WEBVTT
00:00:00.400 --> 00:00:06.240
Hi, today's your host, Selena Larson, principal threat researcher here at ProofPoint and host of the Discarded Podcast.
00:00:06.639 --> 00:00:10.160
Did you know I'm also a co-host of the Only Malware in the Building?
00:00:10.560 --> 00:00:16.960
This is a monthly segment crafted through a collaboration between N2K Cyberwire and the Proof Point Discarded Podcast.
00:00:17.199 --> 00:00:21.120
Our segment focuses on the most impactful and intriguing malware stories.
00:00:21.440 --> 00:00:33.039
We aim to distill complex cybersecurity information into digestible and insightful segments for tech professionals, providing security executives a clear and engaging silhouette that is actionable.
00:00:33.359 --> 00:00:44.159
I am joined every month by my co-host NTUNDK Network's data editor and Keith Wilarski, a former FBI cybercrime investigator and now chief global ambassador at Q Intel.
00:00:44.640 --> 00:00:50.000
This week, I wanted to bring you a sample of Only Malware in the Building, trusting the wrong package.
00:00:50.479 --> 00:00:58.320
In this episode, we dive into the evolving threat of software supply chain attacks and the growing risks facing the open source ecosystem.
00:00:58.719 --> 00:01:05.120
If you like what you hear, be sure to check out Only Malware in the Building and subscribe wherever you get your podcasts.
00:01:05.599 --> 00:01:06.640
Thanks for tuning in.
00:01:06.799 --> 00:01:09.920
As always, until next time, happy hunting.
00:01:32.400 --> 00:01:34.719
Look, I don't want to have to get HR involved in it.
00:01:35.120 --> 00:01:40.239
Last week I gave a malware training session, and the guys didn't pay any attention.
00:01:40.719 --> 00:01:42.159
No pickles, please.
00:01:42.319 --> 00:01:44.079
I don't want any cheese.
00:01:46.719 --> 00:01:48.879
It was my own fault for using PowerPoint.
00:01:49.200 --> 00:01:50.879
PowerPoint is boring.
00:01:51.680 --> 00:01:56.079
People learn in a lot of different ways, but experience is the best teacher.
00:01:56.319 --> 00:01:59.040
Today, malware is going to save lives.
00:01:59.359 --> 00:02:05.280
You got roof anyone hear that noise?
00:02:05.920 --> 00:02:06.959
Oh my god.
00:02:07.200 --> 00:02:11.520
Oh my god! Malware! Oh malware?
00:02:11.680 --> 00:02:13.120
What's the procedure, everyone?
00:02:13.280 --> 00:02:14.240
What do we do?
00:02:14.479 --> 00:02:15.120
Oh my god.
00:02:15.199 --> 00:02:16.800
Okay, it's it's it's happening.
00:02:17.039 --> 00:02:18.400
Everybody stay calm.
00:02:18.639 --> 00:02:20.080
What's the procedure, everyone?
00:02:20.240 --> 00:02:21.360
What's the procedure?
00:02:22.479 --> 00:02:26.639
Calm! I'll email it! It's on the old computer!
00:02:28.080 --> 00:02:29.120
No, no, Keith.
00:02:29.360 --> 00:02:31.039
Check the computer screen first.
00:02:31.199 --> 00:02:32.159
What's it look like?
00:02:32.319 --> 00:02:33.840
It could be infected too.
00:02:34.240 --> 00:02:36.159
What's a blue screen mean?
00:02:36.400 --> 00:02:36.879
Hmm.
00:02:37.120 --> 00:02:38.400
Not a viable option.
00:02:38.639 --> 00:02:39.759
Check other laptops.
00:02:40.400 --> 00:02:41.280
What's next?
00:02:41.840 --> 00:02:45.039
Back to Venom like Data! Data can be saved, Keith.
00:02:45.199 --> 00:02:46.319
Bank account, however.
00:02:46.479 --> 00:02:47.280
Okay, this is it.
00:02:47.439 --> 00:02:49.360
Everyone for the settlers.
00:02:50.960 --> 00:02:52.319
Have you ever seen a random?
00:02:52.560 --> 00:02:53.439
What's the procedure?
00:02:53.520 --> 00:02:54.479
What do we do?
00:03:02.000 --> 00:03:02.560
What do we do?
00:03:02.719 --> 00:03:06.000
Use the surge of fear and adrenaline to sharpen your decision making.
00:03:10.719 --> 00:03:11.520
Look at the kidney fear.
00:03:16.560 --> 00:03:17.919
Attention, everyone.
00:03:18.080 --> 00:03:20.800
This has been a test of our emergency preparedness.
00:03:20.960 --> 00:03:22.159
There is no malware.
00:03:22.400 --> 00:03:24.080
It was only a simulation.
00:03:24.240 --> 00:03:26.080
The malware is not real.
00:03:26.240 --> 00:03:28.240
Just merely a training exercise.
00:03:28.560 --> 00:03:30.639
So, what have we learned?
00:03:30.879 --> 00:03:33.199
That Keith really should have backed up his data.
00:03:33.360 --> 00:03:35.360
I stand by smashing the computer.
00:03:35.680 --> 00:03:38.240
Same time next week, we'll cover fishing.
00:03:38.479 --> 00:03:40.159
I'm calling in sick.
00:04:04.879 --> 00:04:10.560
After that chaotic opener, we have all calmed down and have addressed the pretend malware issue.
00:04:10.719 --> 00:04:18.399
But what isn't a pretend malware issue is soft goalish, Steel C, Comedy Stealer, and Operation Endgame in general.
00:04:18.639 --> 00:04:28.720
Today we're going to talk about how global law enforcement and private sector partners work to disrupt activity related to some major cybercrime threat actors and what this means for the threat landscape going forward.
00:04:29.360 --> 00:04:35.920
One of the most interesting things about this to me is TA569 or the SOC Golish disruption.
00:04:36.399 --> 00:04:40.560
This is one of the most prominent threat actors associated with web injects.
00:04:40.720 --> 00:04:43.199
They've been around since at least 2018.
00:04:43.759 --> 00:04:47.839
And now they have sort of become the grandfather of a lot of this activity.
00:04:48.240 --> 00:04:54.800
But before we get into SOC Golish as well as the information stealers, Steel C in Amity, Keith, I wanted to throw it over to you.
00:04:54.879 --> 00:05:01.120
As someone who has been actually involved in law enforcement disruptions to major malware, what goes into this?
00:05:01.279 --> 00:05:04.720
What, like, what when you heard about this or saw this, what did you think?
00:05:09.519 --> 00:05:11.120
First, I think it was awesome.
00:05:11.279 --> 00:05:18.480
You know, what I thought was, you know, we we've seen a lot of disruptions before in the past, and I've been involved in a lot of disruptions.
00:05:18.639 --> 00:05:24.240
But this is kind of the first like stage two of the same operation, stage three of the same operation.
00:05:24.399 --> 00:05:27.519
Because we talked about Operation Endgame in the spring.
00:05:27.600 --> 00:05:31.439
Uh, and usually these uh, you know, these operations are one and done.
00:05:31.519 --> 00:05:36.639
It's like, bam, we're gonna go in there, just zap the guys, and then kind of move on to the next thing.
00:05:36.879 --> 00:05:41.839
What was really cool about this is the good guys just basically said, hey, we're not done yet.
00:05:41.920 --> 00:05:55.920
You know, we're we we still want to just kind of go after these bad guys and uh continue to impact them because you know, everybody always talks about, well, you know, the name and shame or these disruptions, they don't have long-lasting impact.
00:05:56.160 --> 00:06:09.120
But I think what we've seen in this is that law enforcement is really serious about this and you know, to continue with that, you know, which we talked about in the past, like a lot of things go into you know these operations, you know.
00:06:09.279 --> 00:06:12.879
So it was just great to see everybody involved in that.
00:06:13.040 --> 00:06:15.439
And um, and I just talked a whole lot there.
00:06:15.519 --> 00:06:20.720
So I'm just gonna let you guys say a little bit more before I go into you know some of the other things.
00:06:20.879 --> 00:06:37.519
So well, why don't we just back up a half step and uh I'd love to know, since you two are the practitioners, uh, what are the things, what is the range of things that you would include under the umbrella of an info stealer?
00:06:37.600 --> 00:06:42.639
What are the capabilities who generally is uh doing these sorts of things?
00:06:42.720 --> 00:06:46.720
You know, what what do listeners who may not be familiar with it need to know?
00:06:49.759 --> 00:06:56.720
So Socolish is a dropper or a loader that's associated with um a threat activity cluster called Evil Corp.
00:06:56.800 --> 00:06:59.600
And those types of infections can lead to ransomware.
00:06:59.680 --> 00:07:01.279
So that's one piece of malware.
00:07:01.519 --> 00:07:04.879
But Steel C uh is an information stealer.
00:07:04.959 --> 00:07:10.879
It also has a dropper function, but basically, threat actors are targeting any information they could possibly get their hands on.
00:07:11.040 --> 00:07:21.920
So logs, cryptocurrency, usernames and passwords, banking information, any type of details that they could siphon from your computer, potentially use it to move flaterally within an infected network.
00:07:22.079 --> 00:07:27.439
And we've talked about this on the podcast before, how identity is kind of the gold standard now for threat actors.
00:07:27.519 --> 00:07:43.839
And there's this increase in information stealer activity as threat actors are trying to do more information gathering type focused activity to then do things like potentially ransomware or ATO jumping or trying to, you know, facilitate compromises of additional users.
00:07:44.079 --> 00:07:46.560
And so info stealers are really growing.
00:07:46.639 --> 00:07:50.240
They can also be used as precursors to ransomware.
00:07:50.399 --> 00:07:53.839
And that's kind of the important part of Operation Endgame, right?
00:07:53.920 --> 00:08:00.480
They're kind of targeting all of the ecosystem, the different components of the malware universe.
00:08:00.639 --> 00:08:08.160
I like to call it like the malware cinematic universe because it's like all of these things that are like involved and ultimately like ransomware, right?
00:08:08.399 --> 00:08:10.800
These things can basically enable that type of activity.
00:08:10.879 --> 00:08:17.759
And then of course Amity is also this sort of like dropper loader, which is also does a lot of the same things as um a DLC.
00:08:17.839 --> 00:08:22.800
So these are were two separate actions, but kind of coordinated all under one umbrella.
00:08:23.120 --> 00:08:23.279
Yeah.
00:08:23.439 --> 00:08:52.000
And the thing too, Dave, is that you know, both both of these are kind of like, you know, malware as a service, you know, and um, you know, so the their their whole uh criminal ecosystem on the back end, like, you know, for for example, you know, uh Steel IC, they have like their uh channel with the give support, uh, you know, so pretty much, you know, they're they have support updates, new feature rollouts, and new releases, you know.
00:08:52.080 --> 00:08:58.879
So, you know, when we look at these guys, you know, we always think of like this hacker in the basement or or something like that.
00:08:59.039 --> 00:09:02.159
But these are guys that are running, and you know, they're running enterprises.
00:09:02.480 --> 00:09:05.919
It's very much a malware as a service enterprise model, right?
00:09:06.080 --> 00:09:13.519
So you have the creators of this malware that then sell to affiliates, and then those affiliates are the ones that are running the campaigns.
00:09:13.679 --> 00:09:19.759
So the creator, the manager of the actual malware is taking a cut of that and then is working with their own customers.
00:09:19.840 --> 00:09:32.000
And so I think, you know, Keita, it is really funny that you mentioned it is like an enterprise, it's like a business model, because I think what we've seen from a lot of these different groups is it is like kind of a well-run enterprise.
00:09:32.159 --> 00:09:43.039
Although I have to say that there were some sort of errors in some of the code that allowed investigators or researchers to be able to get a little bit more information, I think, than they probably would have wanted.
00:09:43.200 --> 00:09:46.080
Um, some of those flaws in the in the different panels.
00:09:46.159 --> 00:09:53.039
And there was even some potential maliciousness within the affiliates themselves that were kind of going back and forth.
00:09:53.200 --> 00:09:57.360
And yeah, so you have like these there's no honor among thieves, right?
00:09:57.440 --> 00:10:02.639
They're running a business, but also like it's possible that you know other crimes are being committed.
00:10:08.320 --> 00:10:09.360
I'm curious.
00:10:09.600 --> 00:10:16.799
So to what degree is the info stealing the end game itself for these folks?
00:10:16.960 --> 00:10:33.519
In other words, I'm I've stolen your information, I've bundled it up, and now I'm gonna sell that to someone else, versus uh the info stealer being the first step into me being able to then install ransomware or a crypto miner or something like that.
00:10:33.919 --> 00:10:39.840
Yeah, I I mean, I think there's a little bit of uh the tail wagging a dog on some of that.
00:10:39.919 --> 00:10:43.840
You know, it kind of goes circular depending on what you're trying to do.
00:10:44.000 --> 00:10:58.879
Uh, like for example, on the Soc Ghoulish stuff, you know, they were looking for in order to spread their their infostiller, they were actually looking to get like um cPanel access, WordPress, Joomla access.
00:10:59.039 --> 00:11:06.960
So they they were trying to buy these compromised websites or access to these websites so then they could have their phishing pages on the website.
00:11:07.120 --> 00:11:12.960
So like you're you're you're visiting a legitimate website, but you're getting infected now with the malware.
00:11:13.120 --> 00:11:21.440
So so you have compromised credentials on both ends of getting access to the website to then throw malware down to get more credentials.
00:11:21.679 --> 00:11:34.559
And the the really interesting thing is well, how cheap! Like, so the one actor for Sock Goulish, we saw him on the underground wanting to buy access to like the c panels and you know, the Joomla and WordPress.
00:11:34.639 --> 00:11:46.000
And like some of the prices, uh the he would pay a dollar for c panel access, he would pay 30 cents for WordPress access, and uh 40 cents, a big whopping 40 cents for Joomla.
00:11:46.080 --> 00:11:54.159
Uh, you know, so uh you know, so so it's really not like uh, you know, it's not like advanced malware to get access to these sites.
00:11:54.320 --> 00:11:58.320
It's you know, basically cents on the dollar to then set up your operation.
00:11:58.480 --> 00:12:09.120
Uh so it's kind of like a whole ecosystem, but it depends on really what you're looking for because there's different aspects that fuel the next part of the of the scheme, if that makes sense.
00:12:09.360 --> 00:12:09.759
Mm-hmm.
00:12:09.840 --> 00:12:10.159
Mm-hmm.
00:12:10.399 --> 00:12:23.519
Well, and also too, one of the interesting things about Web Injects in particular, um, Soc Golish is, you know, that threat actor is one of them, is the traffic distribution systems as well, that they're partnering with basically the facilitators of crime.
00:12:23.679 --> 00:12:30.799
So for like Steel C and Amity, these are um phishing-based or maladvertising-based types of activities.
00:12:30.879 --> 00:12:43.600
So they'll send malicious emails or they'll, you know, have some malvertising, but with like the web inject activities that are trying to insert that malicious job script on the WordPress or related websites, those partner with like additional threat actors.
00:12:43.679 --> 00:12:48.159
And in the case of Sat Golish, they also kind of ran their own traffic distribution service.
00:12:48.399 --> 00:12:54.000
So the actual targeted targeted activity targeted like that part of that whole service, right?
00:12:54.080 --> 00:12:57.279
So it wasn't just like trying to clean up the injects themselves.
00:12:57.360 --> 00:13:01.759
It was also trying to see, okay, what can we do with this like traffic distribution service that they're running themselves?
00:13:01.919 --> 00:13:06.639
It was like this this interesting thing to kind of see the impacts beyond just the websites getting cleaned.
00:13:06.720 --> 00:13:08.720
It's like, okay, what else is happening?
00:13:08.960 --> 00:13:16.399
And for all of the disruptions during the entire action, according to Europol, it has a pretty big impact.
00:13:16.559 --> 00:13:26.480
So 326 servers and 142 domains were actioned by law enforcement and private sector partners that crippled the malware's distribution network.
00:13:26.639 --> 00:13:37.679
And crypto assets of criminal origin, currently valued at over 41 million euros or 47 million dollars, were identified, flagged, and thereby restricted from use.
00:13:37.840 --> 00:13:42.480
And as many as 27 million stolen loggering credentials have been recovered as part of the operation.
00:13:42.639 --> 00:13:51.440
So it's quite costly for from the threat actor perspective, um, as well as the sort of overall disruption to the services.
00:13:51.919 --> 00:13:57.200
And not bad for like uh, you know, it's uh you're just talking about the scale of the bad guys.
00:13:57.279 --> 00:14:00.720
It's a it's a pretty nice-sized business, if I can think, you know.
00:14:00.879 --> 00:14:05.120
Uh and and and basically the bad the the good guys here, we hit their supply chain.
00:14:05.200 --> 00:14:08.559
Uh, you know, we kind of do this kind of reverse things where they're hitting our supply chain.
00:14:08.720 --> 00:14:11.679
We decided to uh kind of disrupt their supply chain.
00:14:11.759 --> 00:14:18.080
So Keith, can you take us behind the scenes of of the planning of a disruption like this?
00:14:18.240 --> 00:14:25.360
I mean, you know, keeping it in general terms, how does law enforcement come at something like this that that is at this scale?
00:14:25.679 --> 00:14:40.080
Yeah, so I I think first it's gonna start with like companies like Proof Point that Selena works for and having that intelligence and kind of going to law enforcement and saying, hey, you know, we're seeing a lot of visibility right now into sock ghoulish or this threat that's out there.
00:14:40.320 --> 00:14:47.759
It would be great if uh you guys did something about this, uh, you know, and so then uh, you know, law enforcement goes, okay, well, you know, this is impacting.
00:14:47.840 --> 00:14:49.840
What what what type of impact can we do?
00:14:50.000 --> 00:14:51.840
You know, is this as big as you want?
00:14:52.000 --> 00:15:08.080
And then, you know, in this case, they were at Europol, and Europol was is just a really awesome place to kind of bring together all the law enforcement, especially in the EU, uh, and you know, in the the US is over there, and the other Five Eye partners like Canada and Australia.
00:15:08.320 --> 00:15:13.759
So they all they all sit and they all have their representatives right there in The Hague.
00:15:13.919 --> 00:15:19.679
Uh, and they're able to then pull that data from any of their member states or their other law enforcements.
00:15:19.840 --> 00:15:29.279
So now, even though the infrastructure is all around the world, now this kind of is a good central pulling point to kind of coordinate everything.
00:15:29.519 --> 00:15:35.840
So, so now, hey, maybe we need something from uh the United States, a Gmail or as a server.
00:15:36.000 --> 00:15:47.200
So the FBI or Secret Service could go out and issue uh, you know, legal process to get that data, or maybe something is at Hettner in Germany and the BKA could go out and get that.
00:15:47.279 --> 00:15:53.200
And then it will all kind of come back into that uh basically that coordination center or command post.
00:15:53.519 --> 00:16:01.759
And then at that point, once they get the legal processes in place, then that's when they kind of get with private industry.
00:16:02.000 --> 00:16:05.360
Are there gaps that we can't, you know, do as law enforcement?
00:16:05.519 --> 00:16:07.200
Can't private industry help us out?
00:16:07.679 --> 00:16:14.559
You know, if you're gonna seize like domains or things, you need to have like uh, you know, ICANN or the other registrars involved.
00:16:14.720 --> 00:16:22.720
And then really at the end of the day, how are we gonna kind of pull this off all coordinated at one time uh and make it go off without a hit?
00:16:22.879 --> 00:16:31.600
So so that's kind of like uh there's there's a lot of long nights and a lot of uh beers and other drinks at bars afterwards to play and everything.
00:16:31.840 --> 00:16:37.600
So more more often than not, it goes right rather than horribly wrong.
00:16:37.840 --> 00:16:38.480
Yeah.
00:16:39.519 --> 00:16:41.759
I feel like that's the most important part, Keith.
00:16:41.919 --> 00:16:43.519
The late nights and the beers.
00:16:44.240 --> 00:16:46.159
Well, we're all working for something.
00:16:46.399 --> 00:16:46.720
Yeah.
00:16:46.960 --> 00:16:58.240
Well, well, I think you know, a lot of times, you know, when when you get into some of these big um meetings when you have all these different lawyers and other law enforcement and industry people there, sometimes people don't want to speak up all the time.
00:16:58.399 --> 00:17:04.000
Uh, you know, so but when you get people out with beers, they they tend to pretty much tell you what they think.
00:17:04.079 --> 00:17:07.519
Uh so uh so then you know, then you can kind of plan things.
00:17:07.599 --> 00:17:09.599
Um but it it is really neat.
00:17:09.680 --> 00:17:15.119
And I think I told the story before, before we were doing the core flood uh takedown.
00:17:15.359 --> 00:17:30.559
You know, once you get ready to do that and you got to get that legal sign-off, when we were gonna do core flood, we had to go to the attorney general uh and you know, he had to sign off on it and he looked at it and he goes, It looks good, uh, but just remember if you break it, you bought it.
00:17:30.720 --> 00:17:39.839
So is that like the in the movies when they say the State Department will deny all knowledge of your operation if it doesn't go well?
00:17:40.079 --> 00:17:41.200
Yes, exactly.
00:17:42.960 --> 00:17:49.839
Well, actually, I'm so glad that you mentioned lawyers because they play a really interesting role in all of this too.
00:17:50.000 --> 00:18:03.519
I think a lot of times people think about disruptions and takedowns as, you know, cyber operators and hackers and, you know, kind of the pew-pew maps of things and maybe, you know, seizing servers and busting down doors and stuff.
00:18:03.680 --> 00:18:09.839
But um, there is a lot of uh sort of like legal process that can be used against this stuff.
00:18:10.000 --> 00:18:20.240
And lawyers, cybercrime lawyers, I have so much respect for, actually chatted with um Sean Farrell, who is an assistant general counsel of Microsoft's digital crimes unit.
00:18:20.319 --> 00:18:27.200
And they have really sort of innovated when it comes to doing takedowns via lawsuits.
00:18:27.440 --> 00:18:32.160
And I've never like left a conversation wanting to go to law school until this moment.
00:18:32.480 --> 00:18:35.200
And I was like, wow, do I need a career change?
00:18:35.279 --> 00:18:36.319
Because this sounds so fun.
00:18:36.480 --> 00:18:42.160
I mean, it's really cool because you can use these civil actions to disrupt criminal criminal infrastructure.
00:18:42.319 --> 00:18:50.880
And basically they use Rico, which is a Racketeer Influenced and Corrupt Organization Act that targets organized crime to actually go after some of these cyber criminals.
00:18:50.960 --> 00:19:03.599
And in the case of Steel C and Amity, they were able to identify shared infrastructure between these two groups and kind of do an all-in-one civil suit against this whole ecosystem, these info stealers and the malware together.
00:19:03.759 --> 00:19:08.319
And so it was really kind of cool to see um some of their publications on it.
00:19:08.400 --> 00:19:12.640
Like, here's how we were able to sort of sort of like innovate, and here's how lawyers play a role in this, right?
00:19:12.799 --> 00:19:18.240
Like I'm just over here, like beep boop, I'm on the computer, and they're like filing important documents and things.
00:19:19.519 --> 00:19:22.400
Yeah, so yeah, I mean, that's a really fascinating point.
00:19:22.480 --> 00:19:24.000
I'm glad you brought it up, Selena.
00:19:24.240 --> 00:19:27.279
So what's the reality on the ground, Keith?
00:19:27.440 --> 00:19:39.440
Like when you have trusted partners, you know, it's like a behemoth organization, like a Microsoft or a Google or an Amazon, um, and they say to you all, hey, we've got this.
00:19:39.599 --> 00:19:46.160
You know, how how long a leash do you give a private organization like that to take corrective action?
00:19:51.680 --> 00:19:53.359
Yeah, that's a good question.
00:19:53.519 --> 00:20:01.279
So, I mean, Microsoft has been kind of on the forefront of doing this for uh well over 15 years now, which is really good.
00:20:01.519 --> 00:20:02.400
And I I love Sean.
00:20:02.640 --> 00:20:05.680
Sean's a former FBI colleague of mine, just a great guy.
00:20:05.759 --> 00:20:14.160
And Dave, if you haven't had him on your show, you should have him gone to kind of talk about what they're doing in the space because it it is really fascinating and cutting edge.
00:20:14.400 --> 00:20:19.599
When they first started doing it, you know, they were trying to make an impact, you know, 15 years ago.
00:20:19.759 --> 00:20:21.680
You know, maybe there wasn't that coordination.
00:20:21.759 --> 00:20:27.119
They they were trying to protect their area of you know, of Windows computers.
00:20:27.200 --> 00:20:35.759
And, you know, the the first one or two times they acted uh without, you know, not thinking about how it may impact like an FBI case.
00:20:35.839 --> 00:20:45.839
Uh, but really over these last 15 years, that coordination has gotten so much better now because I think what everybody's realized is that it really takes a village.
00:20:46.079 --> 00:20:51.200
And everybody plays an important role, you know, in this to make that collective win.
00:20:51.359 --> 00:20:58.160
And the great thing is, is that Microsoft being this big behemoth, you know, very forward thought thinking.
00:20:58.400 --> 00:21:06.559
Now, other companies will go, hey, well, if Microsoft could do it and they're a big bureaucracy and they have a lot of potential liability, we can kind of do this too.
00:21:06.799 --> 00:21:11.920
So I love what they're doing because it really is setting the trend uh, you know, for that.
00:21:12.079 --> 00:21:17.519
And I think just much more coordination has been involved because they've done so many of these now.
00:21:17.599 --> 00:21:19.119
It's getting to be second nature.
00:21:19.200 --> 00:21:20.319
And that's what we want.
00:21:20.480 --> 00:21:34.799
We want to be able to kind of do this off the shelf and not reinvent the wheel every time stick around after the break.
00:21:44.400 --> 00:21:46.400
How do we measure success?
00:21:46.720 --> 00:21:59.759
You know, obviously we have these takedowns, uh, but it seems like groups pop up not long afterwards or they reform, or you know, it is part of this monitoring the criminal forums to see that you know these folks are getting a little more.
00:22:00.160 --> 00:22:03.039
Tentative about getting into this business at all?
00:22:03.359 --> 00:22:06.240
I don't think that it's going to stop people from getting into the business.
00:22:06.319 --> 00:22:07.839
Because if you're a criminal, you're a criminal.
00:22:07.920 --> 00:22:08.799
It doesn't matter.
00:22:09.119 --> 00:22:19.119
You know, there's always been the threat of getting arrested, whether, you know, you're running, uh, you're running a gambling ring or you're running cybercrime, you know, the everybody that gets into criminal activity.
00:22:19.279 --> 00:22:22.559
But it does make them a little leery and it does impact their operations.
00:22:22.880 --> 00:22:29.039
And, you know, if you impact somebody and they're down for six months, that's six months of uh, you know, of an impact.
00:22:29.119 --> 00:22:31.440
And if you could put them in jail, even better.
00:22:31.599 --> 00:22:37.759
As long as there's ever crime, which will be forever, there's always going to be somebody that's going to step up into the place, next place.
00:22:37.920 --> 00:22:40.799
But the big thing is you need to disrupt the operations.
00:22:40.880 --> 00:22:42.400
You just can't let it go on.
00:22:43.119 --> 00:22:47.680
So I think there's also a few things to consider when you're thinking about the impact to this stuff.
00:22:47.839 --> 00:22:54.480
So it's one of my favorite parts of my job is actually measuring success of takedowns and disruptions.
00:22:54.799 --> 00:23:00.079
Because you can look at data and say, okay, here's how long this service was down.
00:23:00.400 --> 00:23:02.799
Here are the number of websites that were cleaned up.
00:23:02.880 --> 00:23:04.000
So actually, it's important.
00:23:04.079 --> 00:23:05.359
I think I wanted to highlight that too.
00:23:05.440 --> 00:23:13.920
So in the case of Sockolish, the law enforcement was able to clean almost 15,000 websites, basically deinfect them, right?
00:23:14.000 --> 00:23:22.160
So that plays a huge role in disrupting the botnum because that means that that actor has to go reinfect all of these websites again if they, if they really want to.
00:23:22.400 --> 00:23:23.759
So that's part of it, right?
00:23:23.839 --> 00:23:26.000
So it's like, okay, how effective was this?
00:23:26.240 --> 00:23:34.079
Putting out awareness and general like information about this threat always plays a huge role as well, because you can kind of time it with the disruption.
00:23:34.160 --> 00:23:36.000
You can further education for the end user.
00:23:36.079 --> 00:23:40.319
You can really encourage organizations to say, hey, this is what you have to pay attention to.
00:23:40.480 --> 00:23:50.400
Um, but from our data, for example, we see significant disruptions pretty much every single time there is a law enforcement, either full takedown or disruptions to activity.
00:23:50.559 --> 00:24:00.480
So it'll be a reduced number of emails that we'll see through our telemetry, a reduced number of uh C2s or panels or servers that are actually active and associated with the particular malware or threat actor.
00:24:00.640 --> 00:24:16.079
You see, I'm sure Keith sees this too and can probably speak to it, some chatter on the underground that is a lot more like, oh, okay, well, they're on to us, or we're gonna have to change something, or they might actually even close purchases for a prolonged period of time, potentially even altogether, just completely take their, oh, there's too much heat on me.
00:24:16.160 --> 00:24:17.359
I'm gonna go elsewhere.
00:24:17.599 --> 00:24:24.799
But there's also this idea of sort of causing mistrust among the criminal ecosystem and the affiliates.
00:24:25.039 --> 00:24:33.839
And one really interesting thing that Operation Endgame is doing that they're really pioneering is these videos that they post with every takedown.
00:24:33.920 --> 00:24:44.720
And they'll have these little Easter eggs in the video that are explicitly targeting the threat actor or the affiliates that are part of this targeted effort.
00:24:44.880 --> 00:25:03.839
And so you can see, oh, maybe there's like a username that's included in there that they're like clearly going after them, or maybe there's some sort of indication that the affiliates are turning on each other, or maybe the malware creator is actually like stealing some of the information that they are, you know, siphoning off of their own affiliates, and you know, depending on what the actual video is.
00:25:03.920 --> 00:25:07.920
They've done it for pretty much all of their takedowns and or disruptions.
00:25:08.000 --> 00:25:10.559
And I think that, you know, that's kind of fun too.
00:25:10.640 --> 00:25:20.160
So you have this also sort of like social engineering happening at the same time as the sort of like actual technical targeted efforts.
00:25:20.319 --> 00:25:26.480
Um, and at the end of these videos, there's always like reach out, like think about your next move, or like come talk to us.
00:25:26.640 --> 00:25:31.039
And there's that sort of attempt to get people to turn themselves in or engage with them.
00:25:31.119 --> 00:25:34.799
So I think, you know, I'll oftentimes I hear a lot of scorn in the industry.
00:25:34.960 --> 00:25:36.640
Oh, well, you know, they're just gonna come back.
00:25:36.720 --> 00:25:38.400
So why bother doing these takedowns?
00:25:38.799 --> 00:25:44.720
But I think this idea of imposing cost is from a financial perspective, there's tons, you know, asset seizures is huge.
00:25:44.880 --> 00:25:54.079
From an actual infrastructure perspective, you know, imposing that cost is huge because it, you know, removes their current capabilities and forces them to spend more money to retool more time.
00:25:54.240 --> 00:25:59.359
There's a time stack, a time cost, there's a reputational cost, and there's a psychological cost too.
00:25:59.519 --> 00:26:02.640
So when all of these are factored in, it can have a huge disruption.
00:26:02.799 --> 00:26:10.640
So maybe we're not like maybe, yeah, we'll see a blip in traffic, or maybe they'll come back after a couple of months to be at the same level of activity.
00:26:10.960 --> 00:26:19.599
But all of those factors and variables played a role in terms of their decision making and the potential that they have lost business, which is ultimately what we want.
00:26:19.759 --> 00:26:21.680
We want them to make less money and do less crime.
00:26:21.920 --> 00:26:27.200
Yeah, really at the end of the day, it's not just bringing down servers, it's attacking that trust in that criminal ecosystem.
00:26:27.279 --> 00:26:32.880
Uh, you know, you wanna, you want to have customers distrust their operations, you want to break that trust.
00:26:32.960 --> 00:26:35.519
Uh, and just you were just talking about those little Easter eggs.
00:26:35.599 --> 00:26:36.559
I'll share a little story.
00:26:36.720 --> 00:26:51.279
When I was uh when I came out from undercover, you know, everybody kind of knew that I was there was there was this one criminal that that hit me up online and you know, he hit me up and he's like, you effing fed and you know, and and and all that type of stuff.
00:26:51.680 --> 00:26:54.720
You know, and I responded back to him because he was on our target list.
00:26:54.799 --> 00:26:56.559
He just wasn't home when we raided him.
00:26:56.720 --> 00:26:58.880
I was like, dude, we know who you are.
00:26:59.039 --> 00:27:13.279
Uh you could spend the rest of your life on the run uh and constantly looking over your shoulder of when you're gonna get arrested in you know, this cafe in Paris or when you're at the beach in Nice or somewhere else, or you could just go turn yourself in and just get it over with.
00:27:13.359 --> 00:27:15.359
Uh and two days later he turned himself in.
00:27:15.440 --> 00:27:16.960
So it does work.
00:27:17.279 --> 00:27:24.079
But that that was my next question, Keith, was whether do because I find it hard to believe that these people actually turn themselves in.
00:27:24.160 --> 00:27:28.079
But you laid out the case for why that could be in their best interest.
00:27:28.400 --> 00:27:36.880
Yeah, I mean, especially, I mean, if law enforcement knows who you are, I mean, the only way that you're gonna not get caught is if you stay in Russia or China.
00:27:37.039 --> 00:27:44.480
Uh, you know, and even in those, some, you know, even in those places, if you're not paying people off, you may end up falling down the steps or something like that.
00:27:44.640 --> 00:27:53.680
Uh, you know, so uh, you know, so sometimes it's in your best interest to just um go and uh turn yourself in and let the legal process go through it.
00:27:53.839 --> 00:28:02.400
So uh and because a lot of times the people, you know, they'll be on the run for a couple years, they'll get caught, and then you know, then they have to go through the process, you might just get it over with.
00:28:02.559 --> 00:28:05.200
So that's that that's my suggestion to all the criminals.
00:28:05.279 --> 00:28:07.119
Just turn yourself in, get it over with.
00:28:07.759 --> 00:28:08.880
Going to get caught.
00:28:09.119 --> 00:28:10.559
You might as well get it over with.
00:28:10.720 --> 00:28:11.839
Serve your time.
00:28:12.720 --> 00:28:14.319
Straighten up and fly right.
00:28:18.960 --> 00:28:22.720
Well, what do we feel in terms of like the overall arc of this?
00:28:22.960 --> 00:28:26.079
Are our you know, this this didn't always exist.
00:28:26.160 --> 00:28:27.200
It's here now.
00:28:27.519 --> 00:28:29.119
Is this here to stay?
00:28:29.440 --> 00:28:32.640
I I know from the industry standpoint, industry freaking loves it.
00:28:32.799 --> 00:28:35.839
You know, they're like, hey, let's let's do it, can we do it again tomorrow?
00:28:36.000 --> 00:28:38.160
Uh you know, and you know, and all of that.
00:28:38.319 --> 00:28:43.039
And, you know, in the law enforcement, they they love it because they're making impact.
00:28:43.200 --> 00:28:45.599
And really at the end of the day, that's what they want to do.
00:28:45.680 --> 00:28:49.839
And and if they have impact from their partners as well, uh they want to continue.
00:28:49.920 --> 00:29:00.000
And everybody, every politician or every uh, you know, elected official or like in the government, they love to see their name on TV.
00:29:00.160 --> 00:29:03.200
Uh, you know, and they love to be part of something special.
00:29:03.359 --> 00:29:06.160
Uh, and and so success breeds success.
00:29:06.640 --> 00:29:08.400
Stand in front of the big seal.
00:29:10.400 --> 00:29:11.759
What were you saying, Selena?
00:29:11.920 --> 00:29:13.920
Oh, yeah, no, I so I think so.
00:29:14.000 --> 00:29:16.240
First of all, it's here to stay for sure.
00:29:16.400 --> 00:29:27.599
Um, but I also think that the it's become initially, I I feel like takedowns or disruptions were, oh my gosh, they did a takedown.
00:29:27.680 --> 00:29:29.680
Like, this is crazy, this is unbelievable.
00:29:29.839 --> 00:29:30.799
I can't believe they did it.
00:29:30.960 --> 00:29:32.160
This is so interesting.
00:29:32.400 --> 00:29:33.440
We have to talk about it.
00:29:33.519 --> 00:29:36.400
But now it's just kind of like, okay, yeah, this is yet another takedown.
00:29:36.480 --> 00:29:46.960
And I think it's really cool that we've gotten to that point where, you know, okay, maybe it's just not as newsworthy as it used to be, or maybe it's just not as cool because it's just expected that this is what happens.
00:29:47.200 --> 00:29:52.240
I think that there's a lot of interest from all sides right now to be able to contribute to this.
00:29:52.400 --> 00:30:05.359
Because at least from my perspective, as someone who works in the industry, I often feel like I'm just sort of banging my head against the wall because, like, okay, crime is happening, more crime is happening, I see crime happening.
00:30:06.079 --> 00:30:07.839
I can write detections to stop it.
00:30:08.000 --> 00:30:09.119
But like, how else?
00:30:09.279 --> 00:30:10.319
Like, what else can I do?
00:30:10.400 --> 00:30:12.640
You know, how can I have like a real world impact?
00:30:12.880 --> 00:30:16.480
And so I think it's really awesome to be able to see the real world impact of this.
00:30:16.559 --> 00:30:18.000
And whether or not you get handcuffs, right?
00:30:18.079 --> 00:30:20.319
Like, that's really, that's really when it stops, right?
00:30:20.400 --> 00:30:22.880
Is when you're able to handcuff someone, put them in jail.
00:30:23.039 --> 00:30:24.559
You know, all right, you're you're done.
00:30:24.640 --> 00:30:26.000
That malware guy is gone.
00:30:26.240 --> 00:30:29.200
But I mean, I think it's an ongoing process, it never stops.
00:30:29.440 --> 00:30:31.759
And I think that, you know, it's important to note here too.
00:30:31.839 --> 00:30:34.799
So, first of all, this wasn't necessarily a full takedown, right?
00:30:34.880 --> 00:30:46.079
Like Sakolish is not, it is, I I I refer to it in our blog as literally like the grandfather of web injects or like the OG of the like threat landscape because they've been around forever.
00:30:46.160 --> 00:30:57.680
They're a very prominent cyber criminal group that was they're associated to Evil Corp, which is a Russian uh cyber criminal outfit, a bunch of different ransomware families they've been, you know, had links to.
00:30:57.839 --> 00:31:02.160
So it's a big group, but saying, hey, we're we're coming after you is great.
00:31:02.319 --> 00:31:06.000
And what we're gonna see, I think, too, is like the the echo through the rest of the ecosystem.
00:31:06.079 --> 00:31:15.119
Because if if sockolish was sort of the innovator of the web inject landscape, I think all the rest of these threat actors that are doing, because it's a really popular technique now.
00:31:15.279 --> 00:31:22.640
And sometimes you'll find infected websites that are infected with multiple different web injects, because it's such a common technique used by a variety of threat actors.
00:31:22.720 --> 00:31:32.240
It went from being only Sokolish TA569 to I think we track like a dozen web inject-related threat clusters right now, at least at my team at ProofPoint.
00:31:32.480 --> 00:31:36.079
So maybe there's some reverberation that we're gonna feel across the ecosystem.
00:31:36.240 --> 00:31:41.759
Maybe they're gonna feel, oh, wait a second, if this group is being targeted, maybe I should rethink my strategy.
00:31:41.920 --> 00:31:46.640
Like clearly, there's being a lot of attention paid on this particular technique, a lot of these compromises.
00:31:46.799 --> 00:31:52.240
There was, you know, information about how to patch and advice for website owners and defenders to like pay attention to this.
00:31:52.319 --> 00:31:55.279
So maybe we'll kind of see this reverberation across the ecosystem.
00:31:55.440 --> 00:32:02.160
And then maybe we'll just continue to see some of these like targeted takedowns or targeted disruptions of some of these other types of activity.
00:32:02.240 --> 00:32:11.680
And I think that to me, that's really important is that one, end users are aware that Sock Goalish is not the only web inject threat cluster that is doing this type of activity.
00:32:11.839 --> 00:32:15.839
And it's important to be able to protect yourself against the threat overall.
00:32:16.319 --> 00:32:22.880
And two, hopefully we can kind of see this reverberation through the ecosystem where even SAG Goalish is coming under scrutiny, right?
00:32:22.960 --> 00:32:25.839
They've been around forever and they're still going under scrutiny.
00:32:26.000 --> 00:32:32.799
So yeah, I'm hopeful that we'll kind of continue to see some of that echo throughout the throughout all of the criminal underground.
00:32:32.880 --> 00:32:37.519
And I don't know, maybe you'll start seeing some more gossip on the forums about stuff like this.
00:32:37.759 --> 00:32:40.079
And I just want people to think, well, what's next?
00:32:40.240 --> 00:32:43.920
You know, say, hey, we just did this, you know, what's the next thing they're gonna hit?
00:32:44.079 --> 00:32:49.279
You know, or you know, so uh that that we want that distrust and and that that's what I love.
00:32:49.440 --> 00:33:09.440
And I think the other thing too, Dave, that is that, you know, we all, you know, we're in the corporate space and you know, we're usually in the corporate when you have that opportunity to kind of make a difference in the mission, uh, that's kind of uh it's just a different category of just your normal defense for you know a corporate partner, which is important.
00:33:09.680 --> 00:33:20.880
Um, but when you actually get a chance to make an impact like that, going after the bad guys, uh that that you know, that just makes you want to just kind of put your hand on your heart and stand up and just you know go go for the missions.
00:33:20.960 --> 00:33:24.319
And and I think that's what everybody really likes about it as well.
00:33:28.400 --> 00:33:32.240
I guess it also plays a part in international relations, right?
00:33:32.400 --> 00:33:34.400
I mean, there's a diplomacy aspect to this.
00:33:34.720 --> 00:33:36.480
Oh, no, no doubt about it.
00:33:36.640 --> 00:33:40.400
Uh, and and it just makes that uh, you know, that world a little smaller.
00:33:40.559 --> 00:33:52.640
You know, when you think about uh you're here in the United States and there's infrastructure overseas, everybody over there, let's say in France and Germany or the UK, they all have their own important priority things as well.
00:33:52.799 --> 00:34:02.079
So at what point, you know, do you get them to move your requests to the top of their list uh and being part of these things and building those relationships?
00:34:02.160 --> 00:34:26.159
And like when you go out to Europol, Selena and I were out at Europol last year for a conference, and you just sit around and you're getting a chance to meet a lot of people and you, you know, you meet maybe somebody from Latvia or Lithuania that you know that you just never thought of or you know, meeting, but yet, you know, next week there's a server in Latvia right now, and now now you know you can call Pavel, you know, and he can go help you out.
00:34:26.320 --> 00:34:30.159
You know, so so it's really important to do that and to build those relationships.
00:34:30.239 --> 00:34:33.280
Because really at the end of the day, relationships are what makes the world go round.
00:34:33.599 --> 00:34:36.320
You can all hold hands and sing we are the world.
00:34:36.960 --> 00:34:40.880
I personally would love to kick myself out of a job.
00:34:41.119 --> 00:34:59.920
If, you know, if at the end of this there is no not enough work for cybercrime analysts because we've done such a good job with private public partner collaboration that crime has decreased so drastically that I can go, I don't know, be a librarian or like open open a coffee shop, I would be so happy.
00:35:00.239 --> 00:35:11.360
Here's what needs to happen is we need to take all of the assets that we seize from them, put them into a big pot for the old age retirement home for retired analysts who've been put out of work, right?
00:35:11.440 --> 00:35:14.480
So you have a so you have a place to live, you get a monthly stipend.
00:35:14.639 --> 00:35:23.599
You know, it's like the old actors' home in Hollywood where they just take care of you, but based on the ill-gotten gains that uh, you know, Keith's colleagues collected over the years.
00:35:23.840 --> 00:35:24.320
I love it.
00:35:24.400 --> 00:35:28.480
It's what we'll call it like the uh the AI fund for the AI displacement fund.
00:35:28.800 --> 00:35:29.840
There you go.
00:35:39.360 --> 00:35:42.079
We will be right back after this quick break.
00:35:51.519 --> 00:35:58.400
Well, I do want to just make sure that before we leave, especially if we're talking about the compromised websites, some recommendations for folks.
00:35:58.559 --> 00:36:02.000
Um so obviously, like network detections and endpoint protection are huge.
00:36:02.320 --> 00:36:13.039
But really the things that to kind of look out for, especially with Slack Golish and some of the other web inject stuff, from a defender, actual defender perspective, is restrict Windows users from downloading script files and anything but a text file.
00:36:13.199 --> 00:36:14.639
You could do that via group policy.
00:36:14.960 --> 00:36:18.800
Consider disabling PowerShell for general users who don't need it for their workflow.
00:36:19.199 --> 00:36:22.719
And from the website management side of the house.
00:36:22.800 --> 00:36:29.599
So for organizations that like own websites, like website administrators, make sure you have MFA on.
00:36:29.840 --> 00:36:37.920
Um, you know, consider something like YubiKey or additional layers of protection for that, which is direct access to the WordPress admin with allow listing.
00:36:38.239 --> 00:36:45.119
Just there's a lot of some of these sort of very sort of, I don't know, air quotes basic uh security recommendations that you can implement.
00:36:45.440 --> 00:36:48.079
The WordPress plugins and themes is a huge one.
00:36:48.159 --> 00:36:53.280
Make sure that you're getting them from legitimate websites and they're maintained, being up to date as much as possible.
00:36:53.599 --> 00:36:53.840
Yeah.
00:36:53.920 --> 00:37:02.559
So just really make sure that you're trying to make the best of your web security that you possibly can because a lot of these web inject threat actors, including Zach Golish, really try and exploit that.
00:37:02.800 --> 00:37:06.880
So um, yeah, it's it's it's exciting, but it's still a threat.
00:37:06.960 --> 00:37:08.960
And we have to make sure that we're staying on top of it.
00:37:09.119 --> 00:37:12.079
And uh, I just hope we continue to have more of these.
00:37:12.159 --> 00:37:14.320
So we don't have a podcast episode on all of them.
00:37:14.480 --> 00:37:17.599
It's just so common that we're just like, oh, yep, another disruption.
00:37:18.559 --> 00:37:20.159
The disruption of the month.
00:37:20.400 --> 00:37:21.360
Exactly.
00:37:21.679 --> 00:37:26.159
And that's only malware in the building, brought to you by N2K CyberWire.
00:37:26.400 --> 00:37:33.119
In a digital world where malware lurks in the shadows, we bring you the stories and strategies to stay one step ahead of the game.
00:37:33.280 --> 00:37:40.960
As your trusty digital salutes, we're unraveling the mysteries of cybersecurity, always keeping the bad guys one step behind.
00:37:41.199 --> 00:37:43.280
We'd love to know what you think of this podcast.
00:37:43.440 --> 00:37:49.360
Your feedback ensures we deliver the insights that keep you ahead in the ever-evolving world of cybersecurity.
00:37:49.599 --> 00:37:54.239
If you like the show, please share a rating and review in your favorite podcast app.
00:37:54.480 --> 00:38:01.599
This episode was produced by Liz Stokes, mixing and sound design by Trey Hester, with original music by Elliot Peltzman.
00:38:01.840 --> 00:38:03.920
Our executive producer is Jennifer Ivan.
00:38:04.320 --> 00:38:06.639
Peter Kilpie is our publisher.
00:00:00.400 --> 00:00:06.240
Hi, today's your host, Selena Larson, principal threat researcher here at ProofPoint and host of the Discarded Podcast.
00:00:06.639 --> 00:00:10.160
Did you know I'm also a co-host of the Only Malware in the Building?
00:00:10.560 --> 00:00:16.960
This is a monthly segment crafted through a collaboration between N2K Cyberwire and the Proof Point Discarded Podcast.
00:00:17.199 --> 00:00:21.120
Our segment focuses on the most impactful and intriguing malware stories.
00:00:21.440 --> 00:00:33.039
We aim to distill complex cybersecurity information into digestible and insightful segments for tech professionals, providing security executives a clear and engaging silhouette that is actionable.
00:00:33.359 --> 00:00:44.159
I am joined every month by my co-host NTUNDK Network's data editor and Keith Wilarski, a former FBI cybercrime investigator and now chief global ambassador at Q Intel.
00:00:44.640 --> 00:00:50.000
This week, I wanted to bring you a sample of Only Malware in the Building, trusting the wrong package.
00:00:50.479 --> 00:00:58.320
In this episode, we dive into the evolving threat of software supply chain attacks and the growing risks facing the open source ecosystem.
00:00:58.719 --> 00:01:05.120
If you like what you hear, be sure to check out Only Malware in the Building and subscribe wherever you get your podcasts.
00:01:05.599 --> 00:01:06.640
Thanks for tuning in.
00:01:06.799 --> 00:01:09.920
As always, until next time, happy hunting.
00:01:32.400 --> 00:01:34.719
Look, I don't want to have to get HR involved in it.
00:01:35.120 --> 00:01:40.239
Last week I gave a malware training session, and the guys didn't pay any attention.
00:01:40.719 --> 00:01:42.159
No pickles, please.
00:01:42.319 --> 00:01:44.079
I don't want any cheese.
00:01:46.719 --> 00:01:48.879
It was my own fault for using PowerPoint.
00:01:49.200 --> 00:01:50.879
PowerPoint is boring.
00:01:51.680 --> 00:01:56.079
People learn in a lot of different ways, but experience is the best teacher.
00:01:56.319 --> 00:01:59.040
Today, malware is going to save lives.
00:01:59.359 --> 00:02:05.280
You got roof anyone hear that noise?
00:02:05.920 --> 00:02:06.959
Oh my god.
00:02:07.200 --> 00:02:11.520
Oh my god! Malware! Oh malware?
00:02:11.680 --> 00:02:13.120
What's the procedure, everyone?
00:02:13.280 --> 00:02:14.240
What do we do?
00:02:14.479 --> 00:02:15.120
Oh my god.
00:02:15.199 --> 00:02:16.800
Okay, it's it's it's happening.
00:02:17.039 --> 00:02:18.400
Everybody stay calm.
00:02:18.639 --> 00:02:20.080
What's the procedure, everyone?
00:02:20.240 --> 00:02:21.360
What's the procedure?
00:02:22.479 --> 00:02:26.639
Calm! I'll email it! It's on the old computer!
00:02:28.080 --> 00:02:29.120
No, no, Keith.
00:02:29.360 --> 00:02:31.039
Check the computer screen first.
00:02:31.199 --> 00:02:32.159
What's it look like?
00:02:32.319 --> 00:02:33.840
It could be infected too.
00:02:34.240 --> 00:02:36.159
What's a blue screen mean?
00:02:36.400 --> 00:02:36.879
Hmm.
00:02:37.120 --> 00:02:38.400
Not a viable option.
00:02:38.639 --> 00:02:39.759
Check other laptops.
00:02:40.400 --> 00:02:41.280
What's next?
00:02:41.840 --> 00:02:45.039
Back to Venom like Data! Data can be saved, Keith.
00:02:45.199 --> 00:02:46.319
Bank account, however.
00:02:46.479 --> 00:02:47.280
Okay, this is it.
00:02:47.439 --> 00:02:49.360
Everyone for the settlers.
00:02:50.960 --> 00:02:52.319
Have you ever seen a random?
00:02:52.560 --> 00:02:53.439
What's the procedure?
00:02:53.520 --> 00:02:54.479
What do we do?
00:03:02.000 --> 00:03:02.560
What do we do?
00:03:02.719 --> 00:03:06.000
Use the surge of fear and adrenaline to sharpen your decision making.
00:03:10.719 --> 00:03:11.520
Look at the kidney fear.
00:03:16.560 --> 00:03:17.919
Attention, everyone.
00:03:18.080 --> 00:03:20.800
This has been a test of our emergency preparedness.
00:03:20.960 --> 00:03:22.159
There is no malware.
00:03:22.400 --> 00:03:24.080
It was only a simulation.
00:03:24.240 --> 00:03:26.080
The malware is not real.
00:03:26.240 --> 00:03:28.240
Just merely a training exercise.
00:03:28.560 --> 00:03:30.639
So, what have we learned?
00:03:30.879 --> 00:03:33.199
That Keith really should have backed up his data.
00:03:33.360 --> 00:03:35.360
I stand by smashing the computer.
00:03:35.680 --> 00:03:38.240
Same time next week, we'll cover fishing.
00:03:38.479 --> 00:03:40.159
I'm calling in sick.
00:04:04.879 --> 00:04:10.560
After that chaotic opener, we have all calmed down and have addressed the pretend malware issue.
00:04:10.719 --> 00:04:18.399
But what isn't a pretend malware issue is soft goalish, Steel C, Comedy Stealer, and Operation Endgame in general.
00:04:18.639 --> 00:04:28.720
Today we're going to talk about how global law enforcement and private sector partners work to disrupt activity related to some major cybercrime threat actors and what this means for the threat landscape going forward.
00:04:29.360 --> 00:04:35.920
One of the most interesting things about this to me is TA569 or the SOC Golish disruption.
00:04:36.399 --> 00:04:40.560
This is one of the most prominent threat actors associated with web injects.
00:04:40.720 --> 00:04:43.199
They've been around since at least 2018.
00:04:43.759 --> 00:04:47.839
And now they have sort of become the grandfather of a lot of this activity.
00:04:48.240 --> 00:04:54.800
But before we get into SOC Golish as well as the information stealers, Steel C in Amity, Keith, I wanted to throw it over to you.
00:04:54.879 --> 00:05:01.120
As someone who has been actually involved in law enforcement disruptions to major malware, what goes into this?
00:05:01.279 --> 00:05:04.720
What, like, what when you heard about this or saw this, what did you think?
00:05:09.519 --> 00:05:11.120
First, I think it was awesome.
00:05:11.279 --> 00:05:18.480
You know, what I thought was, you know, we we've seen a lot of disruptions before in the past, and I've been involved in a lot of disruptions.
00:05:18.639 --> 00:05:24.240
But this is kind of the first like stage two of the same operation, stage three of the same operation.
00:05:24.399 --> 00:05:27.519
Because we talked about Operation Endgame in the spring.
00:05:27.600 --> 00:05:31.439
Uh, and usually these uh, you know, these operations are one and done.
00:05:31.519 --> 00:05:36.639
It's like, bam, we're gonna go in there, just zap the guys, and then kind of move on to the next thing.
00:05:36.879 --> 00:05:41.839
What was really cool about this is the good guys just basically said, hey, we're not done yet.
00:05:41.920 --> 00:05:55.920
You know, we're we we still want to just kind of go after these bad guys and uh continue to impact them because you know, everybody always talks about, well, you know, the name and shame or these disruptions, they don't have long-lasting impact.
00:05:56.160 --> 00:06:09.120
But I think what we've seen in this is that law enforcement is really serious about this and you know, to continue with that, you know, which we talked about in the past, like a lot of things go into you know these operations, you know.
00:06:09.279 --> 00:06:12.879
So it was just great to see everybody involved in that.
00:06:13.040 --> 00:06:15.439
And um, and I just talked a whole lot there.
00:06:15.519 --> 00:06:20.720
So I'm just gonna let you guys say a little bit more before I go into you know some of the other things.
00:06:20.879 --> 00:06:37.519
So well, why don't we just back up a half step and uh I'd love to know, since you two are the practitioners, uh, what are the things, what is the range of things that you would include under the umbrella of an info stealer?
00:06:37.600 --> 00:06:42.639
What are the capabilities who generally is uh doing these sorts of things?
00:06:42.720 --> 00:06:46.720
You know, what what do listeners who may not be familiar with it need to know?
00:06:49.759 --> 00:06:56.720
So Socolish is a dropper or a loader that's associated with um a threat activity cluster called Evil Corp.
00:06:56.800 --> 00:06:59.600
And those types of infections can lead to ransomware.
00:06:59.680 --> 00:07:01.279
So that's one piece of malware.
00:07:01.519 --> 00:07:04.879
But Steel C uh is an information stealer.
00:07:04.959 --> 00:07:10.879
It also has a dropper function, but basically, threat actors are targeting any information they could possibly get their hands on.
00:07:11.040 --> 00:07:21.920
So logs, cryptocurrency, usernames and passwords, banking information, any type of details that they could siphon from your computer, potentially use it to move flaterally within an infected network.
00:07:22.079 --> 00:07:27.439
And we've talked about this on the podcast before, how identity is kind of the gold standard now for threat actors.
00:07:27.519 --> 00:07:43.839
And there's this increase in information stealer activity as threat actors are trying to do more information gathering type focused activity to then do things like potentially ransomware or ATO jumping or trying to, you know, facilitate compromises of additional users.
00:07:44.079 --> 00:07:46.560
And so info stealers are really growing.
00:07:46.639 --> 00:07:50.240
They can also be used as precursors to ransomware.
00:07:50.399 --> 00:07:53.839
And that's kind of the important part of Operation Endgame, right?
00:07:53.920 --> 00:08:00.480
They're kind of targeting all of the ecosystem, the different components of the malware universe.
00:08:00.639 --> 00:08:08.160
I like to call it like the malware cinematic universe because it's like all of these things that are like involved and ultimately like ransomware, right?
00:08:08.399 --> 00:08:10.800
These things can basically enable that type of activity.
00:08:10.879 --> 00:08:17.759
And then of course Amity is also this sort of like dropper loader, which is also does a lot of the same things as um a DLC.
00:08:17.839 --> 00:08:22.800
So these are were two separate actions, but kind of coordinated all under one umbrella.
00:08:23.120 --> 00:08:23.279
Yeah.
00:08:23.439 --> 00:08:52.000
And the thing too, Dave, is that you know, both both of these are kind of like, you know, malware as a service, you know, and um, you know, so the their their whole uh criminal ecosystem on the back end, like, you know, for for example, you know, uh Steel IC, they have like their uh channel with the give support, uh, you know, so pretty much, you know, they're they have support updates, new feature rollouts, and new releases, you know.
00:08:52.080 --> 00:08:58.879
So, you know, when we look at these guys, you know, we always think of like this hacker in the basement or or something like that.
00:08:59.039 --> 00:09:02.159
But these are guys that are running, and you know, they're running enterprises.
00:09:02.480 --> 00:09:05.919
It's very much a malware as a service enterprise model, right?
00:09:06.080 --> 00:09:13.519
So you have the creators of this malware that then sell to affiliates, and then those affiliates are the ones that are running the campaigns.
00:09:13.679 --> 00:09:19.759
So the creator, the manager of the actual malware is taking a cut of that and then is working with their own customers.
00:09:19.840 --> 00:09:32.000
And so I think, you know, Keita, it is really funny that you mentioned it is like an enterprise, it's like a business model, because I think what we've seen from a lot of these different groups is it is like kind of a well-run enterprise.
00:09:32.159 --> 00:09:43.039
Although I have to say that there were some sort of errors in some of the code that allowed investigators or researchers to be able to get a little bit more information, I think, than they probably would have wanted.
00:09:43.200 --> 00:09:46.080
Um, some of those flaws in the in the different panels.
00:09:46.159 --> 00:09:53.039
And there was even some potential maliciousness within the affiliates themselves that were kind of going back and forth.
00:09:53.200 --> 00:09:57.360
And yeah, so you have like these there's no honor among thieves, right?
00:09:57.440 --> 00:10:02.639
They're running a business, but also like it's possible that you know other crimes are being committed.
00:10:08.320 --> 00:10:09.360
I'm curious.
00:10:09.600 --> 00:10:16.799
So to what degree is the info stealing the end game itself for these folks?
00:10:16.960 --> 00:10:33.519
In other words, I'm I've stolen your information, I've bundled it up, and now I'm gonna sell that to someone else, versus uh the info stealer being the first step into me being able to then install ransomware or a crypto miner or something like that.
00:10:33.919 --> 00:10:39.840
Yeah, I I mean, I think there's a little bit of uh the tail wagging a dog on some of that.
00:10:39.919 --> 00:10:43.840
You know, it kind of goes circular depending on what you're trying to do.
00:10:44.000 --> 00:10:58.879
Uh, like for example, on the Soc Ghoulish stuff, you know, they were looking for in order to spread their their infostiller, they were actually looking to get like um cPanel access, WordPress, Joomla access.
00:10:59.039 --> 00:11:06.960
So they they were trying to buy these compromised websites or access to these websites so then they could have their phishing pages on the website.
00:11:07.120 --> 00:11:12.960
So like you're you're you're visiting a legitimate website, but you're getting infected now with the malware.
00:11:13.120 --> 00:11:21.440
So so you have compromised credentials on both ends of getting access to the website to then throw malware down to get more credentials.
00:11:21.679 --> 00:11:34.559
And the the really interesting thing is well, how cheap! Like, so the one actor for Sock Goulish, we saw him on the underground wanting to buy access to like the c panels and you know, the Joomla and WordPress.
00:11:34.639 --> 00:11:46.000
And like some of the prices, uh the he would pay a dollar for c panel access, he would pay 30 cents for WordPress access, and uh 40 cents, a big whopping 40 cents for Joomla.
00:11:46.080 --> 00:11:54.159
Uh, you know, so uh you know, so so it's really not like uh, you know, it's not like advanced malware to get access to these sites.
00:11:54.320 --> 00:11:58.320
It's you know, basically cents on the dollar to then set up your operation.
00:11:58.480 --> 00:12:09.120
Uh so it's kind of like a whole ecosystem, but it depends on really what you're looking for because there's different aspects that fuel the next part of the of the scheme, if that makes sense.
00:12:09.360 --> 00:12:09.759
Mm-hmm.
00:12:09.840 --> 00:12:10.159
Mm-hmm.
00:12:10.399 --> 00:12:23.519
Well, and also too, one of the interesting things about Web Injects in particular, um, Soc Golish is, you know, that threat actor is one of them, is the traffic distribution systems as well, that they're partnering with basically the facilitators of crime.
00:12:23.679 --> 00:12:30.799
So for like Steel C and Amity, these are um phishing-based or maladvertising-based types of activities.
00:12:30.879 --> 00:12:43.600
So they'll send malicious emails or they'll, you know, have some malvertising, but with like the web inject activities that are trying to insert that malicious job script on the WordPress or related websites, those partner with like additional threat actors.
00:12:43.679 --> 00:12:48.159
And in the case of Sat Golish, they also kind of ran their own traffic distribution service.
00:12:48.399 --> 00:12:54.000
So the actual targeted targeted activity targeted like that part of that whole service, right?
00:12:54.080 --> 00:12:57.279
So it wasn't just like trying to clean up the injects themselves.
00:12:57.360 --> 00:13:01.759
It was also trying to see, okay, what can we do with this like traffic distribution service that they're running themselves?
00:13:01.919 --> 00:13:06.639
It was like this this interesting thing to kind of see the impacts beyond just the websites getting cleaned.
00:13:06.720 --> 00:13:08.720
It's like, okay, what else is happening?
00:13:08.960 --> 00:13:16.399
And for all of the disruptions during the entire action, according to Europol, it has a pretty big impact.
00:13:16.559 --> 00:13:26.480
So 326 servers and 142 domains were actioned by law enforcement and private sector partners that crippled the malware's distribution network.
00:13:26.639 --> 00:13:37.679
And crypto assets of criminal origin, currently valued at over 41 million euros or 47 million dollars, were identified, flagged, and thereby restricted from use.
00:13:37.840 --> 00:13:42.480
And as many as 27 million stolen loggering credentials have been recovered as part of the operation.
00:13:42.639 --> 00:13:51.440
So it's quite costly for from the threat actor perspective, um, as well as the sort of overall disruption to the services.
00:13:51.919 --> 00:13:57.200
And not bad for like uh, you know, it's uh you're just talking about the scale of the bad guys.
00:13:57.279 --> 00:14:00.720
It's a it's a pretty nice-sized business, if I can think, you know.
00:14:00.879 --> 00:14:05.120
Uh and and and basically the bad the the good guys here, we hit their supply chain.
00:14:05.200 --> 00:14:08.559
Uh, you know, we kind of do this kind of reverse things where they're hitting our supply chain.
00:14:08.720 --> 00:14:11.679
We decided to uh kind of disrupt their supply chain.
00:14:11.759 --> 00:14:18.080
So Keith, can you take us behind the scenes of of the planning of a disruption like this?
00:14:18.240 --> 00:14:25.360
I mean, you know, keeping it in general terms, how does law enforcement come at something like this that that is at this scale?
00:14:25.679 --> 00:14:40.080
Yeah, so I I think first it's gonna start with like companies like Proof Point that Selena works for and having that intelligence and kind of going to law enforcement and saying, hey, you know, we're seeing a lot of visibility right now into sock ghoulish or this threat that's out there.
00:14:40.320 --> 00:14:47.759
It would be great if uh you guys did something about this, uh, you know, and so then uh, you know, law enforcement goes, okay, well, you know, this is impacting.
00:14:47.840 --> 00:14:49.840
What what what type of impact can we do?
00:14:50.000 --> 00:14:51.840
You know, is this as big as you want?
00:14:52.000 --> 00:15:08.080
And then, you know, in this case, they were at Europol, and Europol was is just a really awesome place to kind of bring together all the law enforcement, especially in the EU, uh, and you know, in the the US is over there, and the other Five Eye partners like Canada and Australia.
00:15:08.320 --> 00:15:13.759
So they all they all sit and they all have their representatives right there in The Hague.
00:15:13.919 --> 00:15:19.679
Uh, and they're able to then pull that data from any of their member states or their other law enforcements.
00:15:19.840 --> 00:15:29.279
So now, even though the infrastructure is all around the world, now this kind of is a good central pulling point to kind of coordinate everything.
00:15:29.519 --> 00:15:35.840
So, so now, hey, maybe we need something from uh the United States, a Gmail or as a server.
00:15:36.000 --> 00:15:47.200
So the FBI or Secret Service could go out and issue uh, you know, legal process to get that data, or maybe something is at Hettner in Germany and the BKA could go out and get that.
00:15:47.279 --> 00:15:53.200
And then it will all kind of come back into that uh basically that coordination center or command post.
00:15:53.519 --> 00:16:01.759
And then at that point, once they get the legal processes in place, then that's when they kind of get with private industry.
00:16:02.000 --> 00:16:05.360
Are there gaps that we can't, you know, do as law enforcement?
00:16:05.519 --> 00:16:07.200
Can't private industry help us out?
00:16:07.679 --> 00:16:14.559
You know, if you're gonna seize like domains or things, you need to have like uh, you know, ICANN or the other registrars involved.
00:16:14.720 --> 00:16:22.720
And then really at the end of the day, how are we gonna kind of pull this off all coordinated at one time uh and make it go off without a hit?
00:16:22.879 --> 00:16:31.600
So so that's kind of like uh there's there's a lot of long nights and a lot of uh beers and other drinks at bars afterwards to play and everything.
00:16:31.840 --> 00:16:37.600
So more more often than not, it goes right rather than horribly wrong.
00:16:37.840 --> 00:16:38.480
Yeah.
00:16:39.519 --> 00:16:41.759
I feel like that's the most important part, Keith.
00:16:41.919 --> 00:16:43.519
The late nights and the beers.
00:16:44.240 --> 00:16:46.159
Well, we're all working for something.
00:16:46.399 --> 00:16:46.720
Yeah.
00:16:46.960 --> 00:16:58.240
Well, well, I think you know, a lot of times, you know, when when you get into some of these big um meetings when you have all these different lawyers and other law enforcement and industry people there, sometimes people don't want to speak up all the time.
00:16:58.399 --> 00:17:04.000
Uh, you know, so but when you get people out with beers, they they tend to pretty much tell you what they think.
00:17:04.079 --> 00:17:07.519
Uh so uh so then you know, then you can kind of plan things.
00:17:07.599 --> 00:17:09.599
Um but it it is really neat.
00:17:09.680 --> 00:17:15.119
And I think I told the story before, before we were doing the core flood uh takedown.
00:17:15.359 --> 00:17:30.559
You know, once you get ready to do that and you got to get that legal sign-off, when we were gonna do core flood, we had to go to the attorney general uh and you know, he had to sign off on it and he looked at it and he goes, It looks good, uh, but just remember if you break it, you bought it.
00:17:30.720 --> 00:17:39.839
So is that like the in the movies when they say the State Department will deny all knowledge of your operation if it doesn't go well?
00:17:40.079 --> 00:17:41.200
Yes, exactly.
00:17:42.960 --> 00:17:49.839
Well, actually, I'm so glad that you mentioned lawyers because they play a really interesting role in all of this too.
00:17:50.000 --> 00:18:03.519
I think a lot of times people think about disruptions and takedowns as, you know, cyber operators and hackers and, you know, kind of the pew-pew maps of things and maybe, you know, seizing servers and busting down doors and stuff.
00:18:03.680 --> 00:18:09.839
But um, there is a lot of uh sort of like legal process that can be used against this stuff.
00:18:10.000 --> 00:18:20.240
And lawyers, cybercrime lawyers, I have so much respect for, actually chatted with um Sean Farrell, who is an assistant general counsel of Microsoft's digital crimes unit.
00:18:20.319 --> 00:18:27.200
And they have really sort of innovated when it comes to doing takedowns via lawsuits.
00:18:27.440 --> 00:18:32.160
And I've never like left a conversation wanting to go to law school until this moment.
00:18:32.480 --> 00:18:35.200
And I was like, wow, do I need a career change?
00:18:35.279 --> 00:18:36.319
Because this sounds so fun.
00:18:36.480 --> 00:18:42.160
I mean, it's really cool because you can use these civil actions to disrupt criminal criminal infrastructure.
00:18:42.319 --> 00:18:50.880
And basically they use Rico, which is a Racketeer Influenced and Corrupt Organization Act that targets organized crime to actually go after some of these cyber criminals.
00:18:50.960 --> 00:19:03.599
And in the case of Steel C and Amity, they were able to identify shared infrastructure between these two groups and kind of do an all-in-one civil suit against this whole ecosystem, these info stealers and the malware together.
00:19:03.759 --> 00:19:08.319
And so it was really kind of cool to see um some of their publications on it.
00:19:08.400 --> 00:19:12.640
Like, here's how we were able to sort of sort of like innovate, and here's how lawyers play a role in this, right?
00:19:12.799 --> 00:19:18.240
Like I'm just over here, like beep boop, I'm on the computer, and they're like filing important documents and things.
00:19:19.519 --> 00:19:22.400
Yeah, so yeah, I mean, that's a really fascinating point.
00:19:22.480 --> 00:19:24.000
I'm glad you brought it up, Selena.
00:19:24.240 --> 00:19:27.279
So what's the reality on the ground, Keith?
00:19:27.440 --> 00:19:39.440
Like when you have trusted partners, you know, it's like a behemoth organization, like a Microsoft or a Google or an Amazon, um, and they say to you all, hey, we've got this.
00:19:39.599 --> 00:19:46.160
You know, how how long a leash do you give a private organization like that to take corrective action?
00:19:51.680 --> 00:19:53.359
Yeah, that's a good question.
00:19:53.519 --> 00:20:01.279
So, I mean, Microsoft has been kind of on the forefront of doing this for uh well over 15 years now, which is really good.
00:20:01.519 --> 00:20:02.400
And I I love Sean.
00:20:02.640 --> 00:20:05.680
Sean's a former FBI colleague of mine, just a great guy.
00:20:05.759 --> 00:20:14.160
And Dave, if you haven't had him on your show, you should have him gone to kind of talk about what they're doing in the space because it it is really fascinating and cutting edge.
00:20:14.400 --> 00:20:19.599
When they first started doing it, you know, they were trying to make an impact, you know, 15 years ago.
00:20:19.759 --> 00:20:21.680
You know, maybe there wasn't that coordination.
00:20:21.759 --> 00:20:27.119
They they were trying to protect their area of you know, of Windows computers.
00:20:27.200 --> 00:20:35.759
And, you know, the the first one or two times they acted uh without, you know, not thinking about how it may impact like an FBI case.
00:20:35.839 --> 00:20:45.839
Uh, but really over these last 15 years, that coordination has gotten so much better now because I think what everybody's realized is that it really takes a village.
00:20:46.079 --> 00:20:51.200
And everybody plays an important role, you know, in this to make that collective win.
00:20:51.359 --> 00:20:58.160
And the great thing is, is that Microsoft being this big behemoth, you know, very forward thought thinking.
00:20:58.400 --> 00:21:06.559
Now, other companies will go, hey, well, if Microsoft could do it and they're a big bureaucracy and they have a lot of potential liability, we can kind of do this too.
00:21:06.799 --> 00:21:11.920
So I love what they're doing because it really is setting the trend uh, you know, for that.
00:21:12.079 --> 00:21:17.519
And I think just much more coordination has been involved because they've done so many of these now.
00:21:17.599 --> 00:21:19.119
It's getting to be second nature.
00:21:19.200 --> 00:21:20.319
And that's what we want.
00:21:20.480 --> 00:21:34.799
We want to be able to kind of do this off the shelf and not reinvent the wheel every time stick around after the break.
00:21:44.400 --> 00:21:46.400
How do we measure success?
00:21:46.720 --> 00:21:59.759
You know, obviously we have these takedowns, uh, but it seems like groups pop up not long afterwards or they reform, or you know, it is part of this monitoring the criminal forums to see that you know these folks are getting a little more.
00:22:00.160 --> 00:22:03.039
Tentative about getting into this business at all?
00:22:03.359 --> 00:22:06.240
I don't think that it's going to stop people from getting into the business.
00:22:06.319 --> 00:22:07.839
Because if you're a criminal, you're a criminal.
00:22:07.920 --> 00:22:08.799
It doesn't matter.
00:22:09.119 --> 00:22:19.119
You know, there's always been the threat of getting arrested, whether, you know, you're running, uh, you're running a gambling ring or you're running cybercrime, you know, the everybody that gets into criminal activity.
00:22:19.279 --> 00:22:22.559
But it does make them a little leery and it does impact their operations.
00:22:22.880 --> 00:22:29.039
And, you know, if you impact somebody and they're down for six months, that's six months of uh, you know, of an impact.
00:22:29.119 --> 00:22:31.440
And if you could put them in jail, even better.
00:22:31.599 --> 00:22:37.759
As long as there's ever crime, which will be forever, there's always going to be somebody that's going to step up into the place, next place.
00:22:37.920 --> 00:22:40.799
But the big thing is you need to disrupt the operations.
00:22:40.880 --> 00:22:42.400
You just can't let it go on.
00:22:43.119 --> 00:22:47.680
So I think there's also a few things to consider when you're thinking about the impact to this stuff.
00:22:47.839 --> 00:22:54.480
So it's one of my favorite parts of my job is actually measuring success of takedowns and disruptions.
00:22:54.799 --> 00:23:00.079
Because you can look at data and say, okay, here's how long this service was down.
00:23:00.400 --> 00:23:02.799
Here are the number of websites that were cleaned up.
00:23:02.880 --> 00:23:04.000
So actually, it's important.
00:23:04.079 --> 00:23:05.359
I think I wanted to highlight that too.
00:23:05.440 --> 00:23:13.920
So in the case of Sockolish, the law enforcement was able to clean almost 15,000 websites, basically deinfect them, right?
00:23:14.000 --> 00:23:22.160
So that plays a huge role in disrupting the botnum because that means that that actor has to go reinfect all of these websites again if they, if they really want to.
00:23:22.400 --> 00:23:23.759
So that's part of it, right?
00:23:23.839 --> 00:23:26.000
So it's like, okay, how effective was this?
00:23:26.240 --> 00:23:34.079
Putting out awareness and general like information about this threat always plays a huge role as well, because you can kind of time it with the disruption.
00:23:34.160 --> 00:23:36.000
You can further education for the end user.
00:23:36.079 --> 00:23:40.319
You can really encourage organizations to say, hey, this is what you have to pay attention to.
00:23:40.480 --> 00:23:50.400
Um, but from our data, for example, we see significant disruptions pretty much every single time there is a law enforcement, either full takedown or disruptions to activity.
00:23:50.559 --> 00:24:00.480
So it'll be a reduced number of emails that we'll see through our telemetry, a reduced number of uh C2s or panels or servers that are actually active and associated with the particular malware or threat actor.
00:24:00.640 --> 00:24:16.079
You see, I'm sure Keith sees this too and can probably speak to it, some chatter on the underground that is a lot more like, oh, okay, well, they're on to us, or we're gonna have to change something, or they might actually even close purchases for a prolonged period of time, potentially even altogether, just completely take their, oh, there's too much heat on me.
00:24:16.160 --> 00:24:17.359
I'm gonna go elsewhere.
00:24:17.599 --> 00:24:24.799
But there's also this idea of sort of causing mistrust among the criminal ecosystem and the affiliates.
00:24:25.039 --> 00:24:33.839
And one really interesting thing that Operation Endgame is doing that they're really pioneering is these videos that they post with every takedown.
00:24:33.920 --> 00:24:44.720
And they'll have these little Easter eggs in the video that are explicitly targeting the threat actor or the affiliates that are part of this targeted effort.
00:24:44.880 --> 00:25:03.839
And so you can see, oh, maybe there's like a username that's included in there that they're like clearly going after them, or maybe there's some sort of indication that the affiliates are turning on each other, or maybe the malware creator is actually like stealing some of the information that they are, you know, siphoning off of their own affiliates, and you know, depending on what the actual video is.
00:25:03.920 --> 00:25:07.920
They've done it for pretty much all of their takedowns and or disruptions.
00:25:08.000 --> 00:25:10.559
And I think that, you know, that's kind of fun too.
00:25:10.640 --> 00:25:20.160
So you have this also sort of like social engineering happening at the same time as the sort of like actual technical targeted efforts.
00:25:20.319 --> 00:25:26.480
Um, and at the end of these videos, there's always like reach out, like think about your next move, or like come talk to us.
00:25:26.640 --> 00:25:31.039
And there's that sort of attempt to get people to turn themselves in or engage with them.
00:25:31.119 --> 00:25:34.799
So I think, you know, I'll oftentimes I hear a lot of scorn in the industry.
00:25:34.960 --> 00:25:36.640
Oh, well, you know, they're just gonna come back.
00:25:36.720 --> 00:25:38.400
So why bother doing these takedowns?
00:25:38.799 --> 00:25:44.720
But I think this idea of imposing cost is from a financial perspective, there's tons, you know, asset seizures is huge.
00:25:44.880 --> 00:25:54.079
From an actual infrastructure perspective, you know, imposing that cost is huge because it, you know, removes their current capabilities and forces them to spend more money to retool more time.
00:25:54.240 --> 00:25:59.359
There's a time stack, a time cost, there's a reputational cost, and there's a psychological cost too.
00:25:59.519 --> 00:26:02.640
So when all of these are factored in, it can have a huge disruption.
00:26:02.799 --> 00:26:10.640
So maybe we're not like maybe, yeah, we'll see a blip in traffic, or maybe they'll come back after a couple of months to be at the same level of activity.
00:26:10.960 --> 00:26:19.599
But all of those factors and variables played a role in terms of their decision making and the potential that they have lost business, which is ultimately what we want.
00:26:19.759 --> 00:26:21.680
We want them to make less money and do less crime.
00:26:21.920 --> 00:26:27.200
Yeah, really at the end of the day, it's not just bringing down servers, it's attacking that trust in that criminal ecosystem.
00:26:27.279 --> 00:26:32.880
Uh, you know, you wanna, you want to have customers distrust their operations, you want to break that trust.
00:26:32.960 --> 00:26:35.519
Uh, and just you were just talking about those little Easter eggs.
00:26:35.599 --> 00:26:36.559
I'll share a little story.
00:26:36.720 --> 00:26:51.279
When I was uh when I came out from undercover, you know, everybody kind of knew that I was there was there was this one criminal that that hit me up online and you know, he hit me up and he's like, you effing fed and you know, and and and all that type of stuff.
00:26:51.680 --> 00:26:54.720
You know, and I responded back to him because he was on our target list.
00:26:54.799 --> 00:26:56.559
He just wasn't home when we raided him.
00:26:56.720 --> 00:26:58.880
I was like, dude, we know who you are.
00:26:59.039 --> 00:27:13.279
Uh you could spend the rest of your life on the run uh and constantly looking over your shoulder of when you're gonna get arrested in you know, this cafe in Paris or when you're at the beach in Nice or somewhere else, or you could just go turn yourself in and just get it over with.
00:27:13.359 --> 00:27:15.359
Uh and two days later he turned himself in.
00:27:15.440 --> 00:27:16.960
So it does work.
00:27:17.279 --> 00:27:24.079
But that that was my next question, Keith, was whether do because I find it hard to believe that these people actually turn themselves in.
00:27:24.160 --> 00:27:28.079
But you laid out the case for why that could be in their best interest.
00:27:28.400 --> 00:27:36.880
Yeah, I mean, especially, I mean, if law enforcement knows who you are, I mean, the only way that you're gonna not get caught is if you stay in Russia or China.
00:27:37.039 --> 00:27:44.480
Uh, you know, and even in those, some, you know, even in those places, if you're not paying people off, you may end up falling down the steps or something like that.
00:27:44.640 --> 00:27:53.680
Uh, you know, so uh, you know, so sometimes it's in your best interest to just um go and uh turn yourself in and let the legal process go through it.
00:27:53.839 --> 00:28:02.400
So uh and because a lot of times the people, you know, they'll be on the run for a couple years, they'll get caught, and then you know, then they have to go through the process, you might just get it over with.
00:28:02.559 --> 00:28:05.200
So that's that that's my suggestion to all the criminals.
00:28:05.279 --> 00:28:07.119
Just turn yourself in, get it over with.
00:28:07.759 --> 00:28:08.880
Going to get caught.
00:28:09.119 --> 00:28:10.559
You might as well get it over with.
00:28:10.720 --> 00:28:11.839
Serve your time.
00:28:12.720 --> 00:28:14.319
Straighten up and fly right.
00:28:18.960 --> 00:28:22.720
Well, what do we feel in terms of like the overall arc of this?
00:28:22.960 --> 00:28:26.079
Are our you know, this this didn't always exist.
00:28:26.160 --> 00:28:27.200
It's here now.
00:28:27.519 --> 00:28:29.119
Is this here to stay?
00:28:29.440 --> 00:28:32.640
I I know from the industry standpoint, industry freaking loves it.
00:28:32.799 --> 00:28:35.839
You know, they're like, hey, let's let's do it, can we do it again tomorrow?
00:28:36.000 --> 00:28:38.160
Uh you know, and you know, and all of that.
00:28:38.319 --> 00:28:43.039
And, you know, in the law enforcement, they they love it because they're making impact.
00:28:43.200 --> 00:28:45.599
And really at the end of the day, that's what they want to do.
00:28:45.680 --> 00:28:49.839
And and if they have impact from their partners as well, uh they want to continue.
00:28:49.920 --> 00:29:00.000
And everybody, every politician or every uh, you know, elected official or like in the government, they love to see their name on TV.
00:29:00.160 --> 00:29:03.200
Uh, you know, and they love to be part of something special.
00:29:03.359 --> 00:29:06.160
Uh, and and so success breeds success.
00:29:06.640 --> 00:29:08.400
Stand in front of the big seal.
00:29:10.400 --> 00:29:11.759
What were you saying, Selena?
00:29:11.920 --> 00:29:13.920
Oh, yeah, no, I so I think so.
00:29:14.000 --> 00:29:16.240
First of all, it's here to stay for sure.
00:29:16.400 --> 00:29:27.599
Um, but I also think that the it's become initially, I I feel like takedowns or disruptions were, oh my gosh, they did a takedown.
00:29:27.680 --> 00:29:29.680
Like, this is crazy, this is unbelievable.
00:29:29.839 --> 00:29:30.799
I can't believe they did it.
00:29:30.960 --> 00:29:32.160
This is so interesting.
00:29:32.400 --> 00:29:33.440
We have to talk about it.
00:29:33.519 --> 00:29:36.400
But now it's just kind of like, okay, yeah, this is yet another takedown.
00:29:36.480 --> 00:29:46.960
And I think it's really cool that we've gotten to that point where, you know, okay, maybe it's just not as newsworthy as it used to be, or maybe it's just not as cool because it's just expected that this is what happens.
00:29:47.200 --> 00:29:52.240
I think that there's a lot of interest from all sides right now to be able to contribute to this.
00:29:52.400 --> 00:30:05.359
Because at least from my perspective, as someone who works in the industry, I often feel like I'm just sort of banging my head against the wall because, like, okay, crime is happening, more crime is happening, I see crime happening.
00:30:06.079 --> 00:30:07.839
I can write detections to stop it.
00:30:08.000 --> 00:30:09.119
But like, how else?
00:30:09.279 --> 00:30:10.319
Like, what else can I do?
00:30:10.400 --> 00:30:12.640
You know, how can I have like a real world impact?
00:30:12.880 --> 00:30:16.480
And so I think it's really awesome to be able to see the real world impact of this.
00:30:16.559 --> 00:30:18.000
And whether or not you get handcuffs, right?
00:30:18.079 --> 00:30:20.319
Like, that's really, that's really when it stops, right?
00:30:20.400 --> 00:30:22.880
Is when you're able to handcuff someone, put them in jail.
00:30:23.039 --> 00:30:24.559
You know, all right, you're you're done.
00:30:24.640 --> 00:30:26.000
That malware guy is gone.
00:30:26.240 --> 00:30:29.200
But I mean, I think it's an ongoing process, it never stops.
00:30:29.440 --> 00:30:31.759
And I think that, you know, it's important to note here too.
00:30:31.839 --> 00:30:34.799
So, first of all, this wasn't necessarily a full takedown, right?
00:30:34.880 --> 00:30:46.079
Like Sakolish is not, it is, I I I refer to it in our blog as literally like the grandfather of web injects or like the OG of the like threat landscape because they've been around forever.
00:30:46.160 --> 00:30:57.680
They're a very prominent cyber criminal group that was they're associated to Evil Corp, which is a Russian uh cyber criminal outfit, a bunch of different ransomware families they've been, you know, had links to.
00:30:57.839 --> 00:31:02.160
So it's a big group, but saying, hey, we're we're coming after you is great.
00:31:02.319 --> 00:31:06.000
And what we're gonna see, I think, too, is like the the echo through the rest of the ecosystem.
00:31:06.079 --> 00:31:15.119
Because if if sockolish was sort of the innovator of the web inject landscape, I think all the rest of these threat actors that are doing, because it's a really popular technique now.
00:31:15.279 --> 00:31:22.640
And sometimes you'll find infected websites that are infected with multiple different web injects, because it's such a common technique used by a variety of threat actors.
00:31:22.720 --> 00:31:32.240
It went from being only Sokolish TA569 to I think we track like a dozen web inject-related threat clusters right now, at least at my team at ProofPoint.
00:31:32.480 --> 00:31:36.079
So maybe there's some reverberation that we're gonna feel across the ecosystem.
00:31:36.240 --> 00:31:41.759
Maybe they're gonna feel, oh, wait a second, if this group is being targeted, maybe I should rethink my strategy.
00:31:41.920 --> 00:31:46.640
Like clearly, there's being a lot of attention paid on this particular technique, a lot of these compromises.
00:31:46.799 --> 00:31:52.240
There was, you know, information about how to patch and advice for website owners and defenders to like pay attention to this.
00:31:52.319 --> 00:31:55.279
So maybe we'll kind of see this reverberation across the ecosystem.
00:31:55.440 --> 00:32:02.160
And then maybe we'll just continue to see some of these like targeted takedowns or targeted disruptions of some of these other types of activity.
00:32:02.240 --> 00:32:11.680
And I think that to me, that's really important is that one, end users are aware that Sock Goalish is not the only web inject threat cluster that is doing this type of activity.
00:32:11.839 --> 00:32:15.839
And it's important to be able to protect yourself against the threat overall.
00:32:16.319 --> 00:32:22.880
And two, hopefully we can kind of see this reverberation through the ecosystem where even SAG Goalish is coming under scrutiny, right?
00:32:22.960 --> 00:32:25.839
They've been around forever and they're still going under scrutiny.
00:32:26.000 --> 00:32:32.799
So yeah, I'm hopeful that we'll kind of continue to see some of that echo throughout the throughout all of the criminal underground.
00:32:32.880 --> 00:32:37.519
And I don't know, maybe you'll start seeing some more gossip on the forums about stuff like this.
00:32:37.759 --> 00:32:40.079
And I just want people to think, well, what's next?
00:32:40.240 --> 00:32:43.920
You know, say, hey, we just did this, you know, what's the next thing they're gonna hit?
00:32:44.079 --> 00:32:49.279
You know, or you know, so uh that that we want that distrust and and that that's what I love.
00:32:49.440 --> 00:33:09.440
And I think the other thing too, Dave, that is that, you know, we all, you know, we're in the corporate space and you know, we're usually in the corporate when you have that opportunity to kind of make a difference in the mission, uh, that's kind of uh it's just a different category of just your normal defense for you know a corporate partner, which is important.
00:33:09.680 --> 00:33:20.880
Um, but when you actually get a chance to make an impact like that, going after the bad guys, uh that that you know, that just makes you want to just kind of put your hand on your heart and stand up and just you know go go for the missions.
00:33:20.960 --> 00:33:24.319
And and I think that's what everybody really likes about it as well.
00:33:28.400 --> 00:33:32.240
I guess it also plays a part in international relations, right?
00:33:32.400 --> 00:33:34.400
I mean, there's a diplomacy aspect to this.
00:33:34.720 --> 00:33:36.480
Oh, no, no doubt about it.
00:33:36.640 --> 00:33:40.400
Uh, and and it just makes that uh, you know, that world a little smaller.
00:33:40.559 --> 00:33:52.640
You know, when you think about uh you're here in the United States and there's infrastructure overseas, everybody over there, let's say in France and Germany or the UK, they all have their own important priority things as well.
00:33:52.799 --> 00:34:02.079
So at what point, you know, do you get them to move your requests to the top of their list uh and being part of these things and building those relationships?
00:34:02.160 --> 00:34:26.159
And like when you go out to Europol, Selena and I were out at Europol last year for a conference, and you just sit around and you're getting a chance to meet a lot of people and you, you know, you meet maybe somebody from Latvia or Lithuania that you know that you just never thought of or you know, meeting, but yet, you know, next week there's a server in Latvia right now, and now now you know you can call Pavel, you know, and he can go help you out.
00:34:26.320 --> 00:34:30.159
You know, so so it's really important to do that and to build those relationships.
00:34:30.239 --> 00:34:33.280
Because really at the end of the day, relationships are what makes the world go round.
00:34:33.599 --> 00:34:36.320
You can all hold hands and sing we are the world.
00:34:36.960 --> 00:34:40.880
I personally would love to kick myself out of a job.
00:34:41.119 --> 00:34:59.920
If, you know, if at the end of this there is no not enough work for cybercrime analysts because we've done such a good job with private public partner collaboration that crime has decreased so drastically that I can go, I don't know, be a librarian or like open open a coffee shop, I would be so happy.
00:35:00.239 --> 00:35:11.360
Here's what needs to happen is we need to take all of the assets that we seize from them, put them into a big pot for the old age retirement home for retired analysts who've been put out of work, right?
00:35:11.440 --> 00:35:14.480
So you have a so you have a place to live, you get a monthly stipend.
00:35:14.639 --> 00:35:23.599
You know, it's like the old actors' home in Hollywood where they just take care of you, but based on the ill-gotten gains that uh, you know, Keith's colleagues collected over the years.
00:35:23.840 --> 00:35:24.320
I love it.
00:35:24.400 --> 00:35:28.480
It's what we'll call it like the uh the AI fund for the AI displacement fund.
00:35:28.800 --> 00:35:29.840
There you go.
00:35:39.360 --> 00:35:42.079
We will be right back after this quick break.
00:35:51.519 --> 00:35:58.400
Well, I do want to just make sure that before we leave, especially if we're talking about the compromised websites, some recommendations for folks.
00:35:58.559 --> 00:36:02.000
Um so obviously, like network detections and endpoint protection are huge.
00:36:02.320 --> 00:36:13.039
But really the things that to kind of look out for, especially with Slack Golish and some of the other web inject stuff, from a defender, actual defender perspective, is restrict Windows users from downloading script files and anything but a text file.
00:36:13.199 --> 00:36:14.639
You could do that via group policy.
00:36:14.960 --> 00:36:18.800
Consider disabling PowerShell for general users who don't need it for their workflow.
00:36:19.199 --> 00:36:22.719
And from the website management side of the house.
00:36:22.800 --> 00:36:29.599
So for organizations that like own websites, like website administrators, make sure you have MFA on.
00:36:29.840 --> 00:36:37.920
Um, you know, consider something like YubiKey or additional layers of protection for that, which is direct access to the WordPress admin with allow listing.
00:36:38.239 --> 00:36:45.119
Just there's a lot of some of these sort of very sort of, I don't know, air quotes basic uh security recommendations that you can implement.
00:36:45.440 --> 00:36:48.079
The WordPress plugins and themes is a huge one.
00:36:48.159 --> 00:36:53.280
Make sure that you're getting them from legitimate websites and they're maintained, being up to date as much as possible.
00:36:53.599 --> 00:36:53.840
Yeah.
00:36:53.920 --> 00:37:02.559
So just really make sure that you're trying to make the best of your web security that you possibly can because a lot of these web inject threat actors, including Zach Golish, really try and exploit that.
00:37:02.800 --> 00:37:06.880
So um, yeah, it's it's it's exciting, but it's still a threat.
00:37:06.960 --> 00:37:08.960
And we have to make sure that we're staying on top of it.
00:37:09.119 --> 00:37:12.079
And uh, I just hope we continue to have more of these.
00:37:12.159 --> 00:37:14.320
So we don't have a podcast episode on all of them.
00:37:14.480 --> 00:37:17.599
It's just so common that we're just like, oh, yep, another disruption.
00:37:18.559 --> 00:37:20.159
The disruption of the month.
00:37:20.400 --> 00:37:21.360
Exactly.
00:37:21.679 --> 00:37:26.159
And that's only malware in the building, brought to you by N2K CyberWire.
00:37:26.400 --> 00:37:33.119
In a digital world where malware lurks in the shadows, we bring you the stories and strategies to stay one step ahead of the game.
00:37:33.280 --> 00:37:40.960
As your trusty digital salutes, we're unraveling the mysteries of cybersecurity, always keeping the bad guys one step behind.
00:37:41.199 --> 00:37:43.280
We'd love to know what you think of this podcast.
00:37:43.440 --> 00:37:49.360
Your feedback ensures we deliver the insights that keep you ahead in the ever-evolving world of cybersecurity.
00:37:49.599 --> 00:37:54.239
If you like the show, please share a rating and review in your favorite podcast app.
00:37:54.480 --> 00:38:01.599
This episode was produced by Liz Stokes, mixing and sound design by Trey Hester, with original music by Elliot Peltzman.
00:38:01.840 --> 00:38:03.920
Our executive producer is Jennifer Ivan.
00:38:04.320 --> 00:38:06.639
Peter Kilpie is our publisher.
