Vollständiges Transkript von OMITB: Trusting the wrong package.

been involved in a lot of disruptions. 00:05:18.639 --> 00:05:24.240 But this is kind of the first like stage two of the same operation, stage three of the same operation. 00:05:24.399 --> 00:05:27.519 Because we talked about Operation Endgame in the spring. 00:05:27.600 --> 00:05:31.439 Uh, and usually these uh, you know, these operations are one and done. 00:05:31.519 --> 00:05:36.639 It's like, bam, we're gonna go in there, just zap the guys, and then kind of move on to the next thing. 00:05:36.879 --> 00:05:41.839 What was really cool about this is the good guys just basically said, hey, we're not done yet. 00:05:41.920 --> 00:05:55.920 You know, we're we we still want to just kind of go after these bad guys and uh continue to impact them because you know, everybody always talks about, well, you know, the name and shame or these disruptions, they don't have long-lasting impact. 00:05:56.160 --> 00:06:09.120 But I think what we've seen in this is that law enforcement is really serious about this and you know, to continue with that, you know, which we talked about in the past, like a lot of things go into you know these operations, you know. 00:06:09.279 --> 00:06:12.879 So it was just great to see everybody involved in that. 00:06:13.040 --> 00:06:15.439 And um, and I just talked a whole lot there. 00:06:15.519 --> 00:06:20.720 So I'm just gonna let you guys say a little bit more before I go into you know some of the other things. 00:06:20.879 --> 00:06:37.519 So well, why don't we just back up a half step and uh I'd love to know, since you two are the practitioners, uh, what are the things, what is the range of things that you would include under the umbrella of an info stealer? 00:06:37.600 --> 00:06:42.639 What are the capabilities who generally is uh doing these sorts of things? 00:06:42.720 --> 00:06:46.720 You know, what what do listeners who may not be familiar with it need to know? 00:06:49.759 --> 00:06:56.720 So Socolish is a dropper or a loader that's associated with um a threat activity cluster called Evil Corp. 00:06:56.800 --> 00:06:59.600 And those types of infections can lead to ransomware. 00:06:59.680 --> 00:07:01.279 So that's one piece of malware. 00:07:01.519 --> 00:07:04.879 But Steel C uh is an information stealer. 00:07:04.959 --> 00:07:10.879 It also has a dropper function, but basically, threat actors are targeting any information they could possibly get their hands on. 00:07:11.040 --> 00:07:21.920 So logs, cryptocurrency, usernames and passwords, banking information, any type of details that they could siphon from your computer, potentially use it to move flaterally within an infected network. 00:07:22.079 --> 00:07:27.439 And we've talked about this on the podcast before, how identity is kind of the gold standard now for threat actors. 00:07:27.519 --> 00:07:43.839 And there's this increase in information stealer activity as threat actors are trying to do more information gathering type focused activity to then do

things like potentially ransomware or ATO jumping or trying to, you know, facilitate compromises of additional users. 00:07:44.079 --> 00:07:46.560 And so info stealers are really growing. 00:07:46.639 --> 00:07:50.240 They can also be used as precursors to ransomware. 00:07:50.399 --> 00:07:53.839 And that's kind of the important part of Operation Endgame, right? 00:07:53.920 --> 00:08:00.480 They're kind of targeting all of the ecosystem, the different components of the malware universe. 00:08:00.639 --> 00:08:08.160 I like to call it like the malware cinematic universe because it's like all of these things that are like involved and ultimately like ransomware, right? 00:08:08.399 --> 00:08:10.800 These things can basically enable that type of activity. 00:08:10.879 --> 00:08:17.759 And then of course Amity is also this sort of like dropper loader, which is also does a lot of the same things as um a DLC. 00:08:17.839 --> 00:08:22.800 So these are were two separate actions, but kind of coordinated all under one umbrella. 00:08:23.120 --> 00:08:23.279 Yeah. 00:08:23.439 --> 00:08:52.000 And the thing too, Dave, is that you know, both both of these are kind of like, you know, malware as a service, you know, and um, you know, so the their their whole uh criminal ecosystem on the back end, like, you know, for for example, you know, uh Steel IC, they have like their uh channel with the give support, uh, you know, so pretty much, you know, they're they have support updates, new feature rollouts, and new releases, you know. 00:08:52.080 --> 00:08:58.879 So, you know, when we look at these guys, you know, we always think of like this hacker in the basement or or something like that. 00:08:59.039 --> 00:09:02.159 But these are guys that are running, and you know, they're running enterprises. 00:09:02.480 --> 00:09:05.919 It's very much a malware as a service enterprise model, right? 00:09:06.080 --> 00:09:13.519 So you have the creators of this malware that then sell to affiliates, and then those affiliates are the ones that are running the campaigns. 00:09:13.679 --> 00:09:19.759 So the creator, the manager of the actual malware is taking a cut of that and then is working with their own customers. 00:09:19.840 --> 00:09:32.000 And so I think, you know, Keita, it is really funny that you mentioned it is like an enterprise, it's like a business model, because I think what we've seen from a lot of these different groups is it is like kind of a well-run enterprise. 00:09:32.159 --> 00:09:43.039 Although I have to say that there were some sort of errors in some of the code that allowed investigators or researchers to be able to get a little bit more information, I think, than they probably would have wanted. 00:09:43.200 --> 00:09:46.080 Um, some of those flaws in the in the different panels. 00:09:46.159 --> 00:09:53.039 And there was even some potential maliciousness within the affiliates themselves that were kind of going back and forth. 00:09:53.200 -->

00:09:57.360 And yeah, so you have like these there's no honor among thieves, right? 00:09:57.440 --> 00:10:02.639 They're running a business, but also like it's possible that you know other crimes are being committed. 00:10:08.320 --> 00:10:09.360 I'm curious. 00:10:09.600 --> 00:10:16.799 So to what degree is the info stealing the end game itself for these folks? 00:10:16.960 --> 00:10:33.519 In other words, I'm I've stolen your information, I've bundled it up, and now I'm gonna sell that to someone else, versus uh the info stealer being the first step into me being able to then install ransomware or a crypto miner or something like that. 00:10:33.919 --> 00:10:39.840 Yeah, I I mean, I think there's a little bit of uh the tail wagging a dog on some of that. 00:10:39.919 --> 00:10:43.840 You know, it kind of goes circular depending on what you're trying to do. 00:10:44.000 --> 00:10:58.879 Uh, like for example, on the Soc Ghoulish stuff, you know, they were looking for in order to spread their their infostiller, they were actually looking to get like um cPanel access, WordPress, Joomla access. 00:10:59.039 --> 00:11:06.960 So they they were trying to buy these compromised websites or access to these websites so then they could have their phishing pages on the website. 00:11:07.120 --> 00:11:12.960 So like you're you're you're visiting a legitimate website, but you're getting infected now with the malware. 00:11:13.120 --> 00:11:21.440 So so you have compromised credentials on both ends of getting access to the website to then throw malware down to get more credentials. 00:11:21.679 --> 00:11:34.559 And the the really interesting thing is well, how cheap! Like, so the one actor for Sock Goulish, we saw him on the underground wanting to buy access to like the c panels and you know, the Joomla and WordPress. 00:11:34.639 --> 00:11:46.000 And like some of the prices, uh the he would pay a dollar for c panel access, he would pay 30 cents for WordPress access, and uh 40 cents, a big whopping 40 cents for Joomla. 00:11:46.080 --> 00:11:54.159 Uh, you know, so uh you know, so so it's really not like uh, you know, it's not like advanced malware to get access to these sites. 00:11:54.320 --> 00:11:58.320 It's you know, basically cents on the dollar to then set up your operation. 00:11:58.480 --> 00:12:09.120 Uh so it's kind of like a whole ecosystem, but it depends on really what you're looking for because there's different aspects that fuel the next part of the of the scheme, if that makes sense. 00:12:09.360 --> 00:12:09.759 Mm-hmm. 00:12:09.840 --> 00:12:10.159 Mm-hmm. 00:12:10.399 --> 00:12:23.519 Well, and also too, one of the interesting things about Web Injects in particular, um, Soc Golish is, you know, that threat actor is one of them, is the traffic distribution systems as well, that they're partnering with basically the facilitators of crime. 00:12:23.679 --> 00:12:30.799 So for like Steel C and Amity, these are um phishing-based or maladvertising-based types of activities. 00:12:30.879 --> 00:12:43.600 So they'll send malicious emails or they'll, you know, have some malvertising, but with like the web inject activities that are trying to insert that malicious job script on the WordPress or related websites, those partner with like additional threat actors. 00:12:43.679 --> 00:12:48.159 And in the case of Sat Golish, they also kind of ran their own traffic distribution service. 00:12:48.399 --> 00:12:54.000 So the actual targeted targeted activity targeted like that part of that whole service, right? 00:12:54.080 --> 00:12:57.279 So it wasn't just like trying to clean up the injects themselves. 00:12:57.360 --> 00:13:01.759 It was also trying to see, okay, what can we do with this like traffic distribution service that they're running themselves? 00:13:01.919 --> 00:13:06.639 It was like this this interesting thing to kind of see the impacts beyond just the websites getting cleaned. 00:13:06.720 --> 00:13:08.720 It's like, okay, what else is happening? 00:13:08.960 --> 00:13:16.399 And for all of the disruptions during the entire action, according to Europol, it has a pretty big impact. 00:13:16.559 --> 00:13:26.480 So 326 servers and 142 domains were actioned by law enforcement and private sector partners that crippled the malware's distribution network. 00:13:26.639 --> 00:13:37.679 And crypto assets of criminal origin, currently valued at over 41 million euros or 47 million dollars, were identified, flagged, and thereby restricted from use. 00:13:37.840 --> 00:13:42.480 And as many as 27 million stolen loggering credentials have been recovered as part of the operation. 00:13:42.639 --> 00:13:51.440 So it's quite costly for from the threat actor perspective, um, as well as the sort of overall disruption to the services. 00:13:51.919 --> 00:13:57.200 And not bad for like uh, you know, it's uh you're just talking about the scale of the bad guys. 00:13:57.279 --> 00:14:00.720 It's a it's a pretty nice-sized business, if I can think, you know. 00:14:00.879 --> 00:14:05.120 Uh and and and basically the bad the the good guys here, we hit their supply chain. 00:14:05.200 --> 00:14:08.559 Uh, you know, we kind of do this kind of reverse things where they're hitting our supply chain. 00:14:08.720 --> 00:14:11.679 We decided to uh kind of disrupt their supply chain. 00:14:11.759 --> 00:14:18.080 So Keith, can you take us behind the scenes of of the planning of a disruption like this? 00:14:18.240 --> 00:14:25.360 I mean, you know, keeping it in general terms, how does law enforcement come at something like this that that is at this scale? 00:14:25.679 --> 00:14:40.080 Yeah, so I I think first it's gonna start with like companies like Proof Point that Selena works for and having that intelligence and kind of going to law enforcement and saying, hey, you know, we're seeing a lot of visibility right now into sock ghoulish or this threat that's out there. 00:14:40.320 --> 00:14:47.759

It would be great if uh you guys did something about this, uh, you know, and so then uh, you know, law enforcement goes, okay, well, you know, this is impacting. 00:14:47.840 --> 00:14:49.840 What what what type of impact can we do? 00:14:50.000 --> 00:14:51.840 You know, is this as big as you want? 00:14:52.000 --> 00:15:08.080 And then, you know, in this case, they were at Europol, and Europol was is just a really awesome place to kind of bring together all the law enforcement, especially in the EU, uh, and you know, in the the US is over there, and the other Five Eye partners like Canada and Australia. 00:15:08.320 --> 00:15:13.759 So they all they all sit and they all have their representatives right there in The Hague. 00:15:13.919 --> 00:15:19.679 Uh, and they're able to then pull that data from any of their member states or their other law enforcements. 00:15:19.840 --> 00:15:29.279 So now, even though the infrastructure is all around the world, now this kind of is a good central pulling point to kind of coordinate everything. 00:15:29.519 --> 00:15:35.840 So, so now, hey, maybe we need something from uh the United States, a Gmail or as a server. 00:15:36.000 --> 00:15:47.200 So the FBI or Secret Service could go out and issue uh, you know, legal process to get that data, or maybe something is at Hettner in Germany and the BKA could go out and get that. 00:15:47.279 --> 00:15:53.200 And then it will all kind of come back into that uh basically that coordination center or command post. 00:15:53.519 --> 00:16:01.759 And then at that point, once they get the legal processes in place, then that's when they kind of get with private industry. 00:16:02.000 --> 00:16:05.360 Are there gaps that we can't, you know, do as law enforcement? 00:16:05.519 --> 00:16:07.200 Can't private industry help us out? 00:16:07.679 --> 00:16:14.559 You know, if you're gonna seize like domains or things, you need to have like uh, you know, ICANN or the other registrars involved. 00:16:14.720 --> 00:16:22.720 And then really at the end of the day, how are we gonna kind of pull this off all coordinated at one time uh and make it go off without a hit? 00:16:22.879 --> 00:16:31.600 So so that's kind of like uh there's there's a lot of long nights and a lot of uh beers and other drinks at bars afterwards to play and everything. 00:16:31.840 --> 00:16:37.600 So more more often than not, it goes right rather than horribly wrong. 00:16:37.840 --> 00:16:38.480 Yeah. 00:16:39.519 --> 00:16:41.759 I feel like that's the most important part, Keith. 00:16:41.919 --> 00:16:43.519 The late nights and the beers. 00:16:44.240 --> 00:16:46.159 Well, we're all working for something. 00:16:46.399 --> 00:16:46.720 Yeah. 00:16:46.960 --> 00:16:58.240 Well, well, I think you know, a lot of times, you know, when when you get into some of these big um meetings when you have all these different lawyers and other law enforcement and industry people there, sometimes people don't want to speak up all the time. 00:16:58.399 --> 00:17:04.000 Uh, you know, so but when you get people out with beers, they they tend to pretty much tell you what they think. 00:17:04.079 --> 00:17:07.519 Uh so uh so then you know, then you can kind of plan things. 00:17:07.599 --> 00:17:09.599 Um but it it is really neat. 00:17:09.680 --> 00:17:15.119 And I think I told the story before, before we were doing the core flood uh takedown. 00:17:15.359 --> 00:17:30.559 You know, once you get ready to do that and you got to get that legal sign-off, when we were gonna do core flood, we had to go to the attorney general uh and you know, he had to sign off on it and he looked at it and he goes, It looks good, uh, but just remember if you break it, you bought it. 00:17:30.720 --> 00:17:39.839 So is that like the in the movies when they say the State Department will deny all knowledge of your operation if it doesn't go well? 00:17:40.079 --> 00:17:41.200 Yes, exactly. 00:17:42.960 --> 00:17:49.839 Well, actually, I'm so glad that you mentioned lawyers because they play a really interesting role in all of this too. 00:17:50.000 --> 00:18:03.519 I think a lot of times people think about disruptions and takedowns as, you know, cyber operators and hackers and, you know, kind of the pew-pew maps of things and maybe, you know, seizing servers and busting down doors and stuff. 00:18:03.680 --> 00:18:09.839 But um, there is a lot of uh sort of like legal process that can be used against this stuff. 00:18:10.000 --> 00:18:20.240 And lawyers, cybercrime lawyers, I have so much respect for, actually chatted with um Sean Farrell, who is an assistant general counsel of Microsoft's digital crimes unit. 00:18:20.319 --> 00:18:27.200 And they have really sort of innovated when it comes to doing takedowns via lawsuits. 00:18:27.440 --> 00:18:32.160 And I've never like left a conversation wanting to go to law school until this moment. 00:18:32.480 --> 00:18:35.200 And I was like, wow, do I need a career change? 00:18:35.279 --> 00:18:36.319 Because this sounds so fun. 00:18:36.480 --> 00:18:42.160 I mean, it's really cool because you can use these civil actions to disrupt criminal criminal infrastructure. 00:18:42.319 --> 00:18:50.880 And basically they use Rico, which is a Racketeer Influenced and Corrupt Organization Act that targets organized crime to actually go after some of these cyber criminals. 00:18:50.960 --> 00:19:03.599 And in the case of Steel C and Amity, they were able to identify shared infrastructure between these two groups and kind of do an all-in-one civil suit against this whole ecosystem, these info stealers and the malware together. 00:19:03.759 --> 00:19:08.319 And so it was really kind of cool to see um some of their publications on it. 00:19:08.400 --> 00:19:12.640 Like, here's how we were able to sort of sort of like innovate, and here's how lawyers play a role in this, right? 00:19:12.799 --> 00:19:18.240 Like I'm just over here, like beep boop, I'm on the

computer, and they're like filing important documents and things. 00:19:19.519 --> 00:19:22.400 Yeah, so yeah, I mean, that's a really fascinating point. 00:19:22.480 --> 00:19:24.000 I'm glad you brought it up, Selena. 00:19:24.240 --> 00:19:27.279 So what's the reality on the ground, Keith? 00:19:27.440 --> 00:19:39.440 Like when you have trusted partners, you know, it's like a behemoth organization, like a Microsoft or a Google or an Amazon, um, and they say to you all, hey, we've got this. 00:19:39.599 --> 00:19:46.160 You know, how how long a leash do you give a private organization like that to take corrective action? 00:19:51.680 --> 00:19:53.359 Yeah, that's a good question. 00:19:53.519 --> 00:20:01.279 So, I mean, Microsoft has been kind of on the forefront of doing this for uh well over 15 years now, which is really good. 00:20:01.519 --> 00:20:02.400 And I I love Sean. 00:20:02.640 --> 00:20:05.680 Sean's a former FBI colleague of mine, just a great guy. 00:20:05.759 --> 00:20:14.160 And Dave, if you haven't had him on your show, you should have him gone to kind of talk about what they're doing in the space because it it is really fascinating and cutting edge. 00:20:14.400 --> 00:20:19.599 When they first started doing it, you know, they were trying to make an impact, you know, 15 years ago. 00:20:19.759 --> 00:20:21.680 You know, maybe there wasn't that coordination. 00:20:21.759 --> 00:20:27.119 They they were trying to protect their area of you know, of Windows computers. 00:20:27.200 --> 00:20:35.759 And, you know, the the first one or two times they acted uh without, you know, not thinking about how it may impact like an FBI case. 00:20:35.839 --> 00:20:45.839 Uh, but really over these last 15 years, that coordination has gotten so much better now because I think what everybody's realized is that it really takes a village. 00:20:46.079 --> 00:20:51.200 And everybody plays an important role, you know, in this to make that collective win. 00:20:51.359 --> 00:20:58.160 And the great thing is, is that Microsoft being this big behemoth, you know, very forward thought thinking. 00:20:58.400 --> 00:21:06.559 Now, other companies will go, hey, well, if Microsoft could do it and they're a big bureaucracy and they have a lot of potential liability, we can kind of do this too. 00:21:06.799 --> 00:21:11.920 So I love what they're doing because it really is setting the trend uh, you know, for that. 00:21:12.079 --> 00:21:17.519 And I think just much more coordination has been involved because they've done so many of these now. 00:21:17.599 --> 00:21:19.119 It's getting to be second nature. 00:21:19.200 --> 00:21:20.319 And that's what we want. 00:21:20.480 --> 00:21:34.799 We want to be able to kind of do this off the shelf and not reinvent the wheel every time stick around after the break. 00:21:44.400 --> 00:21:46.400 How do we measure success? 00:21:46.720 --> 00:21:59.759 You know, obviously we have these takedowns, uh, but it seems like

groups pop up not long afterwards or they reform, or you know, it is part of this monitoring the criminal forums to see that you know these folks are getting a little more. 00:22:00.160 --> 00:22:03.039 Tentative about getting into this business at all? 00:22:03.359 --> 00:22:06.240 I don't think that it's going to stop people from getting into the business. 00:22:06.319 --> 00:22:07.839 Because if you're a criminal, you're a criminal. 00:22:07.920 --> 00:22:08.799 It doesn't matter. 00:22:09.119 --> 00:22:19.119 You know, there's always been the threat of getting arrested, whether, you know, you're running, uh, you're running a gambling ring or you're running cybercrime, you know, the everybody that gets into criminal activity. 00:22:19.279 --> 00:22:22.559 But it does make them a little leery and it does impact their operations. 00:22:22.880 --> 00:22:29.039 And, you know, if you impact somebody and they're down for six months, that's six months of uh, you know, of an impact. 00:22:29.119 --> 00:22:31.440 And if you could put them in jail, even better. 00:22:31.599 --> 00:22:37.759 As long as there's ever crime, which will be forever, there's always going to be somebody that's going to step up into the place, next place. 00:22:37.920 --> 00:22:40.799 But the big thing is you need to disrupt the operations. 00:22:40.880 --> 00:22:42.400 You just can't let it go on. 00:22:43.119 --> 00:22:47.680 So I think there's also a few things to consider when you're thinking about the impact to this stuff. 00:22:47.839 --> 00:22:54.480 So it's one of my favorite parts of my job is actually measuring success of takedowns and disruptions. 00:22:54.799 --> 00:23:00.079 Because you can look at data and say, okay, here's how long this service was down. 00:23:00.400 --> 00:23:02.799 Here are the number of websites that were cleaned up. 00:23:02.880 --> 00:23:04.000 So actually, it's important. 00:23:04.079 --> 00:23:05.359 I think I wanted to highlight that too. 00:23:05.440 --> 00:23:13.920 So in the case of Sockolish, the law enforcement was able to clean almost 15,000 websites, basically deinfect them, right? 00:23:14.000 --> 00:23:22.160 So that plays a huge role in disrupting the botnum because that means that that actor has to go reinfect all of these websites again if they, if they really want to. 00:23:22.400 --> 00:23:23.759 So that's part of it, right? 00:23:23.839 --> 00:23:26.000 So it's like, okay, how effective was this? 00:23:26.240 --> 00:23:34.079 Putting out awareness and general like information about this threat always plays a huge role as well, because you can kind of time it with the disruption. 00:23:34.160 --> 00:23:36.000 You can further education for the end user. 00:23:36.079 --> 00:23:40.319 You can really encourage organizations to say, hey, this is what you have to pay attention to. 00:23:40.480 --> 00:23:50.400 Um, but from our data, for example, we see significant disruptions pretty much every single time there is a law enforcement, either full takedown or disruptions to activity. 00:23:50.559 --> 00:24:00.480 So it'll be a reduced number of emails that we'll see through our telemetry, a reduced number of uh C2s or panels or servers that are actually active and associated with the particular malware or threat actor. 00:24:00.640 --> 00:24:16.079 You see, I'm sure Keith sees this too and can probably speak to it, some chatter on the underground that is a lot more like, oh, okay, well, they're on to us, or we're gonna have to change something, or they might actually even close purchases for a prolonged period of time, potentially even altogether, just completely take their, oh, there's too much heat on me. 00:24:16.160 --> 00:24:17.359 I'm gonna go elsewhere. 00:24:17.599 --> 00:24:24.799 But there's also this idea of sort of causing mistrust among the criminal ecosystem and the affiliates. 00:24:25.039 --> 00:24:33.839 And one really interesting thing that Operation Endgame is doing that they're really pioneering is these videos that they post with every takedown. 00:24:33.920 --> 00:24:44.720 And they'll have these little Easter eggs in the video that are explicitly targeting the threat actor or the affiliates that are part of this targeted effort. 00:24:44.880 --> 00:25:03.839 And so you can see, oh, maybe there's like a username that's included in there that they're like clearly going after them, or maybe there's some sort of indication that the affiliates are turning on each other, or maybe the malware creator is actually like stealing some of the information that they are, you know, siphoning off of their own affiliates, and you know, depending on what the actual video is. 00:25:03.920 --> 00:25:07.920 They've done it for pretty much all of their takedowns and or disruptions. 00:25:08.000 --> 00:25:10.559 And I think that, you know, that's kind of fun too. 00:25:10.640 --> 00:25:20.160 So you have this also sort of like social engineering happening at the same time as the sort of like actual technical targeted efforts. 00:25:20.319 --> 00:25:26.480 Um, and at the end of these videos, there's always like reach out, like think about your next move, or like come talk to us. 00:25:26.640 --> 00:25:31.039 And there's that sort of attempt to get people to turn themselves in or engage with them. 00:25:31.119 --> 00:25:34.799 So I think, you know, I'll oftentimes I hear a lot of scorn in the industry. 00:25:34.960 --> 00:25:36.640 Oh, well, you know, they're just gonna come back. 00:25:36.720 --> 00:25:38.400 So why bother doing these takedowns? 00:25:38.799 --> 00:25:44.720 But I think this idea of imposing cost is from a financial perspective, there's tons, you know, asset seizures is huge. 00:25:44.880 --> 00:25:54.079 From an actual infrastructure perspective, you know, imposing that cost is huge because it, you know, removes their current capabilities and forces them to spend more money to retool more time. 00:25:54.240 --> 00:25:59.359 There's a time stack, a

time cost, there's a reputational cost, and there's a psychological cost too. 00:25:59.519 --> 00:26:02.640 So when all of these are factored in, it can have a huge disruption. 00:26:02.799 --> 00:26:10.640 So maybe we're not like maybe, yeah, we'll see a blip in traffic, or maybe they'll come back after a couple of months to be at the same level of activity. 00:26:10.960 --> 00:26:19.599 But all of those factors and variables played a role in terms of their decision making and the potential that they have lost business, which is ultimately what we want. 00:26:19.759 --> 00:26:21.680 We want them to make less money and do less crime. 00:26:21.920 --> 00:26:27.200 Yeah, really at the end of the day, it's not just bringing down servers, it's attacking that trust in that criminal ecosystem. 00:26:27.279 --> 00:26:32.880 Uh, you know, you wanna, you want to have customers distrust their operations, you want to break that trust. 00:26:32.960 --> 00:26:35.519 Uh, and just you were just talking about those little Easter eggs. 00:26:35.599 --> 00:26:36.559 I'll share a little story. 00:26:36.720 --> 00:26:51.279 When I was uh when I came out from undercover, you know, everybody kind of knew that I was there was there was this one criminal that that hit me up online and you know, he hit me up and he's like, you effing fed and you know, and and and all that type of stuff. 00:26:51.680 --> 00:26:54.720 You know, and I responded back to him because he was on our target list. 00:26:54.799 --> 00:26:56.559 He just wasn't home when we raided him. 00:26:56.720 --> 00:26:58.880 I was like, dude, we know who you are. 00:26:59.039 --> 00:27:13.279 Uh you could spend the rest of your life on the run uh and constantly looking over your shoulder of when you're gonna get arrested in you know, this cafe in Paris or when you're at the beach in Nice or somewhere else, or you could just go turn yourself in and just get it over with. 00:27:13.359 --> 00:27:15.359 Uh and two days later he turned himself in. 00:27:15.440 --> 00:27:16.960 So it does work. 00:27:17.279 --> 00:27:24.079 But that that was my next question, Keith, was whether do because I find it hard to believe that these people actually turn themselves in. 00:27:24.160 --> 00:27:28.079 But you laid out the case for why that could be in their best interest. 00:27:28.400 --> 00:27:36.880 Yeah, I mean, especially, I mean, if law enforcement knows who you are, I mean, the only way that you're gonna not get caught is if you stay in Russia or China. 00:27:37.039 --> 00:27:44.480 Uh, you know, and even in those, some, you know, even in those places, if you're not paying people off, you may end up falling down the steps or something like that. 00:27:44.640 --> 00:27:53.680 Uh, you know, so uh, you know, so sometimes it's in your best interest to just um go and uh turn yourself in and let the legal process go through it. 00:27:53.839 --> 00:28:02.400 So uh and because a lot of times the people, you know, they'll be on the run for a couple years, they'll get caught, and then you know, then they have to go through the process, you might just get it over with. 00:28:02.559 --> 00:28:05.200 So that's that that's my suggestion to all the criminals. 00:28:05.279 --> 00:28:07.119 Just turn yourself in, get it over with. 00:28:07.759 --> 00:28:08.880 Going to get caught. 00:28:09.119 --> 00:28:10.559 You might as well get it over with. 00:28:10.720 --> 00:28:11.839 Serve your time. 00:28:12.720 --> 00:28:14.319 Straighten up and fly right. 00:28:18.960 --> 00:28:22.720 Well, what do we feel in terms of like the overall arc of this? 00:28:22.960 --> 00:28:26.079 Are our you know, this this didn't always exist. 00:28:26.160 --> 00:28:27.200 It's here now. 00:28:27.519 --> 00:28:29.119 Is this here to stay? 00:28:29.440 --> 00:28:32.640 I I know from the industry standpoint, industry freaking loves it. 00:28:32.799 --> 00:28:35.839 You know, they're like, hey, let's let's do it, can we do it again tomorrow? 00:28:36.000 --> 00:28:38.160 Uh you know, and you know, and all of that. 00:28:38.319 --> 00:28:43.039 And, you know, in the law enforcement, they they love it because they're making impact. 00:28:43.200 --> 00:28:45.599 And really at the end of the day, that's what they want to do. 00:28:45.680 --> 00:28:49.839 And and if they have impact from their partners as well, uh they want to continue. 00:28:49.920 --> 00:29:00.000 And everybody, every politician or every uh, you know, elected official or like in the government, they love to see their name on TV. 00:29:00.160 --> 00:29:03.200 Uh, you know, and they love to be part of something special. 00:29:03.359 --> 00:29:06.160 Uh, and and so success breeds success. 00:29:06.640 --> 00:29:08.400 Stand in front of the big seal. 00:29:10.400 --> 00:29:11.759 What were you saying, Selena? 00:29:11.920 --> 00:29:13.920 Oh, yeah, no, I so I think so. 00:29:14.000 --> 00:29:16.240 First of all, it's here to stay for sure. 00:29:16.400 --> 00:29:27.599 Um, but I also think that the it's become initially, I I feel like takedowns or disruptions were, oh my gosh, they did a takedown. 00:29:27.680 --> 00:29:29.680 Like, this is crazy, this is unbelievable. 00:29:29.839 --> 00:29:30.799 I can't believe they did it. 00:29:30.960 --> 00:29:32.160 This is so interesting. 00:29:32.400 --> 00:29:33.440 We have to talk about it. 00:29:33.519 --> 00:29:36.400 But now it's just kind of like, okay, yeah, this is yet another takedown. 00:29:36.480 --> 00:29:46.960 And I think it's really cool that we've gotten to that point where, you know, okay, maybe it's just not as newsworthy as it used to be, or maybe it's just not as cool because it's just expected that this is what happens. 00:29:47.200 --> 00:29:52.240 I think that there's a lot of interest from all sides right now to be able to contribute to this. 00:29:52.400 --> 00:30:05.359 Because at least from my perspective, as someone who works in the industry, I often feel like I'm just sort

of banging my head against the wall because, like, okay, crime is happening, more crime is happening, I see crime happening. 00:30:06.079 --> 00:30:07.839 I can write detections to stop it. 00:30:08.000 --> 00:30:09.119 But like, how else? 00:30:09.279 --> 00:30:10.319 Like, what else can I do? 00:30:10.400 --> 00:30:12.640 You know, how can I have like a real world impact? 00:30:12.880 --> 00:30:16.480 And so I think it's really awesome to be able to see the real world impact of this. 00:30:16.559 --> 00:30:18.000 And whether or not you get handcuffs, right? 00:30:18.079 --> 00:30:20.319 Like, that's really, that's really when it stops, right? 00:30:20.400 --> 00:30:22.880 Is when you're able to handcuff someone, put them in jail. 00:30:23.039 --> 00:30:24.559 You know, all right, you're you're done. 00:30:24.640 --> 00:30:26.000 That malware guy is gone. 00:30:26.240 --> 00:30:29.200 But I mean, I think it's an ongoing process, it never stops. 00:30:29.440 --> 00:30:31.759 And I think that, you know, it's important to note here too. 00:30:31.839 --> 00:30:34.799 So, first of all, this wasn't necessarily a full takedown, right? 00:30:34.880 --> 00:30:46.079 Like Sakolish is not, it is, I I I refer to it in our blog as literally like the grandfather of web injects or like the OG of the like threat landscape because they've been around forever. 00:30:46.160 --> 00:30:57.680 They're a very prominent cyber criminal group that was they're associated to Evil Corp, which is a Russian uh cyber criminal outfit, a bunch of different ransomware families they've been, you know, had links to. 00:30:57.839 --> 00:31:02.160 So it's a big group, but saying, hey, we're we're coming after you is great. 00:31:02.319 --> 00:31:06.000 And what we're gonna see, I think, too, is like the the echo through the rest of the ecosystem. 00:31:06.079 --> 00:31:15.119 Because if if sockolish was sort of the innovator of the web inject landscape, I think all the rest of these threat actors that are doing, because it's a really popular technique now. 00:31:15.279 --> 00:31:22.640 And sometimes you'll find infected websites that are infected with multiple different web injects, because it's such a common technique used by a variety of threat actors. 00:31:22.720 --> 00:31:32.240 It went from being only Sokolish TA569 to I think we track like a dozen web inject-related threat clusters right now, at least at my team at ProofPoint. 00:31:32.480 --> 00:31:36.079 So maybe there's some reverberation that we're gonna feel across the ecosystem. 00:31:36.240 --> 00:31:41.759 Maybe they're gonna feel, oh, wait a second, if this group is being targeted, maybe I should rethink my strategy. 00:31:41.920 --> 00:31:46.640 Like clearly, there's being a lot of attention paid on this particular technique, a lot of these compromises. 00:31:46.799 --> 00:31:52.240 There was, you know, information about how to patch and advice for website owners and defenders to like pay attention to this. 00:31:52.319 --> 00:31:55.279 So maybe we'll kind of see this reverberation across the ecosystem. 00:31:55.440 --> 00:32:02.160 And then maybe we'll just continue to see some of these like targeted takedowns or targeted disruptions of some of these other types of activity. 00:32:02.240 --> 00:32:11.680 And I think that to me, that's really important is that one, end users are aware that Sock Goalish is not the only web inject threat cluster that is doing this type of activity. 00:32:11.839 --> 00:32:15.839 And it's important to be able to protect yourself against the threat overall. 00:32:16.319 --> 00:32:22.880 And two, hopefully we can kind of see this reverberation through the ecosystem where even SAG Goalish is coming under scrutiny, right? 00:32:22.960 --> 00:32:25.839 They've been around forever and they're still going under scrutiny. 00:32:26.000 --> 00:32:32.799 So yeah, I'm hopeful that we'll kind of continue to see some of that echo throughout the throughout all of the criminal underground. 00:32:32.880 --> 00:32:37.519 And I don't know, maybe you'll start seeing some more gossip on the forums about stuff like this. 00:32:37.759 --> 00:32:40.079 And I just want people to think, well, what's next? 00:32:40.240 --> 00:32:43.920 You know, say, hey, we just did this, you know, what's the next thing they're gonna hit? 00:32:44.079 --> 00:32:49.279 You know, or you know, so uh that that we want that distrust and and that that's what I love. 00:32:49.440 --> 00:33:09.440 And I think the other thing too, Dave, that is that, you know, we all, you know, we're in the corporate space and you know, we're usually in the corporate when you have that opportunity to kind of make a difference in the mission, uh, that's kind of uh it's just a different category of just your normal defense for you know a corporate partner, which is important. 00:33:09.680 --> 00:33:20.880 Um, but when you actually get a chance to make an impact like that, going after the bad guys, uh that that you know, that just makes you want to just kind of put your hand on your heart and stand up and just you know go go for the missions. 00:33:20.960 --> 00:33:24.319 And and I think that's what everybody really likes about it as well. 00:33:28.400 --> 00:33:32.240 I guess it also plays a part in international relations, right? 00:33:32.400 --> 00:33:34.400 I mean, there's a diplomacy aspect to this. 00:33:34.720 --> 00:33:36.480 Oh, no, no doubt about it. 00:33:36.640 --> 00:33:40.400 Uh, and and it just makes that uh, you know, that world a little smaller. 00:33:40.559 --> 00:33:52.640 You know, when you think about uh you're here in the United States and there's infrastructure overseas, everybody over there, let's say in France and Germany or the UK, they all have their own important priority things as well. 00:33:52.799 --> 00:34:02.079 So at what point, you know, do you get them to move your requests to the top of their list uh and being part of these things and building those

relationships? 00:34:02.160 --> 00:34:26.159 And like when you go out to Europol, Selena and I were out at Europol last year for a conference, and you just sit around and you're getting a chance to meet a lot of people and you, you know, you meet maybe somebody from Latvia or Lithuania that you know that you just never thought of or you know, meeting, but yet, you know, next week there's a server in Latvia right now, and now now you know you can call Pavel, you know, and he can go help you out. 00:34:26.320 --> 00:34:30.159 You know, so so it's really important to do that and to build those relationships. 00:34:30.239 --> 00:34:33.280 Because really at the end of the day, relationships are what makes the world go round. 00:34:33.599 --> 00:34:36.320 You can all hold hands and sing we are the world. 00:34:36.960 --> 00:34:40.880 I personally would love to kick myself out of a job. 00:34:41.119 --> 00:34:59.920 If, you know, if at the end of this there is no not enough work for cybercrime analysts because we've done such a good job with private public partner collaboration that crime has decreased so drastically that I can go, I don't know, be a librarian or like open open a coffee shop, I would be so happy. 00:35:00.239 --> 00:35:11.360 Here's what needs to happen is we need to take all of the assets that we seize from them, put them into a big pot for the old age retirement home for retired analysts who've been put out of work, right? 00:35:11.440 --> 00:35:14.480 So you have a so you have a place to live, you get a monthly stipend. 00:35:14.639 --> 00:35:23.599 You know, it's like the old actors' home in Hollywood where they just take care of you, but based on the ill-gotten gains that uh, you know, Keith's colleagues collected over the years. 00:35:23.840 --> 00:35:24.320 I love it. 00:35:24.400 --> 00:35:28.480 It's what we'll call it like the uh the AI fund for the AI displacement fund. 00:35:28.800 --> 00:35:29.840 There you go. 00:35:39.360 --> 00:35:42.079 We will be right back after this quick break. 00:35:51.519 --> 00:35:58.400 Well, I do want to just make sure that before we leave, especially if we're talking about the compromised websites, some recommendations for folks. 00:35:58.559 --> 00:36:02.000 Um so obviously, like network detections and endpoint protection are huge. 00:36:02.320 --> 00:36:13.039 But really the things that to kind of look out for, especially with Slack Golish and some of the other web inject stuff, from a defender, actual defender perspective, is restrict Windows users from downloading script files and anything but a text file. 00:36:13.199 --> 00:36:14.639 You could do that via group policy. 00:36:14.960 --> 00:36:18.800 Consider disabling PowerShell for general users who don't need it for their workflow. 00:36:19.199 --> 00:36:22.719 And from the website management side of the house. 00:36:22.800 --> 00:36:29.599 So for organizations that like own websites, like website administrators, make sure you have MFA on. 00:36:29.840 --> 00:36:37.920 Um, you know, consider something like YubiKey or additional layers of protection for that, which is direct access to the WordPress admin with allow listing. 00:36:38.239 --> 00:36:45.119 Just there's a lot of some of these sort of very sort of, I don't know, air quotes basic uh security recommendations that you can implement. 00:36:45.440 --> 00:36:48.079 The WordPress plugins and themes is a huge one. 00:36:48.159 --> 00:36:53.280 Make sure that you're getting them from legitimate websites and they're maintained, being up to date as much as possible. 00:36:53.599 --> 00:36:53.840 Yeah. 00:36:53.920 --> 00:37:02.559 So just really make sure that you're trying to make the best of your web security that you possibly can because a lot of these web inject threat actors, including Zach Golish, really try and exploit that. 00:37:02.800 --> 00:37:06.880 So um, yeah, it's it's it's exciting, but it's still a threat. 00:37:06.960 --> 00:37:08.960 And we have to make sure that we're staying on top of it. 00:37:09.119 --> 00:37:12.079 And uh, I just hope we continue to have more of these. 00:37:12.159 --> 00:37:14.320 So we don't have a podcast episode on all of them. 00:37:14.480 --> 00:37:17.599 It's just so common that we're just like, oh, yep, another disruption. 00:37:18.559 --> 00:37:20.159 The disruption of the month. 00:37:20.400 --> 00:37:21.360 Exactly. 00:37:21.679 --> 00:37:26.159 And that's only malware in the building, brought to you by N2K CyberWire. 00:37:26.400 --> 00:37:33.119 In a digital world where malware lurks in the shadows, we bring you the stories and strategies to stay one step ahead of the game. 00:37:33.280 --> 00:37:40.960 As your trusty digital salutes, we're unraveling the mysteries of cybersecurity, always keeping the bad guys one step behind. 00:37:41.199 --> 00:37:43.280 We'd love to know what you think of this podcast. 00:37:43.440 --> 00:37:49.360 Your feedback ensures we deliver the insights that keep you ahead in the ever-evolving world of cybersecurity. 00:37:49.599 --> 00:37:54.239 If you like the show, please share a rating and review in your favorite podcast app. 00:37:54.480 --> 00:38:01.599 This episode was produced by Liz Stokes, mixing and sound design by Trey Hester, with original music by Elliot Peltzman. 00:38:01.840 --> 00:38:03.920 Our executive producer is Jennifer Ivan. 00:38:04.320 --> 00:38:06.639 Peter Kilpie is our publisher.