed, it's five steps. You know, significantly streamlined. We've got a demo  of that in just a second to show you, show it off. Here, just I'll quickly go over this. We've got  the top image is the Helm template. So, you can see now we're using Helm. We have how to install  K3s. So, if you used Minikube in the past, you know, you'd have to install Minikube, set up the  memory, set up the number of CPUs you wanted, start the little virtual machine it has in it.  With K3s, it's just as simple as curling, piping to bash, everyone's favorite thing, and then  doing a little bit of configuration. What's nice is this is copy and pasteable. So,  you can just copy and paste this config and K3s is set up. And then at the bottom, you can see  the Docker Hub. You know, we published all of our containers to Docker Hub. So, you don't have to,  you know, build those yourself anymore. Yeah. So, also, we'll show in the demo,  but, you know, from start to finish, it's usually less than 10 minutes to get stuff up and running.  So, it's hard to really kind of overstate how much better this is. And like Max said,  a huge amount of work here to just make this way more manageable.  Yeah. Also, this is the most beautiful thing in the world. I've tweeted about this like  three or four times. I love this documentation page so much.  So, big shout out here to Matt Alpha on Twitter, or Matt Erschwender. He wrote a PR for building  this documentation. So, now you don't have to go through the docs folder, all the markdown files  sitting in there. You know, it's beautifully set up here. You can go to it at spectrops.github.io  slash nemesis. You know, it comes up. You can see the, if you want to get started with Nemesis,  like install it really quickly, there's the quick start guide down there. And then if you want to  dig into more of the documentation, you know, either the services or how to develop it,  so on and so forth, that's all listed here. We also have usage guides and all this kind  of stuff. So, there's probably close to 100 pages of documentation throughout this. So,  it's definitely way nicer. And also, this link, that's spectrop.github.io,  that is kind of on the right of the main repo page, too. And this gets dynamically built  every time that we modify documentation pages. So, it should always be up to date.  One of the other 1.0 improvements was the text search back end. So,  any time that there's a document that can have text extracted from it, so PDFs,  DocXs, Excel documents, dot log files, whatever it is, that text actually gets extracted and indexed  in the back end Elasticsearch component. So, we spent some time revamping this almost completely  from scratch. So, we're going to show this in one of the demos, but we kind of have full document  by document text search, as well as kind of what's called semantic. Semantic and fused,  like kind of fuzzy BM25 text search for Elastic. So, we're just doing kind of some traditional  text search fused with kind of the semantic language model driven text search, which I'll  don't quite have enough time to dive into all this. There's a blog post that I'll cite here  in a bit that goes into a bunch of details. But the reason for doing that is so we can actually  build some kind of cool NLP driven type stuff in the back end. But again, all these documents  with extractable text are processed. They have their chunks semantically indexed in Elasticsearch.  TLDR, this allows you to even run stuff like an LM powered chat bot over text from documents that  are pillaged from C2. So, outside of just the normal kind of let me search all the documents  I've downloaded like you would with Google of having one document for each results,  you can actually use this is a somewhat proof of concept, but it seems to work. If anyone actually  uses this in the field, let us know how it kind of works for you. It's still, you know, a little bit  of a little bit of the cutting edge, but we released a tool called Ragnarok that's a nemesis  powered offensive, like kind of LM chat bot to where it uses a locally running large language  model where you can connect the interface into a nemesis instance with the creds. And when you  ask a question, it will search the back end for relevant text snippets extracted from downloaded  files and then use that in a context that's fed to the final LM after doing some re-ranking and  a bunch of fancy NLP stuff. And it will let you ask questions about documents that you have  downloaded through your C2 platform, as well as having links back to everything in the dashboard  in Elastic and things like that. So, this is just an example of some of the stuff that the back end  text search lets you build on. We also have the Hasura API. So, we've had Kibana kind of in  nemesis from the beginning, you know, it's kind of the GUI front end for the Elastic back end,  but there wasn't really a super easy way to access the structured data in Postgres.  And again, we kind of have data in two places. We have it semi-structured in Elastic,  and then we have it highly structured in Postgres. So, we can do things like link DP API  keys with blobs and things like this, or, you know, those registry keys to services and all  that type of stuff that Lee was talking about. So, we integrated a new Hasura API. That's a  really awesome project that lets you construct GraphQL and REST APIs on top of existing Postgres  databases. If you have Postgres in a project, I would highly recommend checking this out.  We actually, our team, you know, like Cody, it's a feature, uses this for Mythic. So, this lets you  do basic scripting for processing existing data, as well as doing subscriptions for new data as it  comes in. So, you can actually set up a subscription of, say, if a new file of this type  is processed by nemesis, like, let me know, then I can extract information about it and do some  type of additional things. And we have documentation on this on the website under Hasura,  and we have examples for doing this. But the main Hasura GUI, you can actually see here,  it lets you very easily explore the backend data model. It might look just a little bit weird,  but if you actually play with this, it's super easy to use. It lets you pull out specific fields,  it lets you do filtering, and then you can actually see the results in the end. So,  this is kind of the exploratory component. And then you can use these particular queries or  subscriptions in your own scripting. So, we basically get a scripting engine for nemesis  for free by using Hasura, which is pretty awesome. Again, it's all documented in the main  documentation page. So, there's also a ton of different, like, dashboard features, fixes,  there's a ton of different things, but those are kind of some of the main areas that we  were able to develop for Nemesis 1.0. And now we're going to hit a couple of demos,  starting with the streamlined installation.  Yeah. So, here's our awesome install process.  First, we'll do the quick start guide. You can go to our beautiful documentation.  We'll start by installing K3s. So, as you can see, copy, paste, K3 starts,  and you have Kubernetes running. Then we'll install Helm, get the... Basically,  what this is going to do is just get us the Helm binary, put that in our path,  we're going to start the pods, start monitoring our Kubernetes cluster before we start installing  stuff. So, we're going to install the Elastic Operator. This is the required for installing  our Elk Stack. You can see that installs successfully. We'll install the quick start chart.  So, this is just some dependencies for Nemesis. You can do all of that manually. It's just setting  You can do all of that manually. It's just setting up secrets and TLS certificates,  things like that. And you can set those up manually if you want, but need those before  we install Nemesis. So, if you pause it here real quick, I'll go over this. If you're going to  install this on a remote server, there is a IP address flag that you can set. We're going to  delete that here because we're just going to do a local installation. So, you'll see we'll delete  some stuff. The default value for this flag is HTTPS 127.0.0.1 port 443. So, we're just going  to do a local installation, not worry about it, and install Nemesis that way.  So, we start the install process, come back after a couple minutes.  You can see all our pods are creating, and now they're all running. So, Nemesis is installed.  That's the five steps. The five steps you need to install Nemesis. That's it.  Now, we're going to access it. We're going to grab the basic auth username and password.  We go to local host, enter that username and password that was automatically generated,  and we got our dashboard. So, Nemesis is fully installed. You can access it, everything,  in just five, technically eight steps. And also, to kind of add on with that, the main  basic platform that we've tested and supported for this is just kind of stocked up, and we have  all the requirements and specifications and stuff like that on there. But we're hoping to expand  this for like additional platform for support now that we have K3S. It is significantly better  supported than doing the Minikube and Docker and things like that.  Oh, yeah. Actually, one thing I wanted to add, I did a lot of testing and development on Windows  with Docker for Windows. There's a couple of things. There's a small guide in the documentation  if you want to set it up with a different Kubernetes clustered, something else running  Kubernetes. So, it is possible. It's not that difficult to do. It's just K3S is what we support  with issues and stuff like that. Cool. So, we're going to do another demo  real quick, highlighting some of the PE file analysis and the UI interface.  So, we're going to upload a binary into Nemesis, whether through a C2 or through the web interface.  So, that's what we're doing here. That's a .NET assembly. So, we're going to go take a look at the  uploaded files now. And you can see that Nemesis analyzed it, identified a command execution  primitive. It also does a bunch of things underneath, like decompiling the source code.  So, we're going to go ahead and download that decompiled source code now.  There's a button to do that. So, we'll go ahead and download it. We're going to unzip it. And  then we can see inside of there that vulnerability primitive that Nemesis identified. So, again,  this did this really nice analysis for us that we no longer have to do manually as an operator.  If we go back to the Nemesis UI now, we can add comments on the files. So, this is great if you're  working at a team. And then mark it as triaged. So, I hit the little up arrow there to show it  was triaged. And now my team members know that I've looked at this file and they don't have to  look at it again, too. So, it's great for working in team environments. All right. We can also view  detailed information about all files. So, that's what you're seeing here. It has a built-in Monaco  editor. So, you can it'll do things like syntax highlighting and you can just quickly see the  contents of the file. So, you don't have to open up another program. If it's certain types of text  documents, like Word or RTF files, it'll convert it to a PDF and you can view it from this page as  well. So, that's really nice. You can see the comments and everything there. You can also view  the raw information about the file by going to the Elasticsearch info. And you can see some of  the other analysis that Nemesis did underneath, like extracting PE metadata information. So,  you can see when it was compiled, some PE information, like the file name and the copyright.  It also pulls out things like the imports of the PE file, the exports. Since it's .NET,  it's also pulling out the types that are being used, the type refs, the .NET version, etc. This  is just like starting to automate some common reverse engineering tasks that I, as an operator,  have to do when I'm analyzing binary. So, now that it's in a structured form, Nemesis in the future  could either use this data, or as an operator, I could write my own tools to download this data  and do my own analysis. Yep. And also, all this data is obviously available in Kibana and Elastic,  so you can do your filtering queries and things like that as well. This is just a shortcut way  of showing kind of the JSON dump. All right. And our last demo, real quick. And then we have just  kind of one more slide after this, and we'll have some time for questions. But I'm going to show some  of the improved file processing and document search. So, through the interface again, I'm going  to upload a number of files. So, there's several PDFs, and like kind of one text-based example  config. Now, as things are going through here, Nemesis is going to take those PDFs, extract all  the text using Apache Tika. It's going to index everything, chunk all of it up, and do post  processing on that. So, for one example, we actually have some sample files in the Nemesis  repo under dot slash sample file. So, we have a nosy parker config, which is an awesome tool that  scans for automatic passwords and tokens and things like this. So, we see it's tagged with  nosy parker results that we can actually click on. We kind of see our universal nosy parker results.  It's an example Google OAuth token. We can go to the individual file details for that.  See that nosy parker config. We have that Monaco editor. If this was some kind of source file,  it would automatically detect the extension and do relevant syntax highlighting.  And we also see those same tab, just, you know, per file for those nosy parker results that show  those secrets that show up there as well. So, I marked that as triage. So, it hit it for everybody,  even though you can make those show again. We also run a series of YAR rules against everything  that gets pulled. So, there was a subverting SysMod paper. We see there's some YAR matches  for hack tool strings. So, we actually see the invoke MimiCat string will be scanned for and  actually alert on this. So, over here, I'm actually just going to view that PDF automatically in the  browser. And we see there's that invoke MimiCat string that got extracted. But, again, this will  do this for, you know, YAR rules will be checked for basically all files, including text or anything  extracted as well. Now, I'm going to go to the document search and show, you know, we can do  document by document searching for, like, searching for escalation 6. This will show  one result per document that actually matches if you're searching for code names or stuff. So,  this is kind of like a Google search for all documents that you've downloaded. And, again,  not just searching text files, but it searches the raw text extracted from any document that  can have text extracted. It can also search for something like token. And it shows, you know,  a couple results as well. And clicking on those PDF results will take you to the relevant file  on Nemesis. And then the snippet search is what's every chunk of text gets or every big bit of text  gets chunked into about 500 words a piece and indexed with that semantic search. So, this is  what's driving that kind of LLM chatbot in the back end. You have all these different chunks  that actually get pulled back. So, instead of just searching one document at a time,  you're searching for, like, relevant subsections of the document. And this is what powers that LLM  chatbot in if you choose to use that as well. Just showing kind of the elastic interface as well.  We have our raw, you know, plain text files. So, we see this text field would be all of the  extracted text from that certified pre-owned white paper, which is over 100 pages. It was  able to extract it out and index it. And as well as the kind of semantic text embeddings as well.  So, I think got just one more kind of slide real quick. We'll just kind of summarize and  we'll make sure we have some time for some questions. There we go. All right. Take it,  Lee. Yep. So, yeah. Ultimately, this approach that we're taking with Nemesis,  we're excited about because it gives us, as a team, a lot of advantages that I hope others can  use. So, a simple example is we can update the analysis workflow for all operators. So, think  back to that vulnerability that Nemesis identified in a binary. That was actually a real world  example of a vulnerability primitive we found on an assessment. And we were able to exploit it  and get external access into a network. And we added that into Nemesis. And now,  all operators benefit from that going forward. So, we added that logic in. And now, anytime  somebody downloads a PE file, that will be identified for them if it is present. So,  that's going to help everybody in perpetuity going forward on all of our operations.  And by collecting all this data, we can also do retroactive analysis.  So, we can look at the data that was collected and maybe find new attack paths or new post  exploitation techniques. It also allows us to minimize the footprint of our tooling on host.  So, our tooling has to focus on collection rather than doing collection and analysis all while on  the host. And ultimately, it's going to help assist with some evasion of defensive products.  And then, we can use all this collected data, kind of like I said, whether it's structured  or unstructured, to guide some of our future research efforts. So, we've collected the data  and doing things like a lot of data science ML, you need data to analyze. And so, that's going  to provide us a data source. And, you know, this is great. The installation now is also  very manageable. So, huge shout out to Max there for the great work he did  making that much more streamlined. All right. So, that's the content we have. You know, thank you  all for attending. I know, Lee, do you mind taking kind of the Q&A thing while I leave it up on the  slide? Yeah, we had a few questions that came in already. One question from someone had is,  does the document converter parse external images in the Docx format? They were worried about,  like, canary tokens. So, with our document converter, it lives in a Docker container,  and we isolate that container so that it doesn't have any outbound network communications  to block canary tokens. Yeah, specifically around canary tokens. So, whenever it opens up,  we're using a Gotenberg container that converts everything to a PDF as well as Apache Tico to  extract text. But for Gotenberg specifically, we cut off internet access just for that container.  So, it can access the internal cluster but can't reach out. So, when it gets converted over to a  PDF, you know, obviously, we haven't tested this with every possible version of canary tokens or  whatever else, but we have tried to put some protections in for that. Yeah. Had another  question asking if it's like a sandbox analysis tool. I'd say not really. I'd say it's not focused  on the defensive side of things, but it is similar to what some defensive teams have. You can upload  data into a lot of defensive teams. You know, you can upload a binary in there, and it analyzes it,  and it does things with it. Nemesis, besides just analyzing PE files, it analyzes any offensive data  that we use. So, that could be like a process listing, a file listing, services that we  enumerate on a host, registry keys that we're seeing, as well as files that we are downloading.  So, it's ingesting a lot of different kind of data constantly from our C2 or the tools that  we're using, and then building that data model and doing its analysis kind of in real time.  Got a question about the system requirements for Nemesis as well as Ragnarok. So, if you look  on the documentation for Nemesis, there is our recommendation. So, we say I believe it's four  CPUs and 16 gigs is just our kind of baseline recommendation because you're running a K8s  cluster, a Kubernetes cluster, and that seemed to work well for us. That's what we've used during  our testing and as we've used it. Will, do you want to speak to the Ragnarok? Yeah. So, for Ragnarok,  again, as much as we'd like to, we can't just shove an LLM into the Nemesis cluster because we can't  assume everyone has GPU and that amount of RAM and all that kind of stuff. So, if you're running  the large language model offline for Ragnarok, you need a GPU. So, I think the model is a  quantized model that's around, it's like one of the seven billion, if you're familiar with the  parameter stuff, it's a seven billion parameter model quantized down to, I think, like five bits.  So, it takes about like four and a half gigs of VRAM. So, if you have an eight gig VRAM card,  that'll work. If you have any of the Apple Silicon for M1, M2, or M3, they have the unified memory,  it works very, very well for that. Outside of that, you can technically run it in RAM. It'll  just take a lot longer. So, you essentially kind of need a GPU. But thank you for the question  because I need to go actually put some better system requirements on the Ragnarok documentation.  So, I'll try to make that better documented. Had a comment saying parsing OST files would be great  to search for passwords and interesting attachments. We have a lot of additional  file types that we'd want to support beyond just what we currently have. There's a component in  the enrichment container where all of our enrichment of files happens, where we have a  bunch of file parsers. And PRs are welcome if you want to add in a parser there for OST files,  but it would be great to have that. It's definitely on our list of interesting things to look at.  Leah just mentioned, every time we deploy this type of thing for engagements, we have ideas  and things that kind of come up and additional file types and all that. So, we have more  modifications that we'd want to do than we possibly have time. So, it's a very, very big  ongoing list. Had a question. Maybe I missed it, but were you able to drill down from the LLM  search directly into files and documents? Yes. So, for the Ragnarok, I'm just going to back up  real quick to kind of that interface. I'll just show you. Let's see. Almost there. Okay. So,  the links in this, again, it's a separate application to where you give it credentials  like into Nemesis. When you ask the question for the LLM, that little blue certified pre-owned is  that actually links you to the file, the originating file in the Nemesis dashboard. So,  it lets you like drill down for where it came from and all that kind of stuff. And then the  individual snippet of text, those like 500 word chunk snippet of text that was used to form that  part of the context, that is linked with that snippet and elastic link right there. So,  hold originating document as well as the individual bit of text that had that bit of information  to form everything. Those get cited right there and let you link right to it.  Cool. One more question. I think they asked, is there any utility for pentests  like external or web or would this be overkill? Right now, I think it's mostly focused on post  exploitation. Because again, that's where we saw a lot of kind of the downsides of the workflow or  kind of not flawed, you know, just challenges in some of the workflows and stuff that we've  encountered. This could be expandable to like anything for kind of, you know, a post-processing  enrichment pipeline. That just, the focus has been, we did want to have scope creep of saying  like we're going to analyze just everything forever or whatever. Like we wanted to try to  focus in on some particular use cases first, which tends to be post-exploitation. So, it doesn't do  anything web specific, but you could expand the architecture if wanted. But honestly, at this  point, it's probably a little bit of overkill. Yeah. It definitely could support it though.  Like I, in my mind, I've thought about adding an OSINT data. Like we could add in entities for like  domains and you could do like website analysis. You could have scrapers, like some automation  for a lot of the OSINT activities that you have to do if you wanted to. But it just wasn't our  focus because there's a lot of OSINT tools that do that already. So, we could maybe integrate them in  at a later point. Again, PR is welcome. I think that's it for now in terms of the questions.  Just a reminder again, we are going to be at Black Hat if anybody's going to be there.  We're presenting on the 1.0 release at Black Hat Arsenal. We're also going to have a booth  at Black Hat. So, feel free to stop by. We'll be hanging out around there.  And we love chatting with people. We love chatting about Nemesis, about any of our tools.  And so, we'd love to see you all there too. And feel free to reach out if you have any questions  about anything. We're more than happy to answer where we can.  And we will release kind of a PDF version of the slide deck. We'll tweet it all out through,  it'll be retweeted by the Spectre account coming from our accounts.  And last bit is we actually, Lee, Max, and myself, we're in the Bloodhound Slack.  And we actually have a Nemesis channel in there as well. So, if you have additional questions or  anything, you can reach out to us on Twitter. You can reach out to us on the Bloodhound Slack  or kind of whatever the medium is that's easiest. Thank you, everyone.


url: https://www.youtube.com/watch?v=sYINqevsk0Y
title: Opening Remarks | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=sYINqevsk0Y",
    "title": "Opening Remarks | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\n\nOpening remarks from John Hultquist!",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 131,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   Good morning, Sleuths!  All right, I had a little speech set up for you guys, but you think I'm going to cut it  short because we are running late.  Here's what I've got for you.  Listen, the dirtbags that you guys track have gotten worse, right?  They are out of control.  They're hitting hospitals and schools.  They are attacking people's families.  They're attacking other researchers.  So what you do is so important, and I just want to thank you right now for everything  that you do.  Thank you for coming.  Thank you for being a part of this event.  Some other thank yous.  I want to thank you guys for making this happen.  I want to thank the virtual audience.  Your socks are coming in the mail shortly.  They literally just showed up at my house.  And I apologize for us trying to get everything working.  It's going to be smooth sailing from here on out, guys.  I know it.  Now, thank you everyone who submitted to our CFP.  We got so much good stuff.  It's an impossible choice.  I hope everybody understands.  I literally every year have to talk to people who are at the top of our industry and explain.  I just can't pick it all because we only have one track and one day, and we are flooded  with incredible submissions.  Thank you to our CFP board who makes that hard choice every year.  Thank you to our volunteers who show up and give free service.  We love you.  We can't do this without you.  Thank you to Digital Project Masters, Chris Peterson, you changed my life.  The whole Peterson clan is a part of this.  Thank you so much for everything you guys do.  Thank you to our sponsors, Vertex, Rubric, VMRay, Microsoft, Silent Push, CrowdStrike.  Thank you to my family who puts up with all my harebrained schemes.  Thank you, Selena, for running up here and getting us kicked off.  Where are you, Selena?


url: https://www.youtube.com/watch?v=HEovdEHjF5s
title: It's Me, Hi, I'm the APT: The Rise of E-Crime to Nation-State Levels | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=HEovdEHjF5s",
    "title": "It's Me, Hi, I'm the APT: The Rise of E-Crime to Nation-State Levels | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresented by Selena Larson\n\nState-backed hackers consistently make waves within the cybersecurity community, taking up the majority of focus and attention of what people perceive to be the biggest threats. Selena Larson, senior threat intelligence analyst at Proofpoint, challenges the status-quo, by calling for a shift in focus to threats arguably as advanced and harmful; e-crime.\n\nJoin Selena Larson as she delves into the dynamics of APTs and e-crime, providing a timeline of cybersecurity history, how key players have shaped the cyber-landscape and contributed to the misalignment of real vs. perceived threats. She shares important and compelling evidence of how cybercriminals are advancing to the skills of state-backed hackers, sharing personal anecdotes of the consequences of e-crime on critical infrastructure and everyday lives. Her talk highlights how these actors are constantly evolving, becoming more advanced, and how they pose a much bigger threat to most corporations than government-backed actors.\n\nTimestamps:\n00:00 Intro/about\n00:56 Level setting cybercrime\n01:32 Main argument\n03:45 Timeline of evolution of ransomware\n08:50 Aligning actors with APT definition\n10:18 E-crime\n11:40 TA577\n14:20 Increasing in zero-days\n15:08 E-criminals have money\n17:42 Effect of disruptions\n20:53 State-backed actors vs. e-crime\n21:58 Personal anecdotes\n26:45 Why does it matter?\n28:40 Closing remarks",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 1751,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   Morning everybody, how's it going?  I hope you're all, if not already caffeinated,  getting caffeinated because today is gonna be  an amazing, amazing conference.  I am so excited for all the talks on deck today.  So yeah, for those of you who don't know me,  I am Selena Larson.  I am a threat researcher at Proofpoint  and also lead of intelligence analysis and strategy  for the threat research team.  I mostly focus on e-crime and today I'm so excited  to put in slide deck form a rant that I give all the time.  Some of you in the audience might even already  be familiar with it.  So before we get started, I want to, oh, did we?  Oh, it's slightly, okay, we're good, thank you.  Before we get started, I want to level set.  There are a lot of different things  that exist in cyber crime.  You have business email compromise, pig butchering,  information stealers, commodity malware, all that stuff.  Today we're gonna be focusing on the big kahunas.  The main initial access brokers  and the cyber criminal threat actors  that support essentially a multi-billion dollar enterprise  that is known as ransomware.  So yeah, it's a little Taylor Swift themed  and I got some friendship bracelets already  so great day so far.  Yeah, so in biasing ourselves towards APT versus e-crime,  we create a false dichotomy that pushes resources,  attention, and support to areas that don't always align  with the greatest organizational risks and impacts.  Your average organization has a greater threat  from cyber crime than government backed actors.  And I think part of the reason why we have these biases  in the CTI industry is that we're fundamentally built  on people who came from government,  who came from national security,  who brought with them, frankly, way too many acronyms  and this idea of the mission and this idea  that our enemies and enemies of the state  are the most important ones that we should focus on  and those happen to be government backed threat actors.  Obviously, that's hugely important, right?  But APT or government threat actors are not the ones  that are the most damaging to national interests currently  and the average community and the people that live and work  and exist in our communities.  And I can't tell you how many times I've talked  to an organization that is at much greater risk  from e-crime and financially motivated attacks,  especially those from initial access brokers  and all they want to do is talk about China.  It's like, let's think about what is really risk  and impacting to your organization.  And if we're coming with a threat informed defense mindset,  it's really important to understand the threats  and risks to these organizations  and most of the time, it's cyber crime.  So I propose that we reframe the idea of APT,  an advanced persistent threat.  It's not and it shouldn't be a synonym  for a government backed espionage actor.  And not just because not all government backed actors  are just frankly not advanced or persistent,  but also because the cyber criminal landscape  and the ecosystem that exists is on par  with some of the most sophisticated state backed,  state associated threat actors  that are conducting espionage operations.  To understand how we got here,  we have to learn from where we've been.  And this is just a sprinkling,  things that jumped out to me,  obviously there's not a comprehensive timeline  of cyber crime,  but I do want to point out some key points here.  So in the early 2000s,  consumer focused ransomware and consumer focused malware  was really what cyber criminal threat actors  were very much focused on.  But then come around 2007 in the mid aughts,  we had the rise of banking Trojans.  You had Zeus, Gozi, some of these major bankers  really emerged and sort of set the standard  and created a business model  where they started going after personal finance data,  both from the consumer perspective,  but also the business perspective.  In 2009, Bitcoin emerges, which is a huge mistake.  Sorry to all my chain analysis friends,  but what that did was serve to be a catalyst for cyber crime.  Now they don't have to go after fiat currency.  Now you don't have these mules.  You don't have all of these components  of the cyber crime enterprise  that have to wander real money.  Now you have crypto.  And with that, you had the rise of Game Over Zeus,  CryptoLocker, others as well.  But these were the two main kind of cyber criminal threats  that really ushered in a sort of new era of cyber crime.  They embrace the pivot to cryptocurrency  and really launched the era of the cyber crime kingpin.  They planted a flag for what we now know and understand  as cyber criminal business models.  2014 through 2016, we had the rise of Emotet, Tridex,  some of the most notorious botnets  that caused tons and tons of problems.  Initially they were bankers too,  because banking Trojans were still really big.  They were still leaning into that  until they decided, wait.  You know what could make me more money?  Is ransomware.  So then they started acting as loaders for other ransomware.  Come 2017, WannaCry, I know this was APT,  this was DPRK Threat Actor,  but I think it's important to include.  Because it shows how APT Threat Actors  were learning from the cyber crime ecosystem.  They were using very similar techniques  to fund state activities.  But more importantly, in my opinion,  is it showed the potential for disruptive ransomware  and the just sheer volume of attacks and impact  that ransomware can have on our society.  Unfortunately, in my opinion,  perhaps we didn't take that threat quite so seriously.  Because in 2018, you had Reuke,  the rise of big game hunting.  Reuke was kind of the gold standard.  You know, you see a lot of Emotet trip bot Reuke  back in the olden days.  And big game hunting really became the norm.  So moving into 2019, 2020, double extortion happens.  Now it's not enough to just encrypt stuff for money.  Now they're gonna steal data and hold that for ransom too.  And now there's this other additional layer of risk  that comes from a data leak.  So people's personal information,  very, very sensitive details are being stolen and leaked.  And that becomes an even bigger problem.  In 2021, Colonial Pipeline ransomware attack happened  and we finally started taking ransomware seriously.  Congratulations, we know it's a threat now.  All right.  I just, it kind of annoys me that for literally years,  schools, small businesses,  city and state governments, hospitals,  all of these very critical, important components  of our society were being ransomwared.  And it took an oil and gas pipeline  and a beef manufacturer to be like, wait,  this is bad actually.  So I'm glad we all kind of rallied around that now  and we realized how important this is.  In 2022, Conti leaks happened.  And this was actually pretty interesting  because you had this fracturing  of the cyber criminal ecosystem.  You had all these folks that were kind of in this one place.  They were all sort of in the solar system of cyber crime,  but they were all like a confluence of threat actors  that were operating kind of in this one group  or they knew people were operating in this group.  And it really unveiled a lot of the tactics, techniques,  how these businesses were structured.  And the fracturing of that led to the creation  of some bespoke ransomware,  some new and interesting threat actors  and people maybe changing their allegiances  or the people that they work with.  And then finally, where we are now,  we have increased sophistication across the landscape.  Again, I'm talking about initial access brokers,  but you have the use of zero days,  the expansion of TTPs,  the targeting of edge network devices.  And you have all of this driven  because of work done from defenders  forcing innovation across the landscape.  So I'm gonna talk APT and discuss in all the ways  that the cyber criminal actors,  the most sophisticated ones that we track,  align with this acronym.  Microsoft blocking macros by default  was the worst thing to happen to security  in the cyber crime landscape ever.  This is what Kelsey Merriman, the queen of crime,  one of my favorite colleagues said,  this is obviously a joke,  but we were talking one day  about how much harder our jobs have become.  It used to be an easy button, click to enable macros.  You had Emotet, Drydex, Trickbot,  all of these sort of major threat actors,  Qbot threat actors, all these major actors  using the same initial access mechanism,  macro-enabled documents.  When that stopped working,  you had this forced innovation.  We have to create something new.  And what ends up happening is threat actors  coming up with new attack chains, new TTPs,  sometimes literally every day,  and we wake up and have to write detections for that.  We have to campaign that, we have to block that,  we have to stop that.  Kelsey thinks it's a lot more exciting.  Frankly, sometimes I miss the easy button.  My colleague Tommy Magiar has forced me to read  so much more obscure Microsoft documentation  than I really ever wanted to read  to understand the new techniques  that these threat actors are using.  But it did.  I mean, it really just sort of forced actors  to do different things and forced us  to think about differently and how we respond to them.  E-crime has a mentality of move fast and break things.  They have the space and resources to test TTPs  on thousands of targets every single day.  We have a lot of increased sophistication.  We have infiltering, the use of TDS, indirect syscalls,  tons of random file types that, for some reason,  are still relevant and effective in 2024.  And you have, often, threat actors conducting A-B testing.  Like, literally, in the morning,  my European colleagues will come on,  see a wave of campaign data,  and then when my American colleagues wake up,  those detections are, all right,  we're getting detections for this campaign,  but wait, they pivoted, targeting North America,  they're doing something completely different.  So you have this sort of dynamic development cycles.  You have iterating and testing TTPs at scale.  And then combine that with their ability  to create or pay for novel exploits.  We'll talk in just a second about O-Day.  But, in reality, it's not just Zero Day.  It's N-Days, too, that they're exploiting  and getting a lot better at coming up with ways  to get on a box that, historically,  would have just been a very easy click.  Combine those together, that means lots of money.  To illustrate this, I wanted to highlight TA577,  who is one of my favorite threat actors.  Folks in the audience might know them  as the Qbot TR threat actor.  They pretty much exclusively relied on Qbot  until August 2023, when that was announced  that the Qbot was disrupted.  Anyway, TA577 had both a disruption  of macros not working anymore,  and then they lost access to their number one  malware delivery in Qbot.  So they've had to really be innovating  on both sides of the attack chain.  They have to get delivery done well,  and they have to figure out what malware they're using.  So in February, they had 12 campaigns,  which is about average for them.  Eight of those were unique attack chains.  And most of them, we'd never seen before.  So you had their love affair with Zip JavaScript.  They do like that.  PowerShell or Curl, depending on the day.  Then you had the use of JAR files, which is so weird.  So many initial access brokers lately  have just adopted this pivot to Java downloaders,  which is baffling.  I'm very confused about that,  but they seem to be well-liked.  And then you had the use of file scheme URIs  to external SMB shares.  This was really interesting, because this came on a wave  of initial access brokers using WebDAV,  using SMB in very creative ways  to get folks to download a payload on the host.  So they leaned into SMB.  In fact, all the way into February 2026,  when they were doing a file scheme URI  to an impact at SMB server to steal NTLM credentials.  What?  Why?  And so you really had them,  you saw in real time the innovation  and the dynamic changes in TTPs.  Sticking with 577, bear with me.  If you extend this graph all the way down,  it would be all gray.  They loved macros.  They almost exclusively relied on macro-enabled documents  for malware delivery.  You can see when that changed, when that stopped working.  And they had to innovate.  They're like, okay, well, we're gonna pivot  to compressed executables to bypass Mark of the Web.  Okay, we're gonna actually do shortcut files to JavaScript.  Okay, we're gonna pivot to PDF with URLs  leading to external file shares.  And then we're gonna sprinkle in a few CVEs.  We're gonna play with that.  We're gonna use 404 TDS.  We're gonna use SearchMS.  What?  Calm down, please.  Internet shortcut URLs.  You had just so much activity,  so much changing going on.  And every time they come up with a new attack chain,  we write defenses for it,  and then they come up with something new.  So we're working constantly to combat this innovation  by some of the most sophisticated cybercrime threat actors.  So zero days have increasingly been used  by cybercriminal threat actors.  This is a trend that started, I think,  closer to late 2021 into 2022.  But what we really see is a spike in 2023 to 2024.  Even just last week, Kaspersky published information  about a new Windows vulnerability  that was used to deliver Qbot and some other malware.  You have a CLOP, the zero day, the move it,  zero days by CLOP, which I think  was probably the most high-profile instance of this.  And then you have a couple of threat actors  that we track using Microsoft SmartScreen vulnerabilities  throughout the end of 2023 and into 2024.  So we saw them in email-based attack chains  using the SmartScreen O-Day.  So it's just, you have a lot of evidence  of the evolution of this,  and that's because e-crime has the cash money.  Sophisticated exploit and TTP development  is now done by cybercrime actors because they can afford it.  That puts them ahead a lot of government or espionage groups  that can't develop zero day in-house  and can't spend the money to buy it either.  Cybercriminal operations are a business.  They have the structure, they have the human resources,  they have the arguments amongst themselves  about their timesheets and how much they're working.  Thank you to ContiLeaks, that was a lot of fun.  And they have basically unlimited money  and they will invest it in themselves.  I wanna give a shout out to my pals at Chainalysis  who published this terrific report on ransomware payments  and the cryptocurrency ecosystem supporting cybercrime  because ransomware payments exceeded $1 billion last year.  And this was after a little bit of a slump in 2022.  And ransomware payments are the end result  of all of this activity.  We can use ransomware and the effectiveness in ransomware  and how much people are paying as a barometer of success  for the entire ecosystem  that is supporting this type of attack.  So if ransomware is having a heyday,  then all of those businesses, all of that ecosystem  that is getting paid to support them  are also making that money.  It's called trickle-down economics, right?  Ransomware threat actors  and then all the people that they pay.  So let's think about how they're persistent.  This is actually, for me, pretty obvious  because e-crime actors will go after  literally the same targets every single day.  Like the definition of persistence  is just knocking on doors over and over and over again.  They see what works, fix what doesn't,  and they'll try again.  They have unlimited victim lists.  They have tons of people that they're going after  and companies that they're going after,  and it's the same ones.  Like, okay, well, if this didn't work, let me try it again.  They really don't care about burning tooling  because they only need to be right once, really,  for a massive payout, and then they can try something new.  If they're making a couple million dollars  off of one ransomware payment that uses a specific zero-day  or if they're able to gain access to a number  of pretty successful or rich targets  based off of a zero-day, they're gonna use it  because that will then pay for itself  in the development of the next thing once it's discovered.  It's also probably worth noting that disruptions  often have limited long-term impact on threat activity.  That's not to say that they're not hugely beneficial  and very important in a lot of different ways,  and I'm looking forward to hearing some folks later today  talk about lock bit disruption, for example, which was great.  But if an actor loses access  to one malware delivery infrastructure,  they will leverage the relationships,  they will leverage their finances and skill sets  to pivot to something new.  I think, again, talking about the Qbot disruption  that was made public in August of 2023, that was huge.  They lost access to so many hosts.  That was amazing.  TF577, who was the most prominent  and sophisticated deliverer of the Qbot malware,  took a slightly more extended break over the summer  than we typically see with them, but then they came back.  They came back with DarkGate.  They have a brief love affair with DarkGate,  they have a brief love affair with DarkGate.  Used Latrodectus a little bit, a few times,  and then they're like,  all right, we're going all in on PicoBot.  So they found their malware,  they found how they were gonna continue delivery.  All right, Qbot was disrupted, what's next?  And so we still see them in our threat data  continuing their activity.  It's also helpful to operate in jurisdictions  where you don't get in trouble.  It's very easy to be persistent  and keep doing the same things over and over again  if no one's gonna stop you.  This is, I hope, very self-explanatory.  They're a threat.  So this is just brief Googling  of some of the most impactful things  that I saw fairly recently.  I think the Illinois hospital closing,  being the first to close as a result of ransomware,  the first healthcare organization to close, was huge.  Shout out to Kevin Collier, who wrote the story for NBC News.  But they closed as a direct result of ransomware attacks.  You have almost 1,000 people losing their jobs  after a logistics firm closes because of a ransomware attack.  You have the ransomware attacks  on the manufacturing industry  costing the world economy $46 billion in downtime.  It's not just the ransomware payments themselves  that are enabling this criminal ecosystem,  but also the fallout of these attacks,  the follow-on repercussions,  and how they impact business, community,  and how people live our lives.  Also, schools just really pisses me off.  Like, kids aren't going to school  because you got ransomware?  Like, what?  How do we allow that?  That's crazy.  These are really just the tip of the iceberg.  These are just the ones that make the news, right?  There's so much that we don't see.  There's so much that just aren't told.  And this is all a result.  It's a culmination of a highly sophisticated,  advanced ecosystem of threat actors  learning from each other, talking to each other,  and avoiding and outmaneuvering defenders  and law enforcement.  That's why we keep reading these stories.  Also, side note, I'm not even talking about  the $64 billion that was made last year by pig butchering.  Okay, talk about a super sophisticated,  like, established cybercrime empire.  Okay, that's a totally different talk,  but also something I think we should probably  be focusing on a little bit more.  $64 billion, that's crazy.  All right, well, state actors have more long-game  strategic objectives that support various goals,  and there's sometimes no visible harm to the organization.  E-crime wants to hurt people to make money.  They don't care.  They wanna hurt you.  They wanna make this as painful as possible.  They want you to have to close your business  if you don't pay the money.  They want to see people get hurt,  and that, in my opinion, is a huge national security threat.  Going after critical infrastructure,  going after our schools, going after our communities  just to hurt people is very, very important  to the national security.  And focusing on disrupting cybercrime,  there's a ability to have immediate, very human impact,  and you can make bad guys feel bad, which is just delightful.  Historically focusing mainly on APT  as a cyber threat intelligence industry,  as people that are focusing  on the sort of threat-informed offense,  defenders have missed opportunities to disrupt cybercrime,  and I actually think that that has contributed  to the strength of the modern ecosystem.  Brief personal story time, if you will indulge me.  My sister, she lives in the South here in the United States.  She has been impacted by ransomware four times.  Four times.  She's a healthcare worker  and has been at two different hospitals  and healthcare facilities that have been ransomwared.  They had to pivot exclusively to paper.  They couldn't use digital resources.  All of the stuff that they were doing was old school,  as she likes to say.  And what I thought was really interesting,  as they were dealing with that,  she said it was really annoying and frustrating,  but the worst part, she said, was the rest of it,  the fallout, the having to transfer  all of that patient documentation  that they were taking notes by hand and digitizing it.  There's so much room for error there.  There's so much opportunity to potentially lose information  about your patients, about the people that you're helping.  And she said it was so stressful and frustrating.  That happened to her twice.  Then, colonial pipeline happened.  She texted me.  She's like, I'm in a line at the gas station.  Someone said there's an attack on America.  Like, I can't get my gas?  What's going on?  I was like, I know what's going on.  I'll tell you what's going on.  And while that particular attack  didn't really impact the flow,  it impacted, it had a flood, right?  This fear, uncertainty, and doubt in communities.  People ran to the gas stations.  They disrupted their lives.  They were freaking out.  My sister was like, okay,  I'm just gonna not drive for a few days.  She literally had no gas, so she couldn't,  but until things calmed down.  And I just think that that was so crazy  and so evident of the impacts  that that can have on communities.  As I was preparing for this talk,  I texted my sister.  I was like, hey, do you mind if I tell a roomful of people  that you've been impacted by ransomware three times?  And she's like, sure, but you're not gonna believe this.  And she sent me a screenshot of an application  that she was using to try and deal,  again, with healthcare information.  It didn't work.  She's like, I can't log in.  And I called a number that's listed on this page,  and I just get this robot voice telling me  that they've been a victim of a cyber attack.  She's like, I need to use this.  I need to see this information.  I need to pay my bills.  I'm like, what's happening?  And I said, I know what's happening.  Unfortunately, another ransomware impacted my sister.  All of this kind of happened at my sister.  Her response was, I guess I just have to accept this.  I guess this is just my life now.  Anytime her work, her society,  her life is disrupted by cybercrime,  her response is, eh, well, here we go again.  And that, to me, just breaks my heart.  I feel like we haven't done enough.  I don't wanna say that we failed,  because I think we're making a lot of really good progress.  But if we have the average human being being like,  okay, this is my life now, ha-ha, cybercrime.  Like, oh, well, I guess we got ransomwared.  Oh, well, I'm gonna have to change my life,  change my doctor, change where I'm going  to pick up city services because of crime.  That's not okay.  That is a huge national security threat,  and that is just unacceptable.  We need to do more, we need to be better.  And I think multiple talks throughout SleuthCon  are gonna figure out how we can address  some of these problems.  So, if all of this hasn't convinced you  that e-crime is at the level of APT  and those we take the most seriously,  I leave you with this quote.  Increasingly, you cannot tell which is which  when it comes to the criminal and the intelligence agency.  So, one day, the same crook may be doing something  purely to make a book, but that same crook  may be directed by a trained intelligence operative  using the same tools and techniques  to steal information for the goals of the state.  This was actually back in 2019,  and if you guys remember back to the timeline,  Cryptolocker, Zeus, ransomware,  this was a story about the guy  who was the first criminal kingpin,  Yevgeny Bogachev, and his acolytes.  And I wanna highlight using the same tools and techniques  because I think that's the most important.  As we're creating detections,  as we're learning the behaviors  of these sophisticated cybercriminal operations,  they are going to be used by government actors.  A throwback to last SleuthCon,  my colleague Greg Lesnowich talked about  how DPRK is one of those ones that constantly cribs  from cybercriminal actors to steal billions of dollars  to fund nuclear weapons in the hermit kingdom.  Kind of a big deal.  So if we're defending,  if we're focusing on disrupting the TTPs  of the most sophisticated cybercriminal actors,  we will have those follow-on attacks for APT.  Okay, why does any of this matter?  Why am I here?  Why are we all here at SleuthCon?  There's inherently a cool factor in APT,  and this influenced decision makers and threat researchers,  those of us in the room, to care about them differently.  Whoa, that was loud.  It influenced people to care about things differently.  And I think we should elevate the cool factor.  It shouldn't be just cybercrime.  Can't tell you how many conversations I've had with people,  other fellow threat researchers,  being like, oh, it's just ransomware.  Like, who cares?  This isn't this interesting.  This malware isn't that interesting.  It's just ransomware.  It's just a botnet.  And to me, that's really a bummer.  I mean, I do think APT is cool.  Obviously it matters.  Government espionage matters, too.  But we can't have this false dichotomy of either or.  We need to think about how these threat actors  are sophisticated, how they're using the tools  and techniques, elevate them to be on the same playing field  where we spend the same amount of resources,  attention, focus, and hopefully joy when we disrupt them,  to the most sophisticated in the cybercriminal landscape.  How we communicate threats impacts how organizations,  law enforcement, defenders, prioritize and deal with them.  Words matter.  When we're telling people what to care about, that matters.  If we are putting certain threat actors, et cetera,  on a pedestal and ignoring some of the things  that are most disruptive to people's lives,  accepting that this is the norm now, I guess,  we are doing a disservice to the organizations  that we're supporting and our society and community  that rely on us to protect them.  In reframing APT, we can change the mindset  from who did this to what is the risk and impact?  How can I deal with this?  And hopefully, I leave you with that,  and hopefully some new things to think about,  how you communicate the threats,  how you're thinking about cybercrime versus APT.  I mean, frankly, APT might just be an acronym  that we might have to get rid of.  I don't know, that's a talk for next year.  Yeah, that's it.  That's all I have for you guys.  Yeah!  Woo!  Woo!


url: https://www.youtube.com/watch?v=Z_PeHnt8Pjs
title: Ransomware's Crazy Uncle | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=Z_PeHnt8Pjs",
    "title": "Ransomware's Crazy Uncle | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresented by Azim Khodjbaev\nJoin Azim Khodjbaev, senior threat intelligence analyst from Cisco Talos, dive into the chaotic and strange ransomware landscape while he exposes a notorious cybercriminal known as \u201cDziadka/Dydka\u201d, or Uncle (translated Russian to English). \n\nLearn more about Dydka's involvement in developing Babuk and Monti ransomware, and his role in major groups such as Conti, LockBit, and BlackMatter.\n\nAzim goes into depth about Dydka/Uncle's origins and evolution, gives insights about the ecosystem of ransomware, and some high-profile cyber attacks that involved the cybercriminal such as those from the DC Metro Police and Costa Rica.\n\nTimestamps:\n0:00 Intro/About\n02:09 Overview of Russian ransomware scene\n04:56 Background and early activities of \u201cUncle\u201d\n10:14 Involvement in major ransomware groups\n12:01 Deeper look into Monti and Babuk\n13:47 TTPs and signature \n15:04 Notable attacks\n17:22 Involvement with Wazawaka\n23:18 Mitigation and countermeasures\n26:54 Conclusion",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 1883,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   Thank you, everyone.  Great job, National Crime Agency.  You guys did great work.  We're so proud of you.  This is a little bit related.  So today I'm going to talk about, you know, that crazy uncle that everybody has and inevitably  has to deal with one time or another.  And that's the story I'm going to tell you all today.  A little bit about myself.  I've been a cyber threat intelligence at Cisco Talos for just under nine years.  I've learned quite a bit in that time.  Lucky for me, I am a native Russian speaker, which makes my job a little bit easier and  allows me to do adversarial engagement is what we call it.  But it's pretty much talking to bad guys or talking to anybody directly to obtain intelligence  that helps us protect our customers.  I am not LockBit, as you guys know.  I've been accused of that by many of you in jest.  Not Bratva or Bastard Lord, thankfully.  I'm a rule follower.  I don't like to make people upset too much.  On occasion I am a meme maker that may have got under your skin.  I apologize for that.  But most of the time I get a good response for my memes.  I'm still searching for the 99 cent glizzy that you talked about a few years ago.  That is part of my quest.  I don't believe that it exists.  But I don't want to undermine your intelligence collection.  So I'm still looking for it, okay?  I don't think the prices are going to be real for those.  At the end of the day, in essence, I sleuth around on the Internet.  And the meme there implies most of the time it's late at night.  And I'm using speech to text for Russian because I can't keep up with typing it.  And occasionally my wife will come downstairs and ask, what are you doing and who are you  talking to?  And my response now is Jake from State Farm.  Just a quick outlook on what's going on in the Russian ransomware scene from my point  of view.  There's a little bit of panic going on.  There's a few punches that law enforcement and cyber threat intelligence has been able  to blow in this ecosystem.  It's not dead by any means.  You guys obviously know that.  But ever since the Mikhail Matveev indictment about a year ago, that was one of the first  blows to the ecosystem.  Then the subsequent Hive disruption and the magnum opus of lock bit disruption and interdiction  seriously sent these guys into a big panic mode.  There's a huge splintering going on.  There's affiliates moving around.  There's affiliates disengaging, taking breaks.  And what's interesting, the splintering has actually been affected by the subject of my  talk today.  And we'll talk about how he became kind of the godfather of these splintering groups.  Uncle or Piper.  So the name is a little confusing.  I'm going to refer to them as Uncle.  Because in Russian, dyadka or dudka, kind of intermixed, dudka is a pipe flute where  dyadka is uncle.  The spelling of that user name and moniker was different at times.  So this individual goes by both.  The first time I ever heard of a dyadka or uncle was when they claimed to have had stage  four cancer on the Russian forum XSS and decided to leak, they claimed responsibility for being  the Babuk source, Rensiware source, excuse me, the Babuk Rensiware developer, and they  ultimately leaked the Babuk source code right about the end of 2021.  He's got pretty decent coding skills, to be honest with you.  Way better than any, my understanding, I'm not a coder.  But he's been praised one way or another in the community for his skills.  Horrible people skills.  Doesn't really make good friends, and if he does make good friends, it's for the wrong  reasons and usually has the ability to lose friendships or somehow undermine trust.  He's been in pretty much every single Rensiware group there is under the sun as an affiliate  and has also created two major Rensiware families, Babuk and Monty.  What's true is the reason I used Uncle Buck here is that he's caused havoc in just about  every group that he's been a part of and in the community, including with his friends.  We'll talk a little bit more about that.  So who is Dyadka or Dyadka?  They all started out just like all of us.  Video games lead to hacking, and that's bad.  This individual is really into Minecraft, and when I'm talking about really into Minecraft,  like this is even too much even just for any human being.  Spends constantly, still to this day, plays a lot of Minecraft and started out years ago  trying to cheat and do these things where they can activate games, all the natural stuff  of a natural cyber criminal, right?  So he started out video games, started on forums asking about how to create cheaters  and all that.  Continued to develop their skills and dabbled into creating obfuscators and encrypt the  payloads and started making little money off that.  Wow, money for a young person.  Great stuff.  So they switched over and still self-taught, continued to refine their skills, started  making info-stealers.  Then they realized right around the same time that ransomware was, as a service, was coming  out and becoming big as far as attacking networks, and they dabbled into that.  So they were able to be a part of a team that helped create the Babook ransomware, and they  were pretty much the predominant developer.  A little bit more background.  They are from Russia.  They are young, typically, for what we've been used to, but not too far.  They were born in the early 2000s.  They missed out on a lot of the fun time in Russia that was the 1990s.  So I mean, pretty normal upbringing, right?  Politically stable, economy's good.  Like I said, he's a huge gamer.  Who isn't?  Python, C++, and Java are the languages that are very natural to him.  He really likes it.  So those are the main things that he codes in.  Huge into the party lifestyle.  And when you have a lot of money, right, we make you from ransomware.  Why not?  We're talking about going out for every meal, you know, not being bored, lavish parties  every so often, and a lot of drugs, a lot of recreational drugs, and his drug of choice,  ecstasy.  And I'll tell you who got him hooked on that, actually.  I mentioned that this individual causes a lot of havoc, right?  It's a lot of crazy stories.  Too many to go into every single one of them, but I'll tell you that they did not die of  cancer.  They didn't have stage four cancer.  They did that in order to obfuscate their tracks and think that this developer actually  died.  A lot of people in the community played along with him.  Wazawaka was actually the one that started spreading that idea in the underground.  In fact, he even tricked, and this is literally from his, you know, a quote from him.  He was happy enough to trick Baster Lord into donating to him and laughed about it for quite  some time.  Allegedly, Baster Lord donated thousands of dollars to him for healthcare.  He accused me of being a part of Conti.  Some of you may or may not have seen that, but Conti one time published some victim and  then literally said I was the one that targeted them.  That was a funny moment, especially calling, well, I believe the Nashville field office  and telling them, hey, that's not me.  But they have a pretty vindictive nature to them.  And as I said, the leaking of a book was intentional, and they did that in order to kind of hide  their tracks after the DC Metro Police Department attack.  I'll get a little bit more into that.  And here's one thing that I heard him say directly, but I don't have any proof, but  he does go around saying that he feels bad for turning off life support system in a hospital  one time during an attack.  So don't know if that's actually true.  If the law enforcement guys know that that actually happened, that could be him.  Negotiations.  Extremely tough negotiator.  Takes things very, very personally and has that vindictive nature.  If he's slighted or somehow undermined, he immediately goes into this crazy response  mode and starts maybe not responding or escalating or starts leaking data, but it's not a very  easy person to negotiate.  So he does not have those people skills that gets him the outcome that he wants, right?  A payout.  What's really funny, and I think ProDraft did mention this, so I got to give him kudos,  and this is verified, is that he uses psychic tarot readers in order to set prices or ask  them what to do in situations where he doesn't have a clear outcome or doesn't feel in the  position of power.  That's actually influenced by his mom, who is really, really into it and got him hooked  on psychic tarot readers.  She actually travels around Russia to find the best psychic tarot readers to, I guess,  to fulfill her superstitious needs.  It's very interesting.  So just a quick confirmed list of all the ransomware families that Dyatka, or Dudka,  was a part of.  There's the Conti post that he made targeting me back in 2022, early 2022, January 22,  and so Black Matter, anybody remember Black Matter?  Yeah, funny story.  Remember Khajiit?  Don't worry, I'm not Khajiit.  Khajiit's actually still around, but him, Khajiit, and Wazawaka decided to undermine  Black Matter when they got into it, and they were instrumental in its shutdown, but that's  not really important.  He got into a huge fight with Donut Ransomware very recently, over $100,000, and published  them on his Monty blog.  So again, very, very disruptive and abrasive.  He did get into the Lockbit project early on, but then again, got into an argument with  Lockbit over money, very huge ego, and decided that he deserved more.  We all know how Lockbit took that, because two egos don't really work too well together,  so he stopped working for him.  And then Avos, Conti, Goga, all the other major ones that he got into.  He also, on the side, those were his earnings on the side, excuse me.  He also was running Monty and Babook at a certain time.  Monty was created about 2023 of April, I believe.  And so SunCrypt and Hive were also some of the, he executed some major attacks with them.  So yeah, let's take a little closer look into Babook and Monty.  Babook, or Babak, was created predominantly by him.  He wasn't the sole creator, but he mostly did the work.  The Metro DC, because I always get that wrong, the DC Metropolitan Police Department was  targeted by them, and it caused huge disruptions.  They're right across the river, they're the number one law enforcement agency for DC.  And they actually got scared because of that.  I'll get a little bit more into that later, in just a few slides.  And eventually they're like, look, they're gonna go after us.  Let's leak it and let everybody have it.  That means everyone's gonna use it, and once they start using it, they're not gonna just  go after us, right?  We're just gonna muddy the waters.  It kind of worked, but not really.  You guys are the brightest people, you guys figured it out immediately, I think.  Malware Hunter team, Trend Micro, a lot of folks immediately started tracking Babook variants.  He, after the Conti leaks, he was a part of that.  In fact, he also tried to implicate me and another Russian researcher quite, again, in  the leaks.  When they knew they were being monitored, he tried to target me again, which is kind  of funny.  He decided to create a new one.  He realized that Conti was going away, he created Monty based on Conti, and again, researchers  were immediately able to pick that up, but he did another version later on.  I'll get a little bit more about that.  So TTPs and some of the signatures, boy, does he love himself some ESXi hosts and Linux  servers.  His modifications to ransomware families typically include applying a different encryption algorithm,  that's one of the first things he does, and he also enhances obfuscation.  He's pretty good about obfuscating detection, so that's the first thing he'll go after.  Really he's really, really into zero days and proof of concepts when it comes to VPN  providers and platforms.  He even has dedicated usernames for those particular attacks.  Fortnit and SonicWall are some of his most major attacks and lucrative, he's got usernames  associated with that.  I will admit, Cisco is a huge target for him just because Cisco is pretty prevalent.  We're also known to have a lot of zero days here and there, so I didn't want to exclude  that.  This is a screenshot from his personal folder that works on his ransomware builders.  Again, let's go back to some of the most major attacks that he was a part of, and this is  something that he personally claimed, the DC Metro Police Department and the Costa Rica  government that happened with Conti in the spring of 2022.  Both operations were extremely impactful on the victim.  The operations were shut down, millions of dollars in damage, people could not get their  services done, bad things happened, essentially.  As I said, the first event really scared Jatka and Wazowaka, they were part of the same team  working that, and what they thought was that the camaraderie between police departments  in the U.S. and Russia would actually be bigger than the camaraderie between possible connections  between intelligence services and law enforcement in Russia and cyber-related stuff.  And they got scared that police would look out for each other and actually go after them,  and that was the big reason to leak Babook and let it all go, and eventually impact the  ransomware world, because now we have a source code that could be modified by just about  anybody.  Conti was the last hurrah.  They decided to use that after the leaks, most of the team disappeared and went off  into the void and rebranded to Black Bastard or whatever it was, and they decided to still  use the panel and the builder.  In fact, Jatka wanted to use his new project, Monty at the time, but Wazowaka advised him  against it because it was going to be blamed on Conti and the implications were going to  all be focused on Conti, something that's going to go away.  And so Wazowaka kind of advised that for strategic purposes, let's not use Monty yet.  These are other claimed attacks that he was a part of, personally claimed, and I've been  able to verify that they did exist and were public.  Very, very prolific attacker and got some payouts in these, unfortunately.  Let's take a closer look at this relationship.  You guys all remember Wazowaka, the crazy guy?  Yeah, of course we all do.  He's all over the place.  They've been working together for quite a long time.  I didn't list all of Wazowaka's monikers because it doesn't matter.  We got an indictment.  His days are numbered.  Hopefully one day this individual will get an indictment.  By the way, I do know his identity.  I'm not going to share it publicly here or on video.  I will share it with researchers and law enforcement agencies one-on-one, so please reach out to  me if you want to know the intelligence behind this.  But these are all the names that he was a part of, excuse me, usernames that he had  for different types of platforms that I've been able to track specifically to those and  they're listed there.  Their relationship is actually kind of weird, okay?  They are both known to be very emotional individuals and one is a little bit more mature than the  other, but honestly, they're about the same.  And while they do work together and have had successful operations, they actually have  a really hot-cold relationship like the Katy Perry song where they go into periods of moments  where they hate each other, plot against each other, undermine and backstab each other,  and maybe even leak information about each other to me.  Wazowaka's, Dutka's connection, there's a lot.  There's quite a bit, but one of the first ones that got to me was back in the day when  I was looking into the Costa Rica attack, I noticed that the talks ID that was used  by Boris Yeltsin and Uncle 1756, who was Wazowaka on exploit and XSS, was the same one that  was being used by Slonikval and Gribademon, which is also, that's Dutka and Dyatka.  So they were using the same talks ID to communicate about projects or ransomware and the things  that they do on forums like buying access or trying to figure out a zero day.  What was the overall impact on their relationship?  We're talking about tens of millions of dollars of damage, okay?  They are also causing a lot of disruptions and distrust within the community, okay?  That's really interesting to us because that's how we get a lot of information when they  start backstabbing each other.  It's just cool.  I know that it's not the most lucrative way to get information, but nevertheless, it's  still allows us to be impactful.  So they lied about Black Matter, and that really, really pissed off a lot of people.  And as I said, the biggest victim of that was Khajiit, and they disappeared, as far  as their moniker, but they're still around.  They're not, it doesn't appear, according to Dyatka, Khajiit does not have FSB connections.  They're just somebody that wanted to get into the game, wanted to make a lot of money, and  then messed this whole thing up, thanks to Wazowaka.  That was the story.  They also created GRAMP.  If you remember the old Babook or Babak infrastructure, they shut that down, right, after the police  department attack, and they decided to create this ransomware malware platform forum, right?  And Orange was Wazowaka, the admin behind it, but Dyatka was also very instrumental  in helping develop the site, run the site, and then eventually, Wazowaka apparently locked  him out of it.  Created Monty, based on the Conti source code, and then modified it again.  Another impact is he got a huge drug addiction.  The story goes is that he was struggling with body image, and he shared and lamented that  to his buddy at the time, Wazowaka, and Wazowaka said, do certain drugs, amphetamines, and  ecstasy, and you'll be able to lose weight and also have fun, and that's allegedly what  he did.  And there's a lot of manipulation and backstabbing, as I said.  They go after each other.  The moment they don't get what they want, it's like children with money and power.  They go really, really hard.  It's very interesting, actually, to see that, and it's very easy to take advantage of that,  if you're strategic about it.  One thing I will share with you, they plotted to hurt me, both of them, and this was an  active threat that one time I called John Holtwist two days before, I don't remember  which event it was, but I said, hey, buddy, I can't come, I'm sorry, and he was like,  hey, no problem, and then I was like, you know what, I will come, because I'm tired  of these threats.  I got a call from law enforcement saying, hey, there's an active threat against you.  You may want to be careful, and so they allegedly plotted what they called a hit to physically  harm me.  And how rich is this crazy uncle?  Everybody's got a crazy uncle who's a little rich, right?  Hopefully he gets some money.  Well, as of two days ago, their wallet still got about a million bucks in it, and four  months ago it was about $600,000, but Bitcoin and Ethereum went up, and so at the moment  he's got about a million bucks.  National Crime Agency, please go take it, that would be great, just lock it down, be  very grateful for that.  Most of the money is in Bitcoin, but a huge chunk is also in Ethereum.  This was actually very thankful from Chainalysis to give us a little hint, he looks like a  pretty sophisticated person when it comes to crypto.  He pays a lot of attention and does a lot of NFT transactions and does a lot of cryptocurrency  swaps, so you won't see quite a lot of blockchain transactions directly to another wallet, but  a lot of different internal transactions, which is interesting.  A few weeks ago he moved $50,000 somewhere, who knows, maybe it was the LockBit stuff.  All right, so what can we do?  What can we do?  Well, you guys already know what we do, but just to reiterate some of the stuff he's really  into, okay?  I noticed the moment there is a zero-day news, we see it on Twitter or X, excuse me, immediately,  right?  Proof of concepts or boom, boom, boom, there's some sort of vulnerability out there.  These guys go after that, and this particular individual, it's like a game to him.  He really is, he'll actually stop playing Minecraft in order to explore that, and he'll  read every single line of that proof of concept or summary, and he will go try it.  He gets a really good kick out of that, but he's not really that great of a pen tester,  and that relationship with Wazowaka is Wazowaka did all the pen testing, excuse me, that's  what they would call it, they did all the intrusion, whereas Dyadka served as the technical  expert and the blog maintenance person, okay?  So that's very, very interesting.  Once they had that initial access, whether it was through a vulnerability or through  purchased credentials or through the VPN vulnerability, like I said, encryption happens immediately.  They don't sit around and play, they don't explore.  This person specifically goes after money.  There is no indication that they have a desire to take this information somewhere.  They just want to immediately interact.  It's like a sick, sadistic game.  They want to see a person suffer with encryption.  That's the way that I would describe their thought process.  Once they have that encryption done, like I said, that sadism, they immediately want  to contact and put a lot of pressure on the victim.  That uses social engineering, corporate pressure, corp calls as they call them, but they will  engage the victim in every single way possible in order for them to constantly put pressure  on them.  Again, it seems like it crosses a personal line where it's like a game game for him.  Loves VPNs, if you've got a virtual environment, you're on his list.  He loves virtual environments.  Like I said, social engineering, they will leverage third party offers, or excuse me,  third party groups on the dark web that do social engineering calls.  You will get a call in native English to have somebody that knows a lot about your corporation,  did the homework, and will get the point across.  That's the kind of stuff that they do.  And municipalities.  I've observed discussions between Jyotka and another unnamed individuals chatting about  how municipalities, governments, schools, hospitals, anybody that has a public facing  service that is reliant on that daily service is huge on their list.  They love to go after these targets because they know the pressure to restore these services  is much bigger than the concern over budgets and money.  They really just want to restore operations.  Not only that, they know that these municipalities' budgets are not exactly in tune with backups  and making sure that all the protections are there, so they know that backups don't exist.  At the end of the day, even if you have backups, they know PII.  They know the importance of PII, and anything that has PII, say, of children or healthcare  patients, they know that that's very valuable information.  They've personally discussed this, and they will go after it.  All right.  Just to close out with a few minutes left, these are some of the indicators that I've  collected of them.  I'll give you a moment to take a picture of that if you want.  You guys are all amazing sleuthers.  I think I encourage all of you to explore some of these indicators.  I think you'll find some good stuff on there, one way or the other.  When we all come together as one, like the Avengers, we can all do some good stuff.  So please take this information and run with it, and hopefully I will see some of the research  you guys have done on it.  Just like that, as I said, as I close out, what I see in the next, whatever, short term,  is they will continue to splinter, but unfortunately, people like Dyatka and Dudka don't make it  easier on us.  When they leak the Babook source code, when they leak the Monty source code, which, by  the way, Monty's source code was leaked, but it wasn't him.  That was somebody else.  It was kind of instrumental in its intelligence, but that was somebody else that did that to  him.  When these happen, new guys that don't have to do this from the ground up, right, develop  these source codes from the ground up, just take it, modify it, and now you have Medusa.  Now you have all these other families, right, and you continue to have these little tiny  shops that do ransomware.  Not only that, I could see a bunch of different families coming together and being used by  one group in order to stay under the radar and avoid detection and not be attributed  to one particular ransomware group.  I think law enforcement, the good guys, are going to continue to get better.  The private partnership is going to build trust.  We're already there.  I love working with some of our law enforcement partners, and they're going to get good at  it.  The budgets are going to get bigger.  The trust is going to grow, and I think we're going to see more interdiction.  I hope.  And what is really interesting, and I hope we're all cheering for this, is there's going  to be a lot more infighting within these ransomware groups.  That is what I see with these kind of people that have emotions and egos tied into the  game, and we see that a lot with LockBit, and the trust is getting undermined, and sowing  distrust is something that we can all be impactful for, and I'm not encouraging you to go out  there and troll these people, which is fine.  But I do encourage you to publish information that demonstrates that they are just as untrustworthy  to each other as they are to their victims and everybody else, because at the end of  the day, and this is a new moniker I can tell you, they're scattered roaches, not scattered  spiders.  All right.  I have a few seconds left.  What is he up to?  It looks like yet another diversion to about a week and a half ago, it looks like he claimed  that the project has been sold, and I'm not sure if that's true or not.  I don't believe it.  And here's a really cool thing.  I'll leave you all with this.  Here's something really, really cool I found that was in a folder that belonged to him.  It is file images titled 1, 2, 3, and it looks like a picture of something buried in  a park, and if you really get closer to it, it's really wrapped up quite a bit, and there's  coordinates, too.  Anyone want to take a picture of those coordinates and later figure out where that is?  It's in Kaliningrad, Russia.  The enclave in Europe, yep, yep.  And who else lives in Kaliningrad?  Wazowaka, yes.  So did they bury something there?  Who knows?  We don't know.  We can't get there, but hopefully somebody can.  What's interesting is there was another folder titled 1, 2, 3, and it looked like what it  looked like were security keys for a crypto wallet.  So maybe that's his personal crypto wallet.  National Crime Agency, please go find it.  All right, guys, that's all I have.  I hope it was informative.  Thank you so much.  Thank you to John.  Thank you to Sherrod.  Wonderful, wonderful event.


url: https://www.youtube.com/watch?v=_u9w78_0_-8
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
title:
  I Don’t Think We’re in Western Country Anymore: Ransomware TTPs by the Asia Pacific | SLEUTHCON 2024

content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=_u9w78_0_-8",
    "title": "I Don\u2019t Think We\u2019re in Western Country Anymore: Ransomware TTPs by the Asia Pacific | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresented by Jono Davis\n\nRansomware is rapidly evolving throughout the world, especially within the Asia-Pacific region, creating unique TTPs that differ from those seen in the West. Join Jono Davis, senior analyst from PwC\u2019s Threat Intelligence Team, as he provides critical information that highlight this region\u2019s tactics by walking us through three major case studies. Stay tuned to learn how companies can best protect themselves from these attacks, and what practices provide a deeper understanding of these actors and their unusual TTPs.\n\nKey Highlights:\nAsia-Pacific vs. Western Ransomware: Discover key differences in ransomware operations\nCase Study 1 - White Vellus: Learn more about the Eastern European threat actor who successfully breached an Asian organization by leveraging cracked software.\nCase Study 2 - LockBit Builder\u2019s Misuse: Examine a unique incident of an Asian-Pacific based actor misusing LockBit ransomware builder who did not follow the group\u2019s usual TTPs.\nCase Study 3 - Black Turtle: Understand the targeting of Veeam servers by these actors, and how their tactic of prioritizing these first provides a unique characterization for actors in this region.\n\nTimestamps:\n00:03 Introduction/about\n01:48 White Veles\n04:22 How common is ransomware in Asia?\n04:48 Overview of case studies\n05:11 Case study 1 - White Veles\n09:33 Case study 2 - Black Turtle\n13:22 Case study 3 - White Dev 173\n15:18 Reconnaissance and initial access\n24:15 Closing/thanks",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 1473,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   My name is Jono. I'm a technical analyst with the PwC Threat Intelligence team. I'm very,  very grateful to the SleuthCon committee for having me here and for me being able to represent  my team's research. I cannot move slides, but I do know them, so it's all good. I always  take the opportunity with the introduction to kind of thank my team. They're so excellent.  The PwC Threat Intel team is kind of like, I like to think of the world's best kept secret.  Everyone in the team is amazing. My colleagues do an excellent job of tracking APTs and crimeware,  and you'll see a lot of that in the presentation. So I know some of you are watching online.  Thanks for existing. You guys are excellent. And if you don't know anyone in the PwC Threat  Intel team, I'm more than happy to be the gateway drug. What we're going to talk about  in this talk, which you maybe will see at some point, is we're going to look at three  case studies from the Asia Pacific region in regards to ransomware. Ransomware in Asia,  we're also going to talk about just a little bit in terms of how it functions and why it's  a little bit different to that of the West. I will preface and say that I don't actually  live in Asia and I'm not native to Asia, but I have spoken to colleagues who are from there  and we're going to talk a little bit about how that works and why ransomware is so different  over there. Then we're going to use the case studies that I've got to effectively talk  through the TTPs used, including a very spicy actor that we found that is, we assess highly  likely to be a ransomware group that is based in Asia, and we can go through their entire  tool suite thanks to an open directory that they left out for us, which is very nice.  This is going to be a very awkward presentation without any visualization. So imagine that  you can see a case study wherein a threat actor called White Veles, which is a threat  actor that we assess is highly likely based not in the Asia Pacific region, but based  in Eastern Europe. If anyone knows the malware X Matter, might ring a bell. This is a threat  actor that was found intruding on a threat actor in Asia. Sorry, an organization in Asia.  For initial access, this is where the talk gets really interesting, and it would be so  much more interesting if you could see how interesting it was. You would see that the  threat actor managed to get in on three separate occasions across a period of a month. The  most interesting part is that the initial access of the initial access was a download  by an individual in the company of a cracked software called PTC Creo. Now, PTC Creo is  a like a software that you can use to kind of head up visualizations or just increase  visualization software. It is a visualization software. The cracked software included within  the README and the other files within the package, the .rel package, the same extension  as the ransomware that came a month later. Super spicy because it kind of indicates and  you would have to come up with a confidence assessment that either the threat actor placed  it there for someone to find, which is not like the threat actor to do before. We have  done a number of intrusions on this threat actor. We have seen nothing like that in the  past or that they employed an insider to potentially find the malicious software because  if you would have been able to see, you would have been able to see that they visited a  number of websites prior to the actual finding the actual software that they wanted. The  problem is that there is no connection between individual one, we'll call them individual  one, and individual two and individual three. Now, those two accounts, the latter two, are  individuals who were found, the accounts that were found to be used in the actual intrusion  a month later. The theory, or a theory, is that individual one was a shared account.  We saw that individual one was able to effectively download, the threat actor was able to download  through individual one a bunch of key logging software, so we assessed it with a realistic  probability that actually they were able to see all of the credentials going in and out.  Okay, Asia, it's bad. There's lots of ransomware, but not as much as there is in the West. And  the NCA and the FBI have either covered that or will cover that in about five minutes or  after lunch. Ransomware was bad, but it is not as bad as it was, again, thanks to the  NCA and the FBI. We've been through that. There are other actors in the region. We're  going to come on to WhiteDev173 in a little second. They are the threat actors that I  aforementioned that have the open directory involved. The case studies, again, White Veles  is the one we basically talked through without the slides, but we'll do a little bit of the  slides. The second case study is one that's based in, a threat actor we assessed is based  in the Asia Pacific region, which is kind of like a halfway house between White Veles  and WhiteDev173. It's interesting because they use the lock bit builder, but not lock  bit, but they do claim to be lock bit halfway through their intrusion and then don't have  a leak site or any exfiltration whatsoever, which is really interesting and weird. Okay,  Veles, there's the visualization I wanted you to see, and you're going to look at it  for a lot shorter period than I wanted you to at the time. I spent a lot of time on it.  It's all good. This is what I was talking about, the individual one timeline. If I go  back, because I can do that, you can see individual one and individual two. There's like a question  mark there, and that's where we don't really know why it is that individual two logged  in a month later than individual one. We're just not sure why that is, but we assess with  a realistic probability that there was a key logger installed, and you can see that  on this slide from the timeline, that the threat actor essentially installed a bunch  of key logging software, a bunch of user data upload software, and then a month later they  return with a completely different account, so we assess with a realistic probability  that the threat actor basically used this weird PTC Creo software to effectively enter  into the environment, which as I said is super novel. It's just not something that you see  every day from a threat actor, particularly one as prolific as White Vela, someone that  so much of the industry has such a great handle on. It's just super rare to see, and it really  is only something we've seen them do whilst acting in the Asia Pacific. This is the part  I was mentioning. You can kind of see it. I always misjudge how easy it is to see things  on slides, but you can see the similarity between a legit cracked PTC Creo, let me say  that again, a legit cracked version of PTC Creo, and the White Vela's cracked PTC Creo.  There are similarities. They basically just repackaged, it looks like, a malicious version  of PTC Creo, which is weird, and then made it more malicious, and the file extension  you can see underlined is the same file extension of the ransomware that we saw a month later,  which if that weren't the case, it'd be really spooky, but if you know, it wouldn't be anything  to look at, but if you know how ransomware configs are built, they're done at runtime  often, or they decide that the extension is loaded in before the ransomware is compiled,  so it looks like an executive decision. More questions than answers, but it's just one  of those case studies I wanted to highlight where we can clearly see a threat actor that  is quite prolific in Europe and the West, or targeting Europe and the West, has a completely  different tool set when it comes to Asia. I wanted to do this, threat intel is one of  those industries where we really love, not just the sound of our own voices, but we love  our work so much, and sometimes we don't do a good enough job of making it relevant for  other people, and I wanted to basically take the case studies and create a defender's retrospective  seeing what could have been done differently, not only because it's a cool thing to do,  but because you will see over the course of the case studies that there will be overlap  in defenses, so whilst the TTPs are unique, they're oftentimes like really quick wins  for defenses, and in this case, it's like no real difference. Network segmentation,  for example, to prevent users from being able to access more of the network than they otherwise  could have done, having allow and deny lists for different websites should kind of be a  thing that we all employ, in this case, because it allowed for a threat actor to get in, but  otherwise it's just a really basic thing to employ, and it's quite common here in the  West, less common in Asia to do so. MFA on remote access or remote services, or even  just RDP sessions in general, having MFA installed as much as possible on all accounts, but certainly  for remote sessions is something that is not as common as you see with user-based accounts  or rather like desktop accounts, and that's just a really quick win, and then also like  Exfil, I can say, because I saw it, the Exfil took place over a number of days. If you had  maybe like a network, like some network infrastructure in place or a network traffic monitor, you  would be able to see a bunch of traffic going out on port 22 or 80, especially because it's  so consistent. The Case Study 2 one, which is interesting in its own way because it involves  a threat actor based in the Asia-Pacific region. We assessed realistic probability just based  off of the fact that the contact email they were using, the contact data they were using  was based in CN. As you'll see with WhiteDev 173, I'm not here to make any political statements.  I'm just here to give you the data, and everyone can do with that what you want. BlackTurtle  specifically went after Veeam servers first. That's an interesting thing to note because  oftentimes ransomware entities, at least from the observations that I've made whilst doing  instant response cases, has been that the threat actor will find Veeam eventually. In  this case, they gunned for the Veeam servers straight for backup.  Now I spoke to individuals who worked alongside on the case based in Asia, and they made an  interesting point that I can't say is gospel, so I'll put realistic probability in front  of it so no one can hold me to account on anything that I'm about to say. In Asia, there's  a lot less of a focus on payment. They don't care so much. It's quite easy for them to  rebuild with the advent of cloud, so they don't take ransomware seriously. That's not  what I'm saying, but there's a definite trend towards we'll just rebuild after the fact.  Even if they encrypt, we'll just rebuild. It's interesting with that knowledge in mind  or at least that anecdote in mind that the threat actor went immediately for Veeam and  then after that targeted other servers as well through proliferation. The encrypted  Veeam had an ESXI kind of leaning and then went to Windows after that, which again depends  on the cases you look at. It's less common. In terms of a defender's retrospective, although  there's some pretty images that I managed to get. There's some IOCs there as well if  you want to take a picture or just want to memorize some IOCs, some IPs, good luck. The  threat actor pretended to be LockBit. They ostensibly emailed the client or the victim  and said, we are LockBit. Here's our leak site. Please pay us now. They didn't exfiltrate  any data and immediately upon being questioned gave them the email to use, which is blackturtle  at sugo.cn, which was super interesting. The communications all took place in English,  which was also a weird development I think I would have expected given the victim and  given the nature of the threat actor that it would have been in Chinese, but it wasn't.  The English communications was an interesting development. I've used the word interesting  a lot. I'm going to continue to use it. In terms of a defender's retrospective, again,  we can see some overlap there. Segmented network can prevent proliferation via one user having  access. I forgot to mention that, but you can read it, that the threat actor got in  via a FortiGate SSL VPN vulnerability, which what I didn't mention is that the victim was  told to patch this from a previous incident about four years ago, and they didn't. So  there were easy quick win fixes to prevent threat actors from getting into the environment  at all, let alone proliferating. I'm pretty sure that's all I want to say.  Also, you know, things like MFA on accounts is a classic one. Making sure that passwords  are being rerolled is a super interesting one, and again, some of these are controversial  within the industry. I'm about to mention the MITRE ATT&CK framework in a little second,  which I know is going to cause some controversy, but some things are really quick wins and  shouldn't be controversial, i.e. patch your systems and constantly do vulnerability scanning  where possible. This one is not the juicy one. It's all juicy. It's all good intel,  and again, I really cannot stress enough how grateful I am for my colleagues and friends  across the world, across PwC, who have just provided all of this intel and helped create  and cobble this together, because this presentation would not be what it is without them, so a  huge shout out for the second time to my guys and gals over at PwC.  WhiteDev 1073 is kind of a bit of a pride and joy of ours. We do quite constant, like,  scanning within the Asia-Pacific region for cool little snippets of stuff, and we found  an open directory that had port 18443 open that contained not just a whole suite of tools,  but most significantly the lock bit builder, and immediately, not alarm bells, but, like,  instantly immediately interesting, because even though we do see threat actors not based  in the Asia-Pacific host in Asia, it's not as common as you might think, or it's not  as common as I thought it was, and so immediately got to work looking at what we had found within  the directory, and what we found is, like, a whole suite of tools, and I thought the  best way to go about looking at it, both from an analysis perspective, but from a presentation  perspective as well, is to look at it from the MITRE ATT&CK framework, and I know that  the MITRE ATT&CK framework for some people in this industry is, you know, it is what  it is, it's a framework, but for this particular example, it works really, really well, because  I cannot explain to you every tool that's being used, and many of you will probably  recognize a lot of these tools, and some of them you might not. I thought it best to map  them to the MITRE ATT&CK framework so we can get an idea of how this threat actor operates  from recon all the way down to, you know, impact and XFIL and command and control. Did  that smoothly transition? It actually didn't. There you go. To command and control. And  we'll talk about some of these tools as we go. The recon initial access is always, for  me, the most interesting, because I'm going to spoil it for you, Cobalt Strike is used.  The way it's used is quite novel, which is cool, but Cobalt Strike is, you know, I can't  talk about it for 30 minutes, but the recon initial access stuff is super interesting.  It's the way, it's where we understand how a threat actor thinks about and where they  can develop entering into an environment. We see threat actors use credentials, we see  threat actors sometimes use phishing, although less so now, and sometimes we see them using  vulnerability scanning and then intrusion via some kind of, like, exploit that they  either find or develop themselves. In white dev 173 cases, which I know is not the sexiest  name, I know threat intel is quite famous for having weird and wonderful and wacky naming  conventions. We are currently in the process of doing an ACH, analysis of competing hypotheses.  The reason it hasn't been done now is because I'm quite new to the states and was moving  over and it was a hassle. We're quite stringent in the team about how we do our naming conventions  and this was no exception. White dev 173, as I said, not the sexiest name, but it will  be changed to something a lot nicer once we get going.  The initial access and recon is an interesting one, because they use tools that sometimes  we've seen across our more western-based or rather not Asia-based actors, things like  web scan logic and volmap, which are readily available on GitHub.  Xeon, XeonDXP and XeonDXP, these are tools that specifically target web platforms that  are written in Chinese language. I will say, I'm not going to say what's here on the slide,  but there is a bunch of TXT files that they use to kind of pump into these tools. The  targeting is interesting, and again, I'm not making political statements, I'm here to show  you what the data says. The IPs within their TXT files that they would use are based in  Korea, Taiwan, Iran, and mainland China. I don't know readily what that says about the  actor, I don't know what their handle is, particularly since I'm trying to see perhaps  if it's a raster-based target, rather than speaking of the state and the country. In  this case, people have brought raster targeting, but it's a case of white dev 173, which is  specifically focused on the Asian category in general. I mentioned Cobblestrike, the  proactor does use Cobblestrike, we found a very specific instance of it. In fact, the  proactor was kind enough to leave on their own directory to envolve, so you'll see them  test out the Cobblestrike instance two days prior to it going live. We actually found  that Cobblestrike instance before we found the group, through our online net gang, and  we basically put two and two together, but this was the group that was used in the server,  but we got to see that by testing success, we got to see that they set up their username  and passwords. We had four usernames, jhc, j, hannah, and neo. All of them shared the  same password convention, it was j, jhc, it was Matthew, at 123, j, it was j, at 123,  exclamation mark, and hannah, it was hannah, at 123, exclamation mark. We didn't get neos,  but we did see, and we assessed that the realistic probability probably followed the  same convention. They are all censoring the team server, which has a poor number of 12345s,  and a team server password of 12345, as well as every single IP that was successfully,  what's the word, successfully, and eventually accepted the team server is based in Hong  Kong. Of those five, three of them have the same 27 names.  We did see, it wasn't in the slide, but we did see one other successful user,  the team server, by a name like brownflare, it was done from a team here in Hong Kong.  I mean, it's a very simple model framework, you're supposed to use the dev team models,  right? You put the dev team models into the dev team models, it's really easy to use,  it has a really, like, easy tweak to use, but you can also use plug-in models,  and those are made via the, like, native public thread, I think, so, regressors,  and you'll be able to get .cna files, that is the regressor script, looks like that.  Actually, one of those, one of those scripts is basically, like, Java, basically,  it's really easy to mix stuff, and then you can see, regularly how the thread actors  can use it to develop their own scripts. Now, why do I want to develop its own script?  I think the evidence is, plug-ins from Chinese developers, like LayDot,  might be famous within Chinese AT groups, and some client groups.  Another one, CX, is a free, China-based, Chinese language script.  In fact, CX is written entirely in Chinese, the CNA files are written with the Mandarin  Chinese language, but it's no longer available on GitHub, so you can take it down,  it bridges on, like, state-of-the-art security, new legislation, so we can only say,  with plug-ins, probably going to take to a highly likely confidence assessment,  they have the full GitHub repo, we can only make that assessment.  Now, if you, basically, the CNA files, the CNA files are quite similar,  they do a very similar thing, they effectively have everything from privilege escalation  all the way down to, like, bypass, user creation, scheduled path creation, user deletion,  everything that you could want for Red Team.  All of these tools are patched together in other Chinese language,  like LSTAR, or OneBox, and that's basically how they conduct most of their operations.  There are some other tools that they use, they usually have their own scripts,  for some things, like bypassing, any ways to bypass, they have their own custom script,  I can't find anywhere else, which is interesting, but they do seem to be somewhat, again,  bastardized versions of what we see in OpenSource.  So it's Frax that is capable of developing tools, it has some help, we can do so.  The only other tools that we see on the instance are CD drivers.  They're not normal or sexy, they're quite old.  Which is Redux account vulnerability, if anyone knows that, it's basically like an in-and-out...  Have you ever heard of Redux?  No, I've never seen it.  You've never heard of Redux?  No.  Oh, thank you.  Anyone else?  I don't actually know that you've ever heard of Redux.  No, I've never seen it.  It's basically like a...  It's a one-stop-shop rule, like Redux is, effectively, again, not developing tools themselves,  but they are, in some ways, using privilege escalation,  so the suite is really expensive.  In terms of, I don't know how long I have, I'll just close up here,  because the other stuff, it's going to be much more useful,  on the slide.  I'm not meaning, it should be easier to look at than have me talk to you.  Again, defenses are something that will overlap with the other case studies that we looked at before.  Stuff like MFA on account, both local and remote.  Having user entity-based analytics, where this is a bit more sophisticated,  where you, effectively, have a nominal user,  and you can say, okay, the nominal user will conduct X amount of activities.  Any users outside of that, we would like to flag to assault,  and we would like to immediately alert to stop on that.  Now, that, for WhiteJet 1.33, would be really beneficial,  because a lot of their attack depends on them being able to create users,  and be able to use those new users to effectively,  let's say, take privileges and then bypass them immediately.  I did put in the slide that it's going to be kind of useful to have,  it's had a role that isn't too extensive,  but then I also said a lot of the WhiteJet 1.33 have all bypassed that,  because they're able to effectively shut down AV.  So, yes, extensive AV is always good, and it's a way to talk about practice,  especially if you're ensuring the market there,  but also, WhiteJet 1.33 might be able to do the same thing.  I'm going to close off by saying that,  despite technical difficulties, this has been a really wonderful experience.  Thank you very much for having me.  Big thanks to the Snoop team.  I hope you enjoy the rest of the day.  Thank you very much.


url: https://www.youtube.com/watch?v=CkIgTG0IwJk
title: Hyperscalers and FinCrime: A Match Made in the Cloud | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=CkIgTG0IwJk",
    "title": "Hyperscalers and FinCrime: A Match Made in the Cloud | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresented by Zack Allen\n\nJoin Zack Allen, Senior Director of Security Detection Research at Datadog, as he highlights several incidents dealing with Hyperscalers. According to Wall Street, Hyperscalers include AWS, Azure, and GCP, which present opportunities for crime on all levels.\n\nZach provides context with several interesting cases, providing informational models on the where, what, who, and hows, helping professionals navigate and mitigate cloud-based attacks. This talk will also cover the evolution of TTPs involving Hyperscalers, from low-level crypto mining to large-scale ransom.\nThis talk offers valuable knowledge, frameworks, and real-world scenarios to help you understand the cybersecurity landscape and enhance your awareness on emerging threats.\n @DatadogHQ \n\nTimestamps:\n00:00 Introduction\n00:35 Outline\n01:01 Defining Hyperscalers\n03:00 The 4Cs - Cloud, Cluster, Container, Code (Where?)\n04:05 Data on the wire (What?)\n04:42 Bot or not? (Who?)\n05:10 MITRE ATT&CK Cloud (How?)\n05:51 Cloud as Ancillary Target\n\n\n\n#CloudSecurity #Cybersecurity #Hyperscalers #AWS #Azure #GCP #TechTalk",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 1482,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   Hi, everyone. Thanks for coming to my talk, Hyperscalers and FinCrime, a match made in  the cloud. I'm going to go a lot louder. Thank you. Keep doing that, by the way, because  I'm going to need that. All right. So, that's me. I currently work as the Senior Director  of Security Detection Research at Datadog. We do cloud security stuff. And much like  Brazilian Jiu-Jitsu and much like CrossFit, if you run a newsletter, you have to tell  everybody that you run a newsletter. So, that's my newsletter. A lot of the content that's  in there, a lot of people in this very audience wrote. So, thank you so much. I really appreciate  it. But, yeah, I have a lot to talk about. I split the talk into three buckets. Basically,  I'm going to do some buzzword bingo on cloud service providers. You saw the word hyperscalers,  so a bunch of Wall Street analysts got really excited probably if they heard that. We're  going to talk about how Datadog models cloud threats for detection opportunities, and we're  going to do some case studies here, specifically into two buckets. One bucket is going to be  using the cloud to go and do something else outside the cloud, and then cloud as the actual  primary target. And so, when you hear the word hyperscalers, you mostly think of these  three different companies, right? Amazon, Microsoft, and Google. And there's many reasons  why it's called hyperscalers. You go and look on their websites, you pull things up, you  start to notice that it's not just somebody else's computer. They offer hundreds of services  that a developer can use to go and write code, deploy, start a company, right? Go and look  at it for Azure. Notice it's over 200. I don't know if they're competing and making  sure they have that in their marketing copy. And in the most Google way possible, they  don't say how much they have. They have an interactive map of all the things that you  can go and do. I counted 237. So, all of them are really focused in making sure that they  can create all these different types of services so that developers can write fast. And it's  very similar to how a programming language would work. So, maybe you write Python at  one company, you go to another company, you're gonna use the same tool set, right? So, it's  very similar. You go to one company, you're working on Amazon, you're working on GCP,  you go to another, you're gonna do the same thing. And so, the threat model that they  generally follow revolves around something called the shared responsibility model. Google  calls it the shared fate model. Again, Google, they have to do something different. But the  basic premise behind it is that you're responsible for certain things and securing them and we're  responsible for certain things and securing them. And there's a little bit in the middle  that we're both responsible for. And so, what this does is it creates these homogenous  environments. They're built for scale and rapid deployment of new services. The problem  with these homogenous environments and when you're adding new services is it creates an  information asymmetry. What that basically means is that as these cloud service providers  are making more things and you're trying to make more things with them, cyber criminals  are also taking advantage of this. And they're not really banking on the fact that you know  everything about all the different services that are being deployed. And so, they're built  to rapidly launch these. It's all about the line going up, right? And so, this is taking  advantage of that. And so, the question becomes, how do you precisely describe a cloud service  attack? And again, more than just crypto mining, right? And so, what we do at Datadog is we  try to answer the where, what, why, and how. And so, the where is basically where is the  attack in the cloud being performed? And so, obvious one, cloud. This is like I log  into Amazon, I log into my Azure tenant, and I can configure things. I can launch things,  right? But as you move kind of closer and closer to where the code's being run, you  start looking at the cluster, the actual EC2 instance, the compute node, the virtual machine,  and a lot of the orchestrators like Kubernetes and things like that. Things run on these  EC2 instances. Containers. This is like the de facto standard to building like a hyperscale  company is you're deploying containers and that container contains code. And so, when  we're thinking about where is this attack occurring, we first say where did it first  start? And it can start in any one of the four Cs. And by the way, from those four Cs,  there are attack paths to go and navigate between everything here. So, it can go from  code to container, cluster to cloud, cloud back to code. And so, it's kind of important  to kind of realize like it's a little bit complicated to really go and perform all these  different types of detections, right? The next is specifically the data on the wire.  This is the what can we see. Typically, the cloud service providers talk about two things,  the control plane, the data plane. The control plane is I'm booting up a database and this  database is going to be a certain version. I'm listing my databases. I'm removing them.  The data plane is the data inside the database. So, specifically, what I'm putting in there.  A lot of these, like Amazon, for example, calls this the value. Data plane contains  the value of a company or of a cloud, right? And so, looking at how can I find different  detection opportunities between these two is a really important thing when you're trying  to track all of these different intrusions. The next is the who. We call this the bot  or not question. You go and you look at identity and access management on almost all of the  cloud service providers. They always talk about whether an identity that's interacting  with these resources, is it a human or is it a machine? And there are different things  that you can baseline based on that behavior. A dev does certain things. A database does  certain things. So, baselining where this is, who's doing it, and whether or not it's  a bot is very important. And then, lastly, the how. This is kind of where Mitre comes  in and Mitre ATT&CK. We leverage Mitre ATT&CK pretty heavily, at least for the cloud. It  does have some things that, like, kind of repeat between each of the different stages,  but it's because it's kind of showcasing all of these different components of the where  and the what. And so, it's very useful for us as we're modeling these. So, quick recap,  how we put this all together. Where, what, who, and how. So, where in the four Cs can  we find telemetry? What information is available in those data planes or control planes? Who  is the identity type interested in the cloud resource? And how can a T code describe the  tactic? I stole this from the Proofpoint folks. I think they said on one of their podcasts  a T code for Mitre ATT&CK. Very precise and concise, which I love. So, I talked a lot  about what it is, what is a hyperscaler, why there's an information asymmetry, why it's  really targeted for devs, and now I'm going to start showing everyone a couple things  that we've seen at Datadog as well as things we've seen in the wild and kind of model it  using that threat model that I talked about earlier. So, we recently wrote a blog post  where a threat actor performed a resource hijacking attack to do a phishing campaign,  specifically smishing, I think I'm allowed to say that, or SMS-based phishing. But the  basic setup of it, and the way I'm going to do this is a sequence diagram. So, you have  the participants at the top, and then I'm going to walk through each one of the four  Cs, data plane, identity, things like that. So, we had an IP address that we were tracking  that was interacting with a ton of tenants. And what it basically did is it loaded a bunch  of stolen AWS keys on this specific piece of infrastructure, and it took those AWS keys  and started talking to these victim cloud service provider environments. Specifically,  it was saying I was performing some control plane API calls, and those are get caller  identity and get SMS attributes and get SMS sandbox status. And what that basically was  checking was given this AWS key, can I start sending text messages through the Amazon simple  notification service? And if it can, it went back to that attacker so they can carry out  the next part of their attack. So, there's a detection opportunity right there. The next  part of the attack included using a lot of those access keys to go and issue a data plane  event, which is send the text messages. So, a lot of these customers and a lot of these  honeypots that we had set up did not have text messaging through SNS enabled, and so  we saw a spike of data plane events specifically to go and target phishing victims on the right.  What was interesting about this one is that the same infrastructure that was interacting  with these victim AWS environments was the same infrastructure that was hosting the phishing  website. So, this is kind of like a larger interesting detection opportunity where if  you see a spike of this traffic, and it's coming from an IP address and it's issuing a ton of data  plane events, you can actually pivot on that IP address and find associated phishing website.  So, we thought that was kind of cool. But this is sleuth con. How the heck did this happen in  the first place? So, let's go sleuthing a little bit. So, really, the economy behind this initial  access for the stolen keys kind of boils down to this. An attacker will go and scan the internet,  they'll look for code repos, environment files, they'll look for blob storage devices,  and they're basically grepping out different types of access keys. And from those access keys,  then they can leverage that to go and attack these environments. And then the question becomes,  like, is this working? You can go on GrayNoise right now, go and look at their env crawler tag,  and you'll notice that even just over the last month, you'll see a bunch of internet activity  just scanning for these environment files. If you notice at the bottom two, they're also  leveraging a couple of vulnerabilities. And so, maybe it's not misconfigured to expose an  environment file, but it is misconfigured in the sense that it has a vulnerability. And so,  they can jump on there and pull those access keys from those files. Let's go sleuthing even more. Go  on Telegram. If anyone has a Telegram account, if you'd like, type in a bunch of cloud service  provider services. In this specific case, SES and SNS. You'll see all kinds of advertisements  for this type of access. Some things that are interesting, SNS is for SMS, SES is for email.  So, instead of hijacking an email account, they're just going to hijack a cloud service provider  and a victim there, and they're going to use that to send out emails. You'll also notice that  there's 50,000, 100,000, and 500,000 quota. That's that sandbox account status that you saw earlier.  Basically, breaking out of that sandbox and saying, I'm no longer a dev. I'm going to spend  money on you, Amazon. I'm going to send this a bunch of email. I'm going to send a bunch of text  messages. And they now have really reliable, trusted infrastructure for these campaigns.  So, that's one of them. And a lot of these dev misconfigurations, they lead to these long-lived  access keys, but that's targeting the machine. That machine identity I was talking about earlier.  How about targeting devs directly? Is there any payoff if you can target them directly to get  access keys? Because that's what devs use. They use that to interact with the cloud.  And so, you know, this is a tweet from a few years ago. Super interesting campaign. We're  basically a popular Python library and a popular PHP library. We're compromised. Three million  users combined. And the malicious code was basically enumerating environment variables  and sending it to a Heroku app. Nothing here specifically, well, they said AWS, but if you  go and you look at some of the malware. So, for example, this was the malware in that backdoor  package. Enumerate the environment and send it off to this Heroku app. Nothing here that kind of  indicates this is targeting the cloud. But if you go and look at the PHP version, right there in the  middle, I think 4748, it's specifically targeting those access keys and specifically targeting  those secret keys going to that same Heroku app. So, pull up the sequence diagram. The basic premise  behind this is that someone's compromising a developer account that holds these popular  packages. And then you're shimming in your legitimate or your malware code. You're then  uploading that to a registry like PyPI. And then you're waiting for someone to either run it on  their laptop or run it in prod or staging or a build environment. And then that's when it gets  downloaded. Whether it's on any of those environments, it's now enumerating secrets. It's  taking those and it's bringing those back to that attacker controlled infrastructure. But again,  this is SleuthCon. How did this initial access happen in the first place? So, let's go sleuthing.  So, this is a screenshot of an actor named John Malkovich who eventually became EvilProxy.  And this post was four years ago. But basically, they're advertising their phishing kit.  I've done phishing research for years. And this was the first time, if you see the red box at  the bottom there, I've ever seen templates for registries. So, this is the victimology of this  is really somebody who's a developer. That was years ago. You know, recently, if you kind of  search for these things, you'll notice other actors talking about access they have to different  rats and different botnets. And this particular one was saying that, hey, we get to these  different installs through compromised apps. Or sorry, compromised packages. So, on PyPI and  Golang and things like that. They made a post afterwards kind of describing a little bit more.  You can read it top to bottom. Basically, anything that you can see on the registries, how many  installs it has per day, where it's hosted and things like that. And so, they're constantly  thinking about how can I get access to these popular packages so I can shim in malware and  then get installs on it. If you read the end, they're talking a little bit about they're interested  in a victim set targeting like crypto wallets. And I would say there's probably a Venn diagram  between developers and crypto holders. But it's still kind of interesting to note that is this  are they targeting the cloud? Maybe. But at the same time, like this is the evolution that  I've personally seen where you target, you know, folks that hold crypto and then you realize the  payouts higher if you target companies themselves. So, I thought that was a pretty interesting  finding here. So, I talked a lot about like cloud is like an ancillary target. But we're starting to  see a lot more. And I know a lot of folks here are seeing this too because I've had a lot of great  conversations already where cloud is the primary target. It's the thing that they want to get  access to because they want to do something to the firm that runs that. And so, I can't really  talk about this without talking about Scattered Spider or Muddled Libra. But this is an amazing  blog post by Margaret Zimmerman over at Unit 42 that basically talked about Scattered Spider's  evolution to the cloud and all the associated TTPs with it. So, they're showing that they're  learning how to navigate within these environments. And they're doing cross cloud too, which is also  interesting. I'm not going to model everything that happens during an intrusion because I want  to hone in on something specific. But the basic premise behind it, and I'm sure a lot of people  here know, when you get into a cloud environment, it's somebody that has privileged access to it.  Who is that usually? Either an IT person or a developer, right? So, they'll socially engineer  them. They'll achieve some type of session cookie steal, or they'll add some secondary MFA.  They pivot into the cloud service provider. They set up persistence. It's not just adding things  like a user, but they're doing things like setting up rogue identity providers and tenants,  and they're using that to pivot back in. And then they're literally just enumerating as much as they  can. And they're looking for a few things. They're looking for secrets, and they're looking for  intellectual property, and then they exfiltrate that. And so, again, I'm interested in this part.  How are these actors talking about this? Why are they interested in this specific thing?  And so, I have a screenshot from a supposed Alfie Black Hat actor here. I had to gray out a lot to  make it safe for work. This was an interesting threat on Xplate where they were basically  arguing with LockBit. This was right before the Black Hat takedown and the LockBit takedown. But  the interesting part is right there in the red box where they basically say exfil is the only  thing that actually matters. So, it's kind of moving away from double extortion where they're  ransoming a company, and they're kind of really focusing on taking something from that company.  Another interesting note, too, you'll see the big screenshot right there. The way they prove  they're in Black Hat is they said they were the one that submitted the Meridian Link SEC complaints.  And so, that's their proof right there. Really fascinating threat if you kind of want to see  people bickering. It's almost like trash TV. You can't stop watching it. You like watching  these Jersey housewives argue. But this is where you can glean a lot of that intel, right? I think  I was having that conversation with John earlier. Once they start infighting, all kinds of stuff  starts to come out. I can't really talk about cloud exfiltration without talking about Sisense.  So, for those that are unfamiliar, a few months ago, SISA released an advisory that basically  said this business intelligence company, Sisense, was breached, and if you're a customer,  you should start really thinking about talking to them and rerolling a lot of your integrations with  them. Our good friend Brian Krebs had an expose on this whole thing. He had insiders that had  access to the breach data. So, I want to build that sequence diagram just based on what's on  this public information that Krebs posted because it still kind of shows people are really interested  in targeting the cloud. So, according to the article, there was a host of GitLab server that  was either misconfigured or vulnerable to something. Once that was discovered, the actor  performed some exploit, or they took advantage of the misconfiguration to download source code.  Again, devs. They're targeting the devs and what the devs do. Within that source code,  they found AWS keys within that source code, and they used that to list the S3 buckets that Sisense  owns, and they found a backup, and they downloaded it. And the whole implication throughout this post  from Brian Krebs is that they were going to use that to pivot into customer environments.  And so, I thought this was interesting, too, in the sense of they're not necessarily downloading  Sisense code, or at least that's not what the blog post said, but they definitely targeted  another part of intellectual property that is their customers. And if you go and you look at  some of the emails that Sisense's CISO sent out, again, Krebs got a hold of this and posted it on  the blog, but I put red boxes around like the cloudy things. But if you kind of read everything  here, you can almost always associate it with the cloud, right? API secrets, Active Directory  integrations, and things like that. So, they wanted the secrets, and they want to use it almost in like  a 3CX-style supply chain attack to go and pivot into other environments. So, again, exfiltration  is really going to be a hotter topic. It's something I'm telling my detection teams to  really focus on, because this is such like a massive event that you can catch. But a lot of  the times when it comes to those detection opportunities in the cloud, it's kind of hard to  put it all together and then start detecting it and then stopping it. I can't talk about  cloud threat actors without talking about these guys, Team TNT. So, Team TNT was a group that  kind of emerged on the scene in 2019. This is their Malpedia page. What made them interesting  is they're targeting cloud-native technologies, that cluster and container component I talked  about within the four Cs, specifically looking at Kubernetes, deploying malicious containers that  they uploaded to Docker Hub, Docker itself. They did the boring stuff like deployed a crypto miner,  but what kind of made them interesting is how they did their targeting and how they pivoted  into cloud environments afterwards. And so, the interesting part with this group, too,  is that the main person tweeted all the time all kinds of things that they were doing. So,  Hildegard, that's their Twitter. They still have it up. Notice that they're just like talking smack  that they got into a customer environment or just a cloud environment in general. They also  would go after like researcher firms, like this is Cato Security, talking about things they found  related to Hildegard and Team TNT's tooling. So, this is just him, again, bragging and engaging  with the community. So, it was a really fun time really interacting with Hildegard. The problem,  if you look on the right there, is they retired. And so, one of the first publicly reported  cloud threat actor groups that showed expertise in these environments. Hildegard is likely the  main actor of the group, but announced leaving the scene in late 2021. And one thing when they  left the scene is that they took their tooling and they leaked it. And so, since 2021, since that  leak, at least at Datadog, we've seen all kinds of stuff both in Honeypots as well as some of  our engagements where we're finding code reuse. We're finding a lot of Hildegard and Team TNT's  tooling. And so, I wanted to highlight a specific campaign we saw from Team TNT where we had an IP  address at the top, the command and control server, hitting our Honeypot, trying to get into  our cloud and trying to pivot to other victim environments, both with those exposed Kubernetes  and Docker APIs. Basically, the tooling would reach out, it would check to see if we had a  vulnerably configured Docker API, and it would do a bunch of stuff, such as it would create a  container, it would try to break out of that container, it would try to set up persistence  via all kinds of methods, including cron jobs. It tried to steal the AWS keys that we had as  a canary on that Honeypot, and it would try to interact with those AWS keys. Afterwards, in like  a wormy type of fashion, it would use that same machine that it tried to compromise to go and do  more scanning of the internet, more ways to kind of add things to the cloud, and then it kinds of  ended up in the crypto miner. But again, this is SleuthCon. Let's take a look at this. Specifically,  there are cron jobs that we know are uploading to a very specific endpoint at this IP address.  Well, we as curious observers decided to access that upload API, and it was misconfigured. I think  they should probably watch this talk to learn a little bit more about securing the cloud. We  downloaded a bunch of their tooling, we downloaded their bash history, we downloaded just basically  everything they had on that C2 server, and then we noticed something in the bash history. We  specifically found a unique password. So, within the bash history, this is kind of a snippet of it.  What this actor would do is they would access victim AWS keys. They would then load it into  the AWS CLI hosted locally on that command and control server. It would do a bunch of  persistence things like creating user login profiles, attaching user policies, basically  everything in persistence you can think of. But the one interesting part was right there.  The password, erdnubble1704. I got really excited and my team was weirded out by me,  but I'm like, we get to do the best pivot and thread Intel passwords! And they're like, okay,  sounds good, Zach. So, I took it, and we put it in some breach databases, and we got some hits.  It's like, okay, maybe, you know, we're not going to get full attribution, maybe this person's  kind of small, but at least we're starting to see some hits here. So, we got an email address,  which is great. That's another pivot that we're about to do in a second. We got an IP address,  and we realized that IP address was in Germany, and Hildegard speaks German.  And we're like, okay, it's a little weird, but let's kind of keep going here. And so,  we took that email address and we got a name. From that name, we found social media profiles.  From the social media profiles, we found one specific person from around 2020 to 2021 talking  about writing malware related to Team TNT as well as posting their screenshots. So, you know,  the question became, like, who is this, and is this Hildegard? And so, I reached out to my good  buddy Silas Cutler, who did a lot of work with Team TNT back in the day. He managed to find out  who he was, too. So, I asked him, is Hildegard's name blank? He's like, yeah, that's him. You found  him. And I said, okay, we have some hands-on keyboard activity in a honeypot. It used a very  specific password. He's like, oh, yeah, he does a lot by hand. So, Silas did all the hard work,  like, years ago. And so, specifically, 22 March 2021. He just wanted me to make sure everyone  knew that's when he found him. So, it really kind of came down to, like, he announced he left the  scene. Maybe he just got a little bit smart and still is doing what he was doing back then. He  just wasn't bragging. And so, you know, it is our assessment that Hildegard is continuing operations.  We have hands-on keyboard activity with a unique password tied to his name, further uncovered by  other researchers who on separate occasions found his identity. And so, like a good analyst, we did  some analysis of competing hypothesis. Maybe other threat actors are using this password, either  through a collision or they knew it belonged to Hildegard. We didn't find anything of those  passwords within any of his tooling. It seems a little bit far-fetched. It's not a hunter two  password or a last pass. It's something where we can go and pivot and find very specific findings  in these breached databases. With the other competing hypothesis is, hey, maybe the tooling  that he had leaked by Hildegard contains his password. I have access to all that tooling.  Luckily, we were there when he dropped that tooling and we found nothing related to this  password. And so, I did what anyone does, reach out to Hildegard on Twitter and ask  him if he's still around. He still hasn't DMed me back.  So, that's basically the talk. I hope you all leave here today kind of understanding a little  bit more about the cloud. It's not just someone else's computer. It's about 237, according to  Google. Other things that you can do there. It's kind of hard to track everything that's going on  in terms of, like, where is something being attacked and what layers of the four Cs.  But I hope you can kind of think about this a little bit more because  threat actors are definitely thinking about this more. And it's something that I  hope with this talk I brought to light. So, thank you.


url: https://www.youtube.com/watch?v=iYTeFweNLuI
title: Chasing Androxgh0st: Attribution in an Open-Source Cloud Malware Ecosystem | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=iYTeFweNLuI",
    "title": "Chasing Androxgh0st: Attribution in an Open-Source Cloud Malware Ecosystem | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresented by Alex Delamotte\nAlex Delamotte, a threat researcher at Sentinel Labs, joins us at Sleuthcon and introduces Androxgh0st, a Python-based malware that was discovered on GitHub in 2020.\n\nAndroxgh0st is a Python class that parses web server environment files for secrets, and is used by cloud info stealers such as AlienFox, FBot, and Predator. Although cybercriminals attempt to hide their tools, the source code is distributed on open-source platforms such as GitHub and Virustotal.\n\nJoin Alex as she discusses how researchers within cybersecurity can attribute tools in an open-source malware ecosystem as she explores how actors trademark and distribute tools. Alex details how researchers can attribute geography through social media and other media such as pop culture linked with actors. She explains how and where researchers can find attributable information, and delves into the complex balance actors must have with marketing their tools while remaining anonymous.\n\nTimestamps:\n0:00 Intro/About\n01:11 What is Androxgh0st?\n03:30 Androxgh0st's origins\n05:19 Where to find Androxgh0st? AlienFox\n09:53 Where to find Androxgh0st? FBot\n20:03 Where to find Androxgh0st? Predator\n24:11 Outlook\n25:30 Conclusion\n26:34 Questions & Comments\n\n#Androxgh0st #MalwareAnalysis #ThreatIntel #PythonMalware #CloudSecurity #OpenSource",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 1802,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   Hey, thanks for joining me to speak about chasing Androx Ghost attribution in an open  source cloud malware ecosystem in the spooky dark.  Woo!  All right.  Oh, that one.  Okay.  Woo!  Cool.  All right.  So today we're going to cover a little bit about what Androx Ghost is, where you can  find it in the wild, which there are two malware families that it's associated with.  There are actually more than that.  We had to cut a couple for time, but we're going to cover two of the cool ones.  Then a little bit of wrapping up without looking at the conclusion.  About me.  Hi.  I am Alex Delamotte.  I'm a threat researcher at Sentinel Labs, which is part of Sentinel One.  Woo!  Yes.  We love S1.  I live in Las Vegas.  I am not a sleuth by trade.  I do technical analysis, meaning I take apart tools and malware.  My fun fact is that I started off my career in an internet service provider's network  operation center, which means I got to see a lot of really wild stuff.  And lastly, this talk represents only my own views, not those of any employer or cloud  service provider or anything like that.  All right.  So first, what is Androx Ghost?  Let's talk about that.  Androx Ghost is Python code that scrapes environment files and config files for secrets, and it  uses regular expressions to parse the files when they're exposed on a web server for strings  that are related to API keys, which can be used to conduct spamming attacks.  The earliest reference that we've seen to it was in December 2020, but there was a lot  of activity in 2022, and it continues today.  It primarily targets web servers using the Laravel PHP framework, which is notorious  for being misconfigured.  You can talk to all of your favorite dev and DevOps friends about that.  There's also a lot of comorbidity with WordPress, and the example on the slide here just shows  the credential for a Nexmo key, which is used to conduct SMS spamming or SMS API interactions  is being scraped so that the actor can then use it for spamming.  And how is it used?  It's rolled into Python tools.  As I noted, there are a couple of those malware families that are using it, and they are targeting  the cloud.  It performs credential harvesting using the extracted values that we've discussed, and  it was referenced in this GitHub issue which shows that basically they were locked out  of their web server after getting a message that just says access denied and rocks ghost.  And these tools will often obtain sensitive API keys and secrets and use them for badness  like conducting email spamming or SMS spamming or sell them to those who will, and, again,  locking them out of the web server is to hinder incident response and also just kind of establish  persistence.  Here we have a list of technologies that are targeted.  You can see that there's a lot of cloud service providers, but really they're targeting email  services because, again, the motivation is spam.  There are a couple that do SMS, but overall we have a lot of technologies that are enabling  communications here as well as some content management frameworks like Drupal, Prestashop,  all that good stuff.  Now what do we know about the origins of this tool?  A lot of the variable names are often identified as being in the Indonesian language or one  of the other languages of the region like Bahasa or Malay.  And so many cloud tools do have ties to Indonesia.  This is something that we've seen time and time again.  Like recently Datadog documented crypto mining attacks against ECS containers that were originating  from Indonesian IP space.  Permiso outlined their GU evil attack that also found Indonesia as a source for crypto  mining attacks.  We also had Invictus' danger dev report that found Indonesian IPs as a source for these  crypto mining attacks.  Obviously open source software is adopted by people all over the world, but the Indonesian  nexus and sustained cloud attack presence are certainly worth consideration for those  who have the capability to build relationships and disrupt the ecosystem.  Now how do we attribute these tools?  I call it slop sack.  These actors, they have a contact method inside of the tool, which is generally open source  anyway.  It's just Python code.  It's often unprotected.  They will have their handle or the tool's distribution channel handle inside of the  tool.  Usually it's telegram.  So there's often two pieces of information we can use to attribute here.  We have a telegram channel and then a telegram actor profile, which are generally two separate  handles.  These handles are often recycled across platforms so that they can be found more consistently.  Again, it's not a high level of op sack.  We found them on TikTok, Twitter, YouTube, everywhere like that.  What do you do with all of this information?  Well, let me Google that for you.  That's how we pivot in the world of cloud.  Next we'll talk about where to find Androx Ghost.  One of my favorites here is the Alien Fox Cloud Info Stealer, which was one of my first  reports working for Sentinel Labs, very close to my heart.  It is a multi-purpose cloud attack tool that focuses primarily on spamming, and it recently  focused on cryptocurrency wallet takeover by some of the developers who are maintaining  it.  And again, communal development means that one actor will add some features, another  will add more features, and there's just generally a whole lot of gray area with regard to  who is actively maintaining the tool or who did what, and also they all take credit for  each other's work.  So it's almost collaborative.  It's like collaborative ripping off one another.  It's a very strange world.  As far as attribution goes here, there are so many handles associated with this tool,  this family in particular, and actors tend to cycle through these handles fairly frequently.  And why might that be?  Well, they often rebrand into a new channel and try to get a different customer base or  affiliates and partners.  They might also exit scam, where they quit the scene and take the money, and then often  come back under a new handle.  And sometimes it just gets too hot.  There's too much attention to the handle.  We have here that there was some research put out on xcatzee, which was a fairly prolific  person in the Alien Fox scene, and they ultimately ended up abandoning their handle, and they  actually recently made a new channel called xcatzee re-up, saying they're going to be  coming back with some new stuff soon, but that was in February and no movement yet.  So a lot of these people are full of talk.  On the right, we have a table from the report that I published on Alien Fox that has 13  unique handles, including two that were for xcatzee.  So they were pretty prolific.  They're not doing a whole lot at this point, though.  Now, what we can do to find active handles is, again, kind of banal.  You search for the tool name in Telegram and see what comes up.  In this case, there were a whole bunch of results unrelated to the handles in the previous  slide, but that were actively being maintained.  One channel, which was called Alien underscore Fox 4, is run by the handle Alien Fox 1, which  is also run by another handle called Jaguar.  As you can see on the screenshot on the left of the file system, or hopefully you can see,  Jaguar LLC made that tool.  So we probably have the same person who's responsible for this active one here.  They're posting screenshots about, you know, selling their tools to people.  And then on the right, we have their Snap handle, which they advertise their tools on  Snapchat, which is kind of an interesting choice.  I haven't seen that a whole lot otherwise, and it could maybe indicate a regional nexus  where people are using Snapchat more than other platforms.  Now, where in the world could Jaguar Boss be?  Um, their Snap channel has multiple videos in heavily accented English, and the accents  certainly sound African or maybe West Indian.  And there's another video that has an announcement voice in an automated, like, background  announcement that is very clearly British English.  There's also an interesting conflict between the timestamps of the video on Snapchat and  what I was seeing on my computer.  Inside the video, the actors' devices showed March 9th, or they showed March 10th, and  it was only March 9th for me in the Pacific time zone.  So that suggests to me that they were probably somewhere in the Eastern Hemisphere.  They also have music in their Snaps that are from artists I was not familiar with before  this.  We have Carter FA, Ruger, BNXN, and I wasn't familiar with them, but I looked them up,  and they're all Nigerian artists.  And lastly, they use a QWERTY keyboard.  On the right, we see that there is a keyboard here, and a consistent theme is they're always  using the same-looking MacBook with a QWERTY keyboard.  So based on this, I think it's pretty safe to infer that the actor is probably based  in Western Africa, likely Nigeria, based on the pop culture, although I don't know how  that diaspora works entirely.  All right.  Moving on to FBOT.  This is another family of Cloud Info Stealer.  It's a multi-purpose cloud attack tool, just like Alien Fox, really, but it's a little  bit different because it runs on infrastructure that's hosted by the developer or the person  currently maintaining it.  This is in contrast with other cloud attack tools because they usually integrate API calls  to things like Shodan, Leak9, Zumai, Security Trails.  We've seen them using all kinds of services that we security professionals use to identify  vulnerable websites to attack.  Instead, this actor runs their own infrastructure, which the people who use their tool can use  to identify vulnerable websites for targeting.  It shares code with the Legion Info Stealer, which was covered by Permiso and Cato Security  a while ago.  It's very similar to Alien Fox, maybe a little bit more professional and centralized, but  it shares the same checkout website, which is really interesting.  It uses a Lithuanian fashion designer's website to validate PayPal accounts.  There's this one URL that it will make a call to that doesn't seem to exist when you navigate  to that website, and it's using that to validate whether it's an active PayPal account or not.  Lastly, it is very Indonesia-centric.  We have a few data points that we'll dive into on this.  All right.  So who made FBOT?  It really depends on how far back you're looking.  All of the known samples contain references to idevexploit.io in a core part of the code,  which was also an Androx ghost indicator from some much older samples, too, that was used  as a hard-coded IM profile username, so it's reasonable to believe that they've been around  for a while.  They were probably responsible for some of these older malware families and then kind  of spun off FBOT into their own.  We have here on the slide a funny message that they put in there that translates to  we didn't fully use our senses and thoughts when making this BangSAD bot.  I think BangSAD didn't translate right, but anyway, there's a consistent theme of these  people saying that they are making a tool and they're not liable for how it's used.  You know, something that I'm sure we've all seen and heard a lot.  So as far as who's currently maintaining it, we see that it's currently maintained by someone  named rep.  So kind of missed that there.  The active handle that is maintaining it is at callmerep, and you can see that in the  very badass ASCII art on the right.  Very hacker stuff.  So we looked them up on Telegram, and it shows their personal account.  We have so many different handles.  Then their business account is the rep project account, which is used to market and kind  of use communications for FBOT and other tools that they're working on.  And then they're associated with the Indonesian Darknet Telegram group, which is a group that  has about 3,000 members and seems pretty active.  And then on the top right, there's an interesting post that I added here, because it's talking  about server maintenance, but uses a lips and heart emoji, which is just kind of an  interesting choice to use to talk to people about maintenance being complete.  I think that this is indicative of a consistent theme with this group, where the actors tend  to use different handles for different genders, and they kind of, like, swap between them.  They have a bit of an identity crisis, and it's just kind of interesting to watch from  afar.  So as far as who actively maintains FBOT, we still have this on rep.  I had to get the screenshot from a VM.  So their website is currently down, and I had a VM screenshot that was available, so  I was able to grab this, which was definitely a relief, because otherwise there was nothing.  I think you've all probably noticed that Google Cache stopped working recently.  So there's a lot of historical services that we're using for analysis that are no longer  available.  So it really underscores the importance of documenting your work as you go, and not expecting  anything to be there forever.  So about RepCyber, the screen cap states that the service is a project to make your cyber  security activities more easier and more efficient, with an option to scan an IP address or  domain.  Again, that infrastructure part that we were discussing.  So I can't scan it right now, because the website is down, so there's no output.  I don't know what it would have done.  But there was a lot of feedback in the Indonesian Darknet Telegram group about Rep service  becoming unreliable.  So it seems like it's kind of in question whether they're still active.  But again, having that infrastructure does give people another avenue to potentially  disrupt and investigate the nature of this tool.  And on the right, we have a screenshot of Rep's GitHub account, which shows that they  work at Google, are based in Russia, identify as a hacktivist, and again, references the  RepCyber website.  Okay.  So a little bit about Rep's GitHub.  There are a lot of fun connections on that GitHub, and I have to give thanks to my friend  who couldn't make it here, Lacey Kasten, aka Coran Kovey.  She gave me a lot of help with just kind of pivoting from Rep's GitHub and finding a lot  of really interesting connections that we're going to dive into here.  There was a removed commit on the top left where it had their ASCII art Rep project and  some of their social handles, including a Facebook handle, which we put the screenshot  on the bottom left of the Facebook account.  And then in the updated version from that commit, it says, trying not to be a skid.  So they removed the ASCII art in an effort to not be a skid.  Heartwarming.  The Facebook account was created in 2018, but there were no posts until December of  2022, which is an interesting and relevant timeline.  Pay attention to the timeline here, because we're going to be diving into that a bit more.  They advertise tools.  This Facebook is used to, like, market their tools.  So an interesting choice for Facebook.  On GitHub, there are also references to a handle that is called Replicant, which is  a computer host name that was used to push code to the GitHub.  And we found that Replicant actually links back to a player on several Indonesia-based  high school CTF teams.  So not only is this a skid, but it's possibly a high school skid.  Oof.  All right.  Now, as far as who maintains fbot, we still have this rep handle.  Repcyber was used on TikTok, and we have a first initial and a last name there.  But the attribution is really shaky and unclear.  The TikTok is very unusual.  It's many videos of a young woman, and usually there are no words.  It's just kind of original audio, which I guess is used to bypass the copyright filter  if you are using non-original audio.  I don't know that it actually was.  But there are lots of videos of this woman just kind of looking serenely at the camera,  and often she'll show up with family members.  There are captions that I've translated, but there's almost never any speaking.  There are also some videos of a man with hair that looks suspiciously like the GitHub profile  avatar that we covered earlier.  So that's a little cryptic.  There are also videos where she talks very uncertainly about a dark past.  And a questionable future.  Several of the TikToks reference movies about dark stories, including one where a man in  the mafia is killed to save his partner and their child.  And then the account just completely stopped posting abruptly in June 2022,  after like daily multiple posts.  Just nothing.  No obvious farewell message.  Highly unusual.  It's really unclear what happened here.  But again, we have the December 2022 timeline where suddenly they open up a YouTube channel  under the call me rep handle.  And this YouTube channel is very much associated with the actor.  It's used to distribute or to advertise the tools and just show how to use them.  So instructional.  But then there is the piece de resistance.  This video is called a POC for CVE 2022-I miss her.  Oh, buddy.  The actor shows a demo of a tool called multi detector, which is a Golang-based tool for  processing data at scale.  Sounds like buzzwords.  But again, to summarize, we know that FBOT is maintained by the handle call me rep, who  is going through some things.  They're likely living in Indonesia, based on the videos from TikTok and also the multiple  linguistic indicators that we discussed.  They might be a high school student based on the CTF teams linked to their GitHub.  Call me rep started being active in September 2022.  That was the earliest that we saw that handle.  Three months after the rep cyber TikTok stalked activity.  The video here shows that the actor wishes they were with her.  And TLDR, this actor's illicit activity is being portrayed as a result of someone coping  with a difficult breakup.  Feelings, am I right?  Oh, wait.  We have Predator here.  I don't know.  How are we on time?  I'm good?  All right.  Let's do Predator.  I didn't think we were going to do Predator.  All right.  Awesome.  Okay.  Yeah, we can do that.  All right.  So Predator is another cloud info stealer.  This one has a lot of buzzwords.  We've got both AI and a GUI.  Woo.  It's got integrated chat GPT powered user help mode.  With conditional exceptions that do not call out to the chat GPT API.  It will handle some things locally, which is certainly cost effective.  But also bad for OPSEC, as we'll see.  Okay.  There we go.  So there are a whole lot of handles in this tool in Predator.  How do you really figure it out when you have, like, six unique handles there?  Who is responsible for this tool?  We have OB Hacking, which is a group related to Gray Hat Hackers, another telegram hacking  group that's adminned by a guy named MR0X01, which seems fairly promising there at the top.  And if you use the chat GPT interface that I really hacked together here and ask, who made  you, it actually has MR0X01 there.  So it also references a GitHub handle that is it's basically gibberish.  L4GTR4.  So I apologize in advance for saying this over and over again.  But yeah, let's take a look at that GitHub profile.  So what about it?  It's dead.  It 404s now.  But luckily, they do have some other social media presence where they're recycling that handle.  And it was used on a Twitter account with only a few posts about bug bounty.  And it was also used for a HackerOne bug bounty with a location as Meknes, Morocco,  an imperial city in Morocco with historical significance.  Not sure how their internet is or whether they're likely to have tech people there,  but it's kind of an interesting indicator.  Now, again, what about that GitHub profile?  Good thing that I took screenshots before it was taken down.  So we still have here that it was one in the same, the L4GTR.  So again, it just kind of reiterates the need to document your research and not believe that  anything will be there in two months.  So who is this person?  Their profile and their posts on social media are consistently in Arabic.  There's a Python class within Predator that does translation.  And you'll see that the first listed language is AR-MA, which is for Moroccan Arabic.  A pretty niche choice.  So I think it's pretty reasonable to assume that we at least have somebody in Morocco here.  Their Twitter is, again, also in Arabic.  Most of the posts, as far as I can tell, are kind of like crypto spam posts.  It's really weird.  They were actually quite political a few months ago, but they seem to have slowed down on that  front for whatever reason.  They were posting a lot about the conflict that's happening in Palestine and Israel.  So, okay.  What's their deal?  Again, they're all in Arabic.  What's their deal?  Again, they're often heavily condemning Western countries and pro-Hamas.  I found this picture on their telegram, and it has like F the US, Israel and France, and  it's got this guy with a gun there.  And I looked it up, and apparently it's a Hamas guy from 2014.  So I don't know why we're still posting this.  I didn't like the way that was.  So let's make it look better.  Okay.  That's better.  I can work with this.  Cool.  Oh, also, they love the US, Israel and France.  Okay.  Much better.  So to summarize, we know that this person is the main Predator developer.  They live in Morocco, possibly Meknes.  They have some political views, and they might be feeling the burn that they're feeling.  They're not sure what they're talking about.  They have some political views, and they might be feeling the burn that comes with having  sloppy OPSEC based on some information I've received.  So to summarize, what does it all mean?  Cloud tools are special.  It's often not this easy to find so much about other types of cyber criminals.  I would say that because it's all open source, we have a special window into their world.  To reiterate, I'm a simple malware researcher, not a criminal investigator or an OSINT specialist,  but I'm confident that people with those special skills and connections could certainly fully  dox these actors because of their sloppiness.  Actors are also incentivized to sell their tools, not to maintain high OPSEC.  So they market the tools with disclaimers saying that they take no responsibility for  how the tool is used, but is that a valid take?  I don't know.  Most of these actors are in developing countries, as we've discussed.  You know, we had Morocco, Nigeria, and Indonesia.  They're all certainly not part of the West.  I think that the minimal amount of money you probably get from spamming is a lot more valuable  there.  So does local law enforcement care about that kind of activity?  Should they care?  If they do, the OPSEC will certainly improve, and we're going to lose insight into the tool  development, but it is certainly an avenue for disruption.  And just to wrap up, cloud attack tool devs have a lower bar for OPSEC.  We've been over that.  The consistent theme is that they only make the tools, that they are not responsible for  how they're used.  We see this a lot with C2 frameworks, too, with red teaming stuff.  Is it accurate, like you're only making a tool?  Are you complicit with the abuse?  Again, they often frequently burn and rotate channels and handles, which makes cloud tool  attribution hard.  Let's go shopping.  It would be fun.  And lastly, just a friendly reminder to other threat intelligence professionals that the  services that we rely on are being burned and destroyed at an alarming rate.  Things like Google cache, passive total, I rely on day to day, and they're going to be  dead, if not already dead.  So, we need to document everything as we go, and also to develop robust solutions to replace  the things that disappear.  So, yeah, here's some related research.  Woo.  Okay.  I'll let you take a screenshot.  Cool.  Booze.  Cool.  All right, Aaron, yes?  Like 2018 to 2020, there was like an IoT botnet called EpiBot.  Is that related to the infrastructure you guys bought at all?  Unrelated.  It was a poor naming choice on my part.  I found out about that after I had named it.  But, you know, I couldn't just walk around calling it what it was called.  So, yeah.  Yes?  Yes.  That's a great question, and I've been wondering the same thing.  I actually took a detour to Morocco when I was near Malaga a few months ago, just to  kind of check it out, and it was really harrowing as an experience for me.  It's certainly a very, very low cost of living.  So, I think they're incentivized by that money making opportunity.  But there is also an influx of Western money going there because, you know, there are places  like Casablanca and Marrakesh that are beautiful cities.  So, I think that maybe there is more of an influx of information and technology infrastructure  to host people visiting.  So, maybe even like a tourism push is somehow enabling more cyber activity.  Again, it might be far-fetched, but just a thought.  Yes?  That's a great question.  It definitely depends on the individual tool.  For FBOT, we see that they're selling almost exclusively to the Indonesian devs.  But they post in the Indonesian languages often.  And then for things like Alien Fox, it's usually posted in English, which, again,  Western African cybercrime.  So, it really just depends on the tools.  They seem to serve their local region, though.  Presumably, where we've seen the developer kind of building their brand is also where  their customer base lies.  Am I missing any?  Any more questions?  Oh, no, I can't see your hand.  OK, yeah, please.  So, it's actually just using the chat GPT API.  So, it is built into their tool, and they make API calls through it.  But they have a couple of exceptions that'll handle things locally.  Like, if they're asking about a specific data set that was collected from the tool,  it'll handle that locally instead of going out to chat GPT and wasting money.  And they put their handle into one of those models, I guess?  Yeah, they put a handle into one of those exception cases that says,  if they say, who made you, to the AI assistant, it'll say, I was made by MR0X01.  Yep.  Anyone else?  All right.  Thank you.  Woo!  Woo!  Woo!  Woo!  Woo!


url: https://www.youtube.com/watch?v=9RdofpxaTOQ
title: It Is Time to Ban Ransom Payments: Change My Mind | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=9RdofpxaTOQ",
    "title": "It Is Time to Ban Ransom Payments: Change My Mind | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresented by Allan Liska\n\nIn this lightning talk, Allan Liska, Ransomware Sommelier at Recorded Future, dives right into the controversy of ransomware payments, and if they should be banned.\n\nIn his talk he reviews both sides of the argument, navigating through the historical context and analogies, and real-world examples of current laws in North Carolina and Florida that have banned ransomware payment laws. \nAllan makes the argument for banning these payments to cybercriminals, but only if accompanied with rigorous reporting requirements.\n\nTimestamps:\n00:18 Two sides of argument\n01:05 Precedent to banning ransomware\n03:18 Why should we ban ransomware?\n06:30 Alternatives\n08:45 Conclusion\n\n#Ransomware #RansomPayments #ITSecurity #CyberLaws",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 573,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   So, there's actually some precedent for this.  In 1991, well, before I get to this, we have questions, oh, how do the slides move forward?  Okay.  So, let's go to the next slide.  So, there are sort of two arguments that I generally hear here.  If you ban ransom payments, it'll cause too much pain.  That's fair.  You know what else causes pain?  Ransomware attacks.  Ransomware attacks cause a whole lot of pain.  And then banning ransom payments will force companies to pay under the table.  You know who else pays under the table?  People now who pay ransoms and don't want anyone to know about it.  So, we already have people paying under the table.  I actually witnessed a negotiation where the company that was paying the ransom specifically  said, hey, we're going to pay your ransom, but we need to do it in increments under $100,000,  so we don't have to report it.  I'm like, oh, well, you guys are jackasses.  So, we already have people doing that.  And we do have precedent for banning ransom payments.  So, in 1991, Italy banned paying ransoms kidnappings because kidnappings were running rampant in  the country, and Italy very much is proud of the fact that they passed the law and that  it stopped kidnapping.  The only problem with this, for anybody who can read a chart, when they banned the ransom  payments, kidnappings were already well on the decline.  So, it actually didn't have the impact that they claimed that it had.  We also have other examples.  Go ahead to the next slide.  Both Florida and North Carolina have banned public entities from banning ransom payments.  On the left is the news story about them doing that, and on the right are the number of ransomware  attacks, pre-ransom, publicly reported ransomware attacks, pre-ban and after ban.  You can see that the ransomware actors don't care.  There's this assumption when you try and do local payment bans, like in North Carolina  and Florida, that the ransomware actors are targeting you specifically, but y'all in this  room know they don't target, generally, they don't target a specific organization.  They target weaknesses.  So, it doesn't matter if individual states ban ransoms because they're still going to  be there.  Now, what's interesting is if you talk to politicians in North Carolina and Florida,  they will tell you that their ban has been a success.  Based on publicly reported data, it doesn't look like it.  And here's the other problem that we have with this, is that most of the time, we don't  actually know what's happening behind the scenes.  So, every public entity that gets hit with a ransomware attack in North Carolina and  Florida is required to report it.  That information is not made public to anyone.  So, all you people in the government, stop doing that.  Make that data available.  You don't have to give me the individual victims, but you have to give us real usable stats  that we can work with so we can actually understand what's happening.  So, I'm going to chastise every government employee, please fix that.  Go ahead to the next slide.  What's that?  So, I did.  I have two ransomware interns who, one of them whose sole job was to file FOIAs with  every state to find out the number of ransomware attacks in each school district.  So, for example, in Kentucky, we filed in August of 2022.  Two weeks ago, we got back notification from them that because we don't live in Kentucky,  they don't have to tell us.  And then, in other instances, we get the comment back, we can't tell you about that because  it's sensitive information and it might give the bad guys more details.  Well, the bad guys already know that you're vulnerable.  We want to know how vulnerable.  Could you please tell us what the numbers are?  So yeah.  So, why should we ban ransom payments if a ban won't actually slow down number of attacks?  It's because the number of attacks that we have are going crazy.  By every statistic that I've seen, in 2023, the number of ransomware attacks were significantly  up compared to 2022, and they look like they're continuing that way in 2024.  Now, with the disruption of LockBit, with the disruption of ALF, and hopefully with  the continued disruption of Scattered Spider, we'll start to see some of that decline.  But the numbers early in 2024 were not great.  So hopefully, as we get further in the year, they'll go down.  And those disruptions are good.  We want more of those.  But we also need to make sure that threat actors are disincentivized from entering ransomware  in the first place.  Right now, threat actors around the world see ransomware as extremely profitable.  Now, part of that is, as far as I can tell, ransomware is the only crime where the bad  guy goes and brags about their attacks.  BEC is probably just as commonplace as ransomware, but the BEC actors are smart.  They don't go and tell everybody how many people they infected, and the victims sure  aren't going to do it.  The ransomware actors brag about all their victims and then make up extra victims just  for the fun of it.  And we are, again, because of you people in the government not sharing information about  reporting, we are forced to rely on the ransomware actors to tell us how many ransomware attacks  there were.  Now, understand, John and the nice people at Google, they have a great data set, but  they're not going to share it with me.  I've asked very nicely.  I know we have people from Palo Alto here.  They have a wonderful data set they also won't share with me, and I've asked them very nicely.  I haven't asked people at CrowdStrike nicely.  They won't share their data with me anyway, because I make fun of their action figures.  And my apologies, CrowdStrike, I don't mean to rant on you, but since you can't ask questions,  you can't fight back.  Make action figures of the people fighting the bad guys, not of the bad guys, please.  All right, let's go to the next slide.  I do like, though, if you all saw the news out of the UK earlier this week, Broken by  the Record, which is an arm of Recorded Future and does great cybersecurity reporting.  The UK is proposing mandatory reporting for ransomware attacks and then a licensing regime  in order to make payments, right?  And this is similar to what IST and the IST's Ransomware Task Force has proposed, which  I don't think goes far enough, but I think it's a really good start.  If you have mandatory reporting, yes, there are some people that are going to try and  avoid reporting and try and get out of it, I totally get it.  But if we start with the assumption that mandatory reporting is the way to go, we can get a better  handle on the number of attacks, and maybe that's a better solution than an outright  ban, but I'd rather start with an outright ban and work our way backwards if that's better.  And then, yeah, thank you, Greg.  And then I know we have some people from Chain Analysis here.  You can see, big, big fan of them, and we at Recorded Future love them.  This is something that actually gives me hope.  Ransomware attacks were out of control last year.  I think everybody agrees on that.  But based on the data that Chain Analysis collects, the number of payments went down.  So we saw a decrease in payments.  So the things that we're doing now are starting to have an impact.  So if we go back to that first slide in Italy, where Italy decided to implement the ban after  the problem was on the decline, that might be the thing that pushes us over the edge.  If we're already seeing a decline in the number of payments, then maybe moving to the  point where we can accelerate that decline by having a ban in place, it will make ransomware  less effective.  Is it going to stop cybercrime?  Are we all going to be forced to retire and buy a farm?  No.  And in fact, most of y'all people shouldn't be on a farm, anywhere near a farm.  I know everybody in cybersecurity thinks they're going to retire and buy a farm.  Farming sucks.  I come from a farming family.  You do not want a farm.  There's a reason why as much as I love wine, I would never buy a vineyard.  I don't want my wine being destroyed because somebody decided to have hail that season.  And so banning ransom payments is an extreme step, but it also might be the least bad option  available to us because nothing else seems to be working right now.  Because, I mean, obviously the right thing to do would be drone strikes against ransomware  actors and everybody better securing their stuff, but we're not going to do either of  those things.  So if we're not going to do that, why don't we go ahead and try banning ransom payments?  Try something because what we're doing right now isn't working.  And again, thank you all very much for your time.  Come by my comic book and tell me why I'm wrong there.  Thank you all.


url: https://www.youtube.com/watch?v=4pHetxWDzEQ
title: Tales from the Crypt(er): The Market and Dynamics That Inform Attribution | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=4pHetxWDzEQ",
    "title": "Tales from the Crypt(er): The Market and Dynamics That Inform Attribution | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresentation by Bavi Sadayappan, Mandiant\nIn a world where security solutions are constantly evolving, so are cybercriminals and their methods. One such method is crypters, a tool designed to spread malware on a mass-scale while remaining undetected.\nBavi Sadayappan, a Senior Threat Analyst from Madiant, offers deep insight into how cybercriminals leverage crypters in their attacks. She discusses the market of crypters, and how their specific business models help analysts enhance their attribution and analysis. Discover the differences between private vs public crypters, and the unique timeline of their advertisement in underground forums.\n\nTimestamps:\n0:00 Introduction/about\n01:02 What is a crypter?\n01:56 Where can I buy a crypter?\n04:58 How can crypters help attribution?\n09:26 Closing remarks",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 592,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   I'm a threat analyst on the financial crime team at Mandiant, and today I want to talk  about something a little less controversial than banning ransomware payment.  What I want to talk about is a group of malware that actors call cryptors.  So I want us to take a second and get into the mindset of your average cybercriminal.  Let's say we're distributing a lot of Redline Stealer or some very common, highly detected  malware.  What's a question that's going to come up over and over again for us?  How can I keep my malware undetected for as long as possible?  And the answer for a lot of cybercriminals is going to be cryptors.  So a good cryptor is going to allow us to distribute fully undetected payloads for at  least a short period of time.  But let's level set really quick.  What do I mean when I say cryptor?  What really is a cryptor?  At a very, very high level, a cryptor is just a builder.  It takes an input, your malware payload, it modifies it using a variety of obfuscation  and encryption mechanisms, and it spits out an output, your cryptid payload.  So the expectation here is that cryptid payload is going to bypass common detection methods  for some period of time.  Cryptid payloads have two main components.  You have your stub and the embedded payload.  So the stub is a piece of code whose responsibility is to decode and execute that embedded payload.  At Mandiant, we track cryptid payloads as droppers.  And today, I'm going to be focusing on publicly available cryptors, and I will not be talking  about commercially available services.  So getting back into that cybercriminal mindset, now that we know the benefits of a cryptor,  the next big question for us is, well, where can I get one?  It's pretty obvious, essentially any underground forum.  But what's interesting about cryptors is that they have seen significant longevity on these  underground forums, which kind of bucks the norm with what we normally see with commonly  used tools and services, which tend to have shorter lifespans.  We've seen ads for cryptors since 2006, and one of the most prominent cryptors right now,  VIP Crypt, has been active for 13 years.  We analyzed dozens and dozens of these advertisements, and what we found is that their business models  fall into two main buckets.  You have self-service and you have managed.  So with the self-service business model, the customer is going to receive access to  that builder.  They're going to be able to encrypt their own payloads at their own speed, as opposed  to managed, where the customer is going to provide the malware to the service provider.  They're going to encrypt it and send it back to you.  The pricing model for these different services, it varies pretty drastically, and it depends  on a variety of different factors.  And the three big ones that we identified are availability of the stub, the timeframe  of your subscription, and whether or not there are any premium offers bundled in.  So as we know, stub is that piece of code that's going to decode and execute your embedded  payload.  There are two main flavors of stub.  You're going to have your private stubs and public stub.  So private, you the customer, the only one who has access to that, as opposed to public,  you and a bunch of other customers have access to that particular stub, so it's more widely  available.  Your encrypted payloads are likely going to get detected a little bit quicker.  So as you can imagine, public stubs, a little cheaper than private stubs.  We also wanted to see what types of malware are being encrypted.  So we identified four major crypters that are publicly available, and we looked for  malware samples that were crypted by them and uploaded to VirusTotal in the past year.  And what we found is that over 40% are information stealers.  But what's kind of interesting is that a quarter of these payloads are, in fact, ransomware.  The vast majority are of this stop ransomware family, also called Deja Vu.  So typically, when we see stop ransomware, it's being distributed using SEO poisoning.  So you're really relying on the victim to download and execute the ransomware themselves.  There's no post-compromise activity.  You don't have a threat actor in the environment able to disable any antivirus software.  So it's really critical when that ransomware hits disk that it's not causing a lot of alerts  to go off.  So it makes sense that we're seeing a lot of that crypted.  And now I want us to now put our analyst hats back on.  So we can delve into why and how understanding crypters can help us with our analysis.  So for us, one of the key aspects that we look for when we're using crypters to support  our analysis is identifying whether the crypter is publicly available or if it's privately  available.  So with publicly available crypters, those are going to be advertised on underground  forums.  You're going to see a lot of different actors crypting a lot of different types of malware.  And so really, it shouldn't play a significant role in your attribution efforts.  Now on the flip side, private crypters are not going to be advertised on underground  forums.  You're typically just going to see one threat cluster or a group of shared trusted partners  using that tool.  So it can suggest relationships between actors.  And it can play a more significant role in attribution.  Now I know it can sometimes be a little bit difficult to map that crypted payload back  to the advertisement.  But there are some great publicly available tools and research on common crypters.  And also, you can kind of make an educated guess in a lot of cases.  So if you're seeing only one or two malware samples in a specific period of time being  crypted by a specific tool, that could suggest private versus if you're seeing a bunch of  different malware family being crypted, that's going to suggest public.  I want to delve into a recent example where we were able to use our understanding of crypters  to understand some new threat activity.  So last month, we came across what at the time we thought was a new Rust-based credential  stealer that we track as Storm Shadow.  While we were doing some analysis, we realized that the earliest versions appeared to have  shown up in around May of 2023.  We noticed that the majority of Storm Shadow payloads that we were seeing were cryptic.  So we mapped out what crypter was used and at what time.  And what we found was kind of interesting.  So from May of 2023 through the end of February 2024, all crypted Storm Shadow payloads used  a publicly available crypter.  The majority of them used VIP Crypt, which we track as Longfall.  And then for a hot second in July 2023, they were testing out, it appeared, MassCrypt,  another popular crypting tool, which we track as Bad Mood.  But then we saw a shift in March of 2024 from publicly available crypters to what we suspect  is a private crypter.  Beginning in March of 2024, all crypted Storm Shadow payloads used a crypter we track as  DryRotv2.  And we've only seen a very small subset of threat actors use this crypter.  We then realized after we had done a bit of analysis that we actually had some more  information about Storm Shadow in our holdings.  Specifically, we had a post from an actor back in May of 2023, seeking crypto partnerships  specifically for Storm Shadow.  And then in July of 2023, they posted a positive review of VIP Crypt saying, this is great.  I've been using it for two months.  So that really aligns with what we were seeing with Storm Shadow being crypted using VIP  Crypt through 2023.  We then took a look at the distribution techniques.  So in 2023, Storm Shadow was being distributed using fairly common tactics.  You know, fake installer websites hosted on Dropbox.  But when we saw that shift from public to private crypter, we also saw an increase in  sophistication of the distribution tactics.  So we saw a newly tracked loader, SSLoad, pushing out Storm Shadow in March of 2024.  And then in April, we saw maldocs that were hosted on the legitimate blockchain support  URL being distributing Storm Shadow.  So what can we infer from this?  We're seeing a shift from public to private crypter at the same time that we're seeing  an increase in sophistication when it comes to distribution tactics.  So one theory that emerged is that the actor associated with Storm Shadow at the beginning  of 2024 partnered up with actor or actors that had access to DryRot V2 and more sophisticated  distribution techniques.  We were only able to come to this assessment because we were able to track and identify  what crypters were being used and because we knew their availability.  That's all the time I have today.  I very quickly want to give a shout out to one of my financial crime teammates whose  incredible technical prowess is the only reason we're able to track crypters to the  granularity.  They know who they are.  So thank you so much and thank you all for listening.


url: https://www.youtube.com/watch?v=i0vPoKc9jG0
title: How eCrime Adversaries Use Legitimate Remote Management Tools | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=i0vPoKc9jG0",
    "title": "How eCrime Adversaries Use Legitimate Remote Management Tools | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresented by Eric Loui\n\nJoin Eric Loui, Principal Intelligence Analyst from CrowdStrike, discuss the increase of threat actors using Remote Management and Monitoring (RMM) tools to administer workstations while evading security controls since 2022.\nIn this talk, Eric will provide information from several case cases discussing the most popular RMM tools used by cybercriminals, and some helpful recommendations for detecting and mitigating abuse of RMM tools. He will go over tools such as AnyDesk, used by big actors such as Scatter Spider, Mangled Spider, Punk Spider, and Bitwise Spider affiliates. He will also cover ConnectWise ScreenConnect, and TeamViewer and NetSupport Manager.\nDiscover more about RMM tools and how actors abuse them, and how you can detect and stop these kinds of attacks!\n\nTimestamps:\n00:16 Introduction/what are RMM tools?\n01:17 RMM incidents on rise\n01:53 Case Studies\n02:05 Scattered Spider\n03:30 Chef Spider\n04:11 Callback phishing campaigns\n05:01 Hunting recommendations\n08:10 Conclusion\n\n\n\n#RMM #RAT #Cybersecurity",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 514,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   My name is Eric. I'm from CrowdStrike. I'm here to talk about how e-crime adversaries  use legitimate remote management tools. Oh, and it actually works. All right, let's start  with a little bit of background on these tools. So what are these? They're sometimes called  remote management and monitoring tools or RMM tools. These are legitimate remote administration  software offered by commercial vendors, and they're used by IT teams, MSSPs, and others  for monitoring endpoints, deploying patches and hotfixes, and troubleshooting issues  that users report. Almost every vendor has a free version that you or I or anyone can  go download from their website, and there are numerous such vendors. I've listed some  of the more common ones on this slide, but as it turned out in my research, there are  many, many other more obscure ones. The key advantage of these tools is not only do they  offer remote administration capability and can be obtained for free, but they're not  blocked by most security software precisely because they are needed by enterprise IT teams  for legitimate business purposes. And it's that lack of prevention and detection that  e-crime actors and other adversaries exploit. In fact, based on Falcon Overwatch telemetry,  we saw a near doubling in incidents involving RMM tools in 2023 as compared with 2022, as  you see on this slide. And this trend has only accelerated into 2024. When last I checked,  we had over 600 incidents so far in 2024. I've listed some of the most commonly seen  RMM tools on this slide, AnyDesk, Atera, Connect by Screen Connect, you're probably all familiar  with, but as I mentioned, there are many other obscure ones that we have seen as well. I'd like to turn now to a couple  different case studies that highlight some examples of e-crime actors using RMM tools.  Let's start with everyone's favorite adversary, Scattered Spider. This is an extraordinarily  aggressive adversary that conducts prolific SMS phishing and phishing campaigns, which  direct users to landing pages to capture authentication credentials, primarily for SSO,  VPN, remote access, and they also socially engineer help desk users to give up those creds.  They can defeat phone-based MFA with SIM swapping and MFA notification fatigue. Once they authenticate  to your environment, they will frequently drop a panoply of RMM tools, including several more  uncommon ones that have listed there on that slide, as you see. One of the interesting ways  that Scattered Spider deploys RMM tools is by compromising the admin panels for legitimate  EDR tools, so they already have credentials, they authenticate to the EDR admin panel, and  basically all EDR tools also offer native remote shell capability, so they can go run shell commands  on whatever system they want to, and they run commands that of course install an RMM tool to  give them additional access. At a more basic level, sometimes they will literally just spin up a web  browser, point it to the vendor website, download the installer, and run the installer, and that  usually works just fine. They've also deployed RMM tools using Microsoft Azure run commands,  which can run shell commands on your VMs or Microsoft Intune. Chef Spider is an interesting  lower volume e-crime adversary. They begin their campaigns by contacting companies via public sales  leader or contact forms. They pretend to be a customer interested in the company's products,  they provide an email address, the company responds to the email believing that they are  engaging with a customer, and then Chef Spider sends an email back to the company with a link  to a page which hosts an installer for Screen Connect, and we've seen these pages deliver  both Windows and macOS installers, likely based on the user agent strings of a browser navigating  to those pages. We've also tracked a series of callback phishing campaigns. This is a popular  tactic that numerous adversaries have used, so the adversary sends an email to you, it says  you have this imminent charge for a TV streaming service or some other internet service,  here's your invoice, the invoice PDF contains a helpful customer service phone number that you  are encouraged to dial if you do not want to pay your imminent charge. When you call the alleged  customer service number, the operators will send you a second email with a link, in this case to  Zoho Assist, which is another RMM tool, and we've seen the adversary use those Zoho Assist sessions  to download yet another RMM tool called Super Ops, as well as the WinSCP utility likely to  exfiltrate data. I'd like to turn now to some recommendations for hunting RMM tools, and while  the examples I provided are specific to some of the most common RMM tools, the principles here  apply to basically any tool. So at a foundational level, it's useful to monitor for artifacts that  are typical of RMM tools. You would be surprised just how many adversaries continue to use default  installer or client names, which typically reference the product itself, right? ScreenConnect,  TeamViewer, AnyDesk.exe, whatever, very similar to that. Even if you expect one or more of these  tools in your environment, you may not expect them to be dropping binaries regularly. So for instance,  AnyDesk, as part of normal operations, will write a file called GCAPI.dll, but other binaries  dropped underneath your AnyDesk process should probably be investigated. Additionally, RMM tools  will typically write artifacts of various sorts to a subdirectory within Program Files, Program Data,  or AppData Roaming. You see some examples there. The naming tends to reference the vendor or product.  From a network perspective, some RMM tools will send a DNS request to a vendor-associated  domain. So for instance, NetSupportManager, when it starts up, typically sends a DNS request  to geo.netsupportsoftware.com. And ScreenConnect almost always connects to a subdomain of the  legitimate official ScreenConnect.com domain, and that's pretty typical even with malicious  uses of ScreenConnect. At a more advanced level, adversaries may rename their client or installer  binaries, change the file path. So simple hunts like on the former slide may not be as useful  in some cases, but you can still monitor for process behavior, that is, artifacts that appear  on the command line. So for instance, you see here, ConnectWise ScreenConnect will typically  launch with a verbose series of parameters, E, Y, H, so on and so forth. And obviously,  the particular values will change, but the presence of those parameters can be useful  for detecting ScreenConnect. ScreenConnect can also run manual shell commands that will typically  manifest as those run.cmd files on the command line. AnyDesk is typically installed with the  install flag and almost always is installed with the silent flag in order to suppress notifications  to users. TeamViewer will often run with the configuration or DRE flags, and TeamViewer's  helper binaries may appear with the action or log parameters. So in conclusion, ECRM adversaries will  almost certainly continue to use legitimate RMM tools in the future due to their potent combination  of remote administration capabilities, ease of availability, again, you can just download them  from any vendor website, and most importantly, evasion of detections and preventions. So in order  to detect them, baseline your network, know what RMM tools you do expect, and then write detections  for both hosts and network artifacts, as well as process behaviors. Thanks so much.  Thank you.


url: https://www.youtube.com/watch?v=6k7jesEDydk
title: Catching the Contagious Interview | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=6k7jesEDydk",
    "title": "Catching the Contagious Interview | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresented by Daniel Gordon\n\nDaniel Gordon, Cyber Threat Intel Analyst and contractor at the Department of Defense Cyber Crime Center, provides listeners with information on the Contagious Interview, a hacking activity suspected to be linked to North Korean (DPRK) IT workers.\n\nLearn more about this operation as Daniel walks us through the mind-map of DPRK hacking groups, and how they utilize IT workers. Gain insights into the attributes of their activities, and how they utilize social engineering to get victims to compromise their own systems like on platforms such as Upwork and Fiverr by distributing malicious repositories.\n\nGain insights on the tools and techniques used by analysts to understand more about this threat, some interesting OPSEC mistakes, and how a recent Phylum report helped attribute the group and their recent evolution.\n\nTimestamps:\n00:00 Introduction/Thanks\n00:36 Background\n01:04 Social engineering\n01:33 Infection chain\n02:14 Intent\n02:48 Crypto tracing\n03:26 More heists\n04:09 Targeting\n04:30 GitHub OpSec\n05:05 Infrastructure\n06:05 Attribution\n06:56 Takeaways",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 456,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   Hi, everyone.  My name is Daniel Gordon.  I'm a contractor to the Department of Defense Cybercrime Center, or DC3.  This is my presentation, Catching the Contagious Interview.  For those who don't know, contagious interview is hacking activity linked to or conducted  by IT workers.  While you chew on that, I want to say thank you to a bunch of folks who have shared information  publicly and privately that contributed to my research, and some of which ended up in  this presentation.  So thank you to folks up here.  So what are IT workers?  North Korea sends thousands of people to various countries around the world.  These people apply for remote jobs in the tech sector.  And North Korea takes up to 90% of their salary to generate hundreds of millions of dollars  for their weapons program.  So if you thought the IRS was bad, try this.  Yeah, anyway.  So what does contagious interview activity look like?  It's social engineering on gig sites like Upwork, Fiverr, Freelancer, LinkedIn, a bunch  of other platforms.  They approach people as IT recruiters.  Hey, do you want this lucrative job?  Do this coding challenge.  They'll send people a malicious repository like the one that you can see on the screen.  And people run it and infect themselves.  The first stage is written in JavaScript.  It's uploaded, the repositories are sometimes sent via Google Drive links.  Sometimes it's uploaded to platforms like GitHub, Bitbucket, GitLab.  It leads to the second stage, so the first stage referred to as Beavertail, second stage  referred to as Invisible Ferret.  Invisible Ferret has two components, one's a browser stealer, the other I'll talk about  a little bit more in a second.  And then finally the third stage, AnyDesk, which you guys heard a bit about in the last  presentation.  So Invisible Ferret has, it looks for files and folders related to cryptocurrency and  also related to software development.  So I thought that looking for software development meant they were trying to steal code to help  them get or keep their IT worker jobs, but somebody in the cryptocurrency sector pointed  out that cryptocurrency developers probably leave wallet addresses, passcodes, private  keys in their software, adversary wants to steal that and use that to steal cryptocurrency.  Any questions before I keep going?  So a victim of this actor was kind enough to post their wallet address in a blog post.  Thank you to that person.  Through the wonders of cryptocurrency tracing, we're able to see this actor laundering funds  through Tornado Cash, which helps support attribution to North Korea.  Tornado Cash is used by lots of other threat actors, but the North Koreans love it.  So we also see funds intermingled with funds stolen from a cryptocurrency project known  as Mural.  The Mural heist was linked to a bunch of other major heists, I say major by my standards  anyway.  So they include Serenity Shield, Cloud AI, Concentric Fi, several others.  This puts the totals for money stolen by this actor in the millions of dollars, which is  millions more than I expected them to be able to steal because their offset is terrible  and they're not great at social engineering.  But the cryptocurrency sector is like a lot of other sectors.  Some organizations have more resources than others for security.  So they're targeting, obviously, the cryptocurrency sector.  A lot of their GitHub projects have blockchain themes.  Some of them are focused on tech vertical and obviously AI because everything has to  have AI now.  But folks will open issues against their GitHub repository saying, hey, do not execute this,  is malware, or hey, there's malicious code in line 123, you should probably do something  about that.  And one of the things that makes me think that this is IT workers and not a real, real  cyber threat actor is that they don't take down the repository, they don't change anything  about their code, they don't do anything other than close the issue and move on with  their day.  So yeah, they don't change their code much, and as a result, we were able to write a malware  config parser for their malware family.  A malware config parser is an open source framework, and it allows you to write in Python  code against, you know, a malware sample that you're looking at.  You can use that code to automatically pull out whatever you're interested in.  So if you want C2 at information, like these port numbers that this adversary uses all  the time, or if you want an XOR key, you want sub files, we've written malware config parsers  for all these situations, and it lets you analyze malware rapidly at scale, which is  really important if your actor is operating at scale, as you all are aware.  This actor also has very clear preferences for their infrastructure.  As you can see, they will register all their IP addresses with the same hosting provider.  It's one of a number of things that makes tracking their infrastructure really easy.  When it comes to attribution, these are all circumstantial attribution data points.  They help paint a picture of a North Korean threat actor.  These are all things that we associate with North Korean threat actors on their own.  These would not be good enough for attribution.  Taken together, they do help suggest attribution to North Korea.  The real attribution data point, though, is there are multiple instances where contagious  interview GitHub repositories or accounts are connected to IT worker GitHub repositories  or accounts.  I42 highlighted this in their blog, where they named this threat actor, but we've seen  it as well, and so have other people in this field.  So what are the takeaways on my presentation?  Contagious interview consists of hacking activity conducted by or linked to North Korean IT  workers.  They use gig platforms and malicious software packages to infect their victims.  Their intent is stealing cryptocurrency.  Maybe they have other goals as well, but I've seen them stealing cryptocurrency.  They've been active since at least December of 22, and they are active as of today, so  now.  This is an ongoing campaign.


url: https://www.youtube.com/watch?v=kk6Uvo46k78
title: Certified Evil | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=kk6Uvo46k78",
    "title": "Certified Evil | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresented by Jason Killam \n\nLearn more about signed malware such as Lumma and SolarMarker/Yellow Cockatoo in this talk by Jason Killam, Senior Detection Engineer at Red Canary. Discover the process of acquiring signed certificates from trusted sources such as SSL.com and how it establishes trust and prevents security warnings, and how much revoking them can disrupt these malicious activities.\n\nAdditionally, Jason provides practical guidance on the revocation process, and even shares tools to do so on GitHub. github.com/killamjr\n\nTimestamps:\n00:30 How code-signing certs work\n01:01 Types/costs of code-signing certifications\n01:37 Example with Vidar\n02:31 Anatomy of code-signing certification\n04:00 Investigation and inconsistencies\n06:08 Example with Yellow Cuckatoo\n07:13 Call to action\n08:15 How to revoke\n09:21 Conclusion",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 574,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   So, my name is Jason Killam, I'm a detection engineer for Red Canary, and I'm going to  talk about malicious sign code and why we need to revoke these and how this helps everybody.  So this is kind of a sequel, and Scooby-Doo helped me with some of the information and  research and context for this slide, so a lot of thanks to him for helping me with this.  Sort of a sequel to that.  Basically, for code signing certificates, you purchase a key from a certificate  signer like SSL.com, Satigo, those kind of places, and this kind of gives you a level  of trust with your binary. This usually prevents, a code signing certificate prevents the smart  screens pop-ups and the warning from Microsoft saying, hey, this is some untrusted stuff,  you sure you want to run this kind of thing. Next slide.  So, for EV certificates, I thought about leaving this out, but the reason I want to include  the cost for these certificates, if it's a standard cert, it's $300 to $500, and if it's  an EV cert, it actually costs $1,500 to $3,000, so these guys have to make these fake shell  companies and all this stuff, all this work that goes into this, and they have to pay this money,  and then they have to charge somebody else, you know, to sell the certificate on, so all this,  if we can revoke these certificates, cost them actual money, and this is the actual dollar  figures that are costing this stuff. Hit it. So, this is my first example. This is a stealer  called Vidar. On the left is our bad one in red, and you can kind of see it's got some generic  information about it. I think monkey soft is the name in that one. It's a downloader. It was  actually pretending to be an installer for a piece of software called Notion, which I think is like  a home automation kind of software thing, and on the bottom, you can see the signer. This is all,  most of my screenshots are from VirusTotal, so this is kind of where I usually go to when I'm  looking at a binary, so your signer here in this case is AndresDS, and on the right, you've got  your legitimate binary, which is not directly related, but it's a better example of a good  binary is MSBuild from Microsoft, so it has the metadata that tells you it's MSBuild. It's  specific about what it is. It has a pretty good, it's signed by Microsoft, so it has that in the  name. Hit it. So, for a code signing certificate, you have your name, so this is like the friendly  name you kind of use to identify who signed the code, who made the code, who's the developer for  it, so, and then you have your certificate authority, so in this case, it, I think it's  Cictego. Actually, this is one reason I used, for the previous example, I used MSBuild because the  malicious binary is also signed, then the legitimate signer for Notion are both Cictego,  so it was really actually smart on the actor to choose something that also is from Cictego, so  it's harder to compare apples to apples with those, and then you have your valid to from cert  date window, and then your certificate thumbprint, so the valid to from is kind of helpful if you're  trying to establish a timeline of events. If you find a malicious binary on the box, and the to  from cert is recent, then you know it's a recent binary if you don't have that kind of historical  context, so I used to do a lot of incident response, and it's nice to have those timelines,  and then the thumbprint, that's the thing you want to focus on when you're trying to get this  stuff revoked, that's at the bottom, and the serial number, something I work with Matt Graber,  and he pointed out something interesting is you can spoof one of these, and I don't remember which,  and I should remember that, but you can't spoof the other, so I think it's the thumbprint is  spoofable, so they're both important, and they both individually identify it, but I think focus  on the serial number for this. Next. So, like I said, these are kind of inconsistencies with your  kind of malicious stuff on the left is the bad one, it's a usually really short timeline from  creation to being seen in the wild, so for virus total, like on this timeline, you have your  creation time, your signature date, first seen in the wild, I'm not going to talk about that,  because it's confusing as hell, because like virus total doesn't make any sense, it's like  shows MS build like a year before it was created, which doesn't make sense, but anyways, first  submission, all those last three are specific to virus total, when it was first uploaded, the last  time it was uploaded, and whenever, like if you're in virus total, and you say rerun this binary,  that's the last analysis date. So, yeah, so like with my MS build example, you got like  a much longer timeline of activity, so it gives that sign binary more credence that it's probably  legitimate, because if it was bad, it probably would have been revoked by now, but I've seen  examples where stuff sits on its valid signers for a long time. Next. So, this is kind of a  screen shot from this binary on an actual box, and you can see it kind of does a couple things,  this binary is called notion updater.exe, but like I showed before, it's just really generic,  so they can package it as whatever piece of software they want to pretend to be, but you see  it hits, and you guys are familiar with Vidar, it usually talks to telegram and steam, and I know in  the steam community example, it actually, you go to the URL it goes to, and it's the  profile picture is just an IP address, so you're like, oh, that's kind of a weird name to choose,  but whatever, but then that points it to the next, the actual C2 to send the data, so that the  stealer developer, whoever's pushing this out, can change that whenever they want. So, yeah,  whenever you're looking at binaries like this, it's, for me, when I'm doing analysis, because  I'm doing that kind of analyst work, I kind of think, why would a binary for an installer for  home software be talking to steam or telegram and this other stuff, and what's this random IP  address it's connecting to as opposed to an actual domain, hit it. So, our next example is yellow  cockatoo, it's kind of one we see a lot as well, and it's kind of in the wild a lot, it's off,  they kind of come and go, but on the left, you got your signer information, in this case,  it's heart craft brewery, so it's kind of weird that a place that makes beer would be making  software for that PDF icon, and on the right is, yeah, like our timeline here, again, it's a very  short timeline, I pretty much took this maybe probably the last analysis date, I can't quite  see it from here, but it's only a couple days, so it's pretty obvious if there's some weirdness  going on here, and this binary just got put in the wild, so, yep, next. So, yeah, if you just  Google it, like, I find a lot of stuff, a lot of the times, I'm kind of in Intel, but not in Intel,  but, like, I'm really good at Intel when it's on Google, so, if you just Google the heart craft  brewery, you find this Twitter post from squiggly do, and it actually shows, hey, this is kind of  weird that a brewery is signing a binary, and, yeah, next. So, call to action, like I said,  I have a good example here, Russian panda, I can't remember where she works, but I think it's ESET,  but she revoked, her team revoked the certificates for defact loader, which is a really hard  malware name to pronounce, but the developer had to basically pay everybody back, because their  certs were revoked, and that's the English translation, because it was all in Russian,  and you've got some links here, those are just some examples for SSL.com and Sectigo,  for Sectigo, you have to send it to an email, for SSL.com, they have an actual web form you fill out,  and, yeah, and they'll usually rely on, like, malware repositories, and stuff like that,  and squiggly do has a tool on GitHub that you can just give it the hash, you don't have to download  it or have the file, you just have to have the hash, you just provide it the hash, it will pull  down all the information about it, and basically make you an email that you can send to them,  and give you the instructions on how to get that cert revoked. Next. So, yeah, so, if you're going  to revoke these certs, the things you need to include, a name and email, just contact info,  those will usually help them if they're not sure why it needs to be revoked, some stuff like  non-binaries, like MSIX files, and malicious signed JavaScript is a little harder to explain to them,  because the certificate's not readily visible if you search virus huddle, and then the certificate  thumbprint serial, and then the reason why, and I usually kind of, sometimes you have to get really  specific about it, like I said, if it's on malware bazaar and it's really obvious it's bad,  they'll probably just revoke it, in some examples you might have to explain the attack chain and  how it works so that maybe they can replicate it or something on their end, and providing all that  information up front will shorten that time to revocation, I think with the example of MSIX  files, if the cert is revoked, that installer will not work, period, so it really screws up their day.  Next. Yep, that's it. My slides will be on GitHub, but the Wi-Fi here has been kind of spotty,  so I haven't had time to upload them.


url: https://www.youtube.com/watch?v=KBI1TqIqxzI
title: The Untold Stories of Bassterlord’s Manuals | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=KBI1TqIqxzI",
    "title": "The Untold Stories of Bassterlord\u2019s Manuals | SLEUTHCON 2024",
    "description": "Carlos Borges, an intel analyst from Intel 471, joins us at Sleuthcon 2024 all the way from Brazil to discuss a cybercriminal who has made waves within the cybercrime world, who has ties to LockBit and is training others to follow in his footsteps; Bassterlord.\n\nCarlos unveils Bassterlord\u2019s timeline within his talk, tracking his activity in chronological order since 2016, providing exclusive highlights into the content of his manuals, and discusses how the US Dept. of Treasury exposed him and his links to LockBit. Through his talk, Carlos provides case studies and explanations of the criminal\u2019s methods in action, and examines the hackers online identities as well. \n\nCarlos also provides new information concerning the appearance of a new persona and new manual that focuses on exploiting corporate targets.\n\n@intel471_Inc \n\nTimestamps:\n0:18 Agenda\n1:08 Operation Cronos Intro\n2:12 Intro to Bassterlord\n2:47 Timeline\n9:48 First interview\n12:51 First manual published\n15:00 Updated manual published\n17:17 Second manual published\n21:12 Overview of manuals\n27:19 New personas\n28:30 Bonus manual",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 1791,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   I'm Carlos Borges. I'm from Brazil. I came straight from, you know, South America just  for this event. And I'm an Intel analyst for Intel 471. Today, we'll speak... Let me see  if I can turn... Oh! Thank you! So, today we will talk about Basil Lord and the manuals  he crafted during his... The latest years to teach novice actors in getting into brain  server operations. So, the agenda today is not exactly linear, as you can see, but we  will cover some things like key events that led the actor to the publication and crafting  of those manuals. We will make an overview of those manuals to understand some interesting  and key concepts that he introduced there. We have a big timeline to cover. We will provide  some link analysis and crypto overview. I will disclose a few additional personas which  are not public, and we will talk about TTPs. Let's move it on. So, yes, this presentation  is a lot... Was a lot motivated by, you know, Operation Crumbs in February. One of the good  outcomes of the operation is that the US Department of Treasure announced two Russian  nationals and disclosed their identity and links with the LockBit gang. One of them is  Artur Sengetov, and the other one is, of course, our objective here, Ivan Kondratiev, aka Bastard  Lord. So, this is a big timeline to cover. Don't worry much about it. I will walk you  through some of the key events, so you can see, like, on the bottom right side, we are  on the end of the timeline, see about Operation Crumbs and the disclosure of his persona.  However, we will take a look, you know, like since 2016. So, Bastard Lord, just a quick  introduction. So, he's an initial access broker. He's a reputable hands-on operation. He was  also a malware spammer. Those are a few of the public handles he used, so we have the  National Hazard Agents, which is a handle he used but also a reference to a cybercrack  game, The Actor Assemble. There's a Bastard Lord with one S, Fishy Eye, Buster, Alexo,  and Seener. Let's start with our timeline. According, you know, The Actor claimed this  in a lot of different sources which will be covered throughout the presentation. He said  that he started engaging in cybercrime between 2016 and 2018. At the time, he was engaging  with certain optimization, carding, and hacking websites. Then he got into 2019, The Actor  joined the XSS forum, and there he was already engaging with malware spamming campaigns.  By the end of that year, like the fourth quarter of 2019, The Actor joined Lelartus, I guess  as most of you know he's a reputable affiliate, and Lelartus was a sort of mentor who teached  Bastard Lord a lot of hands-on operations. I can't see exactly the timeline here, but  I believe that we are now in 2020 on the first month, so, yes, June 2020. There's a very  interesting major event, I guess, for Bastard Lord which is the participation on this summer  article contest promoted by the LockBeat gang in partnership with the XSS administrators.  The idea behind this was that the LockBeat gang paid a prize for the best articles, most  interesting articles related to cybersecurity and cybercrime, but that could support hands-on  operations. Bastard Lord participated in that, created a thread, and on that thread, he disclosed  some of his background, some details of the initially first rich organisations, and his  experience of exploiting the CV 2019, 11.5.10, which basically targets secure VPNs. It was  his first public appearance that draws more attention for us researchers. It looked like  the actor enjoyed the attention received, and the same month, he published this spamming tutorial.  On this spamming tutorial, he spoke about a lot of, it was a very detailed tutorial,  and he spoke about tools he used and abused, like AMS Enterprise, the use of Xlead 2 underground  to get access and purchase access to compromised SMTP service, and the LTSpace product which is  a legitimate service for proxies, so the idea would be to hide the origins of the malware  campaigns. The thing is that, on that tutorial, he put that screenshot at the right side, and he  disclosed the user name on the service. So, this is like our first moniker likely operated by the  actor. So, we identified a profile on hacker forums which matches the same activity demonstrated  by the actor in reference to malware spamming operations. We also identified some other leads,  but that still needs double sourcing, so I will not disclose here, but this should be basically  like Discord accounts and similar communication channels. Moving on. He published a second  tutorial, but I don't call that exactly a tutorial, because that's basically a 10-minute video  illustrating him breaching an organisation. So, the whole process was recorded, and he posted that  explaining some of the steps. On that video, we can cite things like initial access via compromised  QSecure VPN, the use of the soft perfect which the actor enjoys a lot and you can see that very  often, lateral movement, and privilege escalation. The most interesting thing here is that  this video is a precursor to the publication of the manual which will occur like one year later  in August 2021, so many of those things that we can see on the first manual were actually  demonstrated on this video. I won't play the video here to not expose the victim organisation,  but I took a few screenshots of the main, I would say, events from the video. So, on this one,  the actor was accessing the company with the compromised QSecure VPN accounts. This is his  machine, his VPS machine. A lot of folders and files he was operating. Once he got access to the  VPN network, he started running soft perfect. He makes a really simple recon to identify  the network on the VPN connection he got, and he uses the same credentials to log on the VPN  to perform an authenticated scan with soft perfect. With that information, with that setup,  he already could identify machines accessible to that VPN network that he could access with  those credentials. This is what you are seeing in the screenshot. So, once he finds a good target  for him, he performs lateral movement via RDP there, and he dumps the process. He exfiltrates  that file to his machine and imports that into Mimikatz. From there, the actor can get access to  plain text credentials, and he uses that to make a new authenticated scan with more elevated  credentials, and he also uses an interesting feature from network perfect scanner to import  all the machines from active directory. So, basically, he starts poking every machine on the  network with those more elevated credentials. So, this is the results. This is basically what we're  seeing here are more accessible machines. The actor kind of highlights the machines with more  disk space which would mean they are good targets for Hanksworth to lock. And the video ends.  Okay, so, moving on. During that time, the actor draws attention from Lockbit,  and he receives an invite to join the programme. We also identify some good evidence  of him working as an initial access broker for Avedon during that same period.  Moving on timeline. On February 2021, the actor provided an interview to the actor  Yashichka. I usually say that. I'm not sure what is correct.  They apparently developed a good relationship, and one thing worth mentioning is that  Yashichka was a translator of cybersecurity articles within the XSS board.  On that interview, the actor provided a few details of his personal life. He claimed to  operate as an affiliate for this Hanksworth programme, Lockbit, and Avedon, and he was heavily  criticised by several members of the XSS, especially due to the public attention we received,  and most of them called it a mediocre ransom operation due to some basic techniques.  He claimed at the time to operate in only a few underground forums, like one and two,  maybe XSS only, you know. However, this is a simplified version, and link analysis we made,  and I would highlight this simplified version if we have more, of some of those handles he used.  So, starting with Bastelord on the XSS, we just make a connection where he was using a  Telegram account linked to Siener, which is a handle that became public in February.  So Bastelord shared that Jabber account below, and that same Jabber account was also used  on Raider forums and the Exploit forums. On Exploit, he was using the handle editor which  is a reference, a possible reference that the actor was working with web designer before,  you know, getting into cybercrime. This was his claim. And here we have an assessment. So,  that editor account posted a very specific victim on the forum, and, like, one or two days later,  the account March Machico also posted the exact same victim. We can theorise a bit about that.  You could perform some ACH, but, you know, that should be probably one of the affiliates of his,  and we could theorise about that. However, we also identified the March Machico Gmail account,  which was used to register the editor account on Raid forum. So, we have a very interesting link  with a null handle he was also using. So, yeah. Moving on.  August 2021, he publishes the first manual. It had six pages, and, as I said, it reflects much  of the actor's underground activities. Some initial insights that we provide are a few  underground services the actor mentioned on that manual. So, the first one is mass scan online  to discover targets. It has similar functions to show them, for instance. The host bulletproofing  provider, and crack which is basically a database of cracked passwords. So, whenever the actor got  a hashed password, he could just drop that into the service to see if the actors had that  cracked it into the database. The first manual also included a set of tools delivered together  with the manual. On that, I mean, there's a few tools. I can explain those tools later for whoever  is interested. I wasn't planning to detail those, but just so everyone is aware. So, the manual  basically said things about gaining access, how to gain access to companies, escalating privilege,  performing lateral movement, and identification of good targets to lock within the network.  There was no details about data exfiltration or extortion tactics on those manuals,  and I will provide a more summarized overview once we also cover the second manual. So,  on the next slides, we will get into it and get more details of the manuals together, I would say.  Moving on to the timeline. We are now in November 2021.  And the actor posted a comment on XSS saying that he would retire from hands-on operations.  His account was voluntarily banned from the forum. However, he kept operating on the forum  under the fisheye handle, and there he disclosed an affiliation with AlphaV  after he was criticized in some aspects of their operation.  One interesting thing is that there was an updated version of the first manual.  This updated version was created about March 2022, and that included two, sorry,  five additional pages. So, the content included things like some comments about the war between  Russia and Ukraine, some information he got into cryptocurrency trading,  and he said some things about some public research made analyzing the first manual.  It also included a new quick tutorial exploiting Blue Keep to get access in vulnerable RDP machines.  The interesting link here is that he was using a custom tool. That tool was developed by the actor  Playbit, who is a reputable and well-known actor for developing, I would say, one-day  vulnerabilities, too. So, whenever, you know, a new vulnerability is disclosed, the actor  kind of develops the tools and starts selling them on the ground. He was a lot well-versed  with operational system vulnerabilities. So, Blue Keep was one of his targets.  On that manual, on the last additional page, he also made some appraisals to a few  actors, which is interesting. They collaborated somehow to the content included on those manuals.  So, you can see, like, TMT, Lalarto, which is a reference to Wazawaka,  also supporting. Wazawaka probably was credited for this due to some collaborations with VMware  Breaching. There is also the actor Satyr and Marmalade Kinate.  Moving on on timeline. It is December 2022, and the actor starts offering the second manual for  $10,000. This manual was 24 pages and included additional methods to gain initial access,  privileges, and reach technologies. Some interesting thing that occurred in both manuals  is that the actor always included screenshots taken from real victims, and the presence of the  password is, like, everywhere. So, there's an interesting link. In May 2023, he leaked a  redacted version of that manual after some online conflicts he had with Prudapt. However, he also  got access to the redacted version, and, you know, we understood why he leaked that redacted version,  because there was a lot of information about the breached victims, and some of those with  high profile, like providers for big government entities and billion-dollar companies. So,  there were things like VPN credentials used to get access into that.  On the latest pages, it included two cryptocurrency addresses, one operated by  Bacelor, and another operated by Yashicheco. Here, I have some interesting crypto links that  I included. They are very basic. There is a lot of other correlated addresses, so this is just  a simplification. So, at the centre, there is the address included on the manual, and, you know,  I said, in December, he started selling the manuals. At the same period, we observed a lot of  transactions of about $10,000, which means, you know, those are potential buyers.  Most of the money he got from that address was sent to KuCoin exchange.  In September, like two months before he disclosed this address, national hazard agents,  no, his hacking group, they breached an organisation in Chile, and there was a handsome  note that included the address at the right side. There was a transaction flowing and, you know,  going to the address he operated linked to the manuals. There is another link from a real breach  with an address the actor shared within the manual. Another interesting link, so I mentioned  there was a good connection of him with Yashicheco, and there was some interactions with them in the  forum where he claimed to make a transfer to support Yashicheco with some medical care,  and that transaction was of about $80,500, and, analysing the transaction, we see that  that amount originated from KuCoin exchange, which, you know, is another good lead that he  operated an account at. So, those, you know, the first quarter of 2023 was some busy months  to Bastelord, so, at the time, he provided interviews to the record and Analyst One.  He claimed to return to the Lockbit as a service programme, and he announced a new retirement.  However, as the first time, he also kept operating with Hangstar operations, so you see a trend here,  right? So, let's take a look on the manuals. So, this is just an overview of the tools the actor  is using. So, we can see there the use of some of the tools that I mentioned above, like  Bazelon scan. However, checking the main techniques he used to gain initial action in those  organisations, we can say that most of that was related to the actor brute-forcing corporate VPNs  using Blue Keep and exploiting vulnerable corporate VPNs, you know, with vulnerabilities,  of course. Once he got access to an organisation, he spawns a software-perfect network scanner,  and from there, he starts looking for targets. What kind of targets those were? Many, of course,  most of the techniques within the manuals speak about escalating privileges to domain controllers.  So, you can see there's like the notepad vulnerability, but he also used a lot of  common red-team techniques, like a ASP-wrapped roasting. He also used the tools to identify  domain accounts, you know, through the authentication protocol, and used the legend  to conduct those brute-force account attacks.  His objectives here was always try, it's common, right? So, I need to get elevated credentials,  I need to dump any TDS database, I need to dump the process. This is kind of a common  procedure that we see in the text. Once he got access to those elevated credentials, he performs  a new scan with that. And then he finds the targets and tries to log them. There was a very  indirect reference. He didn't, he was not very explicit about it, but there was a section within  the manuals where he said, oh, how can you run a file in a remote machine, which is a reference to  how to deploy a hangs or to a remote machine, and he did that to PSZAC.  So, some things that I can provide looking at those manuals is that they leverages  effective and fast manuals. That's what he's always looking for. The most effective and  fast methods. One interesting thing is that actors look on these manuals as a method to  learn about hands-free operations, and we, as defenders, I mean, organisations should also  take a look at those manuals, and, you know, interpret them as a good strategy to fight  hangsware attacks. So, those, as Will Thomas said to me, those are templated attacks. I like that  definition. So, this could be some good guides for us to protect against it.  I will take a quick, I will do a quick mention to a section on the manuals where he speaks about  how they attack VMware technologies, which is the content from this slide. So, first, imagine  they got a domain account with elevated access. So, in many organisations, VMware re-centre,  which is a centralised interface that you can control virtualised machines, in most,  not most, in many organisations, VMware re-centre might be communicating with the domain,  so, in that case, the actor will try to use those credentials, log into VMware re-centre,  and verify if VMware ESX, which is the hypervisor where the virtual disks are,  is also connected to the domain. If that's not the case, what the actor does, so this is the idea for  the slides, he created a ESX admins global group and inserts an account on that group. He accesses  VMware re-centre. Remember, it's not linked, VMware re-centre, actually, ESX is not linked to the  domain, so he forces that connection to the domain. So now he can use that account,  a link with the ESX admins group, to log into VMware ESX, and from that, he now has an option  to change the VMware ESX root account password. This allows him to log into VMware ESX via SSH,  and from that, he can control the virtual disk as he wishes. This is interesting. Those are  template attacks, but, however, they're still effective, and you can still learn some interesting  techniques from that. I say that because I have seen only like two or three reports mentioning  these techniques by Hanksware operators, and there was a nice report from Sophos, if I'm not wrong,  where they mentioned the Akira, a Hanksware group, also used a similar technique.  However, these open-source reports usually didn't provide further context  on why the actors did that, so, you know, you can have some general idea of it.  We are on the last stages of our timeline. So, what do you got now? That is possibly,  and I emphasise possibly, a personal operating account with the Brat's Lab username.  That account was also present on the Ramp forums, Hensel forums, and XSS. There are some good leads  that this account might be operated by Bicelor, such as he posted a screenshot from the Fisheye  web comics, which the guy's a fan, there are arts to the manuals, you know.  In December, he posted a screenshot of the ALFV Taino during that disruption operation as a proof  that he still got access to that, that it was still working. He posted a lot of comments  to researchers indicating and giving hints that he could be Bicelor. However,  seeing that occurring, that account posted a comment saying, you're saying I'm not Bicelor.  And we have a bonus. So, we are getting to the end of the presentation, and just last month,  a new persona arrived on the forum using the Mason handle. That account offered a third version of  the manual. The actor Mason claimed affiliation with Bicelor. He didn't say he was Bicelor.  And the content that I can anticipate in providing you here for this new manual is that it is heavily  focused in identifying targets. I mean, using, like, corporate email addresses,  linking that with potential targets, identifying VPN corporate portals, link it with, you know,  the domains from that email addresses, things like that. And he's probably also using some  underground tools to conduct brute force count attacks. So, this is what this new manual is  about. Okay? And, you know, I can always provide further context. We have plenty of additional  details on almost every slide. So, whoever is interested, just reach out. Thank you.


url: https://www.youtube.com/watch?v=09dzW_k4j60
title: Xakep, Repa, Probiv, Spy | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=09dzW_k4j60",
    "title": "Xakep, Repa, Probiv, Spy | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresented by Will Thomas\n\nWill Thomas is a Cyber Threat Intelligence Researcher and Threat Hunter from Equinix, sharing his lessons learned from studying the unique dynamics between the Russian government and the underground world of Russian speakers.\n\nTune into this talk to learn about the intricate relationship of cybercriminals and state intelligence services, and Russia\u2019s position as a hub for cybercrime campaigns. The combination of the low-income failing economy of Russia and their seemingly permissive stance on such activity, makes cybercrime a promising path for many.\n\nWill provides a comprehensive exploration of Russia\u2019s cybercrime ecosystem, unspoken agreements between criminals and the state, and the case studies that highlight the complexities of this intersection, and what implications it has on global cybersecurity. Through giving this talk he hopes to be able to help analysts and cybersecurity professionals to think deeper about intrusions, mitigate biases, and reshape the way we make connections.\n\nTimestamps:\n0:00 Introduction/about\n00:47 Aim of the talk\n01:22 Russia's long relationship with cybercrime\n04:06 Cybercrime and Russia intelligence services\n08:13 Case study (FSB and Andromeda Botnet)\n09:06 FSB and The DaVinci Group\n11:14 SVR and Infostealer Malware\n12:19 SVR's vs. OSTs\n14:03 GRU's Cybercrime Botnet/Crimeware/Forums\n17:45 Cybercriminals targeting Ukraine\n18:24 Current ransom war\n18:48 Russian arrests \n20:41 Conclusions\n21:55 Further reading",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 1349,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   I'm super glad to be here, thanks to John, thanks to the organizers for bringing me over  and this is a conference I've always wanted to attend and very glad to be here as a speaker.  So I'm here to talk about a little bit of the connections between the cybercrime underground  and the Russian intelligence services.  Something a topic I'm sure everyone's kind of thought about and I kind of took a bit  of a deep dive and shared my thoughts on it.  So the title of the talk is SACA, REPA, probe of spy and breaking that down it's the hacker  reputation, look up services and spy services as well.  So thinking of the GRU, FSB and SVR, the traditional ones there.  So the aim of my talk is to basically help you think more deeply about the intrusions  that you analyze and basically help you make connections between the types of things when  you're looking at basically makes you want to think more deeply about the types of things  you're investigating and try to mitigate some of your biases and try and basically rethink  the ways that you've been doing things as well.  So why does most cybercrime come from Russia, you may ask?  So Russia actually has one of the largest and oldest cybercrime undergrounds if you  compare it to any other country and the interesting thing is they actually have a community of  very technical people and with a brutally low salary and a sort of a slowing and aging  economy which is becoming ever increasingly isolationist, people tend to turn to making  monies in different ways.  So that's definitely one of the main reasons but we're going to dive into some more as  well.  The other interesting thing is the fact of this old unwritten rule of cybercrime.  The fact that you can analyze pieces of malware and you can see them performing system language  checks, you know, for example, the R-Evil ransomware group, you can actually see which  countries the malware doesn't execute in and it's a pretty telltale sign of the fact they  have these kind of tacit agreements between them and the country, the law enforcement  and officials of the country they reside in.  So the other interesting thing is the fact that Russia essentially permits cybercrime.  Any time there's any opportunity for countries to come together and collaborate on tackling  these issues, which do actually impact Russia themselves, they basically always turn their  back on the rest of the world.  They had the Budapest Convention many years ago and they basically decided to not take  part in that because it violates their national sovereignty, which is kind of depressing if  you can imagine you have all the international law enforcement agencies contacting Russian  law enforcement asking for details and information and they're never allowed to really provide  anything.  And if you actually think of some examples of if people actually go out of their way  and risk their necks to share information, such as CEOs of some cybersecurity companies,  they do actually get arrested and thrown in jail for even trying.  So definitely shutting that down.  Another example of how Russia permits cybercrime, an interesting study that the University of  Oxford did in the UK, they actually analysed five different types of cybercrime and they  put it into categories of which is the most common and which is the most prevalent from  each country.  And to nobody's surprise, Russia is number one, as they are in many of these types of  research studies and things.  But this is a first time, a world first cybercrime index that Oxford put together.  I mean, interestingly, Ukraine's second as well, probably because they're so close to  Russia.  But yeah, I'm sure the Ukrainian cyber police are starting to chip away at that statistic  as well.  You can also see by the fact there's so many Russians on the FBI Cyber Most Wanted list  that there is kind of a habit of the fact that there's no denying that Russia is the  global hub or the epicentre of cybercrime.  And I'm sure there's many cybercrime groups there that you recognise and have investigated  yourselves.  One group that I was pretty intimate with several years ago was Zareepul.  I did an episode of a little podcast known as Darknet Diaries on that one.  But it's definitely fascinating to then examine the links between these organised cybercrime  groups making millions of dollars and the Russian intelligence services themselves.  So as we actually explore how deep cybercrime runs in Russia, you can even see the fact  that you have darknet market, darknet drug markets and credential markets and things  running advertising billboards in the streets of Moscow.  So it's pretty, you know, a cyberpunk type of dystopian reality when you see cybercriminals  basically running your city advertising spaces.  And then there's also the famous Evil Corp videos that the NCA shared before of Lamborghinis  and things drifting around Moscow.  It just goes to show they're laughing in everyone's faces about how powerful and how untouchable  they are, unfortunately.  And then, of course, you have our evil, which was sharing pics on Instagram of them staying  on luxury hotels and things, living it up in a very extravagant lifestyle.  But the other thing I really wanted to touch on today, which I think I've not really seen  much research else onto it, is the fact that each Russian intelligence service interacts  with the cybercrime underground differently from each other.  So the GRU, the sort of military intelligence, interacts differently from the other two by  a lot of the time they like to use crimeware for their own operations.  They're not so much recruiting cybercriminals as much as they are taking and buying malware  and buying other types of services and things from the cybercrime underground and leveraging  it for their own campaigns.  And the other interesting thing is because of, you know, obviously you have plausible  deniability.  If you're an intrusion analyst and you detect some sort of run of the mill cybercrime piece  of malware on an endpoint, you may dismiss it as a nation state to detect.  So obviously it makes sense for them to try and muddy the waters and make attribution  harder.  But I mean, as a community, as everyone in this room, I'm sure we can see through some  of that ourselves as well.  The FSB is an interesting one as well because they interact with the cybercrime underground  differently from the GRU.  They tend to kind of recruit cybercriminals and work with them on joint operations into  some regard.  They basically are fully aware of which cybercriminals are active and figure out how they can leverage  their capabilities and infrastructure for their own goals.  If you analyze and think about some of the past campaigns of the Yahoo hack several years  ago, you know, there was a case where access and things were gained potentially by cybercriminals  and then offered to the intelligence services and then basically in return for, you know,  they can continue their campaigns, basically, you know, the old tap on the shoulder.  And the other interesting thing is the fact that the FSB is the agency that is responsible  for sort of internal affairs and state security.  So they are the ones who are most likely to be aware of which cybercriminals are active  and which are the ones they should take down.  If you think, cast your minds back to the Areval arrest in January 2022.  And the last agency that I wanted to bring up was the Foreign Intelligence Agency, the  SVR.  And they are probably largely considered one of the most advanced, sophisticated groups  that breach all sorts of important technology companies.  But they actually not so much interact with cybercriminals directly, but they kind of  are more patient and they observe what's going on in the cyber underground and figure out  how they can leverage those things to their own advantage without directly interacting  with it themselves.  So a case study is back in, I believe it was September 2022, they had TURLA, one of the  infamous FSB Centre 16 groups, they have been active for several decades at this point.  They were a very interesting research produced by Mandiant was the fact that they were able  to detect USB malware infections inside certain organisations and basically registered the  domains, the expired C2 domains and regained access that way by tracking these cybercriminal  malware botnets.  Which is pretty concerning if you consider how prolific and how widespread these malware  botnets are.  This would basically happen at any time.  You may consider generic 10-year-old USB malware not really much of a threat, but if you're  a high priority, high value target, basically you can't discount anything as being a threat.  Another interesting thing is, this is where the probiv side of it comes into, is the fact  that Russia is a pretty corrupt society and the fact that if you have the money, you can  pay someone who knows someone who knows someone to get you access to some sort of information.  That can be mobile carrier information, that can be telegram account ownership, that can  be depending on the status of their citizenship or passport or what countries they're allowed  to go to and from.  I basically came across this by reading some of the Ukraine advisories that they produce  on their website, and they actually specifically called out the name of a company called the  Da Vinci Group, because they normally use the naming generation, it's like UAC, whatever,  but this time they decided to call out a company by name, and listed some of the IOCs and things,  and I was like, okay, this is a little bit more interesting, a little bit unusual for  what they normally do.  So I decided to basically look up, go to their website, and go on to the forums and  things, and I could see all sorts of services that they offered.  They even had an Instagram account and a Facebook account, and they had models where you're  holding up a computer with their logo on it, it's kind of ridiculous.  I did do a blog on it as well if you want to read that on my website, but, yes, it's  very interesting.  And they also, on their website, they also list pricing ranges of how much something  can cost to gain access to a target of yours information, so, with basically based on the  types of access that they had, the types of services and access and data they could provide,  you pretty much can't do that unless you are some sort of law enforcement or have connections  to the deep agencies of the state.  So that's pretty much, you know, I believe and agree with Ukraine's assessment that they  are connected to the FSB.  Another interesting case study that when I came up when I was researching this talk came  up was the fact that the SVR, again, I believe this was based on Mandiant Intrusion Analysis,  was the fact that they had used a basically Infostealer cookie that had been stolen for  a session replay attack to gain access to a Microsoft 365 environment, and they found  out that it was stolen by an Infostealer on the endpoint, and the fact that that Infostealer  had arrived by a sort of cracked software, you know, there's all sorts of organisations  that try hard to ban software, but there is, you know, one country in particular that has  a pretty bad where's problem, which I can pretty much guess who was the victim in here.  But they, you know, the fact that this is very interesting, because the fact that this  means that the SVR is likely monitoring the credential marketplaces that sell, buy and  sell Infostealer stolen data.  They're slowly, silently sitting there, waiting for a high-value target to appear, and then  buy the access and gain access that way.  Definitely some sort of notable TTP to realise, and, again, you can't discount these generic  threats, because, if you're a high-value target, someone is going to be looking for you.  The other side of it is the fact that the SVR likes to use all sorts of commercial offensive  security tools, namely cracked ones that have been spread and shared around on forums and  telegram channels, things like breach forums and raid forums, and all sorts of cracked  key gen Russian-speaking telegram channels, which, if you try hard enough, you can finally  get into, but, again, it's an interesting strategy of theirs to leverage some of the  stolen tools and tactics and things that they see cybercriminals doing without directly  engaging them and working with them themselves.  Another interesting thing, this was kind of a thing that stuck out to me from reading  some of the research that CISR and FBI put out, basically saying that, a few years ago,  they said the interesting thing about the SVR was they were using false identities and  cryptocurrency accounts to basically register VPSs, and they used a network of VPS resellers  to buy some of this stuff.  It's kind of like decent OPSEC-level stuff to register infrastructure, but the thing  that was really striking to me was the fact that this is exactly what cybercriminals do.  You may have seen some recent research about Chinese APT groups compromising IoT devices  and things and building botnets on those.  We have seen groups like APT28 doing that, but the interesting thing here was the fact  that they basically copied the cybercriminal infrastructure set-up service step by step,  and that kind of, to me, made me think that they were potentially someone on that team  has very well, you know, very well strong experience of how cybercriminals do things  and potentially was a cybercriminal in a past life.  Coming back to the GRU, they basically had a lot of interactions with cybercriminals,  as we can tell, as we know, over the years.  The other interesting thing was they basically co-opted a cybercriminal botnet to repurpose  it for their own campaign, so they again had been monitoring how cybercriminals were setting  up infrastructure, compromising devices, and allowing that crime to go on, and then eventually  realised that, okay, we could use this for our own campaigns ourselves, so, again, it's  another reason, another reason for them to allow cybercriminals to do their thing and  permit it from taking place from their country is because it just comes in handy for whenever  they want to run the campaign themselves.  And how could I talk about Russian intel and cybercrime and things about bringing up Samworm  with the man himself in the room?  They use all sorts of crimeware and things, Black Energy, Petya ransomware, which they  turned into a wiper.  Dark crystal rat is something they've more recently done in the last couple of years.  Again, it's just one of these commodity crimeware tools that, you know, if you're a telecom  company in Eastern Europe, if you see these kinds of things hitting your inbox, you may  not realise the sort of real danger and threat that you're actually facing and could have  lulled into maybe a false sense of security because you think it's pretty much commodity  spam which has dismissed that without realising that, no, it's the GRU, they want to get in  and blow up your whole network.  And then there's also recently Google Tag put out a report of the Bradman-Steeler malware,  so again another crimeware to monitor for potential GRU activity, potentially.  Another interesting fact is the fact that at the start of the Ukraine war, probably  even a couple of weeks before the Ukraine war kicked off in January 2022, a number of  Ukrainian government entities were hit by sort of defacement attacks and a couple of  wipers, I believe, and then some of the data that was stolen previously ended up on raid  forums, which is a sort of Western-speaking cybercrime forum, which I'm sure most people  in the room are aware of, but they decided to create this persona called Free Civilian  and start leaking that stuff on these Western-speaking cybercrime forums, probably with the aim of  us researchers in the room picking it up and writing about it and publishing it and things,  and it's kind of like an interesting information operation in that regard of actually trying  to scare a population into thinking government data has been stolen and leaked.  The other interesting thing was an investigation by Brian Krebs, which was on a core member  of the Mazzafacca forum, which was a top-tier cybercrime forum with all sorts of threat  actors that you're probably aware of and cybercrime groups that you're probably tracking on a  day-to-day basis, things like ransomware gangs and banking Trojan-turned-Lotus campaigns  as well.  He was actually a core member of that forum, but a bit of sleuthing by Krebs found that  on his Facebook, on his V-contact page, there's a picture of him in some sort of GRU Spetsnaz  uniform himself.  So again, it goes to show operators have potentially other lives or past lives as well.  The other interesting thing is the fact that cybercriminals from Ukraine, cybercriminals  can target Ukraine basically on behalf of Russia, but some interesting research was  found that mouse-bound campaigns traditionally used for ransomware precursor operations,  they found that they had been basically stopped all the external targeting of global attacks  and sort of European and Western and USA-based companies to actually focus everything on  Ukraine.  And this kind of goes to show that cybercriminals are pretty much on call in some regards to  supporting their government.  And again, sort of the old tap on the shoulder.  Yes, so the current ransom war, I thought I'd just chuck in a slide of, you know, we've  had quite a few talks and things, the great information things shared by people today  about ransomware.  But the fact is, you know, there's currently an ongoing ransom war and we are the targets  of it.  And basically, this stuff is going on and being permitted with only, you know, a handful  of disruptions, which I'll talk about in a minute as well.  So when Russia actually does make arrests and does stop some of these ransomware gangs,  it's kind of an interesting way that they do it.  It's never straightforward with them, there's always some sort of signalling going on by  the fact that at the very same day that the FSB arrested Areval, that's when they performed  the sort of wiper defacement attack against Ukraine.  So it's kind of a, you know, why did they decide to do it that day at the same time  as they launched some sort of operational attack as well.  Again, it's, you know, plausible deniability, it's, you know, distracting and only targeting  certain audiences and things.  It's all an image thing with them, really, at the end of the day.  And a perspective thing.  Again, you know, other sorts of arrests they make.  You know, not long ago, earlier this year, there was a malware developer on Telegram  who was selling, you know, binaries and loaders and whatever, steal a source code or something  on Telegram, and he was randomly arrested by the FSB.  Why would they decide to focus on this one person and publicise the fact that they arrested  this one guy?  It's kind of interesting to think about, I mean, we could all theorise it, but at the  end of the day, sometimes it's a bit of a mystery.  So a couple of the other types of arrests and things actually seems to be they were  potentially trying to crack, trying to make it appear that they were cracking down on  corruption by arresting some sort of senior officer.  Again, at the end of the day, it's a bit of a power struggle going on in Russia all the  time, and any time one politician gets a bit too powerful or doesn't seem as closely aligned  to the main regime, they can always, you know, create some sort of charge to, you know, to  take that, remove that opposition out.  So several conclusions at the end of the day.  At the end of the day, it comes down to the fact that cybercrime is very intertwined with  Russian intelligence services, and you should always keep that in the back of your mind,  I think, when you're investigating some of this stuff, especially if you work for a high  value target, you know, if you happen to know that your organisation is potentially within  the targeting scope of an intelligence service, you also still need to be acutely aware of  the fact that cybercrime campaigns can be turned into some sort of espionage campaign  at any moment in some regards.  So this is, you know, it harks back to the first talk of the day when Selina said that  we should be all thinking of APT as, you know, cybercrime and, you know, state at the same  time, really.  Yeah, again, you know, cybercriminals are on call, and, you know, there's always a huge  financial incentive for cybercriminals to run these campaigns, they're basically never  going to be arrested from it, and it causes damage to the West as well.  So it's going to continue, and until we see some sort of major change and major disruption,  the cycle's always going to continue, and it's the infinite game at the end of the day.  Some further reading.  So we've got some recorded futures dark covenant paper and things by the Atlantic Council,  I highly recommend everyone having a look through these, I definitely enjoyed them myself  when I was researching this talk, and, yeah, some great considerations to make that whenever  you're making an assessment, you should be including some of this stuff as well.  Thank you very much!


url: https://www.youtube.com/watch?v=wnNhRLIGws0
title: Closing Remarks | SLEUTHCON 2024
type: video
author: SLEUTHCON
ingestion_date: 2024-08-29
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=wnNhRLIGws0",
    "title": "Closing Remarks | SLEUTHCON 2024",
    "description": "May 24, Sleuthcon 2024 in Arlington, VA\nPresented by John Hultquist\n\nClosing remarks and raffle spinning with John Hultquist!",
    "channel_url": "https://www.youtube.com/channel/UCqNH7RRDYNXmrcf_ldl_miQ",
    "duration": 457,
    "channel": "SLEUTHCON",
    "uploader": "SLEUTHCON",
    "upload_date": "20240827"
  }

  This text was transcribed using whisper model: large-v2

   I think before we leave, we're going to do the raffle.  I got some big winners.  Oh, here's all the junk.  What are we going to start with?  What's like, let's, uh, what's the, what's the, like the smaller items?  All right, let's start with something exciting.  Let's do the, uh, this pillow.  Big pillow.  I heard a lot of interest in this pillow.  All right, we've got a random name spinner.  This is all, this is just the badge names, by the way, not the ones everybody can see,  not the ones that are behind the scenes.  All right, spin it, go.  And the winner is Derrick, Derrick, you here, Derrick, all right, Derrick, we're going to  hold your pillow here in case you're not in here.  All right.  What is it?  T-shirt?  T-shirt?  Uh-oh.  Bobby Preston.  Bobby Preston, come on down.  Where are you, Bobby?  No?  Okay.  Okay.  We're going to hold that for you, Bobby.  All right.  What is this?  This is, oh, man, this is a front of a license plate thing.  You can't use this in Virginia, but there are states where you can use this.  All right.  Who's the big winner?  Uh-oh.  Uh, Megan?  Megan, where are you?  Come on down.  Isn't anybody here?  All right.  Let's keep going.  Oh, man.  We're just going to give this to Alan Liska.  This is a scattered spider model here.  Who's the big winner?  Alan Liska.  Bring it, come on down, Alan.  I'm just kidding.  All right.  All right.  All right.  All right.  All right.  All right.  All right.  All right.  All right.  All right.  All right.  All right.  All right.  All right.  Um.  I'm just kidding.  Greg Brewer.  All right.  Here you go, Greg.  All right.  Let's see.  How about a skateboard?  Skateboard.  It's flashy.  It's sassy.  Who's the bigger winner?  Um, Megan?  Megan.  Megan.  Megan.  Megan.  Megan.  Which one do you like best?  Uh, Megan.  Megan.  Megan.  Megan.  Megan.  Megan.  Megan.  I don't even know who's going to win or what's going on.  who's the big winner oh oh Gerald B Gerald B oh man big winner  oh man oh right who wants his coffee cup who's the big winner coffee cup as  we're the booze is almost ready I promise coffee cup Ben Coon come on Ben  where are you I'll hold this for you yeah a lot of interest in the pickleball  set look at these bad boys guys this is this is sweeping the nation pickleball  who's the big winner oh David Oxley come on down David big winner come on  Oxley all right send us some videos oh oh we got another board here folks  another skateboard isn't she beaut isn't she a beaut spin that wheel yes we don't  need power to have fun we don't need energy big winner is Alex come on Alex  is your thing just say Alex last item this is a I believe this is this is  Nintendo switch man that's very nice that paper this who do you know where  did this come from Tyler thank you Nintendo switch who's the big winner  the winner is Trayvon Smith Trayvon Smith where are you I'll hold on to this  for you I promise all right I think that's it a few thank yous and I think  you guys can start part in so thank you everyone who stuck through this  ridiculous fiasco this is my Jurassic Park and you guys outlived the  velociraptors and the whole the whole thing so thank you so much for sticking  out through this we lost the virtual people we love them we'll miss them they  didn't make it I'm so sorry we got to figure out what to do with them but you  guys made it and I'm so proud of you so thank you the volunteers thank you  digital project masters who made this work despite the fact that we have like  I mean no power that's pretty ridiculous by the way there is a cord dangling  through the atrium from the front desk that's what we're running on right now  so thank you everyone who made that happen and thank you to our sponsors  vertex rubric VM ray Microsoft silent push CrowdStrike and stick around after  we drink for a little bit and then we're gonna do sleuth con in in the dark  after dark this will be after it's kind of in the in the dark way it's gonna be  fun you'll have drinks they'll be drinks it'll be a great time go party go  party you deserve it


url: https://www.youtube.com/watch?v=Ye-VZFF0qLE
title: I Tried Every Seat on the Most Expensive Train
type: video
author: Ryan Trahan
ingestion_date: 2024-08-31
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=Ye-VZFF0qLE",
    "title": "I Tried Every Seat on the Most Expensive Train",
    "description": "baguettes were eaten",
    "channel_url": "https://www.youtube.com/channel/UCnmGIkw-KdI0W5siakKPKog",
    "duration": 1617,
    "channel": "Ryan Trahan",
    "uploader": "Ryan Trahan",
    "upload_date": "20240831"
  }

  This text was transcribed using whisper model: large-v2

   There is a seat on a train in Europe that comes with a private room, a private bathroom, a king-sized bed, and a personal assistant.  Now, I have no business riding trains in Europe.  However, my dad and I used to always go to convenience stores for fun drinks and snacks,  and, as a joke, we would buy postcards of places we have never traveled to.  Well, I did some digging, and I found some of these postcards,  because when I saw the Ralph of the most expensive train ticket in Europe, I knew exactly who to invite.  🎵  Rome! Let's go to Rome! Why not? This video starts in Rome.  We made it onto our first train. Guess who's here? It's my dad.  We are on our first of four trains on our postcard expedition through Europe.  This is the first one. This is the basic seat. It's basically the cheapest option.  🎵  Which is kind of crazy, because this is nice. This is way more fun than flying in a plane.  Look at all the space we have. There's so many open seats. I don't know if that's normal.  Since this first train started in Rome, we actually already captured the first postcard at the Colosseum.  We made it to Rome! We're gonna get a photo for the postcard.  Cheese. Cheese!  Maybe I'll do a little title screen to celebrate.  🎵  We need to get comfortable, because this is actually a pretty long train ride, so how about a tour?  Behind me is the Italian countryside. That's pretty sweet.  Anyways, here's what comes with the basic seat.  A table. It folds out.  A trash can. It stinks.  An outlet. Free Wi-Fi.  And a small television playing the Lego movie.  I don't know if you can tell, but these seats feel like first class on an airplane.  Like, they're huge. Very comfortable.  Me and my dad are thriving.  I'm gonna go explore. And by that, I mean I'm gonna go use the toilet. So.  This is my first time walking on a moving train.  Am I scared? Yes.  But not as scared as when I walk on airplanes.  Trains don't have turbulence. I think.  Ayo, train bathroom check.  It's actually really bumpy in here.  💩  I'm no bathroom expert, but this thing's got pretty much everything you could possibly want.  Hand soap, water, and a hand dryer.  It was kind of hard to film, but I promise I washed my hands.  I'm gonna go back to my seat now.  💩  We are about an hour into this train ride, and I am hungry. I would like a snack.  Turns out this train has a snack car.  This menu is amazing. Are you seeing this?  You cannot find food like this on a plane.  So here's what I decided to order.  I'll just do one pizza and a cappuccino.  Or two cappuccinos.  Two cappuccino, one pizza.  Yes.  Thank you.  Thank you.  Bye-bye.  Cappuccino and pizza.  This is pretty much gonna be our diet for the next few days.  I'm guessing this isn't authentic Italian pizza.  It looks more like a Lunchable, but it was also pretty affordable, I think.  Hey, cheers.  💩  Mmm.  Italiano.  💩  Hey, for economy, that's not bad.  Let's try the cappuccino.  💩  Mmm.  That's pretty good.  Oh, that's not bad.  We're inside of a tunnel right now.  We've been going through a lot of tunnels on this train ride.  Kind of cool.  I have a feeling there's a lot more pizza where this came from.  In our future.  Considering this is the basic seat, I'm pretty happy.  Not bad at all.  Down with basic right now.  Yeah.  I wouldn't mind this the whole time.  That meal was fantastic.  I even got to use my trash can.  Sweet.  That was sick.  Next thing I know, we are approaching a stop in Milan, Italy.  Our final stop before arriving to Venice.  We're going next.  Train stations are so cool.  It's so loud in here and busy and hot.  But also really cool.  I can't find my dad.  I lost my dad.  But that's okay because we have like 30 minutes until the next ride.  Can I just say, the last train ride was so cool.  And if that's the worst seat we're gonna have in this video,  I'm excited.  With all that being said, there's a train here.  This is not my train.  I need to get out of the way.  And I can't wait for the next one.  Hi.  Hello.  Sorry.  Coming to you live from the VIP seat.  This is insane.  I don't think I've ever had this much leg room ever.  And I'm not that big of a guy.  Get a load of this.  This is only the second seat of the video.  And as soon as I sat down, I was given a menu with tons of food listed on it.  I think it was basically like a server.  And you better believe I ordered some dinner.  Before dinner arrives, how about a quick tour of this seat?  The seat has two reclining options.  One puts your head back.  The other one makes you do a backflip.  Ryan is on fire with this.  Just kidding.  Here's a little clip showing how it works.  It's pretty much just exactly what you'd think it would do.  There's also an outlet and a personal private table.  This is the one I'll probably be eating dinner on.  Oh, here it is.  Wow, thank you.  This looks so good.  Dad, you jealous?  When he's actually jealous.  Sorry, I'm acting different ever since I got into VIP.  Dinner was delicious.  I'm full.  I'm a full boy.  But let's get one thing straight.  I need to find that VIP bathroom.  To my surprise, someone was already inside.  That man is a VIP.  I have arrived to the VIP bathroom.  Emphasis on...  Nah.  I was gonna say emphasis on pee.  It's a urine joke.  How many people can that possibly get?  One.  Anyways, I'm gonna go pee-pee.  I'm serious.  This bathroom is pretty small.  But it gets the job done.  Does the toilet flush?  Yeah, it does.  The soap dispenser, however, did not work.  So I just had to rinse my hands with water.  Please don't tell anyone about this.  Okay, back to my seat.  I found a room.  But it's not just some ordinary room.  No, no, no.  This is a business room.  For talking business.  And doing business things.  So far, so good.  How does it feel to be a VIP?  I feel very important at the moment.  Which city are you most excited to see?  Excited to see Venice.  The history.  The canals.  Super excited to try some real Italian food.  I'm so curious what this room is for.  I think this is where all the board meetings happen.  I feel like we're supposed to talk business.  Talk numbers.  We decided to just eat Joyride.  Mmm.  We made it to Venice.  Yay.  Um, yeah.  We can do the title screen here.  We made it to Venice.  Before I could even ask my dad what he wanted to do first, he flagged down the nearest boat  taxi and for some reason I get the feeling he's enjoying this boat ride more than the  previous two trains combined.  But honestly, I can't blame him.  Venice is beautiful.  I mean, look at my dad right now.  He's glowing.  I wonder what his video looks like.  Good job, dad.  Anyways, after a long day of travel, it was time to check into the hotel and get much-needed  sleep.  Good morning, Venice.  Once again, my dad and I are on a mission to recreate these postcards.  The Venice one is actually just a five-minute walk away.  Voila!  We made it.  You can see the poles here used to be red and blue and now they're yellow and white.  Say Venice.  Venice.  After we got our postcard, we went out for some breakfast before our next train ride  and then my dad hit me with this.  Okay, what did you just say?  We just got here.  I want to stay.  What about the postcards?  Eat a baguette for me.  Oh my gosh.  Not the one-liner.  You're really staying?  Yes.  Alright, I love you.  I love you too.  Have fun.  You too.  See you soon.  It's about that time for the leg of the trip where things start getting a little wonky.  That's the word I picked.  That's the word I picked for that way to describe it.  I did get a notification on my reservation that the dress code is business professional.  Suit jacket, tie, slacks.  No jeans, no shorts.  Really?  I'm literally wearing jean shorts.  What, do they expect me to pull up in a full tuxedo?  No touch.  Sick DSLR shot of me in a tuxedo.  I'm on the train, yeah.  Before I show you my seat, can I just vent for a second about how crazy it was to get  to this train?  This is such a fancy seat that they have people come to your hotel to greet you, take you  onto a boat.  That boat takes you down the canal, which is beautiful, by the way.  I had an amazing time in the canal.  They drop you off at the train station.  I get out.  And by the way, I was waiting in line, completely drenched in sweat, by the way, because I'm  wearing a suit because they said no jean shorts.  And guess what the dude in front of me is wearing?  Jean shorts.  Hey, I'm not going to report him.  So he, I, I'm not jealous.  Even if I somehow misinterpreted the dress code, it's fun to wear suits.  So his loss.  There's a cappuccino and a plate of pastries right here.  I enjoyed my pastries, very much so.  I was also greeted by the head chef, who gave me a ticket for dinner tonight.  Bottoms up.  That's not what you say when you eat things.  I don't like that.  It's time for the sweet seat tour.  This suite is completely private.  I have it all to myself.  I have a table for meals and snacks and other sorts of things.  There's a couch that pulls out into a bed at night.  These are some wooden shades that can be closed for privacy and potentially even dance  parties.  All right.  Yeah.  Trade dance party.  Oh my gosh.  I think we're derailing.  Here's the other section of the cabin.  This cabinet is for hanging clothes.  And there's also a safe.  The seat comes with a robe and some cute little slippers.  You also get complimentary water, fancy glasses, and this stuff, as well as a bunch of toiletries.  Don't get me started on the bathroom.  It is so fancy.  Every texture before my eyes right now is beautiful.  I mean, my seat comes with a full shower on a train.  On top of the full shower, you get a mirror, a frosted window for privacy, and a toilet.  Is that for your-  But I really need to get to lunch before they stop serving it.  I don't know what pretty much anything is on this menu, but I'm assuming it's all gonna  be great.  The first course is swordfish with this thing.  Pretty good.  Next up was tuna.  Again, quite good.  And for our last course, pie and bread.  These final bites at lunch made me think about how much my dad would have loved this meal.  The man loves fish.  And pie.  Don't even get me started on how much he loves pie.  So this extra seat in front of me, it's sad.  It's a sad sight.  Okay?  I miss you, dad.  He's still alive.  He's just in Venice.  I woke up confused.  Why am I wearing jean shorts?  Where am I?  And what does this blue button do?  There's so many blue buttons in this room.  Let's find out together.  Eleonora brought me tea.  She's the personal steward for this seat.  Let me know if you need something else.  Okay, will do.  Thank you, Eleonora.  Cheers.  I love the little pastries they bring.  I could eat 80 of those.  So this is a 24 hour train ride to Paris.  We are actually going through five countries in total.  We start in Italy, then Austria, Germany, Switzerland, and France.  I cannot believe my dad is gonna miss the Eiffel Tower.  When we got to Venice, he was glowing.  He was so excited.  I did leave really quickly, but I mean, what could he be doing right now?  Stop.  Heading that way.  Chasing you.  Chasing you.  I'm gonna get you.  Should I go here?  Hmm.  Over the next few hours, I just took some time to look out on the countryside and to  admire all the cute little towns we passed as I sipped on my tea.  I mean how cool would it be to live in that little town?  This is my ticket to dinner.  I'm not proud of it, but I took off my jean shorts and put on the slacks.  I think dinner's probably the one they're gonna be most strict about for dress code,  but there will be a time where I walk out into that hallway in my jean shorts proudly.  But for now, I submit to authority.  Let's go eat some dinner.  That lady just had her head out the window on the train.  That looked like fun.  Hey, Marco.  How are you?  Good.  Maximum 1-1-0 for the gentleman.  All right.  Thank you.  For the appetizer, they brought out lagustin, not sure what that is.  Then I had sea bass with caviar.  That's fancy.  And for dessert, I had a snow cone.  I think that's pretty much what it is.  It was like a lemon snow cone.  I am done with dinner.  I walk back into my cabin, and what do I see?  An entire bed.  I also got a nice letter from Eleonora, my train attendant person, and a huge pimple  developing on my upper lip.  This has been growing, I think, by the minute, so by morning, it could be the size of a small  tomato.  I'm not gonna worry about it.  What I'm gonna be worried about is the fact that I can lay down in a bed on a train tonight.  I'm gonna take a shower, because apparently, I've got clogged pores.  It is nighttime.  The vibes are off the charts.  I can't believe I'm actually on a sleeper train right now.  This feels...  I feel like a little kid.  I feel like a little kid in a movie.  As a matter of fact, I feel exactly like that one kid from Polar Express with the yellow  shirt and the glasses who's all like, you know what kind of train this is?  As a matter of fact...  I had to get this shirt custom made, and these glasses aren't even prescription, so that's  about 40 bucks for that joke.  If you guys could just spam the comments with nice shirt, that would go a long way for me,  that would mean a lot.  It's pretty late.  I think we've stumbled into Switzerland.  I'm really hoping to be able to see some Swiss Alps, some mountains.  I was about to go to bed, but then I kept thinking about how when I booked this ticket  and they emailed me, the last part of the email said,  Mr. Trahan, we remain at your disposal.  I don't even know if I want that.  That's a little too much for me, a little too much power, but if there's any way I'm  going to test that, it's this.  Operation Milk and Cookies.  That might have been the least cool thing I've ever said.  Hello.  Hey Eleanora.  Good.  I have a crazy question.  Yes.  Is there a way I could get Milk and Cookies?  Yes.  Or no?  Milk and Cookies.  Milk and Cookies.  I can double check.  Okay.  Okay.  All right.  Thank you.  Hello.  No way.  So I have a super good news.  I met one of his kids.  I wasn't sure.  That's amazing.  This is a dream come true.  Thank you Eleanora.  My pleasure.  Wow.  When I said cookies, no wonder she didn't ask which one.  She just brought them all.  This is amazing.  This is like a dream come true, but it's a dream I didn't know I had.  You know?  I'm taking this off.  Today has been magical.  This isn't even my last train seat, but tomorrow we capture postcard number three.  I'm going to go to bed so it happens faster.  I'm about to go to bed.  Good night, sweet dreams, and all that.  But look how satisfying this is to turn off the lights.  Off.  On.  Off.  On.  Off.  Good morning.  Morning routine.  While Eleanor made my bed, I decided to copy that lady from last night and put the window  down to look outside.  It is just so beautiful.  I opened up my shades for some extra sunshine and sat down for some complimentary breakfast.  Well, here we are.  The train is moving.  The sun is shining.  We are in France.  For breakfast today, I've been given two poached eggs on a bit of a bread type of a dozen pastries.  Fruit salad.  And lastly, a cappuccino.  Eleanor was like, I know you love your cappuccinos.  And I was like, you're so right.  This train has amazing cappuccinos.  Really good.  Anyway, just a couple more hours until we get to Paris.  I can't wait.  I'm really excited.  Actually really bummed that my dad's not going to be there with me, but I'm sure he's having  a great time in Venice.  Well, I broke down.  Couldn't help it.  I bought some Levi's.  Shorts.  Shorts.  Buongiorno.  Buongiorno.  Ciao.  Ciao.  I don't know if I captured this successfully, but this was one of the most magical days  of my life.  And as we arrive into Paris, and I pretend that I'm not posing for these clips, I know  that I'm here on a mission.  Paris is awesome.  I came here last year for my European Penny series.  Fell in love with Paris.  As a customer of this train, even though you're getting off, you still get a chauffeur to your  next hotel.  Thank you.  So I checked in, and...  Took a four hour power nap.  Realized I could see the Eiffel Tower from my hotel room.  Wow.  And then headed out on my journey to recreate the postcard.  And...  Boom!  Not bad.  Oh, I'm actually not in the shot yet.  I was behind the camera to make sure it looked good.  When I travel to new cities, I'm pretty big on finding low-key spots.  Like spots that you wouldn't really find anyone else at.  Kind of taking photos.  That's sort of my thing.  I love it here.  I'm currently blocking a baby's face.  I just feel like that's appropriate.  But anyway.  The lighting's actually very similar, and I think we're ready to take this photo.  I'm so sad that my dad's not here.  I feel weird taking this by myself.  Would you like to be in the photo?  Might as well.  My dad was supposed to be here with me, but I'm going to send this to him and make him  jealous, so.  Okay.  Okay, ready?  One, two, three.  We love trains!  Johnny.  Pleasure meeting you.  You know what I just realized?  Back when I ran track when I was younger, I always dreamed of qualifying for the 2024  Paris Olympics.  And I'm actually here filming this video during the 2024 Paris Olympics.  But instead of competing for my country, I'm filming a YouTube video about trains.  And that's pretty cool.  Good morning!  Good morning!  I am preparing for my final train ride to Budapest.  That's when I saw a supermarket that I remember from my Penny series that 100% sells baguettes.  I located a fresh baguette and bought it, which may have been a mistake.  Anyways, this time I got a police escort to get to the train.  That feels like a little bit much, but I guess this is the most expensive train ticket  in the world, so let's get on it.  I'm on the train.  It's the same train, I'm just in a different cabin.  This suite is similar to the last suite.  However, this suite is grand.  It's called the Grand Suite.  This is literally the most expensive train seat in the entire world.  And here's what comes with it.  The couch is grand.  The table and chair, they're grand.  The amount of space you get is grand.  The bathroom is pretty much the same as the last one, but it is undeniably grand.  The woodwork is grand.  The fruit bowl is grand.  The lampshades are grand.  But the grandest thing of all, this suite has a full-on bed.  What?  I can't believe my eyes.  There's a bed and a couch and a seating area.  And the bed goes up like this so you can store your luggage underneath it.  How do they even do this woodwork?  I finally got one of those aesthetic train shots.  I normally mess these things up.  Okay, yeah, the tripod fell.  So that's the Grand Suite.  I'm officially on my way to Budapest.  It looks so pretty.  I'm excited to see what the rest of this experience is like compared to the last one.  We don't have Eleonora this time around.  However, she is on the train, and she even came by to tell me hi earlier.  No, no, no.  The Grand Suite customer gets Lino.  Lino, I think, is publicly known as, like, the goat of stewards.  I mean, look at him absolutely crushing it, just telling me how sick this suite is.  My goodness, Lino, go off.  So it's almost dinnertime, and I anticipated this.  I anticipated the Grand Suite dinner.  I was waiting for it.  I was ready for it.  And I even packed something specifically to wear for my final dinner on this train.  And now I'm having second thoughts.  I don't know if I should do this.  Should I really put this on?  Nah.  Nah, I'm not going to wear it.  I can't do this.  I'm not going through with this.  I'm wearing something else.  That outfit took up, like, 80% of the space in my luggage for this entire trip.  I don't want to disturb people.  I feel like if I wear it, I'll disturb someone.  At dinner, I once again found myself looking at an amazing view with some delicious bread  and a variety of other foods that I don't really know what they're called.  But they're fancy, and they taste great.  And just when I thought I could not eat anymore, they brought out this.  I don't even know what I'm eating, honestly.  But it's so good.  We also went through a couple of tunnels during dinner.  That was fun.  Before heading to bed, I slammed a cappuccino.  That feels like a good idea.  And when I walked back into the Grand Suite, it seems that Lino left me a surprise.  All right, you guys can tell me if I'm crazy or not.  First of all, I've had, like, seven desserts since I got on board.  I just ate dessert at dinner.  And what do I come back to in my suite?  A full-size cake.  But here's where things get crazy.  Do you know what the cake says?  Are they messing with me?  Enjoy ride.  Enjoy ride.  That's weird, because my candy brand is literally called Joyride.  Enjoy ride.  I just spilled the cake.  You already know this, but most candy is packed with sugar, junk ingredients, and fake colors.  When I was in Paris, I saw a Mountain Dew that looked like this.  America, Europe doesn't roll like us.  And that is my dream for the world of candy.  Throughout this video, I have been absolutely devouring bags of Joyride like my life depends on it.  And that's because it does.  We're trying to make Joyride the number one selling candy at Target.  I've got a five-phase plan that I'm calling The Climb.  And I need some Mountaineers.  That's a long way from number one, but we're on the list.  And that's all I need to know that it's possible.  Target gave us three months on the bottom shelf to prove ourselves that we're worthy of sticking around.  And we did it.  You guys crushed it.  Now we're rolling out into practically every Target in America.  And we're gonna be in the actual candy section.  So if you don't live in America, just go follow Joyride Sweets on Instagram.  That'll help us so much.  But if you do live in America, go to your local Target and buy as much Joyride as your heart desires.  And let's become the number one selling candy in Target.  I smell like butter.  I'm gonna shower.  I'm on a train.  I don't smell like butter anymore.  After my shower, I decided to do one last little exploration.  This is my last night on the most expensive train in the world.  I'm gonna make the most of it.  Eventually, I located this train car.  Everybody is dressed super fancy.  But I'm really only here for one thing.  As my fun drink was prepared, this guy was shredding on the piano.  He's so good.  I'm having a great time.  This doesn't even feel like real life.  I really wish my dad was here to experience this with me.  I'm in bed.  Somehow, this is even more surreal than The Residence.  The suite I got to stay in in my airline video.  It truly just feels like I'm in a movie right now.  Like, I don't even know what kind of movie.  Maybe, like, Polar Express.  I'm sorry. I just had to do the joke one more time.  I, like, made this design and everything.  Well, I'll see you in the morning.  Good morning, Mr. Rohan.  Good morning, Lino.  How are you?  Very good. How are you doing?  How was your flight?  It was really good.  Before I could even say the word cappuccino,  Lino brought me the biggest breakfast I had ever seen.  Yummy. This all looks amazing.  I really wish my dad could have experienced this.  I miss him.  I also miss Johnny.  I think.  I wonder what he's doing right now.  Anyways, I've learned a lot about myself.  I've learned a lot about myself.  I've learned a lot about myself.  Anyways, I've learned a lot about myself through this experience.  The first thing is I really do love trains.  I want there to be more trains in America.  And the second thing, and maybe even more profound,  I love tunnels.  I just love the feeling of going through and exiting a tunnel.  I mean, dude, look at the size of this bridge.  Is that... Are you seeing that?  The scenery during this trip has been...  Dude, look at this.  Imagine just living in this little town.  Like, where are we right now?  It's so adorable.  This has to be one of the most beautiful routes in the world.  Alright, that's enough.  I'm gonna house my meal now.  We're almost there.  I haven't been completely honest with you.  When my dad and I used to go buy these postcards,  we never actually expected to be able to go to these places.  Not in a million years.  Honestly, we just thought it was funny.  We liked going to the convenience store together  to buy snacks and fun drinks.  It might sound dumb to some people,  but it was a way of spending time together.  So, in Paris, when I was looking at Budapest  and the baguette,  and thinking about how excited my dad was  to try a baguette from Paris...  I'm not gonna be able to recreate this final postcard  because this train is not even going to Budapest.  This is my last night in Europe.  And I wanna spend it with my dad.  I'm gonna make the emotional music louder now.  All the way from Paris.  Might be a little stale.  Turns out my dad made a lot of friends here in Venice.  This is his first time leaving America,  so we spent the night the only way we know how.  Eating pizza together.  And I wouldn't want it any other way.  Thank you so much for watching this video.  These are pictures of some of you guys  who bought Joyride at Target recently,  supporting the climb.  If you buy Joyride in Target,  just tag us on Instagram  and maybe you'll make it in a video.  Also, YouTube thinks you'll love this video  on the screen right now,  so click it.  I don't know.  I guess that's what they want you to do.  You should watch it.  It's probably a good one.  Maybe I'm biased.  Love you. Bye.


url: https://www.youtube.com/watch?v=iGYpj2gFu9Q
title: Dyson is Back… Why Do These Exist?
type: video
author: Marques Brownlee
ingestion_date: 2024-08-31
transcription_model: medium
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=iGYpj2gFu9Q",
    "title": "Dyson is Back\u2026 Why Do These Exist?",
    "description": "Dyson already made the ridiculous air filter headphones. Now they're back.\n\nThe original Dyson nightmare: https://youtu.be/tFdnCzfJPJ0?si=Cor44XLKoek01HWy\n\nMKBHD Merch: http://shop.MKBHD.com\n\nTech I'm using right now: https://www.amazon.com/shop/MKBHD\n\nPlaylist of MKBHD Intro music: https://goo.gl/B3AWV5\n\nHeadphones provided by Dyson for review.\n\n~\nhttp://twitter.com/MKBHD\nhttp://instagram.com/MKBHD\nhttp://facebook.com/MKBHD",
    "channel_url": "https://www.youtube.com/channel/UCBJycsmduvYEL83R_U4JriQ",
    "duration": 639,
    "channel": "Marques Brownlee",
    "uploader": "Marques Brownlee",
    "upload_date": "20240826"
  }

  This text was transcribed using whisper model: medium

   So you remember like a year ago when Dyson came out with these things?  The Dyson Headphones Combo Wearable Air Purifier Nightmare Gadget.  I tested them, I reviewed them, I gave it a chance, it ended up still being the single  dumbest product I've ever reviewed.  So imagine my surprise when Dyson unveils a new product a year later and it's just headphones.  It's just like they removed the stupid air purifier part and left behind the giant metal  pair of Dyson headphones that were kind of overshadowed last time.  This is them, and they are $500.  So yeah, of course I'm going to give them a shot.  Because you know, on the off chance that someone out there was turned off by the super spreader  air filter thing, but was still intrigued by the idea of a pair of super high end Dyson  active noise cancelling headphones, I'm dedicated to giving these a fair shake.  And the thing is, the thing is, it might not seem to make much sense until you consider  that AirPods Max also exist.  In fact, the more you compare them, the more it feels like Dyson just saw AirPods Max just  getting dusty sitting in the corner.  No updates after four years.  Still has a lightning port.  Still super heavy.  Unchanged and still getting sales at $550 and thought, okay, well, surely that audience  is looking for an alternative, right?  And when you put them side by side, it becomes actually pretty clear to me that what Dyson  seems to have done is aimed to basically one up Apple's headphones in as many ways as  they possibly could, while still being in the same exact category of huge, heavy noise  cancelling headphones.  So like I said, these things retail at 500 bucks, but that is 50 bucks cheaper than  Apple's.  It has replaceable ear cups for 50 bucks a piece.  Believe it or not, that also undercuts Apple.  The rated battery life is 55 hours, which is just dramatically better.  More than doubles.  AirPods Max is 20 hours.  Also Dyson's headphones work the same on both iPhone and Android.  And of course, these also have a real off button.  So yeah.  But anyway, I think I have to start with the fact that these headphones are somehow heavier  even than Apple's.  These are the heaviest headphones I've ever tested, 451 grams, which is not great on paper.  But the thing that they at least do well is they kind of, they distribute it well across  your head.  Now everything on these headphones is metal, like not just the ear cups, but also the hinges,  the top band, and then basically just this top cushion is super soft.  The left and right ones actually aren't super soft, even though they look the same.  And that's because they've put batteries in here.  So the weight now is actually higher off of the ear cups, which is how they managed to  be, I'd say just as comfortable as AirPods Max.  They feel different, but you know, not a high bar.  They're still super heavy.  It's just, they're not super uncomfortable for sitting around and passively listening  for a while.  And honestly, there's actually a lot of interesting, sometimes clever design with these headphones.  The main one really being these interchangeable back plates and ear cushions.  I'll get to how they sound, don't worry.  But these ear cups are a quarter twist and an unlock away from being totally replaceable.  And then these back materials, it's just a cap that is also a quarter twist away from  being totally replaceable as well.  So they can both be replaced with different colors, and then you can mix and match different  combos of ear cups and back plates.  Now you don't actually get like a bunch of these with the headphones.  Like I said, they're 50 bucks a pair.  So basically when you go to their website, you choose between these four base color combos.  And I'd say choose wisely because then any extras you want, you got to pay for.  So you might've seen what people were doing a few years ago with like mixing and matching  different ear cup colors with AirPods Max.  Dyson basically, I think saw this, but took it to the next logical level and just said,  all right, we'll build it right in as a feature and upsell you.  And it's fine.  It works.  Is it a bit of a gimmick?  Kinda?  Yeah, sure.  But you can also tell they put in real work with the lock and twist mechanisms so they  don't come off easily, but you can also always unlock and swap out a new cap, which have  lots of different finishes.  By the way, there's the aluminum one, which is really shiny and metallic, but the colored  ones have like a matte finish.  They almost look like a color work lab.  Another clever little design thing.  And this actually comes from the previous Dyson headphones is a clever little joystick  on the back, on the back right hand side.  This is almost all of the physical controls for these headphones.  And it's great because it has a bunch of functionality.  You can press in to play pause.  You can go up or down for volume left or right moves you through tracks and it sticks out.  So it's easy to find blind.  You don't even have to see it.  Then the only other physical control is double tapping the left ear cup to turn on and off  noise cancellation or transparency mode.  Unfortunately, this control is extremely finicky and only works like 50% of the time,  which sounds insane until you realize this is not a touch surface.  It's just the cap on top of the headphones.  So I imagine it's some sort of like force sensor.  So you like really have to smack the headphones to change it.  Yeah, that's not great.  But a couple other small observations, the chime that plays when you first put them on  is super loud every time.  I don't know why.  Please turn that down.  But then these headphones also only twist in one direction.  So that way, that's how you get them to fold flat, although they don't actually totally  fold at all.  So to bring them with you, you need this.  This is the case.  I mean, I guess you don't need this case, but this is the one it comes with.  This is it's basically two flat boards of silicon connected by some elastic.  You kind of just push the headphones down right in there.  You do have to shrink them down a little bit and there is one pocket near the top for any  cables you want to take with you.  Sure, that's fine.  These headphones also have on head detection so they can automatically play when you put  them on and then automatically pause whatever listening to when you take them off.  Pretty standard for high end headphones.  And they also have multi-point multi-device connectivity.  So I had these paired to both my iPhone and my Pixel at the same time.  And the Dyson app is pretty solid.  It lets you change ANC modes and it still does that real time thing where it shows you  like a graph of the last 30 seconds of how loud it is outside the headphones versus how  loud it is inside the headphones.  So you can see that delta when you have noise cancellation on.  Fine.  Cool.  I guess it's not the most useful feature in the world, but it's still cool to look at  once in a while.  And of course, how do they sound?  They're headphones after all.  That's what people want to know.  So as your resident non-audiophile, but someone who has listened to a lot of headphones, these  sound solid, but not amazing.  I actually did listen to a lot of back to back with the AirPods Max because that feels  like the appropriate comparison here.  The AirPods sound better in basically every single genre, but by like 10 to 25%.  And you can play with the EQ in the Dyson app, but there's only three presets.  So there's neutral.  That is the flattest, most honest representation.  It is actually surprisingly neutral.  Enhanced sounds closest to AirPods Max and it's pretty good.  That's my personal favorite for listening to music.  There's nice big range, deep sub bass, and then still has crisp detailed mids and highs.  And then bass boost sounds horrible, but it does what it says if you're into that.  I think the struggle really is mostly to create like an open, like wide feeling soundstage.  The inside of the ear cups actually is pretty shallow.  It's legit touching my ear with the fabric.  So it's just not the widest soundstage and there isn't as much instrument separation  as I was hoping for.  But in general, they sound like any other rock solid B plus noise canceling headphones  would for around like a $300 price point.  There are also eight microphones all the way around for active noise cancellation and they  are decently good at getting rid of some white noise, but they are not the strongest.  Like Sony's Bose and AirPods all cancel way more background noise and then the transparency  mode is okay.  The real strength of these headphones, if you must know, is definitely the battery life.  What they've done with like getting the battery cleverly on the band instead of resting on  your ears made a surprisingly big difference and it's a lot of battery.  This battery life is amazing.  Like I've only had to charge it once during this super heavy use of like week and a half  testing I've been doing.  Yeah, like 50 plus hours with ANC on is like world beating.  So great battery life, plus they actually have an off button, which they can't all say  they do.  But at the end of the day, these are still Dyson headphones.  Like why do these exist?  That's the real question that I've been wondering this whole time testing them.  I think the obvious business 101 answer is Dyson spent real R&D money making this stupid  pair of headphones that have an air filter attached to them and figured they might as  well get their money's worth and also ship something that might have a little bit of  a larger addressable market, which is just headphones.  Now there's headphones.  So if you aim these squarely at AirPods Max, which is what I did, I feel like that's the  closest thing to them, then they don't seem as ridiculous.  I mean, they're built just as well.  They have much more clever, interesting customization going on.  They have decent sound.  They also have like a solid physical controls and they're much better with batteries.  So yeah, I guess since they're cheaper, they make sense.  But however, if you compare them to basically any other high end normal pair of noise  canceling headphones in the 350 range from any of the other majors, then yeah, these  are overpriced straight up.  So that's the verdict.  Now, you know, at least the people from Dyson can say they shipped something.  Thanks for watching.  Get you guys the next one.  Peace.


url: https://www.youtube.com/watch?v=tAmjkfO3-Ow
title: Off-by-One 2024 Day 1 - Keynote : Breaking Into Vulnerability Research: Dr Silvio Cesare - InfoSect
type: video
author: Off-By-One Comms Team
ingestion_date: 2024-09-03
transcription_model: large-v2
content:
  {
    "webpage_url": "https://www.youtube.com/watch?v=tAmjkfO3-Ow",
    "title": "Off-by-One 2024 Day 1 - Keynote : Breaking Into Vulnerability Research: Dr Silvio Cesare - InfoSect",
    "description": "Abstract\n\nThis talk discusses the challenges of starting and running a company that specialises in vulnerability research. The typical problems likely faced include:\n\nHow do you build a new team?\nAnd how do you encourage knowledge transfer and upskilling within your team?\nWhat targets do you focus on?\nHow much engineering is required to support research?\nThis talk will give insights and answer these questions, for the purpose of maintaining reliable, consistent, and high quality research outputs.\n\nSpeaker\nDr Silvio Cesare is a founder and Director at InfoSect, a vulnerability research company. He has worked in technical roles and been involved in computer security for over 29 years.\n\nThis period includes time in Silicon Valley in the USA, France, and Australia. He has worked commercially in both defensive and offensive roles within engineering.\n\nHe was previously the Director for Education and Training at UNSW Canberra Cyber, ensuring quality content and delivery. In his early career, he was the lead architect and developer for the startup Qualys, now the industry standard in vulnerability management. He has a Ph.D. from Deakin University and has published in academia, having been cited over 800 times on google scholar. He is a 4-time speaker and also a trainer at the international industry leading Black Hat conference.\n\nHe has taken his University research through commercialisation and authored a book (Software Similarity and Classification, published by Springer).",
    "channel_url": "https://www.youtube.com/channel/UCmrsIbKdxEMBEefD8v8RigQ",
    "duration": 3059,
    "channel": "Off-By-One Comms Team",
    "uploader": "Off-By-One Comms Team",
    "upload_date": "20240831"
  }

  This text was transcribed using whisper model: large-v2

   It's a great pleasure for me to welcome our very first speaker, Dr. Silvio Cesari.  So Dr. Silvio here is actually a founder and director at Infosec, a vulnerability research  company that he has set up.  He works in various technical as well as leadership involvements in computer security and has  been doing so the past 29 years and counting.  So his talk today will focus and discuss about the challenges of starting and running a company  specializing in vulnerability research, the challenges involving your building a team,  the knowledge transfers, targets to pay attention to, and these will be some areas of focal  point for his talk.  So without further ado, let's put our hands together to welcome Dr. Silvio.  Thank you everybody for coming off by one, a really special thanks to David and Star  Labs for giving what will be a great conference.  It's the first conference of the many to come.  And like I was introduced, I want to talk about effectively building a vulnerability  research company, not really from scratch.  And so this talk is about some of those challenges and it's really going to focus on building  a team of vulnerability researchers and faculty.  One sort of basic question I suppose that broadly across the sort of the cyber security  industry isn't uniformly known is what exactly are we talking about when we're saying vulnerability  research?  Are we talking about a two week end test engagement to audit some code for a customer?  What is really the point of it?  And in my sort of definition, and everyone's definition will be slightly different, but  my definition of vulnerability research is the ability to reliably and repeatedly discover  and exploit zero days in hardware or software targets or any target.  The targets have to be relevant.  So when we talk about finding bugs and finding zero days in the software, are we talking  about that shopping cart that three people in the world use?  No, we're not.  When we talk about vulnerability research specifically, we're talking about targets  of ubiquitous nature and most likely essential system software.  When we talk about vulnerability research, we're talking about those types of targets  or software configurations in the default configuration.  So it doesn't really matter if you find bugs in some fewer part of the software that isn't  enabled.  It doesn't really count when we say that we're doing vulnerability research.  Typically when we look at a target as well, it's going to be hardened and defended.  There'll be some sort of software team defending that software, implementing mitigations and  hardening, looking for previous exploits that have been used against the target and making  appropriate responses as well.  And really when we exploit these targets, we're looking for some sort of reasonably  strong effect such as remote code execution or local commits or whatever it might be that  pass across a real security value that has a useful effect for the people and widens  their needs for it.  Any attack that achieves the objective, so if your goal is to get an RCE, anything that  achieves that objective, whether it's XSS or SQL injection, whatever it might be, is  valid.  In practice though, realistically most of the bugs that you will find that have real  utility are going to be memory corruption bugs against native code like C or C++.  That's just the nature that most of the software that we use is written in those native languages.  So the typical types of targets that we'd be interested in are operating system kernels  and OSes in general, but kernels are very particularly important.  Operating system network services, that gets you sort of onto a box or remote code execution  and so forth.  Hypervisors are a great thing to look at.  Host escapes, host perverts, guest perverts, all of those things are sort of useful.  Browsers or some of these one-click browser chains are very common and almost synonymous  with vulnerability research in fact.  And then we go on to things like instant messaging apps with three clicks.  Mobile handsets are very much in scope.  Something that's useful and crosses the security boundary if you want it.  And embedded devices are becoming part of this world as well.  So vulnerability research against embedded devices, whether that's security cameras,  NDRs, whatever it might be, have valid validity.  If you're still sort of wondering what type of thing, if I'm finding bugs in software,  is it the concept of usefulness for a vulnerability researcher?  The Zeronium sort of bounty list is a good place to sort of get an idea of what targets  have some sort of utility for vulnerability research.  So Zeronium and exploit broker are probably quite ubiquitous.  They pass on these exploits too.  But we can see at the very top, Android full chain with persistence, zero click.  Then at the bottom we might have lock screen bypasses or qubits or whatever it might be.  But this is just indicative of the type of things that really are essential to systems software  and really what we want to focus on.  Now, ultimately what tends to happen is that we all sort of start off quite broad and say,  well, vulnerability researchers, lots of software might be useful,  but we end up generally all going towards these common targets or these common domains.  In pentesting you might be given any software or hardware target for any nature.  You don't really do that in VR, I guess.  Not generally anyway.  Occasionally you might get persuasive stuff.  But in general you often sort of evolve to these set of standard targets and domains.  Because ultimately the goal is to reliably, repeatedly and consistently develop research outputs.  So the targets that you end up going towards, well, they need to be complex enough  and sort of have enough code to ensure that there's a steady supply of bugs that come out of it.  If you sort of build like a team to look for suit, for example,  you're not really going to maintain bugs in that software.  You might opportunistically find some sort of pre-vets,  but the code chain is quite low, the access is quite small,  so it's probably not going to be where you invest a team to look at.  And even just user-land pre-vets in general on Linux would be a pretty hard target in that sense.  It's probably not going to have a high code chain, a high complexity and a steady supply of bugs.  But operating system kernels might be more useful.  So you need supply of high quality bugs.  And if you get a bug, you need to be able to be somewhat confident that you can exploit it.  So some targets simply are not easy to exploit.  If there's not much programmatic feedback, you can't sort of build your primitives,  your pre-write primitives, get info links, scan over memory in some programmatic way,  it becomes really quite difficult.  So most good exploits or reasonable exploits are going to have heap grooms,  they're going to have leaks, corruption and so forth.  So this idea of this one chop of lines attack,  maybe for a non-interactive program like Sudo or something like that,  it's going to be very difficult.  So programmatic feedback is desirable.  So operating system kernels, hypervisors, browsers,  these are the things that really enable you that when you find a good bug,  you have a pretty good chance of exploiting it.  Also the targets need to be ubiquitous and have desired privileges.  So again, I've sort of said this already,  if you have an obscure package that needs a user to install some weird configuration  or install the package ultimately, it's probably not going to be that valuable.  A little bit about me.  I've been sort of in the hacking world for about 25 or so years or 25 plus years really.  I didn't do bug hunting and exploit development for the entire duration of my career.  Certainly there have been people that have been my peers in that period of time  that have stayed almost exclusively as bug hunters and exploit developers.  I did sort of hobbyist bug hunting at various points in the first half of my career.  And in fact, even back in 2008, I was one of the first sort of people  or individual researchers that did sort of large-scale auditing  of a single learning kernel in particular.  But most of that 25 years or so that I've been working in sort of IT or security,  I've been working on low-level native development, reverse engineering or program analysis.  And in fact, I did a PhD and commercialised some of that PhD research  using program analysis on malware defence actually.  I was also a university educator for a couple of years and still regularly run trainings,  generally private trainings at InfoSec in my home of Australia.  But that was sort of my first part of my career, my first half of my career,  and then I transitioned to full-time bug hunting and exploit development.  So InfoSec is roughly about a 20-person VR company, about 22 people at the moment.  Our team works on-prem.  So it's sort of unusual in today's sort of age where people want either fully remote  or at least a combination of remote and on-prem.  We almost exclusively work on-prem on our facility,  and we have a lab and so forth and all of those types of things.  It's founded by myself as the CTO and Kylie McDevitt as our CEO.  And this talk is about some of the challenges and lessons learnt  in building and running that 20-odd-person VR company.  So, I mean, this almost is going to be like how to build a start-up talk, in fact.  And so the founding team is how do you start a VR company?  Well, you need a founding team that does that.  Now, when you run a business, any business, not just a VR business,  you need to have business know-how.  But this talk is about sort of the technical and engineering challenges.  So we'll just ignore the business part of registering businesses,  getting insurance, you know, getting Superall, all that type of stuff.  I would say your founders need to be generalist specialists.  So founders will be doing all the tasks at the beginning.  They'll be setting up infrastructure, doing research,  finding bug-prone exploits, developing tooling and so forth.  And so your founding team needs to be able to put on many hats  and do lots of different things to sort of build the team over time.  And at Infosec, my co-founder, Kylie, was a generalist.  So she knew very broad IT security and cybersecurity,  but she was also a specialist in infrastructure.  And that's what I mean by generalist specialist.  You can do everything, but you have some sort of unique skill  that has value to the company.  Because no one wants to employ people that are just average at everything.  So you can build customs, all that, but you need to be a specialist at something.  I started sort of as a generalist, but I was also a researcher.  So I was sort of the primary researcher when we started the company,  and I still do lots of research today.  Now, sales is actually a very important thing to start-ups.  And in fact, most start-ups see the main problem with business...  I want to say start-ups, cyber start-ups in general,  not just VR companies here.  In fact, not VR companies here.  Most start-ups see the main problem with business as a sales problem.  And they see that the more sales and the more customers you get,  the bigger and faster you'll grow.  So sales drives growth in most cyber start-ups.  Now, in a vulnerability research-focused company,  that's not generally the main problem.  You have a customer set that finds VR valuable.  The main problem in a VR-focused company is engineering.  The more things you can develop, the more research output you have,  that will drive growth.  So the better you are at your job,  generally the deeper your customer base will go and the stronger it will be.  There are lots of myths about VR.  In fact, you see this all the time.  And one of the common myths even told by people,  like quite a few people today,  is this idea that if you're not doing VR already,  then don't even start.  Because the argument is, if you want to do VR today,  you would have wanted to do it 10 years ago.  And it's only gotten so much harder in that 10-year period.  So if you didn't do it then,  and you're just maintaining your capability, I suppose,  why would you think you can start now  and catch up the past 10 years and the next 10 years going forward?  So the idea is that if you pursue too hard,  you would be already doing it if you could,  so don't even try.  So that's sort of a very common myth, actually,  by people that have consumed the outlets of vulnerability research.  But people break these myths all the time.  You see CTF players jumping into hard problems  and solving hard problems.  You see vulnerability researcher newcomers  enter the field all the time.  There are young people that enter vulnerability research  and are very successful.  And you see existing vulnerability research companies  take on new targets or new complexities  as the technology evolves.  So, I mean, you see VR companies expand their repertoire  so they can do new things.  Now, my own transition, there's a big difference  between hobbyist, bug hunting and vulnerability research.  Vulnerability research is a large, deep and complex field.  In my opinion, it's basically impossible  to find bugs more lively  unless you've invested a large amount of time  studying your target, your real-world code and your targets.  For myself, when I started sort of, you know,  20-odd years ago, 25-odd years ago,  I was always pretty good at finding bugs.  But as I sort of transitioned to doing this all the time,  I lacked focus on finding relevant and impactful issues.  So, I was finding bugs that really weren't that useful.  So, maybe it's good to do sort of advisories  or something like that or public blog posts.  But in terms of finding relevant and impactful issues  that vulnerability research produces,  that was what I lacked.  So, over time, I worked to sort of target...  work my targets that I was looking at  using domain-specific knowledge  and became better at identifying,  focusing on relevant attack services.  So, that's really one of the main transitions  is you're not just finding bugs anywhere,  almost like a developer.  You're focusing and targeting  very specific attack service that has a useful security boundary.  And if you cross it, then that bug is going to be impactful.  And I sort of, as I did this more and more,  I became better and faster at learning new targets  and identifying target-specific bug-hunting strategies.  So, transitioning as a hobbyist bug hunter,  most bugs are actually not that useful, like I've said.  Bugs can be...  if it's non-ubiquitous,  if you think of just general development software,  most developers write terrible code.  That's just the reality of it.  Most software is non-ubiquitous,  so it doesn't really matter that much.  Most software is non-hardened  and it's not defended against...  and the software base is generally extremely buggy.  So, this doesn't...  if you're finding bugs in random software,  it doesn't really matter.  I mean, you should be able to find bugs  in non-hardened software pretty easily.  And even large and flexible hardened code bases,  so operating system kernels and so forth,  have practically an unlimited number of worthless bugs.  So, if your scope is the entire Linux kernel,  you should be able to find tons of bugs.  But at that point,  you're basically becoming a kernel janitor.  You're becoming a developer  and fixing small kernel problems  versus trying to find bugs that are useful  as a vulnerability researcher.  So, it's great if you're a developer,  but not great for vulnerability research.  And identifying the attack surface  and focusing on relevant default configurations  is really paramount.  It doesn't matter if you're finding bugs  in really non-default configurations  that are only used randomly or occasionally.  There's really no value whatsoever  from a vulnerability research perspective.  Now, we started sort of our founding team  at InfoSec, Polly and myself,  and we built the team over time.  I would say that transitioning  from a couple of people to a team  is a challenge in itself.  And I would say that leading by example is important.  Research is hard,  so I would say don't expect  that you can just hire your way  into having a successful VR company.  You really need to sort of set an example  and the team will sort of come  or gravitate towards you.  Hiring is challenging, for sure.  And you have your common startup problems.  I mean, do you hire the very senior people  that cost a lot of money?  Or do you hire sort of new up-and-comers  or juniors that probably are going to be  sort of cheaper to hire,  but probably don't have as much research output?  So those are the types of questions that you have  that every startup has.  Do you hire your first hires  to become seniors or juniors?  So exactly the same in vulnerability research.  And I sort of do believe there is a place  for juniors in vulnerability research.  There's lots of stuff that's needed  to support senior researchers,  tooling, engineering,  all of those things are quite relevant.  So I would say that if you're hiring,  there is a place to hire junior people as well,  and new up-and-comers,  and even occasionally take on interns and so forth.  So where do you hire these vulnerability researchers?  So you could hire well-known, famous  vulnerability research specialists and veterans.  You might see them on the internet.  You might know that they're very good.  They might be inclined to own as individuals,  stuff like that.  CTF players are good.  CTF players that are a very good opponent in RE  can sort of transition into  professional vulnerability research.  University graduates,  we at Infosec have sort of a collaboration  with our local national uni,  and we've had interns come through that process,  and they can be quite good.  But an internship is also an opportunity  to see if they're fit for this type of work.  It's sort of quite an unusual area  to work these days.  You know, from sort of a broad perspective,  you know, most young university people  don't really know that there's a world  of working with sea and assembly  and writing experts and so forth.  Sometimes you might get pen testers  and consultants looking to change careers.  It occasionally does happen.  I would say it's not the usual path  for most vulnerability researchers,  but you do see we have certainly in Infosec  had some pen testers change careers  and work for us to find bugs and write experts.  Software developers, OS kernel  or embedded developers are a good place to look.  If someone's working on a kernel or hard device,  they're probably good at finding bugs  and those types of targets as well.  We also have forensics people.  If you think of IT devices or embedded,  typically you want to get the firmware  off the device so you can start looking for bugs.  Forensics people tend to be quite good  at getting the data off the device  and getting the firmware off the device  so that we can start to turn it  into a software problem.  And then you might have electronic technicians  and engineers.  We do a lot of hybrid Infosec,  so we can have this as well.  The hiring process can be complicated  and like every startup,  how do you know that the person that you're hiring  is fit for the job  or it's a good culture fit and so forth?  And so we've evolved this over a period of time  and now effectively we use a trial process  for people entering or looking to work for us.  We basically get them to come out and work with us,  sit next to us for a couple of days  and then we give them a task  indicative of the type of work that we do  and then we say work on that task  and at the end of the couple of days  they do a presentation to the team  on what you've done.  The task is not unrealistic for the timeframe,  so you're not giving them ridiculously hard things  and normally the process is we take  a fairly pointless zero day  from a real world target  and then we get them to provide a POP to trigger  that verified that this bug is a real thing.  And we say pointless zero day  because it's probably some sort of bug  that, you know, like for example  if they get an info leak out of this code  but you need to be, normally you need to be  root to get sort of access to this part of the OS kernel  so that's sort of a pretty good,  if they can do that, it's pretty indicative  that they know how to write C code,  read a code base and so forth  and it's a pretty good way of doing things.  I think our hiring process has improved  quite a lot and we get better recruits  and better hires because  they know what they're getting into  and we can see how they work with the team as well.  So you can also identify if there's a culture bit  or a culture clash.  So when you're working, you know, sitting next to  the people that you plan to work with in the future,  I mean, you identify pretty quickly  if, you know, this recruit  knows how to, you know, collaborate in a team.  It also lets them know the expectations.  You'll be surprised that there is a sort of a belief  that, you know, people want to be vulnerable in your research  and so they don't want to really read too much code,  they don't want to write too much C code.  It's like, well, that's the job.  And it's very evident if a recruit knows basic skills  around a terminal, that they can write code,  use compilers, read code bases and so forth.  And if they complete that task that we initially give them,  we just basically, we get them to do sort of further work.  So if they've got an info leak,  then you turn it into sort of a KASLR bypass.  Or if you've done that as well,  we'll give them more bumps to sort of work up  in that period of time.  And so we always try to keep them busy and occupied  for the days that they're working for us.  Some people do these tasks really quite fast.  And then other people, you know, basically,  given sort of an unlimited amount of time  with where they're at at this point,  where they're at in their career,  they're never going to complete it.  So you're a VR company,  and VR companies have to set up targets.  The targets in VR are varied, but not unlimited.  You need to aim for realistic targets  if you're starting out.  If you're a very small team of two people  and you've never done iPhone stuff,  and you've decided that you're going to do an iMessage  with zero click, probably an unrealistic target.  You will almost certainly be doing targets  or looking at targets dictated by  what the founding team's specialties are.  And likely, you'll hire people early on  to support those specialties.  And as the company grows,  you can certainly go more broad.  And as the team grows, you'll have more outputs and so forth.  As you grow, you'll typically start off  with a relatively isolated component that you're targeting,  and you'll add more components as your team improves.  These components might be useful together,  you know, when you can chain them together.  And really, I would say that depth and specialisation  is the only way to be effective.  If your goal is to be across as many targets as possible  to some surface level, you will never achieve any success.  And in fact, when you have juniors on the team,  the basic goal of a junior is to get deep enough  into some sort of narrow area  that they can start to be effective.  Because if they just go across lots of broad things,  they'll never reach the depth required to find useful parts.  As they become more senior,  the great sort of this going deeper sort of slows down.  And then they become more broader.  So they start to see that, OK, maybe these things  that I'm working on actually is correlated  to this thing over here.  And then maybe you start to handle the bulk of the components.  Knowledge sharing is paramount.  The goal is to have a team  that lifts each of its team members up.  You don't really want, at least from my perspective,  you don't want a team that is all entirely individual-based  and doesn't want to share anything that they've done  or anything that they've learned or anything that they know.  It really limits how fast your team as a whole can grow.  And so there's lots of ways to sort of encourage  team collaboration and team knowledge sharing and so forth.  And probably most companies have variants  of all of these types of things.  There's things like internal documentation,  so wikis and so forth.  Internal presentations for the team is always good.  You can have a monthly internal presentation or seminar, I suppose,  with people doing what they've worked on.  Having a collaborative team culture is actually a really big thing.  It's harder for remote staff, for sure,  and that's one of the reasons that we're basically all on-prem.  Having a collaborative team culture is easier, I would say,  when you're face-to-face with your colleagues and your peers.  And also having staff and sort of establishing that culture,  having staff feel comfortable in asking and receiving help  or giving information of what they've discovered.  Having knowledge trapped within an individual  and not having an opportunity to share that with the rest of the team  ultimately limits how fast the team as a whole can grow  and what they can achieve.  I've sort of talked a lot about team culture,  and it's sort of cliché when a company sort of says,  you know, it's all about team culture,  but I would say it really is.  When the company is small,  so when looking at the company size of about less than 10,  that's ultimately when your culture is built.  And then as the company grows bigger,  it gets really hard to change that culture  unless you've nurtured that culture very strongly early on.  And I would say you might have challenging decisions to make early on  to sort of enforce that culture,  but it's something that has to be nurtured and pruned and grown correctly.  If you just let it grow without any regard to what's happening,  you will have certainly a terrible outcome as the team gets bigger,  and it will, I imagine, become complete chaos.  Now, VR is very different to pentesting and consulting.  The culture is not the same.  So when pentesters look at engagements  and the customers that they're working with,  they have a very different view of their customers.  I would say pentesters are generally engaged  to find some sort of sloppy misintegration  or some sort of weakness of the person that's implementing that.  That's generally a very broad brush stroke here.  But I would say that VR people  work against a large team of expert developers  who spend their days, these developers,  trying to write functional and hard-to-attack software.  So you're going against a much stronger person writing code  or teams writing code.  And I would say that you have a greater understanding  of the skill that developers have,  and there's almost like a weird mutual respect.  I mean, I use these software systems myself all the time.  And for me to look and find bugs in the things that I use  as well, I mean, I think they're very good developers,  but our job ultimately is to find bugs in their software.  So I can certainly respect the developers of these systems.  I would say that most generally cyber security people  can't write very good code,  but the developers that we're trying to find bugs in  are very skillful.  When you have a new startup in your team,  you might fall into the trap of giving them  some sort of open-ended problem.  And for some starters, if you're a veteran VR person,  having some broad open-ended problem,  just some sort of target and some desired effect,  that makes sense.  For people new to VR, so you've got your interns  or your juniors or your mid-levels,  it really can be demoralising,  since typically if you're not guiding these junior people,  their output will be slow, inconsistent,  maybe even non-existent, and probably weak as well.  So I do prefer progressing sort of newbies in VR,  sort of juniors and interns,  or juniors and mids really,  from small tasks such as verifying a simple bug  that we found, say by writing a small pop  to verify that the bug exists,  and then progressively getting harder tasks  that make their work more balanced.  Again, you want to get their depth to a sufficient level  where they can actually start being useful  versus not being useful at all  if they only know certain level of information.  The more real and consistent output people have  at the beginning of their employment,  the more confidence they build.  So if you give a junior or a mid busy work,  they won't really build confidence from that,  but if you give them work that,  maybe it's not a big impact, but it's real impact,  and it's a real task,  they'll feel much more confident.  So I'm really opposed to this idea of busy work  for younger people or junior levels.  And broadly speaking, that confidence  also extends to the team as a whole.  New teams need to quickly find confidence,  otherwise it can be quite unpleasant to work  in a place like that,  or sort of having no belief that  you can do the task at hand.  Confidence, I believe, is built by the founders  and the rest of the team  ultimately demonstrating confidence.  If the founders can do it,  or your colleagues can do it,  it's sort of motivating.  You think it's possible, you think it's reasonable,  you think, well I want to do that as well as a junior.  And you can achieve seemingly impossible objectives,  and that really does build strong confidence.  And then ultimately your team just sort of thinks,  well this is business as usual,  our job is to find bugs in hard targets,  and we do that successfully.  Results do not always come quickly,  so we're not finding good quality,  impactful bugs every single day,  but major findings must come at regular intervals.  That's the goal of the job.  As a vulnerability research company,  you have to produce outputs.  So if you do that,  you'll have a tendency for your team to say,  well let's just hire,  I know some people that are my peers  from my ex-jobs or whatever it might be,  and they try to push their new peers as well  into the company.  So you sort of have this idea that  you get referrals from existing staff  to hire new people that are going to be good at the work.  Now if, as a team,  you're not getting findings,  major findings at regular intervals,  and you've gone through some extended period of time  and you're just sort of arguing that,  oh it's just a hard target,  yeah there's probably no bugs there,  well it's really untenable.  You need a direction shift or a change of strategy  must occur to stay on track.  You have to have regular outputs.  Engineering will have a role  in maintaining a VR company,  and so you'll need to do engineering support work  as well as doing pure research.  Some companies that are large enough  have separate engineering teams to research teams,  but as a small team,  even for us at Infosec,  as a 20 person company,  researchers will be required  to do some of the engineering work.  And it can be motivating in a sense  that engineering work tends to be fairly linear  in getting progress,  whereas in research,  it seems to be a bit more lumpy.  And even though it's sort of,  research might be nothing, nothing, nothing, something,  and nothing, nothing, nothing, something,  ultimately under the hood as well,  you can actually see linear progression  in research as well.  So even though the output is what you want,  you can see researchers,  I've ordered this part of the code,  I've identified an attack surface,  I know these APIs are problematic.  All of these things are linear progressions  of getting deep into the target,  and ultimately you have a pretty good intuition  whether your researcher that has followed this path  is going to be successful.  What typically indicates non-success in a researcher  is that they won't have any tangible, measurable output  apart from the bug itself or the exploit itself,  and they don't know what the attack surface is,  enumerate all the APIs,  know the problematic things,  know the architecture of the system.  You can sort of see that they're not going to be successful.  But engineering needs to support that as well.  I mean, there's a lot of engineering work  to support vulnerability research.  But some researchers do prefer just research  and don't want to do engineering work.  Others don't mind a bit of both.  I sort of, as a generalist specialist founder,  I'll end up doing engineering work as needed as well.  At some point, the focus will be  to make everything as professional as possible.  You know, coding and research output standardisation occurs,  they follow standard sort of templates  and standard sort of use of your code.  You build systems and engineering work  to automate things as much as possible  prior to taking the human out of the loop  when it can be done,  just to have consistent output,  even though the human in the loop is always going to be there.  Internal design patterns and coding styles  become solidified and then pushed across  all the things that you're doing.  Now, exploit reliability.  The goal is as close to 100% reliable as possible.  In reality, this is the goal,  but in some cases it just can't be achieved.  In general, it's not desirable to have  a long run time in your exploit.  So if you have a reference count overflow  that takes four hours to trigger,  and the compiler core is spec'd at 100% CPU,  it's not considered practical for most people.  For many people, in fact.  In hobbyist approaches, ROP is seen  as a reasonable exploitation strategy as well.  And ROP is not a good strategy generally.  Sometimes that's all you can do.  So you do end up supporting these ROP chains.  It's sort of considered quick and dirty  to build a ROP chain, in fact.  But if you do that,  your exploit now is version specific.  You have to maintain ROP chains,  and the maintenance burden becomes quite significant.  Infrastructure you need.  We work on-prem.  You will need infrastructure.  Your network on your premises  will be vastly more complex  than is reasonable from a comparable-sized company.  You'll have on-planes  and various other types of networks.  And you need infrastructure people.  Good infrastructure people  can be somewhat challenging to hire.  And the thing is,  you need people that are very seeking  to understand your setup and requirements.  But VR companies generally aren't telco-grade,  work on telco-sized networks internally.  So the work, from an infrastructure perspective,  is interesting to work in a VR company.  It's not classically desirable by infrastructure people.  For me, and InfoSec in general,  my co-founder is a very senior infrastructure specialist  and was able to sort of cross that bridge quite well.  But for many other people,  I imagine building infrastructure  has its own set of complexities.  And if one of your domains is embedded, for example,  at InfoSec, we do hardware,  then your lab is going to be a significant cost as well.  We have an RFC library.  We have an X-ray machine,  rework stations and so forth.  All of these things are quite complex to manage  and complex to build.  And even just moving an X-ray machine,  you have to get forklift licenses.  All of these things add complexity.  Now, is there a technical glass ceiling to VR?  And I would say that many traditional jobs  do have essentially a ceiling  in terms of what you can do,  in terms of career progression.  It's true really regardless of what people advertise  on the brochures.  Certainly true in Australia.  Many techs reach their top level  in their area of expertise.  Their salary effectively maxes out  and the work they do becomes more routine.  And then they struggle to decide  if they want to transition to a non-technical role  for more impact.  So that's sort of the question,  you want to be an individual contributor  and have sort of impact,  or you want more impact by managing a team of techs now  and knowing that as a tech,  your salary is going to max out  and you're not going to be able to influence a company as much.  So this same is true even in academic research.  I've had a few years in academia.  Senior professors tend to see impact  by becoming more administrative and supervisory in nature.  So you see the same sort of things in that as well.  In VR, these things I don't think are the case.  It's simply not the case at all.  The more you learn, the deeper you go,  the more success you achieve.  Proportionally, the higher your salary and your bonuses become,  and really it's sort of a limited amount of depth  in knowing these targets  and being successful at finding both of them.  Is VR worth the hype?  Is it a good job?  I will say yes.  It's certainly the best job I've ever had  as a service in my technical career,  and it's not just because I am a founder.  It is the most technically challenging career I've experienced  in my odd 30 years of working.  I do have an amazing team that I work with,  and I do think we do certainly amazing stuff.  So that sort of brings me to the end of the presentation.  There's lots of things about running a company.  This sort of turned into a start-up talk as well,  how do you sort of build a start-up,  have that culture, hiring people and so forth.  But it's similar in a VR company as well.  That's that specialisation.  I've seen exploits referred to as modern-day magic,  and I do think it is an apt description.  That's it for me.  I'll take any questions.  Thank you, Dr. Sridhar.  Very insightful talk.  Just to check, yes, we do have a first question.  I'm coming.  Thanks.  Why is it that so many EEs end up getting into VR?  I think I like the engineers.  Yeah, the engineers, yeah.  Embedded has become more popular than it used to be, I suppose.  I mean, go back 10 or 15 years ago,  and embedded wasn't really a thing in society.  And now IoT, embedded, even OT,  is so integral into the world that we live in  that we want to look at them.  And so where do you hire people that look at embedded?  Well, I talked about on the slide,  we might hire forensics people to do it.  We might hire electronics or engineers  that look at hardware.  So I think it's sort of a pretty nice fit for IoT embedded.  There's probably a lot of people  that just go into software as well  just because they like the challenge.  But from our perspective, as we hire,  we will certainly say yes to good engineers  that can get firmware off devices,  get serial interfaces, JK and so forth.  So I think that roughly answers your question.  Thank you.  Question?  Thank you for the talk.  You mentioned that it's very important  to have consistent output.  Do you ever see, from your perspective,  you don't know when your researchers  will be able to find something,  but you have to constantly be producing output.  And do you see that time frame or the uncertainty?  How do you manage that uncertainty in your case?  That's a great question.  So it can be perceived as like  there's no output by a researcher  except the research output itself,  which is a bug or an exploit.  And I really disagree strongly with that idea  that research is this completely black box  and that at random point you just have some spike  and then it gets back to zero.  I can see in our team, like every day,  if you're finding new attack surface,  if you're auditing new code,  then you should document that.  And so you can start to see  that they are making progress in their targets.  And you sort of have a pretty good idea  because of this sort of every day  documenting what is being done.  You sort of have a pretty good intuition  whether it's like any day now,  I'm pretty sure something's going to be found.  And most of the time it's pretty accurate.  You can't predict that research output,  the good research output will come  because they've done all the work up to that point.  They remember that maybe they built a buzzer.  They found some sort of secret attack surface  that no one knows about.  They found this weak API system.  They found that the programmers are sloppy  in all their testing of certain cases and so forth.  There's instructions that the developers don't know  that we've identified.  All of those things are sort of  an important part of research,  but not the research output itself.  It's more like an internally focused output  so that for your peers and your bosses as a researcher  versus the customers who will just  prefer the research output itself.  But I do think it's not as completely opaque  the idea that you will be successful in research.  You generally know when someone is not going to be  successful in research because  often you'll see this idea of like  I'll just hop from idea to idea,  never go deep in one area.  And you say well actually you're just  sort of slightly on the same spot.  You need to sort of stop going and  hopping to the next thing that you're looking at  and just go deeper into the thing that you're looking at.  So depth is a pretty good indicator  that you'll be successful as well.  So the deeper you go in some subsystem,  the more likely you are to have a result.  If you have a research that's like  surface level, looks at a subsystem,  says oh it's actually getting really hard  to follow all this and I'll just jump to the next thing.  Well you're never actually going to be successful.  So I think that's from my experience at least.  Thank you.  Any other questions?  We do have time for, okay.  I'd like to take a question  in more kind of business perspective.  As a CEO of your company,  I speculate that  the companies that  manufacture the target  you research on should pay  for your vulnerability or  I think that the business  of that work in a way so  please give me any  episodes or cases that  the company,  the target company doesn't want  to pay for the vulnerability you found but  also  didn't want to publish  the vulnerability that you found.  I think I want to take the American  Hollywood TV legal angle and  say I plead the fifth.  I mean that's a great  question but really  I'm under NDAs and agreements with  all my customers so I can't really go too much  into depth on any of that but  great question though and certainly  I mean the disclosure debate,  if there's one thing that's persistent about the cyber security  industry is that every five years  someone solves disclosure  and then also password complexity.  It's just like passwords get longer  every five years because a big rant about  it becomes a mainstream media issue so  I would say I don't expect the  disclosure debate to be solved  in my lifetime but it will  be solved periodically by random people,  random new people every five years  so I enjoy the rest of my  career where the disclosure debate  is constantly being re-examined.  Thank you.  Hi,  good morning. Thank you for your talk. It's a good  oversight of the industry from a founder's point of view.  A quick question,  in your experience,  how easy is it to keep  key talent, key researchers  I mean because they just hop over  to another company that pays more.  Is cultured unity keeping  your guys intact, keeping your team intact?  That's a great question.  I think a lot of people have thought about  this problem and I would say  from my perspective  there's  not that many offensive security  companies out there and  you want basically the talent to stay  in the offensive industry  and not take terrible jobs  that oppose that.  So I mean how do you maintain  staff? I mean it's classic sort of  start-up things here. So how do you have  staff retention? Well, pay them what they're worth,  give them a good culture,  have people that  they can talk to  and all of those things. So I wouldn't say  we're uniquely unique as  staff retention in broader  cybersecurity. I mean it's still hard. I would just say that  it's not  a terrible thing to have sort of  staff move from company to company so long as they  don't take terrible jobs that oppose  that.  So in your experience with  interns or hires  from universities, how much  do you think that whatever they learnt  let's say in IT  or cybersecurity in the universities,  how applicable is it to  the actual work or do they have to really unlearn  a lot of the things that educators have to  do there? I've got a lot of  views on interns and juniors but  one thing, for example, we've had a lot  of remote  people at university in some other city  in our country say, I want to be an intern.  You do really good work,  that they see sort of thing, I'd like to be an intern.  And in our experience, remote juniors  or remote interns in vulnerability  research, a terrible idea. I mean  it's hard enough in a normal company to be a  remote intern junior  but in a vulnerability research company, the turnaround  time for feedback  of what they're doing and monitoring for what they're doing  and having a colleague next to them say  do this or do that, it's  all practically impossible.  So in that perspective, about  juniors and interns, I would say you can't  really hire them remote and so that  means that you get them from sort of your, they either  relocate to you or you  get sort of a local university or  something like that.  I would say that we  in our university that we have in Australia  we often do, as a company  a guest lecture to the  software security  course that they  have. And we basically talk about  things like keep exploitation. And then we sort of  say, well if you like this type of stuff  maybe apply as an intern to work for  us. And that worked out pretty well.  All the content that we do is  memory corruption and stuff  like that, so they have a pretty good idea.  Then we go through the normal process of talking  to them, understanding where they are  and if they're good at this type of work.  Another good thing about an internship is  it's prior before you buy  from an employer perspective. So if  they do a six month internship or a three  month internship and they're terrible  then they just don't become a  full time grad. That's pretty much  you know, it also gives them the opportunity  to say actually I don't really want  to do this type of work, I want to do something else.  Now you can't really give  interns or part-timers  in that sense good work.  And that's another sort of thing to manage  as well because generally you don't want to give good work  to people that are sort of transient  and might leave in  a few months time.  And so there is that challenge.  So again these are all challenges that  many other start-ups have but  the big challenge  as we are is that remote interns are  generally, that they will have a terrible  experience, they come across, they will see your  company is not really doing  anything useful for them because you can't really  give them good work, it's hard to get feedback and so forth.  So don't fire remote interns, it's quite  awkward.  Is there an age limit  to VR?  I mean there's a lot of  old school hackers that are sort of getting  older now will be like  actually a lot of my colleagues that were  sort of technical on tools  from years ago are now managers  and site leaders and all that type of stuff.  I'm still a diehard, I still have my  best experiences behind a keyboard  bashing away, reading  code and stuff like that so  I'd say that there's definitely a drop-off as you get older  for people to move into sort of the  not on the tools  side of things but I mean  at our company for example we have a mix of people  we have a bunch of sort of  you know sort of a younger  crowd, we have people with families and stuff like that  that are all technical  so I'd say it's a great job for older people  but I mean statistically I'm pretty  sure that a lot of my peers from  10 or 15 years ago aren't  as much on the tools as I'd like to be  today.  There's nothing that I prefer than just  reading code and writing  code and stuff like that.  Any other  questions? We still have about 10 minutes  if not  oh we do, okay.  Hi, given VR  applies to anything with a marketable  code, which areas do you think  needs the most people  to be on and why?  I mean managing  like if you're  if you need a full chain of anything  it's pretty hard for one person to be across all that  so the more components in a chain  probably has some sort of proportion  proportionality to how many team members  are needed to support that and depending on how much testing  you're doing as well you might need bigger teams as well  so I'd say more complexity  more targets, more components  in a target probably is proportional to the  number of staff that you have.  I'd like to exploit my  MC capacity to also ask  a question. So  where do you see  invulnerability research is  a skill gap or skill shortage in  general, that if there are  existing or aspiring VR  practitioners, if they want to  prepare for and address the skill gap  what would it be?  So for sure most people coming through university  today, like writing in C  isn't the  language that they normally learn to do  computer science. But then you see  these emergent communities, like the C camp  community is really good  and pwning an artery is  pretty good to do that  type of stuff. So I would say that in some parts  of universities the pipeline  isn't sort of,  the pipeline doesn't favour native  code, native languages  that type of stuff. But then you see  most universities now will have C  camp groups that do this type of  binary exploitation. So maybe  it's good, maybe it's bad. I don't know exactly how  to encourage more  juniors to get into the industry  but we do internships, we do  guest lectures, stuff like that  so I think it's a cool industry  hopefully other people come along  that pipeline as well.  Thank you.  Any last  questions?  Yes.  What's the most exotic target  you've overcome that you can talk about?  I don't know,  good question, maybe something to talk about  afterwards but very  I think that's the end of your answer, right?  Okay, got it.  If not,  I think we've asked  Doctor quite a bit so we want to  put our hands together again to thank him  and his generous service.


