Full transcript
0:03On August 16th, 2025, this picture was
0:07floating around the internet and it made
0:10couple waves, seemingly a notice from
0:12Europole with a reward of up to $50,000.
0:17It says the cyber criminal group known
0:19as Kllin has carried out ransomware
0:21attacks worldwide, disrupting critical
0:23infrastructure and causing severe
0:25financial losses. Now, if you aren't
0:27familiar, Killllin or Quillin, I don't
0:29know, however you want to say it, is a
0:30ransomware gang, a cyber criminal group
0:32that tries to break into computer
0:34networks, encrypt all the data, and so
0:36the computers are rendered useless until
0:39the owners, the oh, business company,
0:41whatever, pays a ransom to decrypt and
0:44get all their data and files back. In
0:45the cyber crime group, Killin ransomware
0:48has been extremely active. They have
0:51been, for lack of a better word, and I
0:53guess the most polite way to say it,
0:55they've been wrecking house. I'm here on
0:58their leak site on the dark web using
1:00tour. And obviously, I've redacted or
1:02tried to, hey, cut up the company names
1:04that are affected just for, you know,
1:06their sake. But obviously, this info has
1:08already been leaked and published out on
1:10the dark web. But these are some entries
1:12as of just a few days ago, as of today
1:14at the time of recording, and they've
1:16been doing a lot of damage. And this
1:19anecdote is extremely sad and I don't
1:21mean to be making light of it, but is
1:22something that I did want to bring to
1:24your attention just for the sake of
1:25getting this point across. Ransomware,
1:27right, cyber crime has done so much
1:29damage now when it affects critical
1:31infrastructure or like life-saving or
1:33lifepreserving work like a hospital
1:35taking down infrastructure, taking down
1:37operations. Uh I believe one individual
1:39unfortunately the killing group that
1:41took advantage of this exfiltrated
1:43compromise hacked that has really led to
1:46the death of one of the individuals and
1:47the patients there. So it sucks. Cyber
1:50crime is bad. That's why law enforcement
1:53works to stop stuff like this. They'll
1:55take down, seize, disrupt, do anything
1:57they can to stop ransomware and cyber
2:00crime like this. So this notice reading
2:02continues. The group is administered by
2:04individuals using the aliases Hayes and
2:06Exoracle who coordinate affiliates and
2:09oversee extortion operations. Europole
2:11together with international partners is
2:13actively investigating. A reward of up
2:16to $50,000 is being offered for
2:18information that directly leads to the
2:20identification or location of these
2:22administrators. H now when this notice
2:24came out on August 16th, obviously of
2:27course you've got news outlets that are
2:28trying to tell the story. They want to
2:30cover this. They want to get the
2:31messaging out. And there are a lot of
2:32other online accounts or individuals
2:34that will try to amplify the message. Of
2:36course, obviously Twitter and X, you've
2:38got some folks that are saying Europole
2:40offering only $50,000 for Quillin admins
2:43seems super low, but they are the feds.
2:46And they include the Telegram link uh t
2:49me/uripolecti
2:51that was included at the very bottom of
2:52that notice and alert
2:54t.me/urupolerewards
2:55and t.me/uropolecti.
2:58If we went to go take a look, we can see
2:59the exact same $50,000 reward for
3:02killing ransomware. Now, I'm recording
3:03this on August 25th, and this news broke
3:07on August 16th. But what happened in the
3:09middle of that timeline? Let's take a
3:11look at the Europole rewards account on
3:13Telegram. It currently says, "I'm taking
3:16this lol view in Telegram. I'm
3:18conducting surveillance." And this
3:20individual, I guess noting, I'm taking
3:22this handler, y'all. Handle I like the
3:25name, I assume. Clicking on their
3:26profile. Yeah, they're T Europole
3:29rewards, but not seemingly Europole.
3:32This Telegram channel was created on
3:33August 22nd, so we're walking a little
3:36bit back in the timeline. But how about
3:38further back? Well, on August 21st, it
3:41became clear that this was an
3:43interesting example of a cyber crime
3:45counterintelligence operation. It was a
3:48scop. It was a hoax. It was a scam. It
3:51was a lie. The Shidtoken amongst others
3:53were amplifying the fact that this was
3:56confirmed to be fake because security
3:59week, one of the reporters there
4:00actually finally got a chance to chat
4:02with Europole and they told them this is
4:04a scam. The message does not actually
4:06come from Europole or any other law
4:08enforcement agency. Big shout out,
4:10credit where credit is due. This was
4:12Edward Kovac, the managing editor at
4:14Security Week and the reporter that
4:15wrote the Security Week article on uh
4:17Hey, you know what? Yeah, this is a
4:19scam. You know, our Spidey senses were
4:21tingling. Europole says killing
4:23ransomware reward is fake. We had the
4:25thought $50,000 just seemed a little too
4:28low. Obviously, that's not just it, but
4:31this is what the Telegram channel for
4:33Europole CTI, now known to be a hoax and
4:36a lie, originally had stated. And
4:38actually, while we are digging into some
4:40dark webs shenanigan stuff between
4:43Telegram and ransomware operators and
4:45cyber crime, I think this would be a
4:46really cool opportunity because it just
4:48ties the story together with how we
4:50might be able to explore this and go
4:51look. And I got to be honest, hey,
4:53that's something with the sponsor of
4:54today's video. You know that I am a huge
4:56fan of Flare, the threat exposure
4:58management platform. Just being able to
4:59see our exposed attack surface and just
5:01kind of be able to see what those cyber
5:03criminals are up to. I do want to use
5:05Flare to help tell this story here cuz I
5:07think there are some other interesting
5:08breadcrumbs we can track down. Like what
5:11were other cyber criminal folks chatting
5:13about this? And what were they thinking?
5:14What's the reaction? What's the
5:15response? So, while we could oh dig into
5:18the different identifiers we could set
5:19to track your own company, your own
5:21business, see if any of your information
5:23is out and about on the dark web.
5:25Really, I want to go into the events tab
5:27and then use sort of the global search.
5:29So we could basically use Google of the
5:31dark web and explore all the strange
5:33shenanigans that Flare is tracking. A
5:36lot of stuff on the clearet alongside
5:38the darknet, whether it is the
5:40ransomware leaks and blog sites
5:42themselves or different forums or
5:44marketplaces or even those Telegram
5:46chats as well. If you're not familiar,
5:48Flare has like a bajillion entries
5:50because they are actively always
5:52collecting, listening, trying to see
5:54what's going on on those shady illicit
5:56cyber crime communities. And it's got
5:58tons of Telegram chat info and tons of
6:01info stealer malware logs. Take a look.
6:03More events coming in just as we're
6:04chatting now. But let me get back to the
6:06events. Let's go search in the chats. We
6:10could basically toggle that to just
6:12chats and let's look for just that word
6:15Europole CTI search. So obviously more
6:19data coming in in the last month. This
6:21is very recent. VX underground letting
6:23folks know. We can see even from the
6:25chat it has been able to extract out the
6:27image that was included from each and
6:29every message. VX underground saying hey
6:30recently some people reported Europole
6:32had placed this bounty on the kill and
6:34ransomware group. However, Edward Kovac
6:36quickly ascertained this was false after
6:37speaking with Europole. Basically they
6:39ran a counter intelligence. Good
6:40Photoshop skills. Okay. Yeah, but that's
6:42just spreading the word. What else is
6:44there? Some discussions in the raid
6:46forums chat. We looking for Haze. One of
6:49the other neat things though, we could
6:50see the similar activities or even keep
6:52looking at that actor like see what was
6:54Aegis up to, what have they shared over
6:57on these chat messages within Telegram.
6:59Tons of cool stuff you could dig into.
7:01Anyway, it's silly to see them chirping
7:03about this over in Telegram. But what
7:05more is there? Wanted to give Bleeping
7:07Computer credit because their screenshot
7:09is the one that I had just showed of
7:11what was originally on the t.me/
7:14Europolecti Telegram channel. But if we
7:16were to take a peek at that Telegram
7:19channel, I didn't show you that earlier.
7:20We only looked at Europole rewards, but
7:23the Europole CTI now displays a single
7:27message that says, "Ooh, this was so
7:30easy to run and fool so-called
7:32researchers and journalists that just
7:35copy stuff. Thank you all from Rey."
7:38Kind of fun. You can see the history.
7:39August 16th was when this all went live.
7:42the hoax, the scam messages in that
7:44channel will then automatically be
7:45deleted after one week and then oh later
7:47on they no longer be deleted
7:49automatically. But Ray's little
7:51signature and calling card is the he hea
7:54gotcha to all fellow CTI internet people
7:58that were like, "Oh, hey, let's get the
8:00word out." But that was a scop counter
8:02inelligence misinformation campaign just
8:04for the jokes. After Europole confirmed
8:07that this was a fake notice all along, a
8:10new post appeared on the impostor
8:12channel claiming it was created to troll
8:14researchers and journalists, some of
8:16whom wrote articles about the claims.
8:18Now, Rey, that individual, I'm not sure
8:20if some of you will know or recognize,
8:22but that's uh one of the folks from what
8:24was I think Hellcat as the ransomware
8:26gang that tried to get up in action,
8:28maybe did some stuff here and there. I
8:30don't know what happened to them. I
8:31think they faded away. Whatever. But Ry
8:33keeps doing stuff. He claimed to be a
8:36part of the Telefonica breach that there
8:38are articles out and about and that
8:39again will mention the Hellcat
8:41ransomware group. The thing about Ry is
8:43that he's kind of in it for the hijinks,
8:45right? He's chatting with reporters.
8:46He's just kind of trolling out on the
8:48internet. He likes to make a little bit
8:49of hoopla. Also done some damage to
8:52orange group and obviously we saw a lot
8:54of the chatter in that scattered spider
8:56shiny hunters and lapsis group. They're
8:58of course on telegram where we got to
9:00see some of the messages folks just lol
9:02lol ws lauing all around. Can we heart
9:05this message? Oh we can. Oopsie. So kind
9:09of a neat story I think. Interesting to
9:11see that counter intelligence, a little
9:13misinformation, a little SCOP, hoax scam
9:16from some other cyber criminals kind of
9:18teasing and playing another ransomware
9:20gang and group and, you know, making a
9:22big stink with the law enforcement end.
9:24So, I just thought, huh, wow. I that
9:26would be worth covering and chatting
9:27about and seeing what other folks are
9:28screaming and shouting about as they're
9:30chirping over in the dark web and
9:31Telegram. So, hope you enjoyed. Hey,
9:32please do give some love to our
9:34sponsors. Link in the video description.
9:35I hope some of the extra sprinkled sauce
9:37from Flare in here was pretty cool. And
9:39uh with that, thank you so much for
9:40watching.