Full transcript
0:00I'm sorry. I just think this is a really
0:02funny story. One of the resources we
0:04monitor is ransomware.live and that
0:07tracks a lot of like recent ransomware
0:09intrusions and attacks and breaches
0:10across the industry. And just the other
0:12day there was a report and alert out for
0:14Halcyon Technologies. Apparently, the
0:17ransomware group Synnovebi had gone
0:19ahead and published on their leak site,
0:21their dark web blog, they had
0:23compromised Halcyon, the industry's
0:25first dedicated adaptive security
0:27platform, blah, blah, blah, that uses
0:30some AI stuff to stop ransomware. And if
0:33they were compromised by ransomware
0:36gangs, that would be slightly ironic.
0:39So, I was thinking, that's wild. I want
0:41to go check it out. I want to go see
0:42what's on the Synnovebi ransomware gang
0:44leak site over on the dark web. And it's
0:45like, is it really there? And in case
0:47you've never seen a ransomware leak site
0:49before, Synnovebi's is pretty dumb, it's
0:52stupid. The website, I don't know,
0:53breaks when you try to zoom in. So, I'm
0:55sorry. I'm going to the header looks
0:56weird. The news section has nothing in
0:58it. The leaks page, of course, has all
1:00the listed victims and their published
1:02data. I'm going to redact and obscure a
1:03lot of this, but I noticed the fact that
1:06allegedly the Halcyon victim was not
1:09there. I scrolled through, little show
1:11more button at the bottom. It's just it
1:14wasn't there.
1:15>> [laughter]
1:15>> Now, the Synnovebi ransomware group has
1:17been active, I guess, since July of 2025
1:20and very recently had that victim that
1:22they added, but was suddenly gone. Over
1:24250 victims pretty quick, almost 2 weeks
1:27between attacking victim and then
1:29publishing data or putting at least a
1:30claim on their leak site. And
1:32ransomware.live, as usual, has some
1:33pretty cool insight, a little bit more
1:36intel to be able to tell you what group
1:38is up to what. They even include a
1:40sample ransom note, so you can kind of
1:42see the artifacts that are left on a
1:43compromised host. But the alleged recent
1:45victim, Halcyon, was not on their dark
1:48web leak site anymore. So, I got to
1:49thinking, you know, like is there a
1:52wayback machine equivalent to like look
1:54in the past of a dark web site, anything
1:56that's over tour, and then I realized,
1:59oh yeah, there is. This could be pretty
2:01easy. Hopping over to the events tab
2:03here in a global search, I want to look
2:05for something recent, maybe the last 2
2:07days, last 7 days, and I don't need to
2:09look at the open internet. I just want
2:11to look at the dark web and illicit
2:13networks, but probably just the
2:15ransomware leaks. And then let me search
2:17for Halcyon ransomware leak for Halcyon
2:20on Synobi. I can take a look at the
2:22content tab here, and it's basically the
2:24same thing as what we saw on
2:25ransomware.live with a little bit more
2:27like JSON metadata. But, the summary
2:29section here does give us the URL and
2:32the tour leak site again for that
2:33specific instance. So, hopping back over
2:35to Synobi's dark web tour URL, it just
2:39kind of errors. Uh undefined.
2:43Title is gone. Content description is
2:47>> [laughter]
2:47>> The date's still here. I just think it's
2:49really funny to see this thing like
2:50break. It's gonezo, and not even in the
2:53listing of victims over on this
2:54left-hand side. We can still drill down
2:56and actually even see the images. We're
2:58getting to the point though where we
3:00realize, okay, this is not the Halcyon
3:03AI anti-ransomware company. It is an
3:05entirely different organization.
3:07Ransomware group, bad guys,
3:09cybercriminal threat actor trying to
3:11demand a ransom and extort like the
3:14wrong company. Like, hello. No, sorry.
3:16You got the wrong number. Halcyon.ai,
3:19the anti-ransomware company, puts out
3:21this post, "Hey, statement regarding a
3:23misattributed ransomware leak site
3:25listing." And aw, "We recently became
3:28aware of a ransomware leak site listing
3:30that references a company named Halcyon
3:32Tech. We dug into it and saw, this is
3:35actually referring to a different
3:36organization with a similar name based
3:39in India. There has been no ransomware
3:40incident affecting Halcyon and our
3:42operations, customers, and partners
3:43remain fully secure." Cool. That's good.
3:45This is good. Big sad to Halcyon Tech in
3:47India. I'm sorry. But, this felt like
3:49kind of a funny a actor fail.
3:51Misattribution occurs when threat actor
3:53leak sites publish limited or incomplete
3:55information or when the organizations
3:57just happen to have a similar name.
3:59Whoops. My heart goes out to Halcyon
4:00though. I'm sorry you got to deal with
4:02that weirdity because the threat actor
4:04made a mistake. Like that that's on
4:05them. That's not on you. The crazy cat
4:07guy on Twitter made a really funny
4:08heehee haha about this thing about look
4:11yeah you SpongeBob meme you got the
4:13wrong guys. Quick fourchan green text
4:16rundown of the thing
4:18>> [laughter]
4:18>> don't know who they're extorting
4:20obligatory cat picture. If you're doing
4:22cybercrime, you got to at least extort
4:25the right people, right?
4:27So look, I'm sorry. Big love to Halcyon.
4:30They do have the pictures and a lot more
4:32to confirm the misattribution in their
4:35post. We got to track that down with
4:36Flare. They're a big sponsor of the
4:38channel and I really appreciate all
4:39their support, but looking into the dark
4:41web seeing the funny mistakes from
4:43threat actors. There's a link below in
4:44the video description to give Flare some
4:46love, but this page still just cracks me
4:48up. Undefined undefined they took it
4:50down. It's gone. You can't even see the
4:52old one now. I got to fill out the
4:53report section now like hey you got the
4:54wrong number.