Full transcript
0:00Most leaks had massive downstream implications and the largest targets that yielded the most results for cybercriminals were companies that served other companies in some kind of technical or like technical service capacity. The other which is shocking is credential attacks are on the rise. MFA is much more popular but not like nearly
0:21as popular as one would hope or that we would expect since we work in cybersecurity and talk about MFA a lot. There is a ridiculous amount of accounts sitting in the wild that I'm sure any cybercriminal could walk right into with no MFA on pretty much every platform in the world. >> An anecdote, I was thinking I need to
0:41get some sort of skit recorded where we're just playing with the idea of MFA everywhere. I want to be like I try to get out of bed, I try to leave my bedroom and I can't open the door without checking my phone to accept the prompt. I can't go to the shower, open the bathroom, whatever. MFA everywhere.
0:56>> [laughter] >> That is a great idea and we should do it. We should. We need MFA everywhere. Sorry, didn't mean to derail but I'll sprinkle in every now and again. No, you're you're absolutely right to derail. We should if MFA was everywhere this this wouldn't be happening. Just kidding, it would because cookies are much more popular than they used to be.
1:15Because if with MFA being a blocker now for cybercriminals more so than it used to be, cookies are more popular. Getting some kind of OAuth or any kind of session token walks right past in in many many cases walks right past multifactor authentication. So, much more popular than it used to be.
1:36And also an interesting economic change, free leaks. Like back in the day you scroll breach forums in the in early 24 late 23, everything is free. There are there's an access page where people are are asking you to pay for access for some stuff. There's a few DBs that are for sale but pretty much every leak is
1:54like for the culture. It's all free, it's all I hacked this company, you know, this company was owned by me, Intel Broker or Sanjiero or Angie Weaponizer or whatever. This is not the case anymore. The the groups who are the main characters now are extortion motivated. Like they are making money off of their leaks. It is not for the culture anymore. Less
2:17leaks are showing up in the wild quickly. Sometimes if the if the victim doesn't pay, the data does get released but it's not like it used to be. It's not the there's free downloads all over these forum websites anymore. And also, a lot of forums are gone. A lot of forums disappeared in the last year that were hubs of cybercrime. Which this
2:36comes with many positives and negatives for those of us who track cybercrime but like all in all I think disruptions to the world of cybercrime are a net positive. These like these are bad these are places where people organize doing bad things but it means the world of cybercrime has scattered quite a bit. It's not it's not quite as easy to like
2:55you can't just go on breach forums and scroll around and know what's going on anymore. Everything exists in a variety of Telegram channels and Discords and you know, offshoots of smaller forums that are all trying to make a name for themselves now and none have really succeeded in in taking the throne and who knows what will. Or maybe the the
3:12era of forums is is over. I'm not ready to say that yet but it's certainly changing. And then finally, arrests. A lot of people went to jail. On the note of creds, attackers logging into things instead of hacking in in in actual complicated ways using exploits or like sending a well crafted phishing email and pivoting around and doing you know,
3:33post exploitation framework requiring things. It's not necessarily decreasing in a meaningful way but the the amount of people just straight up logging into things is increasing a lot. The success of brute forcing login portals is much higher. Well, you know, it's not so much brute forcing as like stealer log initiated cred stuffing. So, people
3:53aren't taking again, this is a few years ago your cybercriminals downloading the MyFitnessPal leak and like 15 other leaks from the breach forums leak page and then they're stuffing these creds into a platform they're trying to get into hoping you know, they don't even know if these emails have accounts there. Now with stealer logs being much easier to get to and much more popular,
4:10this a stealer log contains the URL that the person was saved this credential for. So, when you see someone on the dark web now or in any cybercrime community saying selling 100,000 Azure accounts or selling 10,000 GCP accounts, they're selling accounts that they know have logged into that resource before cuz they took it from someone's password manager. These are way way way more
4:32confident credential like operations. So, that's why logging in has become more successful cuz now people are you know, it's more common to just find creds that you know can access a thing cuz you're taking it from stealer logs password manager DBs. I hear that term combo lists, is that right? That's kind of oh kind of a bundle of all user creds
4:52etc. that could log in well. And I know you mentioned look, a lot of this stuff is going to have a price tag now when threat actors are selling it and that's that's the money making route but more often than not you still do see free samples quote unquote like here's an excerpt of the logs just to prove just
5:07to give just to show we have the data and then even that you could very well weaponize. Totally. Yes. There and now the world of combo lists is more complicated than it used to be. Now like a combo list itself is usernames and passwords not necessarily with a specific target in mind. There is a new type of download that's been a lot more
5:26common this year which is a ULP. And this is like a combo list of stealer logs. So, you'll see ULPs for sale on stealer channels, you'll see free sample ULPs, you'll see these on forums, you'll see these all over Telegram. And a ULP is like the URL that the user can access, the login and the pass. So,
5:41again these are taken from browsers password managers. It's like a it's an evolved combo list cuz now you can say, okay I'm trying to get into as a cybercriminal I'm trying to get into Jira or Snowflake or GitHub or something. I can control F on that domain and only spray credentials against the portal that I know do have
6:00an account on this website. So, I'm still going to get it I'm going to get blocked, I'm going to get you know, I'm going to have a bunch of issues but now my list of credentials is way way way more confident and I'm probably going to have success the larger my stealer collection is. And another interesting thing is the DBIR found that the number
6:16of companies who had a corporate cred found in a stealer log whether it's from a corporate device or someone's home device that they logged into some SSO thing once and and then had a ransomware event a few days later was super high. While most of the people consuming stealer logs are do you know, selling Netflix accounts in bulk and doing super
6:34low level fraud, IABs are in here too. Extortion groups are in here too. Like everyone who's doing a little more interesting higher impact bad guy stuff is also in stealer logs. So, this kind of shows you IABs are looking at logs a lot and they're taking action relatively quickly to find valid creds, sell them, get them in the hands of a ransomware
6:55group, you know, some of them have exclusive relationships with affiliate programs. So, like a stealer log collector, someone who's actually going out and infecting people will through through a variety of different ways some of which I'll talk about later, will sell those credentials sometimes exclusively to a ransomware affiliate group first or ransomware program and the ransomware group will distribute
7:16credentials among their affiliates in order of who's the best. Like who is their highest money making affiliate? Who is the most skilled affiliate? They get the best you know, creds. So, it's it's become pretty systematized. Most credential testing now from these things is pretty automated. Much more than it used to be. Okay, someone asked a question just to clarify even if you're
7:34using phishing resistant MFA, even if a stealer grabs your cookies they can go straight in. >> Yes. And platform dependent. Platform dependent is a good call out there because yes, the cookie has to be valid. The cookie has to or has to have some kind of like refresh token that you can refresh with but yes, in general
7:50Thank you for the Fs. It's helping. Um >> [laughter] >> In general, yes. A valid cookie helps. Uh helps them get by like a a credential stuffing issue. All right, that was fun. Now let's do the rises and falls and rises and subsequent falls. So, Breach Forums was a big uh kind of a main character this year in
8:08the sense that it fell many times. John, were you going to say something? No, I was just going to say hey, please do keep throwing questions in the chat. If there's anyone else thinking anything else, please don't hesitate as we transition from one thing to the next. And please let me be your megaphone as well. I can I can raise my hand and be
8:25the whiny child in the back of the room. Yes, so do that. If I'm not if I don't notice a question, please call it please call me out. All right, cool. So, Breach Forums this year you'll notice is currently and honestly, this may have changed this morning. I have no it's impossible to keep up is currently offline. As of the last time I checked,
8:42there is no actual Breach Forums forum online. Again, this could have changed yesterday and I didn't know cuz I was out sick. But this is a this is a literally by the day changing situation but so, in the last like year and some change Intel Broker steps down from Breach Forums ownership and gives his ownership over to Anastasia. Shiny
9:04Hunters then takes over ownership of Breach Forums from Anastasia and claims that Anastasia was actually an alt account for Shiny Hunters. Breach Forums then disappears suddenly off the face of the earth. And also, there's like a bunch of drama in between these two things that we don't even have time to get into. But Breach Forums then disappears all of the sudden for like a
9:23week. A ton of copycats come up. Prominent Breach Forums members are are launching their own copycats. Then Breach Forums Shiny Hunters puts out a message officially and says Breach Forums we suspect that law enforcement got access to Breach Forums through a MyBB zero day. MyBB is like one of the bulletin board softwares that the forum runs on. They said that we have a you
9:44know, we had a zero day, we suspect they have access to things, we're pretty nervous, be careful. And then Breach Forums is used the the main domain, this is sometime later, is used by Shiny Hunters as their DLS. This is the clear web domain, not the not the onion. The onion is still sometimes hosting a forum in this uh in this calamity and chaotic
10:02situation. Shiny Hunters then claims, this is after using it as a DLS, that Breach Forums is entirely compromised and that they will now be taking Breach Forums offline. They also claim that pom uh pom pom purin, Connor Fitz Patrick, the now arrested, recently re-sentenced 3 years in prison uh admin of Breach Forums, they claimed that he was like a
10:22puppet for them this whole time. I don't know. There's a lot of uh nonsense going on in the a lot of tomfoolery in that narrative, but who knows, you know? They're just they're really muddying the uh water. And also the owner of the official Breach Forums Shiny Hunters account apparently was arrested. This is not uh we'll get into
10:41that too, but they're not the actual uh Shiny Hunters is not an individual. Uh so, there there's still things going on with that crew. Uh and then in other forum news, this would seem less important than Breach Forums, but there were more users on these platforms. Nulled and Cracked uh are gone. They were also seized. There were arrests
10:59made. Um these forums are again, God knows, these things pop back up every day, but they were knocked offline in the last year and change. So, the current forum landscape, this is when I made this slide for the first time, all of these forums uh except Raid Forums were online. These were all operating, very very popular cybercrime forums.
11:19Nulled and Cracked, which were seized and and several people were arrested when it was seized, were the most popular by the user count, by millions and millions and millions. They weren't making the news every week like Breach Forums was. Back in the day, like again, early 25, late 24, if you like you couldn't throw a stone and not see Intel
11:38Broker or San Giero or Energy Weapon User or so many other prominent Breach Forums members posting uh something that was like it's that immediately made the news and was a national headline and like odds are if there was a big cybersecurity incident that was a headline, it it tied back to Breach Forums. Like one of five users on Breach
11:57Forums. Now, it's really just the the primary Russian-speaking forums that are still online. Breach Forums, Nulled, Cracked, Raid Forums and more are now the primary hubs of English-speaking cybercrime are offline. And and you're not XSS, Exploit, Ramp, BHF, these aren't quite as easy uh communities to navigate and get into. They require some
12:19of them require reps, some of them require money, some of them require vouching. Uh it's not these are not places that it's easy for the very casual cybercriminals of Nulled and Cracked and Breach Forums and Raid Forums past to operate on. But those forums were an important part of the cybercrime pipeline that is luckily now
12:39kind of disrupted in a serious way. So, people from Raid Forums, which were originally raiding Twitch streamers, people from OG users, which were trying to get cool usernames that were just one word or a name, people from Leak TX that were leaking music and people from Minecraft forums playing hardcore factions were typically the kind of people, the prominent users there, the
12:57people who like grieved and hacked other users and originally were not in were not doing cybercrime for cybercrime. They were like hacking their friends' accounts to whatever, leak music or raid a Twitch streamer or take down some rival Minecraft faction, would end up kind of you know, getting referred over to Breach Forums cuz they were all in a
13:16similar ecosystem. And then a lot of those guys end up on Breach Forums and become real fixtures of the cybercrime community. Almost all of them, like a lot of the people we're going to talk about in a minute, come from one of these places and their foray into cybercrime was not cybercrime. It was like it was a video game community, it
13:34was a music community, it was some kind of community where they were just one of the terminally online people who like made a name for themselves in it and then figured out the the same tools they could use to like hack into an uh uh to get a cool username or to hurt another person in Minecraft or something
13:49could also be used to make exorbitant amounts of money very very easily. Not without risk though, as we'll see. And then these kind of end up taking you to weird Telegram channels to, you know, some people end up on more serious cybercrime forums like Ramp. Some people end up doing, you know, kind of sketchy businesses that they learned about on
14:05Breach Forums or somewhere like Blackout World. And then there's other sub forums, Hack Forums, Zone-H Forums, places that exist and don't exist and are much smaller offshoots of like hacking culture um and community more than places where crime happens. But Breach Forums was at one point the kind of nexus of all of these places and with it gone, that nexus is also gone and
14:24these things are scattered between a bunch of different you know, Telegram groups and Discords now. So, Operation Talent was a big thing that happened. This was where Nulled, Cracked, Selex, MySelex and Stark RDP were removed from. Selex, MySelex, Stark RDP were used to sell like for transacting among cybercriminals a lot and there were legitimate companies who used them too,
14:44but they were super popular among cybercriminals and the same person owned all of these. Two people were arrested, a bunch of properties were searched, not everyone who was searched was arrested, a bunch of money was seized and this was a big This is a big deal in the forum world. Forums that millions of people went on uh disappeared. Operation Secure
14:59was This is a this was targeting the info stealer world, a little less the forum world, hit tens of thousands of IPs associated with a bunch of different variants of uh info stealer malware, primarily Luma, Rise Pro and Meta. That is a that's an that's an old one. That's a callback. But Luma was super popular. Is it Luma
15:18or Lama? Feel like I hear different ends. SQL, SQL, GIF, GIF. Like I say seam, like I say seam, a lot of people say seam. I don't know. Is there a right answer? Luma or Lama? Does anyone in the chat know if it's Luma or Lama? And you can't just say you can't just type the word because then I don't know how
15:36you're pronouncing it. But I think it's Luma. I think it feels natural. I agree. But Lama seems like it's read that way more. Anyway, again, I'm derailing. >> [laughter] >> Giving you a chance to get a drink at least. Yeah, thank you. So, this was a big deal because the info stealer world was taking off. Like we talked about the
15:53forum world and a lot of Thank you, WTS. Very helpful. >> [laughter] >> Um there was a lot of arrests in the uh forum world, but stealers are like the like the info stealer logs are like the AK-47 of cybercrime. Everyone it's like the the thing that every military has, it's in like real companies are selling
16:14it, arms dealers are selling it, it's used in every conflict on every side. Stealer logs are they are the backbone of this kind of cybercrime. It's like if you're not using the stealer log to log in, then when you're going to fish someone, you're looking through stealer log for like a hyper-specific internal domain where when you call the help desk
16:32or when you send an email, you're going to look so real cuz you have a username that's weirdly complicated and like an internal dev account. You've got a domain that only an insider could know, but you found it cuz it's a saved to a corporate device. Like it's a part of from fishing to help desk calling to uh
16:49actually just logging into stuff, these are everywhere. Uh so, it was important it was it was good that there was also action here and 18 people being arrested in one operation. There were 30 some 32 people arrested total in this. That's like a huge deal. That is not you do not see malware authors going down in in
17:08substantial volumes uh like this. So, this was a crazy This one shocked me. I still don't even know what most of the 18 were arrested for, but it happened. And then this was a really big deal and this one's kind of hot off the press here. But some Medusa, which is different from Medusa ransomware, this is Medusa the stealer. Medusa stealer
17:26admins and developers were arrested in Russia. When Russia arrests cybercriminals, this is a newsworthy event. This is crazy. So, Medusa stealer, by the way, if you reverse engineer it, you will see that it has like anti-CIS bypass. It's like if if it detects it's being run from a CIS country, from any post-Soviet nation or
17:46Russia, it will not execute. It will not the malware will not run. Um apparently, this is what uh the >> Sorry, this is just a nerd in me. It's like is that the silly old detect Russian keyboard stick or is there I think they do like the IPify checks. I think it's both like IP. So, also like
18:05if you use a Russian VPN, then or Russian egress point at least on your VPN, you also might not the stealer might not execute. So, Medusa's Medusa stealers were arrested. What the government said, what Russia's narrative here is right now, is that these guys attacked a specific city in Russia, not sure why, called Astrakhan. Again,
18:26probably really butchering the the pronunciation, but they apparently, the developers themselves, removed some whatever the anti-CIS evasion techniques were, removed them to attack the city. So, that's the this is the This is the one thing you can't do. In cybercrime, attacking Russia is the one thing you
18:46can't do. It's why you don't see in our, you know, in stealer log collection specifically, you see Russian like you'll see Microsoft say they detected X amount of stealer infections in Russia, but then in the actual log marketplaces, you don't see the same amount of Russian logs. It's cuz they do not like these do not make it to the public. If an
19:04infection happens in Russia, it is an accident. Like it is not it's something that they want to undo. They don't want that data in the wild. They don't want to sell it. You will get in trouble. Most of them are in Russia. So, it's huge news. But they made the mistake of going after Russia. Again, this could
19:17have been a mistake. It could have been they accidentally let it execute and this person was just a victim of theirs and it's a whole, you know, it's their own blunder. They fell victim to a classic blunder or it was intentional and they had some beef with this city or were trying to do something specific. But it's interesting. In in cybercrime
19:32in America, if you look back in the history of of tons and tons and tons of cybercriminals, you'll see that some of their first victims were were companies or city governments in near them. So, it's interesting that that's that's not the case as much overseas. Russians do not hack Russians as often, but like American cybercriminals do hack American
19:50things often. And there were a lot more falls. There were some big ones. There were a lot of members of a couple groups that got arrested. Shiny Hunters is a group emerged in, we'll call it 2020. That's a maybe a controversial statement. Some people want to say 2022. But this was like a com offshoot of just guys who were friends from the com
20:09hacking places together. A big big one of their victims was AT&T. They're responsible for all of these Snowflake hacks. Those guys went to jail, which hit Ticketmaster, Santander Bank, and hundreds of other companies using stealer log, like stolen creds. So they would just look up Snowflake credentials in their own stealer log collections and just try and log in. And they claimed to
20:28have gotten into a big like some record holding company that got them in that was holding data for all of these companies and that's one of their ways in. And then they also stole other creds and logged into other Snowflake tenants. And then they are also their name has been used in a bunch of extortion. Their name was used in the PowerSchool
20:43extortion. Their name was used in a couple AWS big like AWS extortion campaigns. The Salesforce extortion campaign now, which then turned into them using a different name. But this is like kind of a brand. Yeah, I'll I'll talk about the PowerSchool extortion. This was kind of more of a brand than a group, but it it kind of became a group.
21:03The next one, before we get into fun arrests, there's a few more, is Lapsus. This was much more popular years ago, but these guys are starting to go to jail now. They're a little more of like you know, these are SIM swappers. The you know, Shiny Hunters are some people in there who were like obviously SIM swappers before, but they don't they
21:19didn't do a lot of that in in their confirmed hacks. Lapsus loved SIM swapping, loved MFA fatigue, loved like more classic social engineering. They also did buy creds to get into stuff. And in like 2022 was their biggest spree of victims. Nvidia, Okta, Microsoft, Samsung, and then you know, Ubisoft, Uber, Rockstar Games. They had tons and
21:40tons of victims. Most of these were from one guy in Lapsus who is now in jail. And then Scattered Spider is probably the most arguably the most what appears to be the most organized. They showed up around 2022, have been super active last year, super active this year. This is again like com sub a loose-knit group of
21:58people who are members of the com. I shouldn't say members, who are a part of the com subculture. Again, the com is not a group, it's a culture. It's a collection of different places where people hang out and talk about certain things. It's the community for for these people, you know, who are in the know. They love going after cloud
22:14environments. Their big campaigns have involved Okta, have involved Azure, have involved AWS extortion, have involved tons and tons and tons of things. There some of their biggest hacks that actually several of them did work on together were MGM Resorts and Caesars. And then they members of Shiny Hunters who attacked Snowflake and Snowflake tenants, not actually the company
22:32Snowflake, also posted like we're in the Scattered Spider Telegram channels and we're posting spiders. So that just goes to show you this is not there's not dudes who are members of Shiny Hunters who are like chatting with members of Scattered Spider and saying, "Hey, isn't it cool that we're both members of different cybercrime groups?" They're all in the same chats with each other.
22:50There is not like there they use brand names when they do certain things sometimes. But for the most part, these are just loose-knit groups of people hacking together. And this is a a part of a massive network that we've put together on the group. And by the way, this is like I think 26 or 27 names you're going to see either connected to
23:10Shiny Hunters and Scattered Spider or both. And the com and Scattered Spider and Shiny Hunters or all three. And Lapsus and the com and at the middle of it all is Scattered Lapsus Hunters, which is a new group name. It's a new brand that they've slapped on because they're all doing things together. And honestly, mostly the name is just a
23:29troll. Like it's just being funny about yeah, SLSH is the acronym that everyone uses for them. It's just it's just to be funny because everyone calls them a bunch of different things. No one knows who's who. This is intentional and mostly because of disorganization. But everyone who we've been able to connect to the group, pretty much, not us, but
23:48the security community at large, is in jail. This is like 26 people who've all gone to jail in the last year and some change. So their their opsec has been atrocious. They brag about their hacks immediately from private accounts. They share things everywhere and it's been a huge problem for them. That a lot of these guys came up using the same
24:09usernames in cybercrime for years and years and years. So all someone in the FBI has to do is take that username and plug it into some data leak lookup engine, find the guy's password, pivot from the password. He used the same password on his personal email 2 years ago and it got leaked. These deanons typically do not have much stuff. And
24:26yet ego is the problem. They don't want to abandon their personas because they built up mystique around them. And in these communities, they like celebrate each other. So let's go over some of the some of the right to jails. Believe it or not, extort a company straight to jail. Believe it or not. So Kai West, this was IntelBroker. This is the
24:43official this is the real identity behind IntelBroker is now in jail. Obviously an extremely well-known cybercriminal. The latest hacks were Europol, Cisco, Apple, AMD. The Cisco one was huge and a big problem. Yeah, truly posted up with that Keurig. Absolutely hanging out. Also had a LinkedIn account where he like posted his sneakers. It was ridiculous this guy. But Kai West was one of the most
25:06prolific members of Breach Forums. I mean obviously you know, IntelBroker owned Breach Forums for a time and then kind of went off the map and then you know, later turned out that that they were arrested in February of last year or of of this year. So they this was a huge hit to the Breach Forums community. It is probably one of the reasons
25:23there's not a huge push to bring back the forum itself or to find a new forum for people to hang out on because a lot of the main characters went to jail. Fall Joubear, this is the person this is the Lapsus guy who hacked Rockstar Games and a bunch of other places and is now is like in a is like on a psychiatric
25:39hold I think for all of the things that he did. There's there's lots of good like documentaries about this guy's operation all the things that this guy did with as Lapsus. 19 years old and is most prominent in the world of cybercrime that I keep an eye on for starting StarChat, StarFraud Chat, a lot of the places where Scattered Spider
25:59members can be found. So this isn't like StarChat isn't like the Scattered Spider group chat, but if you look up, you know, if you go in like a tool and look up like a I promised I wouldn't promote. I'm accidentally this is not promotion. If you went into Flare and typed in like one of the a Scattered Spider members
26:16username, you would see chatter from them in StarChat. Like they're also there. It's just a place where a lot of them happen to be. Matthew Lane, this was the PowerSchool extortion. Matthew Lane used the name Shiny Hunters when extorting, but a lot of people do that. The direct connections are not super clear, but they were on Breach Forums as
26:34Gore, did a bunch of Telegram accounts. And Matthew Lane hacked PowerSchool using a stolen credential. It's not clear in the in any of the court docs if it was from a stealer log, from a combo list, from whatever, but they found a stolen credential that worked. They downloaded tons and tons and tons of data from like every PowerSchool
26:49customer, which is like almost every school district in the United States. PII on every student, every faculty member, varying levels of medical information. And they extorted PowerSchool. Matthew extorted PowerSchool for that. I don't know if they've been sentenced yet, so we'll say allegedly. But they did plead guilty, so again, allegedly. But this was a guilty plea. And they are Matthew is now in
27:08prison. So the they did other things like on Breach Forums, we can see Matthew as Gore selling access to accounts. So they they liked logging into things. They liked logging into So PowerSchool was a huge get for them, but typically they were just finding accounts that worked again probably from stealer logs, ULPs, that kind of thing. Finding accounts that worked and
27:27reselling them to places like you know, Office 365, SharePoint, corporate web apps. They got a big score on PowerSchool and I guess decided to do it themselves. Decided to take it on on their own. They were talking about OG users back in the day inferring that they were on OG users. So they again obviously originating from the same
27:46community. I mean PowerSchool was a big deal. The data itself from PowerSchool never made it to the internet. It's not it's still in the it's still in the ether. PowerSchool paid Matthew. Matthew claimed to have deleted it. But who knows, you know, that happens in every extortion. Connor Muca, Waifu, who is now in prison also, called themselves
28:03Scattered Spider, extorted also sometimes using the name Shiny Hunters, and hacked all of the Snowflake tenants, which was 160 something companies. Again, if you saw in the last last year in the news, Ticketmaster hacked, Santander Bank hacked, AT&T hacked. There were hundreds of victims from this campaign. All they were doing there is finding looking through stealer logs for
28:20credentials that worked to log into Snowflake. And then they would just log in, export all the data from the Snowflake tenant, and then hold them for ransom. And it worked and they made millions of dollars. And he was bragging on Telegram all the time. Posting screenshots of victim machines, literally just saying I hacked Santander, BofA, Truist, Fidelity, NTD.
28:37This is extremely common for members of these communities to literally just say who they hacked. Say it out loud. It's not a something they hide. Cameron WaGenius, very funny to have genius in the name. Cameron WaGenius helped with the Snowflake extortions and was a soldier in the US military, active duty, constantly posting about being an active duty soldier in the US military. And
28:57posted pictures of themselves under this username to Telegram without their face in it, but like pictures of their boots on bases. Was immediately arrested after trying to come to Waifu's defense after the arrest. Very active on Breach Forums, very active in the Scattered Spider chats, all that good stuff. And so many more. Again, if you're if you're
29:16familiar with the Breach Forums world, Hollow, Not, Depressed, and the shiny the owner of the Shiny Hunters Breach Forums account, which is probably a member, you know, just someone who's in the same group chats as these guys, maybe has a PGP key and that's it. These people were all arrested along with Lucas Zone who used the username,
29:32believe it or not, Lucas as an admin on Nulled, was also arrested. So most of these are from Breach Forums, this one's from Nulled and Cracked. And then so many more Scattered Spider members. These arrests, you have King Bob who has again lots of interesting YouTube documentaries about the like sort of rise and fall of King Bob. Owen Flowers,
29:50who was in 764, again, you see so much crossover. Like 764 is a harm group that's like an offshoot of the com. This is like a a weird This goes to show you people who are who consider themselves in the com and in 764 and in scattered spider are not all They're all of the same ilk. Like they're all chatting
30:12together in the same chat rooms. And then AD, a username that was not disclosed, but they had the account owner, Nosibo, Jolieoli, another famous person another the the Minions meme is outstanding. Yeah, Jolieoli, which was a another, you know, kind of famous person from this community. Harvey Cannon, whose username
30:32was undisclosed. And then a bunch of other people who we don't know because they were underage, so law enforcement said we won't tell you. This is a ton of people. Like if you are involved in these groups, the odds that you're going to go to prison soon are not super low. These are all people, by the way, who
30:49were super public about what they were doing. They posted a ton. They were personalities in these communities. They did not hide what they did. And their opsec ended up typically being their undoing. Now, we only have 10 minutes left, so we're going to save a lot of this for the next part, but the interesting about the last year is
31:05people started talking about sessions a lot more, cookies. Because stealer logs are amazing and provide tons and tons and tons of credentials, but creds hit 2FA a lot. If you're trying to get into a corporate web app as a cyber criminal, that's a problem. Like 2FA is going to be annoying. And there are ways to bypass it, and the easiest way is
31:23finding a valid session token. Otherwise, you're going to have to start calling. You're going to have to be on the phone. Cookies are great because they bypass MFA, and stealer logs make it easy to use cookies. So, if you're not familiar with cookies, by the way, when you go to log into a website, cookies are immediately placed on your
31:37device. Logging into a website, saving your credentials to Chrome is optional. Saving a cookie when you log into something is not optional. This is going to happen. So, you log in, you know, a couple cookies are added to your device. We'll go over some examples in a second. You log in and you've been given a session cookie now that says, "Hey, this
31:52person logged in and they don't have to log in again for a little bit." And maybe a session cookie, session token, OAuth token, whatever you want to call it, expires in 6 months. So, you log in once, and now every time you open your laptop and go back to this website, you already entered your 2FA pin. You don't
32:06have to re-login again for 6 months. Now, how this looks in your cookies file, which by the way, for most browsers, cookies are literally stored in a file, including your important session tokens. Let's say it's in a file called cookies.text. You visit the website, you haven't entered anything yet, and you already have cookies. You've got a visitor ID just to track
32:21who you are. You've got dark mode to it's on zero. You've got light mode enabled. This should be undone immediately. Then you log in, you enter your creds and log in, and your issued cookies.txt gets a new cookie. And it's your session token for this website saying, "Hey, it's not expired. You're good to go. Here's the value." Every
32:36time you load the browser, this cookie will say, "No need to re-authenticate. You're on our I'm already logged in." And then when you do, it'll say, "Hey, cool, you're back. Welcome back." Now, if someone steals if your if your laptop gets infected with stealer malware, the cookie's taken, then literally all the person has to do your cookie file gets
32:51taken, it gets put on one of these stealer marketplaces, someone downloads it. Literally all in most cases, all someone has to do is copy the cookie file onto their browser or launch a new It's called an anti-detect browser where you can kind of customize it a little bit and take up the session. And even if they change some things, like in this
33:09example, I'm saying they did the dark mode switch cuz they're hacker they're they're obviously going to use dark mode, and it like still works. I'll give you an example of variables changing and it's still working in a second. And not all cookies are this are of equal importance. Like stealing a cookie that says that is the cookie script consent,
33:23like you consent to cookies or not, this isn't going to help a cyber criminal do something if they have this. Now, if they have your ESTS off persistent cookie from off at Microsoft online, then they can reissue themselves a session. They can bypass MFA with this token. Stealing this cookie would be super bad. And bad guys talk about this
33:41all the time. But you know what? Given the limited time we have, we'll do that on the Flare Academy or on the Flare Discord. And I want to show you a video of a bad guy doing this. This is some never-before-seen goodies right here. So, what I'm going to show you is this is a cyber criminal in a local
33:55anti-detect browser. And an anti-detect browser is something they use to recreate browser sessions. You can make This is like a marketing tool. It's for marketing to like import their own cookie files and say, you know, we want to test what our TikTok ads look like in Poland. So, we're going to set the location of this browser to Poland.
34:12We're going to make the device profile look like a I don't know, a Polish laptop with a Polish language pack installed or something. There's all kinds of things you can do. This threat actor recorded this and we found it. Now, what they do here is they open this file from an actual real stealer log, a real infected device with a victim, and
34:29they copy and paste the values of it into their little browser configuration here. It's in Russian, but to translate, they're saying, "Okay, how much RAM is on this machine?" Basically, when they connect over browser, they want it to all look the same. "How much RAM is on this machine?" All right, it's 16 gigs. Let's update it to 16. They did that.
34:44"How many cores?" Four cores. All right, let's go update the core count to four. "What's the graphics card?" GTX 1050. Let's select GTX 1050. Let's find an IP nearby the actual source IP of this infected device. They go to the their little proxy config here, and this they they They're looking for Concord, New Hampshire. They want This is because
35:04when a when a cyber criminal takes over a session, and when you take your laptop to Starbucks, for example, you can you open your laptop in Starbucks, and it it keeps you logged in logged in to YouTube, even though you were logged into YouTube at home. It's not going to make you re-authenticate just cuz you changed IP nearby. Now, if you reopen
35:21your laptop in Poland, it might say, "Okay, you went pretty far. Let's re-authenticate." But he's saying, "All right, I'm going to find an IP in the same region so that when I try and take over this session, I'm not going to it's not going to be a problem. Now, they go into here, they look up Concord, and
35:34they lease an IP. Now, what's outstanding about this is they picked an IP in Concord, North Carolina. This is not the same Concord. This is in a completely different state. And then they drag and drop the cookie file into here. So, now what we have They did this a little They did the cookies a little earlier. They It's literally a drag and
35:52drop. They dragged and dropped the cookie file into the cookie section of the browser. So, now what they've done is they basically created a little VM. They have a browser they've customized that has the same hardware footprint as a device that they infected. It has the same cookies as the device that they infected. It has the same like network
36:09connection footprint as the device that they infected. And now they're going to launch the browser. And they type in youtube.com. And remember, they've done nothing, right? They haven't logged into anything. They've seen no login pages. This browser has only existed for a few seconds. They go to youtube.com, and they're already logged in. You've got a username picture here. This all loads.
36:27They are logged into a YouTube account without logging into the account. All they did was drag and drop the cookie. They picked the wrong location. They probably forgot several things in the hardware profile, and it doesn't matter. It worked. They were able to take over the account with just a drag and drop. That is the power of sessions right now.
36:44And honestly, most sessions There's a couple. We'll cover those on the Flare thing. They're pretty cool. So, we'll have to skip them. Yeah, Concord. This is in case the video didn't work. I have a slides version. Concord, North Carolina, still work. Most of this is not actually done through anti-detect browser. Most of it's done through like these cookie checker tools. And what's
37:02funny about these cookie checker tools So, all you do is point these at a directory, and they'll test the cookies in that directory. You set up like stealer log. Like a bad guy will set up their logs to go to this one directory and automatically test things. What's crazy is if you go on YouTube right now and type in BL Tools, it you're going to
37:16get a ton of ton of videos showing you how to use BL Tools. And in the in the link on the BL Tools video is going to be a media, you know, a some sketchy link downloading site. Odds are the BL Tools version that is available in that YouTube video is itself laced with infostealer malware. So, we get we see
37:33tons of infostealer infections that are from cyber criminals infecting themselves by downloading BL Tools from YouTube or from another stealer group. So, stealer groups infect other stealer groups, which is an outstanding Yeah, OpenBullet is the same. SilverBullet is the same. Totally. Tons of them are laced themselves with stealers. It is a crazy little part of the the cybercrime
37:55underground. Now, there's a bunch we didn't get to. We'll save it for next time. That's That's all the time we had. Any questions, comments, concerns? What is going on here? What is going on in the chat? A lot of fun things. Yeah, we've just been memeing. I'm sorry. I mean, the thing that really just sticks out to me when we were rolling
38:14through all of the arrests, all of the cyber criminals, all of the scattered shiny Lapsus Hunter slushies. I think again, the recurring thing to me, and I'm super glad it stuck out in chat, was like, "Look, for one thing, these are kids. These teenagers that are just falling victim to too many Minecraft hardcore factions or Counter-Strike where they want a cool username and then
38:35just end up in the pipeline to become a cyber criminal." >> [laughter] >> And when you look at it, these like the MGM hacks or any of even some of the cloud stuff, it's never malware. There is rarely ever malware part of the attack chain. It is just lying, social engineering, calling up the help desk,
38:55using what's already stolen, what's already breached, what's already public infostealer logs to log in. And you don't need an exploit or some leet sexy kernel day zero day, whatever. It it's it's too easy now. And they just swing from trusted cloud platform to next SaaS solution to whatever else is in your
39:16environment. They just pivot around. And there's no malware, which most people don't know. And there's very little I think I would say skill. There is not These people could not the the the cyber criminals who've done these attacks could not go be good pen testers. You would be annoyed if they were on your pen testing team. They are
39:33not talented hackers necessarily. They are good at logging into things. They pay other people to make the calls for them. These are not skilled coders or exploit developers or malware developers. They just log into stuff and go to the export function on the tool they got into and export it and and extort. So, like the the the old school
39:53theories of like they're going to go to jail and then get a job for the FBI or something. That's not happening anymore. They're not hackers. I mean they're they're criminals. They're cybercriminals. But they're just they're doing the easiest possible thing. That's another big change is the barriers to entry of cybercrime became a lot easier this year. And all right, we got a
40:11question here. Beyond forms and Telegram, are there any signs that threat actors are using unconventional spaces like MMO private servers or Discord communities to coordinate and exchange with breach forms being down? Discord communities, absolutely, yes. You see Discord links, Discord invite links all over Telegram in the group chats that still exist in the fall of like a lot of forms that have fallen
40:28still have their group chats active on Graham and people send Discord invites all the time. Now, MMO private servers, I don't know. I can't say I've seen that prominently, but Discord communities, absolutely, yes. And Discord is trying to crack down. Like I think they do. There's a ton of it on on on Discord and Telegram totally. Yeah,
40:44probably Minecraft chat to be honest. Good point, L'Oreal. What about Nation City PTs? Can you guys do a session on them in the future? Probably. Are there any plans to discuss Mission Triad? Yeah, that would be fun. Toll scams are crazy. When you say vendors are at fault for the barrier to entry lowering, fact the work seems to be in part due to the
41:03vendors being so easy to hack. Yeah, I mean that's not I don't want to put all the like for most of these vendors, the problem is WTS that it's There's like a shared responsibility model. You can configure the security settings to be stricter in whatever the application is. In like a Snowflake user could have prevented this. Now, I think Snowflake
41:22does enforce like stronger default settings. And I think that's the like that's where shared responsibility should head is like all these apps should ship with stricter settings out of the gate. And you should I get you know, you should be allowed to turn them off, I guess. It's you know, you're using the tool. It's up to them what
41:39they give you, but you know, sometimes you need to turn features off to use the app a certain way and it's not unsafe cuz you've segmented it somehow. But I think yes, vendors who have extremely lax default policies aren't really doing a lot to stop cybercrime when like a couple easy default policies would put a huge dent in the problem, but like I
41:58can't throw them under the bus. It is a shared responsibility model, but hopefully that will get better. Yeah, yeah, yeah. Definitely better cookie like session detection for sure would be better. Yeah, tons of tech debt, absolutely, Bishop. That is a huge huge thing. At 16, you must select from the two talent trees, cybercrime or dropshipper. Hilarious, Melvin. You are also correct.
42:19Two grifts, cybercrime or dropship. Cool. All right, I don't want to go too far over. I know you have a life, John. So, this was Discord things are fun. This was cool. We're going to do another one in a few weeks in the Is it next week? In the next week in the Flare Discord. So, check that out. It'll be similar to
42:35this. It'll be me and John again chopping it up. So, thank you so much everyone. >> [laughter] >> I'll be sprinkling in the derail every now and again whenever I find something I can make a joke at, but you're the real Smeagol. You're the real subject matter expert here, but I am under your wing. I've been learning a little bit
42:50about all the BL tools and all the things to understand what threat actors are up to because whether or not look if this is valuable or not to you because you're not a cybercriminal and you shouldn't be, it's still worthwhile knowing their tricks and their tactics and just what that playbook is. Yes, don't do crime. Those guys go to jail as
43:09you saw. Don't do it. Not worth it. My parting message. Thank you so much everyone. I'll see you on the next one. >> I'll get this video out hopefully soon over on the inner webs, but until next time, we'll see you next week. Thank you so much. >> Bye.