Full transcript
0:00I want to show you two videos from real
0:02hackers, or more specifically, real
0:05threat actors and cyber criminals. And
0:07these are raw screen recordings while
0:10they're using their computer doing their
0:11hacking, whatever they do, doing their
0:14account takeover, session hijacking.
0:16Now, I've had to redact these
0:18appropriately because they're targeting
0:20real victims as you'll see, but I
0:22thought this would be really neat and a
0:23cool way to visualize what cyber
0:25security threats really look like today
0:28in the modern world. and then you can
0:29see just how easy it is. So, I have two
0:33videos here, bandandycam.mpp4
0:35and screen capture.mpp4.
0:38And the first video, Bandandyam, was
0:40provided to me by my good friends over
0:42at Flare. They do some incredible
0:44research and I'll chat more about them
0:45later, but let's dive in to the video.
0:48Now, I'm going to pause quite a bit
0:51because I think we can talk through a
0:52little bit of this, but take a look at
0:54what we've got here. Okay, Bandandy Cam,
0:56right? Screen capture, screen recording
0:57footage. We can see maybe that window
0:59open on the far right side. You can see
1:01the dimensions that they're recording
1:03at. Obviously, a lot of Russian text.
1:06Presumably, this is a thread actor in
1:08Russian or their language is set to
1:10that, right? I can't make any
1:11assumptions. I'm not going to. You can
1:13see a full path here though. C users
1:15Vlado putting this in their Bandandy Cam
1:17videos folder. And I'm going to be
1:18honest with you, this is way back from
1:202023. This technique, these tactics
1:24still work. And they've been beating
1:26this up for a little bit of time because
1:27I'm sure you see way over on the whole
1:29left hand side of the screen are all of
1:31these different accounts. And to be
1:34honest, these look like YouTube channel
1:37ID numbers with the title or like the
1:40account name, the number of subscribers
1:42that they have, the number of views they
1:44have, videos, and their email that I've
1:46tried to redact at least enough so you
1:48know there's an email there, but not
1:49enough to put the puzzle pieces
1:50together. Maybe you could, but don't do
1:52it. You're not a cyber criminal. Don't
1:53do cyber crime. Now, presumably this is
1:55some application called CrawlCloud. And
1:58I can see maybe just barely a title,
2:00Paranoid Checker. I'll hit play. And
2:03we're looking through a couple of these
2:04accounts. We can see our thread actor
2:06now pulling up their file explorer. And
2:08whoa, look at this. Okay, croncloud
2:10paranoid and all the results for Chrome.
2:13Probably looks like uh this folder or
2:16file is probably associated. Let me hit
2:18play. And we're going back to the
2:20interface. Oh, now we've got another
2:22tool. Take a look at this. This is uh
2:23October browser, right? Are folks
2:25familiar with October browser? We can
2:27Google real quick uh octobrowser.net.
2:30Octo browser perfectly handles
2:31multi-accounting tasks on any platform.
2:34Uh look, it is an anti-detect browser.
2:38Octo browser is a multi-accounting
2:40browser that facilitates managing
2:41multiple online accounts across various
2:44platforms. popular in the
2:46Russianspeaking market. It enables
2:48unlimited virtual profiles and is used
2:50for evading fingerprint detections on
2:52platforms. Obviously, there are a lot of
2:54other anti-detect browsers, but the
2:56gimmick is that you get to type in and
2:59enter and configure all parts and pieces
3:01of your own sort of metadata. Like while
3:04you browse the internet, you're carrying
3:06the information that you provide by your
3:08web browser or client to the website, to
3:11the server, to the end destination that
3:13you're visiting. That's why people talk
3:14about VPNs, virtual private networks, so
3:16you have a different IP address. But
3:18it's not always just that. It could even
3:20be the device that you come from. It
3:22could even be the screen resolution that
3:25you have. Anyway, let's press play and
3:27walk back to the video here because
3:29they're firing up Octo browser, their
3:31anti-detect browser. And look at what
3:33they have here. Look at this. This is
3:35info stealer malware logs. So, one of
3:38the most common viruses or malware that
3:41runs on your computer and infects or
3:43compromises you is info stealer malware
3:46where the payload, the virus, the
3:49malware itself is going to rip through
3:51and run through all of your cached data
3:53information like passwords. Whenever you
3:56check the oh remember me or sign in on
3:59different online accounts and you say
4:00store my information for next time.
4:02Well, if that's cached or they keep
4:04track of your cookies, then they or
4:07threat actors, hackers, cyber criminals
4:09could just grab those cookies and then
4:11reuse them. And they don't even have to
4:14enter your username or password or even
4:16your multiffactor authentication on your
4:18phone or whatever PIN that you might
4:20use. With those cookies, they don't need
4:23your credentials. The hacker can just
4:25walk right through the door. And now so
4:27many dark web marketplaces or cyber
4:29crime industries just share and give out
4:32these info stealer logs like the
4:35artifacts what they've uncovered the
4:37records from infected victims of all the
4:39passwords and cookies that they've
4:40stolen. But I know you're probably
4:42coming to the real question of okay uh
4:44that's cool and all John but like how
4:46did you get this video? Isn't that uh
4:49something? Now I mentioned that this
4:50came from my good friends over at Flare
4:52and Flare. Oh they have a new website.
4:54This looks nice. Well done, guys. Look,
4:56it's all about tracking threat actors
4:59and cyber criminals, trying to get the
5:01threat intelligence to then be able to
5:03stop attacks, like prevent this session
5:06hijacking, account takeover, the work
5:07that they've done, what you saw hackers
5:09do, because Flare is always keeping an
5:12eye on what's happening in the dark web.
5:15They're looking at the marketplaces, the
5:17forums, the Telegram chats, even the
5:19signal groups here and there. a lot of
5:21the stuff where shady hackers, thread
5:23actors, and cyber criminals are just
5:25sharing this information, talking about
5:27the breaches that they do or even
5:29sharing the database breach dumps that
5:31they've done themselves. That's how a
5:33lot of the like recent arrests in 2025
5:36happened. By the way, too many stupid
5:38threat actors are just talking and
5:40bragging about other elite hacks, saying
5:42outright what they did. Anyway, I want
5:44to show you the platform super quick.
5:46We're not going to go all that deep into
5:47it, but I did just want to show you. I
5:48know my dashboard looks kind of like a
5:50mess because I like to use this for like
5:52thread intelligence. I could create a
5:54whole ton of different identifiers for
5:56my name, my company, my business, and
5:58then even you could hook this up to
6:00Entra ID. Like if you use Azure Active
6:03Directory or a lot of the online now
6:05Microsoft accounts that you probably do
6:06for business and company work, you could
6:09be looking for any of the incidents,
6:11whatever shady hackers are chatting
6:12about, anything that might affect you,
6:14your industry, your people. Uh-oh, they
6:16got one with me in there. Sorry, I
6:18should have zoomed in a little bit so
6:19that's easier to see here for us. But
6:21listen, you can define these identifiers
6:23for automatic alerts, even remediation.
6:25You could track down different threat
6:26intelligence, maybe some current trends,
6:28generate reports, look at supply chain
6:30risks, even track down expose
6:32credentials. Like you could track down
6:34what employees, team members, and
6:36personnel have exposed information like
6:38passwords, sensitive information. And
6:40you can even have it test against the
6:42Enra ID environment and mitigate it and
6:44stop it. So, if a leak happens, then you
6:46don't have to worry because, okay, maybe
6:48Flare could automatically change the
6:50password, lock out the account, do all
6:51the sweet stuff. It's just awesome. Big
6:53thanks to Flare for sponsoring this
6:55video. You can check them out, kick the
6:56tires, play with it, all with the link
6:58below. So, let's get back to the video.
6:59When they pull up and open up this
7:01InfoSaler malware log, and we can
7:03recognize it by a lot of the other files
7:05that are included here. Obviously,
7:07there's a folder for cookies, maybe
7:08installed browsers, installed software,
7:10process list, user information. Look,
7:13it's going to extract a lot more
7:15information than just, oh, the passwords
7:17and cookies. It's going to look for
7:18other software that you have installed,
7:20like Steam for video games that you
7:22play, maybe accounts you have connected,
7:23or Discord tokens that it might be able
7:25to steal, cryptocurrency wallets, stuff
7:27that it might try to rip up recovery
7:29seed phrases or anything like that. It's
7:31going to check your installed software.
7:33It's going to see processes running like
7:34antivirus security solutions that might
7:36get in the way. Tons of stuff. But watch
7:38what happens here. Keep an eye on this
7:41explorer window and what they do to now
7:44enable or activate these cookies from a
7:47victim. Did you see it? They just drag
7:50and dropped. [laughter]
7:52They just took the file containing the
7:54cookies and plopped it in. And now they
7:57have all of the secrets and can
7:59impersonate and steal your session.
8:01That's it. That's the hack. Some info
8:04stealer malware logs that they found for
8:06free out on the dark web, honestly. and
8:08take a look. Okay, we have the user
8:10information log. So, Telegram t.m
8:13me/metastealerbot,
8:15probably one of the info steelers that
8:17are out and about. Build ID here. The IP
8:20address I have redacted. File location
8:22is going to be the binary or the program
8:24like the virus, the malware itself that
8:26was probably executed on that computer.
8:28Username is user, country, US. Location
8:30is in conquered, New Hampshire. Look at
8:32how much data they get. Hardware ID,
8:34screen size, time zone, operating system
8:36was Windows 10. even if they have
8:38elevated privileges, like if they're
8:40running as admin or have high privileges
8:42on this computer, keyboard layouts and
8:44the hardware. Now, look at what they're
8:46doing. They're starting to highlight the
8:48hardware information like the amount of
8:50RAM that they have or maybe the GPU,
8:52CPU, a lot of the other details. So, let
8:55me press play here because we could see
8:58he'll literally recreate like type in
9:01enter each and every tidbit of
9:04information that they could use so that
9:06they can replicate what you or the
9:09victim naturally looks like. So when
9:11they go to some other website, if that
9:14website is doing the right thing, like
9:16trying to check and fingerprint, are you
9:18the individual that you say you are and
9:21how you used to be, how you naturally
9:24use the computer and browse these
9:25websites, like if you're always on your
9:27iPhone and that's how you log in to some
9:29other websites, that user usually uses
9:32this sort of device with this sort of
9:34information like the screen size, like
9:37the operating system, blah blah blah.
9:40And now here's the neat thing. Let me
9:42run this back. I don't know if you could
9:43see it because I am redacting just a
9:45smidge here, but they're beginning to
9:47highlight the IP address because they
9:50want to look like they're coming from
9:52like their traffic location is from the
9:54exact same place or at least a similar
9:56enough location. So, they've opened up
9:58another program here and they're going
10:00to start trying to move across the
10:03internet to use some sort of proxy like
10:05a residential proxy. Residential proxies
10:08are just communications and connections
10:10to the internet. Oh, hang on. Sorry. Did
10:12you see that? I will admit I don't quite
10:14know which anti-detect browser this is.
10:17I'm not familiar with it. But do you see
10:19that little icon there? They might be
10:21able to track that down. So, they're
10:22running two, right? Because this one
10:24gives them a little bit more power to
10:26spin up. Oh, it's bit browser. Did they
10:28say that? Did it just like say it
10:30outright in the interface and I never
10:32even realized? Bit browser. Oh, yeah.
10:34Okay. I don't know if their logo would
10:36have changed in between like 2023 and
10:39now, but that's another anti-detect
10:42browser. But what they end up doing is
10:44enabling a residential proxy, trying to
10:47find what location can they simulate,
10:50what can they look like they're coming
10:52from that matches the same geographic
10:55location as their victim, as their
10:57target. So, we could see, right, their
11:00location and zip code here. And you can
11:01see they copy conquered and they go
11:04paste this in to the city in the top
11:07here. But [laughter]
11:08take a real quick, let me pause super
11:10quick. Take a look at the state. It like
11:13autofilled and defaulted to North
11:15Carolina, which is not New Hampshire,
11:18which is different. So they kind of
11:20messed up on that part, but they could
11:23have toggled it. And uhoh, hacker made
11:25mistakes. Whatever. Something stupid.
11:27So, they go find a conquered North
11:30Carolina residential proxy to enable.
11:33And while they loop through this, they
11:35try to refresh, get some new results.
11:37You'll see what they do here because
11:38once they find one they like, they
11:41select some Russian text that I can't
11:44read because I don't know that language.
11:45But they start to serve it on a port.
11:48So, it will okay, now activate and
11:50enable and use that bind to an IP listen
11:53on a port. They grab it so that when
11:55they go back to their new profile that
11:57they're creating for this victim to log
11:59in with their cookies to impersonate and
12:01steal their session presumably on
12:03YouTube, right? They just paste in
12:06everything that they've already got with
12:08the host just listening locally and the
12:10port 40,03
12:13and that's all that they need to now
12:16look like they're coming from whatever
12:18location in the world across the
12:20internet. They give it a name. They have
12:22a profile created. uh now that they've
12:24built all this and configured all the
12:26settings to look like as much as they
12:28could, even if they're in Russia, now
12:30they're going to look like they're
12:31coming from conquered North Carolina,
12:34not New Hampshire. But we start up our
12:36browser, Octo Browser, and now they go
12:39to youtube.com.
12:42Don't have to log in. Don't need
12:44username or password or credentials or
12:46Google service, two-factor count,
12:47whatever. They're just already logged
12:50in. You can see see the profile icon
12:53there. They're trying to load. They're
12:55trying to view the profile or account
12:58information. And I've redacted the name
13:00here, but I'm loading the account. They
13:02didn't have to authenticate or offer any
13:04credentials. They go visit their account
13:07and they're logged in. And that's it.
13:11[laughter]
13:11That's the hack. Copy paste. I'm going
13:15to have to redact a lot of this, but
13:17could I track down that individual? Is
13:20that a real account or victim? Oh no.
13:26Well, no. [laughter]
13:29Four subscribers, 11 videos, whatever.
13:32Like YouTube sense. The idea here is
13:36that account takeover, that session
13:38hijacking. And now this could be done
13:40just as easily for YouTube as any other
13:42website. Amazon, Facebook, I don't know,
13:45Microsoft Entra ID, your login accounts,
13:47all online. Now, let's get back to our
13:49cyber crime videos. Flare tracked this
13:51down because they just saw it exposed
13:53out and about on the internet in the
13:54dark web and Telegram chats, whatever.
13:56But now, I want to get to our second
13:59hacker video. And this one actually
14:01didn't come from Flare. This came from
14:03Huntress, where I work. Previously in
14:05September, we shared a story that we
14:07were walking through way back in June of
14:09a threat actor, a cyber criminal bad
14:12actor that installed Huntress onto their
14:15hacking computer. And just so folks are
14:17aware, the whole like manifesto of
14:20Huntress is to wreck hackers, to stop
14:23malware, to prevent all that bad stuff.
14:26Cyber Criminal had voluntarily,
14:29intentionally, purposefully installed
14:31and toggled and enabled like detections
14:34and alerts for a managed security
14:36solution where security operations
14:38center analysts and investigators and
14:40triage folks go through to look at this.
14:42And a handful of people were originally
14:44a little bit confused not knowing that
14:46that's what managed security does
14:49because there's a whole saga of looking
14:52through oh browser history trying to do
14:54the root cause analysis as to how
14:57malware and alerts are firing and
14:59invoking on that computer system. But
15:02it's wild. Anyway, with all that context
15:04out of the way, amongst their browser
15:06history was a video that they had shared
15:09and that is this screen capture. Now
15:12this screen capture is them using a
15:14utility and tool called graph spy. Now
15:18in case folks aren't aware graph spy is
15:21a initial access and post exploitation
15:24tool for Azure active directory and
15:26office 365 with a browserbased graphical
15:30user interface. So this is targeting
15:32this is exploiting this is taking
15:34advantage of enter ID like your online
15:37Microsoft account so that they could
15:39then read through. Let me scroll down
15:42because I think it talks about some of
15:43the usage here. Like you could then read
15:46through the files and folders in One
15:49Drive or SharePoint or look through your
15:52emails in Outlook or send messages or
15:56read messages across Microsoft Teams. So
16:00that's kind of bonkers, but we've seen
16:03video proof like legitimate. Okay.
16:05Watching them do it with Graph Spy using
16:08the Infoseler malware logs. they had on
16:11their endpoint. So, this is bonkers. Let
16:13me hit play and show you this thing.
16:14Looks like they're using scre s.io to
16:17record, but they're in graph spy. They
16:20go take a look at their access tokens.
16:22Like really a representation of
16:24essentially the cookie that they could
16:26use to then authenticate and not even
16:28need the username, password,
16:29multiffactor authentication across
16:31Microsoft Graph, Microsoft Outlook,
16:33Microsoft Teams, all the things that
16:35they could pull from. And I have
16:36redacted the usernames and the emails
16:39that they got here. But let me show you
16:41what they do. They activate this token.
16:44They have that connected now with an ID
16:46number four. You can see they're
16:47scrolling down and they go take a look
16:49at that user account including the
16:51access token and look at all the info.
16:54Their name redacted, their IP address, a
16:57lot of the other things pertinent to it.
16:58And then they go to Outlook Graph. Now
17:01Outlook graph is where they can read
17:04their email, right? They loaded 11
17:06mailbox folders like their inbox. Looks
17:08like there's 47,000 emails in there and
17:11all of the other subfolders. And then
17:13they start to load things pertinent to
17:17their account ID. Now, the one they've
17:19chosen, the number for tied to that
17:21access token. So, when they click
17:23reload, they're literally pulling down
17:26all of their emails. And I've redacted
17:29here, but this is wild and crazy. But
17:34you can see down in the bottom left,
17:35maybe the top right, they've fetched a
17:36100 emails based off the limit that they
17:38supplied and the skip value. I don't
17:41know what they're particularly doing
17:42here, like hovering over and showing
17:44things. I don't know if this was
17:46recorded like a demo for someone else
17:48because they recorded this video, put it
17:50on mega and like shared it, put it
17:52public on the internet. So, this was
17:53exposed. But you see them scrolling
17:56through emails. You see them taking a
17:58look at what's what. And then they start
18:01to search. You can see them entering in
18:03a search query or looking at what they
18:05could do, trying to find password
18:06resets, trying to find maybe other
18:07password specific phrases, but they look
18:09for the word invoice.
18:12And I can only think that's maybe
18:15something. You can see it loading kind
18:16of spinning over in that top left. Uh is
18:19is this like a business email
18:21compromise? Is this just something that
18:23they were doing to go track down bank
18:26account information, things that would
18:28be necessary for money, finance ends of
18:30this. And here we see it. They got a lot
18:32of results with that limit. And they
18:35find some emails that say, "Yep, someone
18:38will release the funds from what or
18:40whoever at whatever time." And that's
18:42it. That that's the video. That is what
18:45they recorded themselves, published and
18:48put on the internet of using graphs by
18:50with the accounts that they've already
18:52stolen, the account takeover, session
18:54hijacking that they've done and then
18:56interrogating a lot of Entra ID or that
18:58online Microsoft account. Insanity. I'm
19:02super curious. What do you think? I
19:04think it's wild to get that like
19:06firsterson perspective, see through
19:08their eyes what they're doing on their
19:09own computer screen that they recorded
19:12and just left out exposed. But that's
19:15some crazy education as to really all it
19:17takes. Oh, a couple cookies, some logs,
19:19some info stealer malware logs, and they
19:21don't even need passwords, credentials,
19:24or two-factor authentication,
19:25multiffactor authentication. At that
19:26point, if they've got your cookies, they
19:28can just walk right through the door.
19:30And then the damage that they can do
19:32swinging from one application to another
19:34in the online environments, especially
19:36SharePoint, One Drive, Microsoft Teams,
19:38Outlook, everything in Enra ID. Bonkers.
19:41But hey, I hope you enjoyed that video.
19:42Please do let me know in the comments
19:43below if you would be willing. Please do
19:45give some love to our sweet sponsor
19:46Flare. Really appreciate their support
19:48and the help for like the first portion
19:49of this video. And they always have just
19:51incredibly cool research and good stuff
19:53to share. And they can protect you, your
19:55company, your organization, and your
19:56business. Link below in the video
19:57description. Thanks so much for watching
19:58everybody. I'll see you in the next
19:59video. I love you. Bye.