crime – PwnDefend

When the negotiators go bad!

Every ransomware incident runs on one uncomfortable assumption: that the people you bring in to help are actually on your side. A case that concluded in a Florida federal court this month blew a hole straight through that assumption. Three cyber professionals — two of them ransomware negotiators whose day job was to defend victims — have been sentenced for working as an affiliate crew of the ALPHV/BlackCat operation. One of them didn’t just moonlight as an attacker; he sold out the very clients who were paying him to protect them.

This is not another “big scary ransomware gang” story. It’s an insider-threat story, and it lands right in the middle of the incident-response industry itself. If you run an IR practice, negotiate on behalf of victims, broker cyber insurance, or you’re a CISO who will one day have to trust one of these firms on the worst day of your career — this one is worth your time.

Threat Intel

If you ask people, often they just do things!

You might see, BREAKING NEWS, RUSSIAN Hackers steal SIGNAL BACKUP KEYS, or other such styled headlines. Wow this sounds super interesting right! Magical hackers are stealing keys form the SECURE messaging platform! oh MY! but wait…. maybe, maybe there’s some devil in the details!

Threat Intel

Fortibleed continued…

There’s a lot of data in the world, and we typically never get to see every bit of it, so I thought I would share some different views from different people on this. Great work from Kevin as normal here:

Cybercrime

Using shame to enable extortion

When we look at ‘sextortion’ and ’email based extortion’ tactics used by threat actors we see a common pattern, one that leverages shame & fear. I’ve worked with some victims of this and it’s really not nice for them, the impacts are not just financial, they are emotional and sometimes more. It’s fortunately (for me) don’t however deal with this in volume, however I wanted to highlight something, the similarities between extortion and what I would describe as ‘Security Scanning’ shame scamming. Now you might think, that’s a massive leap… but bear with me, I’ve been looking at this (CTI/OSINT) plus working with ‘victims’ for years…

I’ll be posting about some research I’ve done on DNSSEC shortly too, I’ve kind of figured this topic was over years ago, but it’s recently come back on my radar, you know sometimes ‘duty calls’. But let’s look at shame based extortion patterns for now:

Defense

A brief history of AI being used for Defensive…

There’s lots of talk from some people about how AI is going to destroy the world and needs to be regulated, like some kind of SkyNet has been created… Well I thought, aside from this being largely not reality, I would look into a history of ‘AI’ being used in cyber defence.

Breach

Ransomware kill chains are boring.. will we ever learn?

Are we stuck in a cyber world that never learns? are we doomed to suffer the same fate over and over again? Well, not if you take action, you can totally prevent events like this!

This is a fast post using an LLM to analyse the Capita redacted ICO report. Hopefully it will help people think about things and take the lessons and apply them in their own organisations.

Threat Intel

Shiny Hunters / Scattered Spider Alleged Victims

Shiny Hunters/Scattered spider have published a leaked download site (DLS)/extortion site etc.
This is a fast publish with content mainly generated using an LLM (GROK). This appears to relate to victims who have been victims of social engineering, it does not appear to be related to the Salesforce, SalesLoft Drift breach: https://help.salesforce.com/s/articleView?id=005134951&type=1

Can AI replace intelligence analysts?

Ok, it’s late, and well I wanted to look into cyber attacks where social engineering is a key component combined with technical hacking skills.

There’s been a growing number of these style events, so I tasked GROK to create an assessment for me, let’s see how it did! Let’s both try and answer the questions:

Can GROK replace intelligence officers and can GROK help us defend better against social engineering + technical attacks? What do you think? (please take all of this with a pinch of salt… LLMs are known to make mistakes/hallucinate/lie in a very convincing manner)….

they look nice…. but looks can as we know, be deceiving! (is the entire blog just a social engineering experiment by me?)

Education

Making cyber security relatable to people

If we look at the reality of cyber security on a personal level, it’s insanely complex. There are hundreds if not thousands of details that matter, under the microscope security is incredibly complex and contextual. Which makes it a nightmare outside of simple abstractions, because things get complex fast.

Fiction

The Hacker on a Train

It was a crowded train ride during rush hour, and everyone was packed in like sardines. The train was slowly making its way through the city, and people were trying to kill time with their phones or laptops.

At one end of the train, there was a young man, who appeared to be in his mid-20s, typing away furiously on his laptop. He had a serious look on his face, and his eyes were focused on the screen.