Full transcript
0:00So, this what we're doing today, by the way, is a continuation of what we did last week. We did a little presentation on the world of cyber crime and what happened in the last year. And I guess I can do a a quick recap before we jump into all of the fun stuff. And then I uh I'm going to finish up all the content
0:20we didn't get to last week as like a wrap-up of what's going on in the world of cyber crime. And then after that, John and I will take questions from the chat and I will ask John many questions if the chat doesn't have questions because John knows a lot of things. I don't know if you guys know this.
0:34>> Not true. >> But John a lot about a lot of things. All I know about is what I'm talking about here, but there's many angles to cyber crime that are shockingly not just what cyber criminals are doing that can be very interesting. He does. He hacks and he knows things. John of all trades. That's funny. That is officially a funny
0:51thing to say. >> All right. you join the party here, Nick. >> Yeah, dude. It's an honor to have you. For those of you who don't know John, John, can you introduce yourself? Which again, you're you're most likely here because you know who John is, not because of any other reason. So, just in the in in the unbelievably rare event
1:08that someone has not heard of you, who are you? >> Hey, hi. Hello. My name is John Hammond. I'm a security researcher person who works at Huntress for the day job. And then I have a silly YouTube channel where I share a whole lot of videos on cyber security stuff. Trying to be on keyboard, trying to talk and not just
1:25talk, but actually walk the walk. Trying to do the stuff. Trying to actually do some showand tell, do some demos, uh, to have folks see what it all looks like for real and not just ramble and yap. Though I do do a lot of yapping and rambling in my videos. So, but super happy to be here with y'all. Thank you
1:42for letting me join the party. Last week we did this show over on my Discord server and we thought this would be kind of a cool way to not cross-pollinate is not the right word, but I guess the closest to it to like hey get the party together in two different ways, two different places, which was super sweet.
1:56>> Yeah, we suspect if you're in here, you're interested in cyber crime. Not committing cyber crime, but what's going on in cyber crime and if you're in John Hammond's audience, that is most likely the same. In case you're not following him, jh.live/links is where you can find all of his stuff. But without further ado, I'm going to
2:12start presenting. I'm going to give you guys a quick wrap up of what we talked about in the last event in case you weren't there. And then we will cover some news and then do some Q&A. So what happened in 2025? A lot of things happened. One is many youth hacker collectives became significantly more prominent than they were in years past.
2:32However, they were still very prominent in years past. The other thing that was very interesting is breach impact. So like the fallout of a data breach was not quite as isolated as it may have been in years past. The impacts of a breach typically like in some of the largest breaches we saw in 25 and like the tail end of 2024 were like company
2:52the the company that was hacked and their data that was leaked on like what would have been for a lot of the year breach forums and a lot of last year breach forums. A lot of that data did not actually affect the company that was hacked, but rather affected the many many people who use their service or
3:06rent servers from them or use their software or whatever. It was like the the the actual victims were mostly downstream. There were leaks of vendors configs for tons and tons of customers. There were leaks of code from tons and tons of customers. There were of of the like parent company that was hacked. So that was interesting. We started to see
3:23a lot more people get compromised and have their data leaked who serve many organizations. This is something that Waifu Connor Muka who's now in jail for hacking snowflake and a bunch of other a bunch of snowflake tenants, a bunch of people who use snowflake, not actually the company of snowflakes. He specifically said that they target these kinds of companies. There's like several
3:41acronyms for them, but basically business process and service companies or who they go after, which they went after during the snowflake campaign went after one that successfully got shiny hunters, which was his, you know, he said he was a part of shiny hunters and scattered spiders, so got them into whatever they got into. And then they also hacked many of the tenants
3:58directly. So kind of an interesting macro look at things. The other is free leaks are slowing down. This is partially because of the decline of some of the more prominent forums. As an example, breach forums as of right now is not uh the I mean the old breach forums is just not alive. There are probably still clones around that have a
4:17few members, a few hundred members. There are forums trying to take its place that have not yet succeeded. Yes, leakbase is a popular one right now. There's a few others, but the like free advertised leaks that like in 2023 and 2024, every single freaking news story was a leak posted to breach forums or something else. And in the last year,
4:38that was uh the case. Like under the hood of every story was XYZ thread actor posted to breach forums, XYZ threat actor posted to a dark web forum and the data was free. They just gave the data for street cred. That was not so much the case this year. A lot of the kids who did that ponyied up into larger
4:52groups and started posting on data league sites where they post samp you know free sample file which they also used to do in breach forums but mostly they're monetizing the data that they stole which is a part of these all play into each other the rise of extortion crews this year and then the decline of forums blah blah blah and also arrests
5:07I'm not going to go over all the arrests again but we went over so many of them last week that's probably why we took so much time and again one of the big changes in the last year which is shocking that this number is rising but the amount of attacks In general, this is a recent Microsoft report. This is
5:21covered in Verizon's DBIR from this year. The amount of attacks where the bad guy literally just logged in or took over a valid session is higher than it used to be. Despite atto huristics tools being more advanced than they used to be to detect a session being taken over, the volume of attempts is so much higher
5:42and the like circulation of creds and and cookies is so much higher that the number itself has also risen which is shocking. Now I also we covered the rise and fall and rise and fall because everyone involved in these things has pretty much gone everyone prominent involved in these things is now in jail. But many things happened in the last
6:00year. breach forums changed ownership. I did a little history recap of it and two huge forums were seized that's nulled and cracked. So this is a fun graphic that illustrates the forum landscape. This is a slide I made two years ago where with the exception of raid forums all of these forums were alive. Now pretty much all of the prominent
6:19English-speaking forums nulled cracked which this may shock some but null and cracked had way more members than breach forums despite being in the news significantly less. Nulled and cracked were super super prominent forums. I don't know how many of those members were like bots but they had a ton of members and now breach forums nulled cracked and raid forums no longer exist.
6:39Of course raid forums doesn't right it's like the breach forums is its successor but still interesting like places like exploit and ramp that are still alive have much smaller member aces and are much they're kind of more serious places for cyber crime and like that you could make a distinction between threat actors and cyber criminals. Some people do like
6:58maybe a cyber criminal iss a type of threat actor. Ramp and exploit and like some of the Russian the more serious Russian speaking forums. I call those usually I call those guys threat actors. They're like you know they know how to hack things. When John makes videos like dissecting interesting malware or showing like UAC bypass that's like
7:16thread actor stuff. Cyber criminals are copying and pasting creds and they're hanging out in in seedier places or easier to get to places like people. There are many people who graduate from breach forums into a place like ramp or a place like exploit once they're serious and yeah you have to pay for an account. Sometimes you also have to
7:32vouch depending on what the rules are like at the moment someone has to vouch for you in order for you to get membership. They like sometimes open up sometimes lock things down on these forums and it's a whole different ballgame. But the the easy to go to places which were like telegram and breach forums to like meet other cyber
7:46criminals, join cyber crime telegram channels and get involved in that world have kind of now become just a scattered world of telegram channels and you know a handful of forums again but no forum is I don't want to say there's a clear leader quite yet in the history of forums you know uh other forums that started with another topic were often a
8:04funnel into another. So raid forums was for raiding Twitch streamers. OG users was for finding OG accounts. Like when someone says you have an OG username, that's like your name on Instagram is Nick. Like you have the Nick. You have your account is like a word or a phrase or a name. It's like an impressive username to get because it's it's it's a
8:22very small amount of characters. It's like of course someone would get that in the first day of a service being up. Leak CX was for music. Minecraft forum was for Minecraft. But a lot of those kids hacked each other in Minecraft. learn how to hack and and the shockingly Minecraft hardcore factions was for many years a big funnel into the world of
8:38cyber crime. A lot of those cyber criminals are in jail, but breach forums leads to other places. people doing, you know, sketchy marketing stuff, people doing lower level hacking stuff, people being internally online forums, and then people finding Telegram channels to have fun, and then sometimes people getting more serious, you know, joining extortion groups, starting extortion groups, be, you know, becoming
8:58ransomware affiliates, and then they usually hop off platform and go somewhere where more serious people are talking. There were many law enforcement operations. We don't have time for them. Tons and tons of people got arrested, blah blah blah blah blah blah blah. I think in our map of uh arrests this year, there were like 27 very prominent
9:14arrests of cyber criminals in the like young English-speaking extortion group world, which you know is so much more than years before. And then another interesting thing we saw this year was sessions. So session cookies, session tokens became uniquely in the sites of cyber criminals because taking over a session bypasses MFA. It's typically the
9:35value of a session is as simple as that. You can attempt to log into something, but a lot more things have MFA on now, and MFA is very effective at stopping someone from logging in. You know, bar, you know, a handful of thread actors who are very dedicated to getting past these things. These things are very helpful.
9:50Session tokens walk right by it. Walk right by MFA because they're already authenticated. And why I'm rushing through this to get to the new stuff. This is all stuff we covered last week, by the way. You literally just visit a website. Odds are it's throwing some cookie on your host. when you log into that website, a session cookie is often
10:06added to that list of cookies. And then that's why when you open your laptop again 6 months later and go to, you know, website.com, you're still logged in. That's because your session hasn't expired. You don't have to log in every time. As long as that session is stored on your computer and that's literally stored in a file on your computer. So if
10:25a cyber criminal steals that file, they have your cookies. And infos stealer malware obviously steals cookies. It's like one of the two most important things it steals, cookies and creds. So, you visit a website and it slaps a couple cookies on your machine. Let's say dark mode, light mode switch and a visitor ID. Like, what what number
10:41visitor are you on this website? You log in successfully and it adds a new cookie to that cookie file and says, "Hey, now onite.com, you've got a session token. You already logged in. You don't need to uh you don't need to log in again for a while." And then when you do log back in, you know, nothing new happens. It's
10:54just still checking your session token. Eventually, your session token will run out and it'll ask you to log in. Session hijacking is when malware infects the machine or something runs some script is able to execute locally on the machine and literally just grabs that cookie in the world of info stealer malware you know usually ships it off to some
11:12telegram channel somewhere or someone reposts it to a telegram channel later you know after downloading it from their own C2 a guy downloads it and literally just uploads it to his browser. It is unfortunately that simple in many cases and then the attacker boots it up and even if they change something which we've seen on many services that ATOs
11:31have happened on even if something does change in their footprint often times if the session token is valid the session will still be permitted. It's a crazy crazy world cookies but it's also important to remember most cookies don't mean anything right to to a bad guy. This cookie that's you know tracking someone's consent to have cookies tracked in their browser to a cyber
11:49criminal this is extremely interesting. This cookie ests off persistent is a wellocumented means of reissuing entra basically off stealing this cookie means you can also bypass MFA and log yourself into someone's session bar couple you know steps in between there and bad guys know this so this guy was selling access
12:09on a forum this might have been rampant and he said let's be clear there's no zero day here this is just a session hijack I have a rat on a senior exec's machine you know here's all the information about the access this guy said to be honest I've been sitting on a stolen cookie for half a year now from
12:23stealth. Is this a bad joke? Like it still hasn't expired. This person was saying, "Is it really that easy to bypass 2FA with a simple stolen session cookie?" And replied, "Yes, stealing a session cookie can easily bypass 2FA, which is true. You know, you're logging into an already unlocked session. Does session does stolen session work if it
12:40has 2FA?" This person replies, "Yes, session theft is a way to bypass 2FA. I see it at work a lot a good bit." Interesting that they're talking about work in here. This person said, "Pitting from a stolen session to DevOps access is closer than you think." And this is like this is very common in the world of
12:54cyber crime now. People giving away cookies, people offering cookies for their channel. And you know, because in a in a stealer log, you don't have to save credentials to your browser. Infos info stealer malware will steal credentials from the browser's password manager. Cookies are not optional. Those are going to be on the device unless they're cleared diligently, which is not
13:12common in most stealer logs. These logs are sold on the internet. We all know this. What bad guys doing? Oh, this. Okay, this was a fun one. I went over a video we have, which John might put in a video of his own at some point, but this was a cool video. I'm going to do screenshots so we can go faster, of a
13:26cyber criminal taking over a stolen session. I did this in the cookie training uh too. So, this is a you may be seeing this for the second time if you attended our stolen session training. But basically, cyber criminals, this is how easy to steal a session. You go into your stealer log and open the user info file, the system
13:42info file, the whatever it's called that has all of these, the information about the infected machine. And then you go into an anti-detect browser, which is basically like a little virtualization platform for a browser. You can make a bunch of birds with a unique hardware profile, unique connection footprint, a unique everything, and they just copy and paste the config of the stolen
14:00device into the anti-detect browser so it looks exactly like the device they infected. So, this one has four cores. They update the core count to four cores. This one has uh GTX 1050. They update the graphics card to a GTX 1050. and it's accessing the internet when it was infected with an info stealer malware from Concord, New Hampshire.
14:17Now, this person goes into their uh the cyber criminal goes into their proxy config for their anti-detect browser and and searches up Concord. They accidentally select Concord North Carolina, which is notably not New Hampshire, but they click it anyway. They successfully connect. They keep going, drag and drop the cookies into the cookie section. So, what they've done so far is click like three things
14:39and they're dragging and dropping the cookie file into the anti-detect browser. They launch it. They visit youtube.com just to show off and boom, it works. And it's that simple. There there was no click. There was no login. There was no nothing. All they did was drag and drop the cookie file into the browser, configure a few things,
14:55configure that the location completely and correctly. The reason they do the location is so that they like it looks like the device is connecting from a uh like a coffee shop down the street from the person's house instead of a whole different you know country or states away but they they did that wrong and it and it still worked which is terrifying.
15:11Now most cookie takeover is like fully automated. John covered this in a recent video for creds and cookies. Things like open bullet silver bullet BL tools. These are uh tools that have like largely automated testing cook stolen things stolen cookies stolen creds. And then MFA is also not, you know, they can bypass MFA with cookies, but if you use
15:31TOTP based MFA, horrifyingly enough, stealers also steal the config of most browser extensions that the user has installed. Mo, usually they're looking for crypto stuff, but if you look in the list of browser extensions from any old Stealer malware family, you're going to see a couple TOTP browser extensions, too. And all they have to do is steal
15:51the config here which contains the secret key, the number of digits, and the token period. And if they plug this into any website or Python script or whatever, that's a tootp generator. So like, this is a victim's authentication on their actual device, which the config has now been stolen. This is a random website where you can plug in totp
16:09configs. And then this is the tootp code that the bad guy generated using the stolen config, which you can see matches the victim machine exactly. So stealing this tootp config from a from a stealer which you know a lot of which most families do is also a way to bypass MFA unfortunately. And the the kinds of apps
16:28that we've seen extortion groups target in the last year are things that have like uh some kind of OOTH token that can be used to hop around to different apps because an OOTH token typically is issued to a user and can be used to to access any app that they're federated to see. whatever identity suite they're using has federated them to access. So
16:48like you use octa and it gets you into you know Dropbox and GitHub and whatever. So you log in through your IDP once and you're logged into all of your work accounts at the same time. These are the kinds of tokens that they go after that one token that's going to get them into everything else because they
17:03typically have very very broad scopes. Now they're often doing, you know, they're finding these things in stealer locks, but also very prominently this year, a lot of very, you know, kind of classic social engineering, which is, you know, getting someone to install a malicious app that's going to steal OOTH tokens or, you know, con convincing someone to visit a web page or download
17:22something that's going to steal existing OOTH tokens and send it to them in the moment. And then also some fancier supply chain attacks happened. But a lot of it is social engineering and stealer logs. And then even when it's not a stealer log, you go into the stealer log and and see a super unique, you know, you can make yourself seem a lot more
17:39credible as a cyber criminal when you're calling help desk by using information found in the steeler log like oddly specific corporate links, which by the fact that this these same groups are are typically using dealer logs in addition to social engineering. We suspect they're cross-pollinating information from both. Now, this is a an example of the technique used in the one of the
17:57larger more recent campaigns, which okay, what we're looking at here is a is someone using a Telegram bot that is making calls for them over Google Voice with like a pre-built script. This is a bot called Big Hit Bot. >> Are you able to full screen the video, Nick? >> I can. Yes. >> Sorry, I'm blind. I wear glasses.
18:15>> I wish I could zoom in even more. So, they have like a config they upload to this and it dials. Maybe you can hear the audio. I doubt it. But so he's asking for the status. He's waiting for it to dial and boom, it dials. >> This is an automated call from Google Mail. We have detected an unusual amount
18:32of login attempts located in Ashurn, Virginia. If this wasn't you, please press one on the keypad. If this was you, thank you for confirming. A Google Assistant will contact you shortly. So now like they can run a significant amount of these calls at the same time, but once someone enters one on their keypad, it shoots it back to the
18:53telegram channel that the person is using to control their dialing bots. Yeah, the voice did sound kind of cursed. It sends back the code and says, "Hey, this worked. This this phone number called and they pressed one." So they've confirmed they own the account. Now you can call them back and it's it'll you know, you've got a a much
19:07better chance of going well than randomly calling these numbers yourself. So this is how they automate these things. And yes, these are mo. You'll actually notice Coinbase recovery is written. CB hacking is written here. These are super popular. I mean, the Coinbase attacks, but the same bots are used in all kinds of different fishing campaigns. Oh, good question from
19:23orangutang tortoise. Orangutan tortoise. How often are OTP generators as extensions found in the wild? Unless a Cavalier sketchy extensions. That's curious. Yeah. So like they're not I would say they're super uncommon for corporate like as a corporate multiffactor source but people just regular people for a shocking amount of
19:44app in the wild do use OTP and it's not like again for for corporate apps people have password manager you know based code generation or app-based code generation for like a Duo or any one of the popular authenticator apps that are much much safer than OTP P browser extension, but you do see it just not
20:05for work things. But there's there are a lot of people who have no interest in corporate compromises. They're just like taking over Netflix accounts and streaming accounts and like premium accounts on services and just kind of reselling them. And yes, in the crypto context, definitely like people using sketchy crypto services that take OTP and finding those. A lot of people who
20:24actually end up downloading these stealer logs are looking for crypto things. It's very evident by the actual the data that's included with the logs, but not all of them. There are obviously many people using steeler logs for much more sophisticated stuff. Now topic for the roundup of the year. Ton of people went to jail. A ton of uh interesting
20:41things happened. The thing that I found particularly interesting this year was an increase in people though you'll see these attacks called ransomware in the wild. An increase in people getting extorted rather than classically encrypted with ransomware. So there are several prominent groups in the last year who made most of their money
21:01downloading data from people's environments and listing it on a data leak site and saying we'll release it if you don't pay us. They got access to an environment or just a SAS and downloaded things like using the export function of the SAS tool. But the interesting thing is they didn't do much else. They didn't go lock down a bunch of machines.
21:18They're not ransomware affiliates. Their access can be cut off and it doesn't matter. They stole data and they're just trying to extort you for the data. Usually that's something that's something in the past and still ransomware groups did. They would extort you for the data and have your systems locked down which is you know a double uh double extortion situation. But now
21:37the single extortion that's happening is becoming increasingly popular. It is so damn easy for them to do. Some of the most successful campaigns, like the snowflake one for example, literally just meant with valid credentials, logging into someone's snowflake tenant, finding the export button, downloading all the data, and then emailing them and saying, "Hey, we stole all your data
21:56from your Snowflake tenant. Please pay us or we're going to put it out." And that's, you know, that's how it worked. There's no hacking. There's there's logging in in that. There's no real hacking. There's no scripting. There's no knowledge of cyber security. There's no knowing how to bypass anything. There's no need to understand how an environment works in any way. You just
22:15need to log into a SAS app. You know, maybe a decade ago, the data that now lives in Snowflake was on prem in some database server locked away behind a VPN would have been many more steps and much more expertise to get to. Now, that same exact data lives in a SAS app and all you need is a valid set of creds and if
22:31the creds don't work, a valid cookie to get in there. So, it's changed the game a little bit. Now, some of these groups, Crimson Collective is an interesting one, a very recent one who already has several prominent victims that they've claimed. Red Hat, Nintendo, Claro Colia, and their whole operation is exfiltrating content from S3 and EC2. So, they steal things out of companies
22:52S3 buckets and then find ways to get into other S3 buckets at other other AWS environments to go into other S3 buckets and Xfill the data and then they send a extortion email. Now, what's interesting is Shiny Hunters, who's responsible for many, you know, uh, responsible people use the shiny hunters name when extorting people all the time. It's
23:10often not super clear if they're actually a part of the, you know, comm subculture or are really actually affiliated with like shiny the people who own the shiny hunters accounts on forums in any way. But, nonetheless, they use the name in the power school hack. They use the name in the snowflake campaign. They did in the Salesforce
23:26campaign earlier one. they did in several bucketjacking campaigns, which is what I affectionately call these kinds of things when you try and take over AWS environments to steal data from the buckets. And they this this ransom note we're seeing here is from the same thing from them doing exactly what Crimson Collective is doing now and stealing data from S3. Now, we've also
23:45seen them log in via info stealer. The power school hack was from that. The snowflake campaign was from that, but the this like uh bucketjacking thing is a little different, but it looks exactly the same. very very similar to what Crimson Collective is doing despite them being different groups. So they find a US keys exposed somewhere. Their code
24:03didn't work in some ways which PaloAlto called out which was very funny. They failed to retrieve AM users. They viewed the names of all the S3 buckets that the access key they found can get into again failed to retrieve a list of IM users. The name of all the buckets deleted a section of the buckets after exfiltrating them. So they stole a bunch
24:20of the bucket. This is like an interesting take on ransoming. They didn't encrypt the buckets at rest, which by the way, there are separate campaigns that actually encrypted the buckets at rest. Not affiliated with this crew, but they deleted buckets, left a bunch of buckets, and said, "If you want your data back, you're going to have to reach out to us." And then they
24:36created new buckets with their names just to hopefully draw attention to it. Apparently, some of these just went completely unnoticed by the companies they'd hit for a very long time. Cuz a lot of buckets are just kind of cold. Like, they're not their contents aren't being retrieved a lot, and no one's checking for new buckets being made in
24:50any serious volume. you know, if they're just making a handful. So, it is kind of funny, kind of tragic that a lot of people just didn't notice this attack happened despite it infecting so many environments. Another extortion group, again, a super recent one, is Coinbase cartel, who apparently, you know, at least research suggests they're also using stolen creds to get in where
25:10they're getting in. Sea Logistics, Entity Data, AdScale, they've already got a list of victims and they've already got a DLS up. So again, another group that is does not seem to be encrypting anything, but only stealing data from an environment and posting it on. And then obviously most recently SLSH, but we've talked enough about them and all of their things. So an
25:28interesting landscape now more so than before defined by extortion. Not to say ransomware is not still very prominent, but extortion is obviously becoming noticed by a lot of the younger, you know, upand cominging crews and collectives of cyber criminals. Now, okay, for presentation content, that's it. That was wrapping up what we were supposed to get to last week and now we
25:48can do the fun stuff. So, I'd love to take questions from the audience for John and myself. Mostly John, obviously. It's rare that you get this one-on-one time with him. So, please ask away. And I also have questions for John that I will sprinkle in that are kind of like cyber crime philosophy, like what what is going on and where are we headed? So,
26:08if anyone has questions, please start dropping them in there and I will also ask away while you while you think of them. So, >> it's a strange arrangement of words. Cyber crime philosophy, the code of conduct. >> It's an I think it it's a a space that needs more love from academia. Cyber crime philosophy. What is the philosophy
26:27of cyber criminals? Typically, it's not it's not a very deep philosophy, usually financially motivated. When tracking threat actors, what's a great tool or framework to track their TTPs, events, etc. I mean, John, you answer that otherwise I'm going to this this question is asking me to shield for flare. Yeah, very good question that you can use on paid.
26:45>> No, I mean the knee-jerk reaction that I know a lot of folks will throw out is like Maltiggo because that's oh something you could probably get up and running a little bit quick and easy. I think is Maltiggo still free and open source. Um >> there is version. >> Yeah. Yeah. Um I think you have been
27:00falling in love with and also kind of got me caught the bug with uh predict a graph which is incredible. >> That is like a huge mind map custom flexibility customization of what might be doing what and that's probably a little bit more to like the individual to the person to the people behind a
27:21thread actor group or cluster. But if you're looking at their TTPs and their events, those you could very well look be tracking a miter attack framework. Use something like Feedley to see and any of the new reports that are out the door. Of course, Flare. Yeah, predict a graph is a huge one that I would recommend if you're getting to like the
27:38individual level or if you like that canvas to be able to connect the dots, draw and drag and work with the nodes. I think there's a price tag on that one, but it's well worth it if you know that that's what you want to do. >> Yeah. And they do let you make free graphs on predict graph. So like yes it
27:54is it is paid but there is a free there's a community edition. You can make free graphs you can make a predict a search account and we also have a cool integration with predicted graphs. So you can pull in like leaked creds from emails into your graphs automatically and a bunch of other cool things. So yeah we know that that's incredible.
28:10>> I personally a big fan. Yeah it's pretty cool. I like it. Okay. Can both of you speak to why there's such a gap in security at across the SAS/shared responsibility model? It feels like as things shifted from on-rem to cloud and SAS, security fell by the wayside and I just want to know if anyone has taken
28:24has any takes on that. Very good question. John, do you want to take a stab at that? >> Yeah, I can get the ball rolling if that's okay cuz I don't know how you'll approach it versus how I would. I feel like the delta when you're talking about on premise and cloud SAS whatever amorphous void is that like it is then
28:41you who is responsible and you have to be in control of everything and you have to manage and monitor and audit and do literally everything when it's on prem but SAS you're just giving it to someone else you're saying it's your problem now and they manage it for you hopefully that's kind of what the whole premise and promise is supposed to be and how
29:00well they manage it for you is no longer up to you like that the ball is not in your court, you gave it to them. So there's convenience with that. There is security if they're doing it right, but then it's a matter of are they doing it right? That's where I think where you get into a lot of the like vendor
29:15accountability. That's when you start like, hey, can I see your quarterly pentest reports? Do I know you're doing quality assurance? Are you actually monitoring and enforcing all of these security recommendations? Do we have multiffactor everywhere, blah blah blah, UB key, etc., etc. I know that's a lot of question marks, but I feel like that's the problem is because if we are
29:37going to just blindly trust whatever that managed SAS solution is, you do still kind of want to know how is the sausage made to a certain extent. >> I agree. I think the color I would add is that maybe it was easier in the past when there was the shared responsibility model didn't exist before in the sense
29:54that like you were deploying this database locally and you weren't necessarily locking down the database itself but you were locking down everything around it. You were making the pipe that people were accessing the database at your company through. So you like and you were probably using three open- source projects to to make that happen or like things native to whatever
30:14your network tools were. So now that people go through the internet to get to the same thing or to get to the same data, it's like a re-imagining of uh maybe it wasn't you didn't think of how much your database product had to be locked down because you were like listen we you know we're we're monitoring every
30:29freaking event on that thing. Everything to any log file is getting shipped to the SIM. We're only expecting these five executables to ever even run on the thing. So everything else, we're having an alert if anything runs there. These are the service accounts that should even be pinging the database from other products. Like you could very easily
30:45write detection rules for anything fishy going on under the database. That's just not really the case anymore. And people like defenders have still defend the endpoint I think with great diligence with detection content with very good EDRs with all of this stuff. And the same love, you know, it take these things take time. Like the same love is
31:04now being given to SAS tools, but it's a slower evolution. Like once a tool is through the third party risk assessment, I don't think a lot of people think quite as deeply about locking it down as they do locking down their end points. As things evolve, the people who admin them are outside of the security function. Yeah, totally. They are. You
31:20want security to be involved in the procurement at least like a notification that you bought this tool so that they can get around to securing it. But I mean that's a big problem in its own like there's most orgs have a huge backlog of that kind of stuff. Yeah, project zero. We we probably could we could probably do this question alone
31:34for hours. Do you see ramp taking over exploit or XSS? Oh man, I don't know. I don't know. In the near future, I think things will probably not change immaterially. But why do you ask? Do you think? Yeah. Yeah. Okay. If there's a big OP endame announcement, then things could certainly change immediately. But I don't know. I I um I don't have a
31:56confident answer. If Oleg was here, I'm sure he would. Oleg is our Russia cyber crime guy. He give you a a big essay about ramp, but I don't I haven't like consumed any information that would suggest that. I should have told like to be here, man. But good question. >> Maybe I can ask a question for you or if
32:11anything just to kind of get us thinking and maybe we talked about this a little bit, so I don't know if I'm just talking hot air. Sorry. But why are there so many now different either forums or factions or has the cyber crime ecosystem ever actually successfully centralized to one? But then I know you're just going to get oh the high
32:28school clicks and whatever stupid cyber crime crap to just splinter in faction as they inevitably do and yeah I guess kind of cockroaches thing. You cut the head off the higher end and there are more blah blah blah. >> The early days of cyber crime were the more unified like there were you know back in the days of what was that forum
32:45called? What was like the it was like the oge it was like before I mean way before raid forums not even dark code the one was like after dark code. Someone's going to remember it, but the cyber crime world was a lot smaller back in the day. It was like a few people stealing credit cards and sharing them
33:00with each other. And that was the most probably the most organized in terms of location that the world of cyber crime maybe ever was. And then honestly, like 2024 Breach Forums was very very tight-knit. Every story that made the news, it felt like for like a six-month period were from one of the main characters on Breach forums of really
33:22there were a few clicks that were doing all of the data leaking, posting data leaks, and very few of them were for sale. Like it was a lot of free stuff. That was the most like organi I think one of the more organized eras. But I mean what VXTV said is yes, Shadow Crew. Thank you. Thank you, VX. I was just
33:38about to I I don't know. I was going to Google search cyber crime mindlessly and see what came up. Uh but yes, absolutely shadow crew. Um thank you. But uh I mean VX is right. When you cut the head off the hydra, it grows more. This happens every time a big form falls. Like look at when the the most recent or like the
33:54second most recent breach forms fall when there were like 25 clones. It was chaos. And there were prominent Breach Forums members who were who were making clones and then selling the domains and then saying that their clone was fake and it wasn't actually them. Even though like there was a ridiculous amount of evidence that it was them. There were
34:11scams left and right. It was a it was a very chaotic era. So, you know, it's scatterrained right now. I think it'll probably like the world of cyber crime will eventually find its way back to a prominent at least the English speaking world of cyber crime will eventually find its way back to a prominent location, but for now it's spread
34:28between many many many channels on and groups on Telegram, which is just much more chaotic than in years past. I know this is a noob question, but I just wanted to ask you guys, what's your advice to a newbie threat intel analyst? How can newbies be better analysts other than MITER mapping, tracking a unique tip, tracking using a tip, what mindset
34:43should we instill for newbies to be better analysts? Very fun question. I think for a new threat intel analyst, the interesting like people, you know, we we sometimes open um research positions at Flare and generally people who have writing samples always stick out. Like maybe they put things on a blog or maybe they just write privately and share a writing sample with us. But
35:02like the actb obviously has an amazing blog that you all should read. The act of organizing things into a report, even if it's not a part of your job, is very, very helpful for wrapping your head around the narrative of what's going on in the world of cyber crime. Because sometimes you'll see a major attack going on. You'll you'll see some quote
35:19from some threat actor or you'll see something happen on Telegram and you won't you'll have a a bit of the story and enough to share, but like the deeper you go, the more context you get and you might have to read three reports and go, you know, into four different tools to find all of the posts from all the
35:33thread actors. but the history of the cyber criminals involved, their personal relationships, the things they've done before, the crews they've been a member of before, these things all help you wrap your head around what's going on. So, I think trying to write reports with like a nice exec summary, a nice bluff bottom line up front before it is great
35:51practice for, you know, shaping the narrative around a cyber crime event that will help you prepare things for as you get more senior in your thread intel career, you'll have to share these things with different audiences. So, it'll help you kind of get perspective on as you're writing a report, who would really care about this? Is it our sock
36:06manager? Is it one of the GRC folks? Is it someone in finance? Like, uh, who's the audience? These are very good things to consume. And then what John just shared is awesome. These are like handouts and resources from people who do this kind of stuff for a living, which are are great. So, consuming from analysts that you admire and that you'd
36:24like to make content like theirs, or you'd like to, you know, do the job that they do as your day job. These are the kinds of things that I recommend. You know, kind of generic advice, but it's it's real. And find a find a corner that you're very interested in because if you're really interested in whatever it
36:37is you're researching, you're going to have a really awesome time. You're going to be really excited to wake up for work the next day and see who posted what. So, I highly recommend it. Mitch asked, "As cloud dominance reduces the number of traditional attack paths, are we inevitably pushing towards adversaries targeting people physically instead of systems? Does the next evolution of this
36:54trend involve coercion or threats against individuals to force access?" I think it's a good question. Basically, you're saying there's one path now to get to access and it's like through this guy's creds or a stolen session, you know, or help desk. It's like a handful of very generic access paths. It's not there's not 15 routes in through like
37:12any number of internal prives and pivoting and things that you know maybe happened in the past. I think probably not physically yet, but we have already seen an increase in actual physical attacks targeting prominent people in the world of crypto specifically. So, it has the focus on the individual because they hold the keys to the kingdom more
37:33so than they did before. It's harder to pivot into the thing you want. You have to get the keys from someone either from their device if you can get it or if not from them by tricking them or by any number of things. So, I think we will probably see the same trend of violence in the crypto world. maybe that we have
37:48so far, but I haven't seen this spill into corporate corporate cyber security yet, like people being extorted as individuals. I've seen offers go to people like people offer to pay insiders for access, but I haven't seen threats against insider yet. But now, Mitch, you're giving people ideas, man. But it's a really good question. My question for John, and I have an answer, too, and
38:06I bet people in the chat have answers, too, so please chime in, is do you think the number of arrests this year, basically the question is, what does it mean a lot more people went to jail this year? Like there was a stealer log sting that took down tons of domains. Like 30 some odd people were arrested. In all of
38:22the like young extortion groups, there were 27 arrests in the last like year and some change. Do we think this is law enforcement making a ton of progress? Or is the iceberg getting larger and they're still cutting the tip off? But like since it's getting larger, the tip is getting larger, too. But are there more cyber criminals? Is it getting
38:40easier for people to do cyber crime? Is this real progress? Is it just the tip of the iceberg or nuanced? You know, is it maybe a little bit of comm a, a, a little bit of calm b? John, you first. >> That became a very big question, Nick. You threw in a lot of extra sub questions in there.
38:55>> Main question is, is this solid progress? That means we're cracking down on cyber crime or does this just mean there's more cyber crime? >> I don't know if I'm like glass half full, rosy glasses, or too much of an optimist or whatever, but like no, genuinely, I do think it is good. It is good forward motion. It is progress. I
39:14think law enforcement doing more crackdowns, more takedowns, more seizures, more arrests. Like that, I think for me is not a uh-oh, there's some bigger baddy around the corner or there's going to be more that we find as we open up Pandora's box. I think it's just that there we're getting better at it. We're good at it. And this is not by
39:31any means some like, oh, political thing, but I think for a while, for a little bit of time, we had like good players on the field. And at least that did set a precedent for the continued players on the team now to keep things going in a good direction. I don't know if it's a good direction yet, but I know
39:50it's a direction. And I think that's a heck of a lot better than no movement at all. But I think when we are putting it in the limelight, screaming and shouting about like look at these arrests, look at the damage that we're doing. And that's a good thing. It's not like chess thumpy, but it's really genuinely to
40:05show Yeah. If you're some stupid 16-year-old, 17-year-old kiddo and doing the cyber crime stuff, you're going to be caught and you're going to be arrested and you're going to have your life ruined and taken away from you because of the stupid things that you did. So, I don't think we're emboldening or glorifying whatever when we have an
40:23arrests and I think that the number of arrests is a good thing and I think we are fighting the fight the right way. But that's me. Sorry, I'm waxing poetic. I don't know. What do you think? That's that is a perfect philosophical answer to a very philosophical question and I agree I my answer is relatively simple which is one yes this is real progress
40:41and progress should be celebrated because the damage the amount of damage cyber criminals have been able to do in the last 3 4 years is like stunning. So crackdowns on it are meaningful. There was a lot of time where no serious arrests happened like there were big ones in 2023 and the beginning of 2024 but like now it's a lot a lot higher
40:58than it used to be. Law enforcement is paying more attention and that's good. And I also think not but and I also think the iceberg is getting larger. I think the barriers to entry for cyber crime have gotten lower. I think there's a lot of literature that suggests this may be an effect of co the lockdowns people staying home a lot more. But
41:13there is a more technical group of uh young people online who some are channeling their passions into you know stuff like this researching about the things that are happening and hoping to be on the right side of it. But a lot of them who, you know, maybe don't have the best judgment or role models or who knows what. That is uh that's not my
41:32question to answer. But I think there are more there are more cyber criminals now because cyber crime has has simply become easier. The data has become easier to find. The companies have become easier to extort. This is something that I do suspect will change over the years, but it's the the era that we're in now. That's my
41:48philosophical answer to and also philosophical question that I ask. There's a couple more questions I should ask, but I'm not Okay, you know what? This is another philosophical question for you, John, which is you have hacked potentially more things than anyone. You've hacked many things, not as a bad guy. You've documented it on your YouTube channel. You've taught people
42:06how to be uh defenders and the demos you were giving, you know, years ago on techniques or access have maybe changed a little. Like you've seen a lot of data that we have. You've seen stealer logs. You've seen videos. You know how easy stealer logs have made the world of cyber crime. Like the just the proliferation of creds and cookies
42:23alone. Do you think we've gone wrong somewhere in authentication? Should we have sped up the elimination of passwords quicker now that creds are everywhere and they're being stuffed more than they were before? Which is crazy because like it's easier to stop the stuffing now, but they're still stuffing more. They're succeeding more. Cred based and cookie based attacks are
42:43at a higher success rate than they were before at mostly because they're at a much higher volume than they were before. But like, did we go wrong somewhere? Should we have gone somewhere faster? And what do you think? What do you think of when I ask you that question? Is the world of Oth okay? >> Um, I think the current landscape that
42:59we're in, right, oh, whatever cheesy landscape, big fluffy term, is just the fact that that is the way things work for HTTP and making connections and working with the internet like that's just the way that it is. That's just how it has been. Passwords were the way. Cookies are how you store that a state sessionwise connection in that regard.
43:21And that's just how it's been. And that's I think now what has enabled the how it's become so commoditized to have stealer logs and password spraying and all the cookie stuff falling around and about. But I don't think to say okay we missed the boat or we jumped the shark or we were wrong in that. However, I do
43:38have another part of me that's saying like look we're a little bit smarter now and we do know authentication kind of comes from like three different pedestals or podiums, right? You've got something you know traditionally your password something that you have that's supposed to be your multiffactor authentication like your phone your pull out and then something that you are like
43:53your biometrics your eye retina scan fingerprint whatever right so if we got a little bit smarter and sharper with that earlier yeah okay cool we probably maybe I don't know maybe could have prevented a whole lot of the stuff that we're in right now if we had mandated and gone away with okay here's this holistic picture of how you prove your
44:12identity and who you are what you say you are maybe we just started We used the password and that's how we got to where we are right now. But now I think, yeah, okay, are we going to kill passwords? Do we ever replace it? Is it like cash? It's currency. It's never going to die. We just have to. I tend to
44:27think, yeah, it's never really going to die. But if we could try to get to that passwordless world or those pho keys or something that has a little bit more bolstering in the layers of Swiss cheese for defense and depth, that's good. That would be good. So, I guess we are really to a certain extent playing catch-up. I
44:43don't know if I answered your question or if I just drove all over the map. >> You actually did, believe it or not. And it was a it was a very compelling rant. I loved it and I really appreciated you being on here today. We are actually at time. So that is it my friends. The next thing we're doing is flare is our I
45:02think we posted the link in here already, but an intra ID like an an AD and intra ID security training. Again, it's not these are not like it's it's like a it's a training by Flare, but it's not of Flare. So we're not there's not much of the tool in the training. It's if you protect Active Directory or
45:17Entra, then these are interesting attacks for you to understand and interesting defense techniques for you to understand. So thank you again everyone. You were such a such a fun uh chat. Such good questions which I had a lot of fun answering. I hope you did too, John. And we will see you again on the next