Name: Underworld: Building an Investigation Lab for the Dark Web
Uploaded: 2026-10-21T18:32:34.169Z
Duration: 2 h 3 min 16 s
Description: Underworld: Building an Investigation Lab for the Dark Web

Transcript for "Underworld: Building an Investigation Lab for the Dark Web": Hi, everyone. Super excited to be here, and welcome to Underground. So this is gonna be an interesting, hopefully, an interesting exploration of how important OPSEC is and how to, build your lab with concepts in mind. Originally, I was hoping to do this more of a hands on, workshop, but I sort of took it into a little bit of a different direction, and I think everyone's gonna enjoy it. And we are planning a more hands on version of this, afterwards. So, stay tuned for, when, when we were actually gonna give the data out for that, so when that's gonna happen. But without further ado, let's get... Jump right into it. And so this is, just a heads up. There is a bit of flashing light. So if you're sensitive to that, just that I'm giving you a heads up. So let's have a look here, and let's get into it. So this is this is a story of a hacking crew. This is the prologue, and this crew didn't wanna be seen, and they spent a whole year making sure that everyone knew their name. So for now, we're gonna look at... Back on how OPSEC Express was a very important part of this, and we are definitely going to see how one reporter actually found out how this was all connected. In Greek mythology, anyone who ate in the underworld to never really leave the underworld. And Persephone's pomegranates were a way of keeping people in the underworld and trapped there. Even just a little seed can... Even though it's... You may think it's insignificant, can be a big issue. And later down the line, it can be your undoing and the reason why you never leave the underground. So this story is about team PCP, and team PCP was a loose group of about 12 people, give or take. And similar to how these other decentralized groups didn't really have a leader. So what they were doing was exploiting SaaS applications, right, and exploiting supply chain. They weren't your typical extortion group. They weren't encrypting systems. They were going after what's the companies that were supplying the companies, essentially. Let's take a look at the crew. So team PCP didn't exactly need anything else. They used... They, attacked Trevi. They attacked, Light LLM, which was one of their big ones. And, they were really looking for credentials for GitHub or secrets that... An access tokens on GitHub. So we're gonna be looking at how these individuals are really... How the evolution of extortion and how the evolution of these criminals are going. Because when it first started off with, like, maze and when they they pioneer double extortion with a a dedicated leak site of DOS, they weren't necessarily attacking, like, Salesforce or other ticketing systems. Right? So this is the new... This is what we have to protect. It's the perimeter now, not necessarily what's internal anymore. So first off, they started with React to Shell, and this exposed Docker, Kubernetes, Ray systems. And in December 2025, they had used a newly published flaw to exploit on nearly 59,000 servers in under 48. And they went from a single access token, and then they basically pivoted, pivoted, pivoted to a misconfigured GitHub, and they were able to exploit, a whole bunch of systems. And this was the company that essentially was behind Trevy. And one token is all it took. Then they put their sites on LiteLLM, and this was 95,000 downloads. Sorry. 95,000,000 downloads a a month. And this was a massive supply chain, and thousands and thousands of companies were affected by this. But in the same month, we had someone infiltrate their gang, an analyst at Google. And this crew kept going. Right? They had exploited 308... 3,800 repositories, according to CloudSec. Each one of those numbers stands as a company that had to do incident response. If you think about it from the other side, these were... A lot of these were volunteers that were maintaining all of these, open source supply chains. They were leveraging, that were based on GitHub. And this really shows the dangers of leveraging open source in an in an AI world where AI can... At the exponential... Almost at the speed of light, what what it feels like can find all of these vulnerabilities and essentially create proof of concepts to exploit them. And just this year, we've seen an explosion of CVE numbers and CVE, alerts. And we need to understand that it's not how smart AI is necessarily that is the danger. It's the speed at which the agents can run-in automated fashions and tandem and in parallel that will... We will never be able to to, to to really compete with as an individual. So how these guys were found was through an investigation because they reused some of their handles. And this story really goes back ten years when they were just children. And in 2016, one of them was banned, on a gaming, forum, for, like, a a game sheet engine for, VAC, which is from Steam. And this essentially created pivots and seeds that we were able to find. So this was a collaboration with many other companies, but... And, and many other researchers, but everyone basically came to the same conclusion. We looked at dead cat, which was one of the handles. And this was used across many different sites. HackerOne, this was used on Hugging Face. This was used on Steam. This was used on many different locations. So this gave us a correlation. Right? And this gave us an access to understanding how the infrastructure was was laid out. And what's crazy is that their own Hugging Face page actually pointed to their own c two infrastructure from team PCP. So we had a name. We had a face. We had a profile, and this is something that we have to take into consideration. We had a personal email now and that we can all pivot from. And it wasn't very long until we found out where they were. Right? And this all pointed to an individual in Perth, Western Australia. And this is basically one of the issues that you have when you are trying to build a reputation online for so long. You start to reuse because, like, your personas have reputation, and that reputation is tied to that persona. And... But that persona has left crumbs and seeds everywhere. So it becomes a thing you need to weigh on scales of how much is this reputation and this access worth versus how much I've spread myself in on the on the web and how many contacts I've I've made or how many things I've touched. And it... It's understandable. Like, some people can pick the same usernames, but at the same at the same time, like, people can think that it's the same user. But the thing is is that if if you... There's so many points of distinction. Right? And and you can have the same username, but you can have a different talks, or you can have a different profile pictures, or you're gonna have a different numerical value at the end like on Discord, right, or even on signal or on Telegram. So sometimes there's ways of identifying yourself. But this individual used a very unique image. And through reverse image search, right, we weren't able to find it. It was it was unique to that individual. So it it isolated that account from anything else. And now we go back to where we were talking about OPSEC. And since this individual was about bug bounty hunter, and they essentially operated their own business for bug bounty. This business was tied to their legal entity, and this brought in, records that you can essentially search business records. And this is what Krebs did. Krebs was able to find the names of the individuals behind this company and just type them directly to the company, to the group. And this is all recent. So now that we've had the private chats because we were... The the groups were infiltrated, they... We had the real names. We had all of this information. It wasn't very long until law enforcement was contacted, and the, the individuals were were arrested. Now the group did try to clean up, and they did purge their private chats of anybody they suspected was a mole or a rat, as they say. But persistence and access to... Remaining inside the group is is imperative. And we call that essentially redundancy of accounts. Right? And we wanna have access to... Even though one of our accounts gets banned, we wanna stay act... We wanna stay inside of the, the groups. And, really, by August, everything pointed to the same place, and it was time to move. Now these still remain accusations. They haven't been proved, but these individuals were arrested for attacking more than a thousand organizations. And they were young. Right? The two men that were arrested were only 21 and 23. So mistakes that they made years ago as they were children affected them ten years later. So their handle was connected to a public domain, and their public domain was connected to passwords that were breached in old databases that were found through Flares threat flow. And then those contact info... That contact information matched three accounts, and then we were able to match or... And now others were able to match on the avatar, and then all of that pointed to OPSEC Express. Now what I wanna do is we're going to explore stories together, and this is going to be a way of seeing how these stories happen behind the scenes and how these stories from an investigator and an analyst perspective essentially started and how we... The thought process goes behind each of these investigations. So let's have a look at this. This is the first question of our workshop. So you're setting up a persona, and I'm asking the chat now. To watch a crew on Telegram, what handle does it get? So are you gonna do, a, a variation of the handle you use on a gaming form years ago so that it feels natural to type and, like, you have muscle memory of it on your keyboard, or, b, a new handle made for for the... Specifically for this persona, and you've searched for it across multiple forms and breached data to make sure that it's unused and use no or else or, c, your initials and your birth year, nobody would guess it. So let's have a look at what people say on this. B b b b. We're getting a bunch of b's. Okay. We're getting a c. Amazing. Alright. So let's go with b. Let's go with b. And that is correct. B is correct. Now something to keep in mind is that investigators are also looking you up, but, also, the criminals are looking you up. And the good criminals have access to leak databases and, and illicit sites that provide access to breaches to look you up. So it's important that you protect your offset not only from, like, when you're on the on the on the bad side, you're protecting yourself against investigators. But when you're trying to do this type of work, you also have to protect yourself against the bad guys looking you up. So the persona needs a profile picture. Are you going to, a, the image you used on Steam for years is just a cat. Everybody loves cats. There's cats everywhere. A new image that... Or, b, a new image that was never used or posted before with this metadata stripped. And see a photo of yourself. But don't worry. We can do, like, a mister swirly and heavily blur it or swirl it if you know what that is from a dark web folklore. So we can go from there. So I'm gonna go b. Let's go with b. Perfect. So this gives us a handle on things, and now we have brand new personas that are tied to nothing fresh off the off the, the bat, and we can actually start generating new contacts. But the downfall to that, I mean, on the flip side is we have no reputation. So we're gonna have to build our reputation next. So let's go into the descent. So for the rest of the session, we will work inside the underworld and the underground, and we are going to... Right here in our browsers, and we are going to work on an investigation called Night Fury or Night Fairy. And from there, we are going to essentially, try to track down these investigations and these personas. So our next story takes us into the 2010 since the pandemic, and researchers are posting. They're logging into their blogs. They're logging on to Twitter, and they're exchanging information with each other. And what's interesting is that there's this one user, Rovan, writes up this phenomenal exploit write up, and it gets retweeted. And people go and look at this, who this individual was. And researchers that knew each other in the industry and online within tight knit circles follow each other, and they build this mutual trust for each other. And Brovin was following most of the high profile researchers online. And they all had connections to each other. They all had been vetted in the... Separately together. And this is called social proof of acceptance. It's like this individual just popped out of nowhere, but everybody was following them or it was... He was following them. So what's the harm? And when you're on LinkedIn, for example, and someone wants to connect with you, you you have a glance at who are they connected with, and you take for granted that since others have been following them, they must be okay to follow. So this is a way of protecting yourself, and this is more of a, human side of creating labs and creating, this mindset of who do you trust. So this goes to something that I I try to employ every day. It is called trust but verify. And you can trust that other people trust something, but you should also verify it yourself. And so this individual kept writing blogs, right, and kept giving, guest posts. So inviting people onto his blog to, write and to, essentially be promoted on this blog. And these were real researchers. Right? And they gave credibility to this individual. So when this individual started to basically weaponize this trust, what they were looking for was a way into this... Into other people's, infrastructure. And so when we have different techniques, for example, we have something called the watering hole. And this was one of the, attacks that this individual did, poison the water well so that everybody that goes to the water well essentially gets poisoned. So this individual also weaponized the trust, created a waterhole attack, and then went on to directly go and say, hey. I want to collaborate with... On research with you. And this sounds a lot with with a lot of researchers are... They do on a day to day basis. We all essentially collaborate with each other. We all essentially, reach out to each other and say, hey. Can you have a look at this, and can you have a look at that? Right? But if you're running your code and you run the code and the exploit or sometimes during a job interview now, they say, can you do this? Or a work study, they're like, hey. Can you do this? Can you do that? You're essentially running the code. Right? So let's have a look... A little test and take a a step back here. So imagine you're a researcher and you you... A researcher did you follow for months, and they have 1,800 followers and replies from people you respect, and they send you a visual studio project from... For a bug, you're both chasing. So... And he says, say, like, build it and see if it pops. So, essentially, there's delivering you a proof of concept, which is incredibly enticing, of course. So do you build it, a, on your work laptop because after months of talking, you trust them, or, b, you read the project files included in the build events, and you build the binaries, you bundle the binaries before anything runs, and you build it only on a disposable virtual machine that's offline. Or c, you ask for a video call to confirm who they are, and then you build it. So let's have a look at the chat. Be for sure. BBB. Alright. Let's go with b. And that is correct. So we build events and bundle the DLLs, our code that runs when you build. And that's exactly, how you would defeat exactly what happened in 2021 with this, but they didn't necessarily do that. So we go here. So this individual also to further boost the credibility, created a video and would provide, and say, doctoring this video to try to get more into people enticed to to download and exploit themselves. And in 2021, this is where Google essentially labeled them, DPRK and was able to tie their, key base, their Telegram, and their other accounts and, essentially, listed publicly that this is where, a lot of the vulnerabilities were coming from from the... A waterhole attack from this, researcher, supposedly researcher. So within weeks, this operator had built a new identity. Even though when you burn an account and you burn a persona, it doesn't necessarily mean that the campaign stops. They will adapt. And this is why threat actors can have redundant accounts and redundant side profiles that are ready to step step up and take the mantle when things... When when, one gets burnt because the overall campaign is the goal. And the the campaign structure is the same, and then it's just for... The the the names and this... The the details can change, but the overall structure of the compromise is the same. So let's have a look at this question. A colleague tells you that they've been using GetSymbol, which was... You understand to be a watering hole attack for a week. Google has just reported it as a backdoor, which is the hidden way for attackers to get into a machine. So what do you tell this colleague of yours? You tell them to delete it and carry on? Do you, again, treat the machine as compromised, so you reinstall and rotate every credential in chi that it was used on? Or, c, you run an antivirus scan and you only reinstall if it finds and socket? So I think we all know what the the answer to this is, and it's gonna be, again, yet another b. So let's see if this trend continues and if it's all gonna be b's or if it's all gonna be a's. Let's see what happens, but let's go with b. So this campaign lasted for about three years, but no victims were publicly named for this. And if you look at this playbook, right, this is very similar to a campaign that team PCP deployed, right, with canister worm. Poison the well where everybody gets their data from, And make sure that everybody earns their trust. There's also an ethical issue with being in these groups because a lot of the times, they'll want you to participate and show your commitments to the cause. And how do you do so when the the whole ethics and the whole point and the whole point of this group is to commit crime. And being a fly on the wall can also be a a way of exposing yourself. So your persona is inside a closed chat, and that chat, a fresh dump of live AWS keys for 300 companies shows up on a server that the group uses. Those keys are the credentials that unlock each company's Amazon cloud accounts. So you... Do you email all 300 companies yourself today from your work address, or do you go through your legal and leadership chain, ask your cloud providers to revoke the keys in bulk and then notify the victims, or c, do you log in with one of the keys first to confirm the dip... The dump is real? Let's go with b. Maybe a or c. Let's go with b. Google didn't email the companies all at once and asked AWS to essentially revoke the address, and then it contacted them. Tribal gang unprompted offers you a full chat log of the group your persona is sitting in. Do you accept and preserve it with hashes and notes of where it came from and assume your persona's cover may... Now may be at risk, or you refuse it to keep your hands clean, or you accept it and post excerpts to show how much access you have? This is an interesting question because sometimes you can pivot through access and through these understandings of where... How you use the the... This this, OSINT information. Right? Because one of the techniques that was used earlier on, it's no longer used now, but on forums where ransomware gangs would share screenshots of their back end, like early ramp or ramp in, like, in the mid days, you could essentially, create screenshots... Fake screenshots and say that you also have bad access. And when people would leak, like, lock bit builder panels or stuff like that on Twitter, you essentially could say that, hey. I also have access and pass those off as your own with some modifications, of course. So what do you do on this? Let's have a look at the chat. What are people saying? A c a a c a. Okay. Let's go with a. And that is correct. This is the proper investigator way to do it. So after team PCP tightened its circle, Shining Wonders did the same, and also purged a lot of their members out. So we are going to start with a sorting rule for anything people send you. So we're gonna look at... We're gonna look inside our our first OS now, and we're going to look at how we can work with information that people send us. Let's have a look at our first workstation. I'm gonna turn autopilot on, and you can have a look at how we solve this puzzle. So there's a concept called ingratiation in social engineering where, essentially, it's called killing them with kindness. And you will get a lot more out of people if you're kind to them. But, again, that is extremely manipulative, right, if that is your goal. And the problem with social engineering is that it's basically applied psychology and behavioral analytics, and everyone is susceptible to social engineering. Everyone does social engineering every day. We do it all too because we are social beings. The the idea is, though, how much of a manipulator are you that you can actually go out and do this and compartmentalize your your actions and your thoughts and your ethics and your morals to be able to do this as a practitioner. So this particular example here, which you can actually go through and, do it on your own if you really wanted to explore all the commands and and and, experience it for yourself to dig through it. But, essentially, this was a beacon that was embedded into this proof of concept file, and this researcher was trying to get to expose themselves. Right? They were passing off as a researcher and using kindness as a deep, method of taking down their, objections or the defenses or their their their, yeah, their their wall, this is how, you essentially get it. And by saying that you're gonna... You're slammed and that you're gonna take it out, it doesn't necessarily say that you are... You call them out or they... Because you... Now that you know that they're trying to infect you, you can essentially start playing the double agent and working them as well. So calling someone out right away isn't always the best way to do it. So we left no seeds, and we correctly answered everything. So most labs are built on virtual machines. Right? We don't necessarily use bare metal machines all the time. You can do everything in virtual machines that is way, way, way more efficient. Right? You just need the hardware to run vast amounts of virtual machines, interconnected virtual machines. Right? And one of the ways that you can do it is you you don't have to... Like, understanding... Like, you can get all boggled up on saying, like, which VPN is best or with, like, if you should use VPN with Tor. I think those are besides the point. Right? What you wanna do is you wanna have a system that works for you that is essentially fast and convenient for you that maximizes your, your security. So this is the trade off that you wanna do between convenience and security, and it's it's what security practitioners have to deal with for their day jobs as well. But when you're building a lab, if you just focus on making something the most secure, then you won't use it because it is too it is too cumbersome. So a colleague asks you to take a quick look at the source code of a suspicious tool someone sent them, where do you open it? Do you open it up in your own work laptop? Do you use, again, use a VM? Or do you you have a lab machine that's connected to the Team Share drive so that you can save your notes. It can't possibly be beat, can it? Let's check. So for every one of those infections that happened during this investigation, it happened on the people's work laptops because they trusted the source. And let's go for room two. So before anyone on the team visits the mock bill site, the analyst workstation has to be audited. Most people assume that the lab is clean. Let's have a look. Anyone familiar with the Odyssey? Let's take a look at Trojan Eye's entry. So when a software flaw is announced, it gets a CVE number that is part of CVE alert and... Which is a public ID. And a proof of concept or POCs code that shows the flaw can actually be exploited. Right? Not every vulnerability or... It gets an exploit or a POC. And the POCs are just proof of concepts. They're not necessarily packaged exploits. So a lot of the defenders will look for POCs. So how do you know if what you're downloading on GitHub is actually safe? If you're just gonna make something off of GitHub because you're looking at a POC for a vulnerability. Or if you are a threat actor and someone gives you a builder, how do you know that's clean? And that's actually just gonna make you a an encryptor and a decryptor. So a CVE was published two days ago, and now a proof of concept for it appears on GitHub. It's from a brand new account with three stars, and that's compiled POC dot EXE inside a Python script. So are we gonna run it on your analysis VMC whether it works? You read every single file first since an executable in a Python project is a warning sign. You only run anything in its disposable sandbox. There's no credentials and no network access, a airtight air gap system. Or you wait until it has more stars and let the community verify it. We're gonna go with b, this one. So those are the warning signs, and this is what other individuals have also put. We're not necessarily looking at... Like, everyone knows that, like, cracked software is where a lot of infections come from. Right? That this is the new vector, and it's a vector that's been going on for a while. With this method, the campaign was able to amass almost half a million credentials. And a lot of our research at Flare explores criminals infecting themselves with their own malware, either to test it or by accidental detonation. This is how a lot of threat actors get compromised and exposed. So a colleague wants to open a leaked archive sample folder on the team's shared analysis server. So we wanna make sure... We wanna see if, the data that was provided by the threat actors is legitimate, which is the one that holds everyone's... Like, so this server that we're gonna be actually look... Working off of holds everyone's credentials. So you say that's fine since that's what the analysis server is for, but it also contain huge oversight of... It also contains everyone's credentials. Right? And it's not airtight. It's not air gapped. It doesn't... It holds credentials. So you wanna hash it and copy it to a disposable sandbox with no credentials and open it there, or you run an antivirus scan and you open it on the server if it comes back clean. So, again, running an antivirus scan is static analysis. It doesn't necessarily mean it will cache any... The the right thing. If it hasn't seen the signature or the hash, it won't find it. And then depending on how good your EDR or your your antivirus is, it it might not necessarily find a, heuristic or behavioral issue because you're not exit... Necessarily executing it yet. Right? Unless the system can execute in its own sandbox. So the best course of action is b. So we have to treat every single file that we collect as hostile, and we essentially work in VMs. So let's have a look at our next room and see what we can do here. So the threat actors have sent, two journalists additional samples, and we wanna make sure that these samples are safe. We wanna summarize the datasets. According to the US Department of Justice, there's been over almost 3,000 victims across a 120 countries for LockBit since 09/2019 to 2024. So this is the idea of double extortion versus single extortion and how different groups monetize and consider themselves. The... One of the issues is that if you steal data, you have to pay for it to host it. And you... A lot of groups are trying to find ways of monetizing that data. We're seeing a lot more now threat actors, and groups leveraging AI to summarize and analyze the victim data to pinpoint the most sensitive information. And we've seen this with Leap Bazaar. We've seen this with other groups as well. And the issue with that is that you have to leverage AI. You have to pay for AI. You don't necessarily need to pay for as much storage, but your cost... Your your cost allocation for extortion goes elsewhere. It goes to AI now. And we're seeing more and more groups leveraging obliterated models and hosting their own AI models to help with this workload. So we're seeing... The industry is changing, so threat actors are changing as well. So a leak site posts your client, which is a hospital with seven day countdown and a three screenshots for a file listed. So a, you brief the board that the breach has confirmed that the two terabytes is gone, or you, b, you treat it as a claim. You check the screenshots against your company's real paths and naming. Because a lot of of threat groups... Not a lot, but some threat groups are bogus, and they will attack and rather damage your reputation than make sure that you have... That is enough to extort you. Right? And or, c, you ignore it and you wait until the actual actual data is published and you gamble the fact that you might not be... Even be able to download it because not every single group actually ends up publishing the data. Or the, like, the gentleman, they make it practically impossible to download at scale the datasets. So let's go with b. So Operation Kronos was one of the best operations for disrupting BlockBit. It was extremely effective. BlockBit used to be the number one site. Now it's not even cracking the top 30 sites. Having little issues with the audio. So they're gonna have to mute the music for now. So what was interesting with LockBit was that this is more of a reverse psychology type of effect where you either put on... Like... I don't know if you actually believe that his, his offset was that good, that he would put himself a $10,000,000 bounty on his head, essentially saying that he would pay what the FBI was offering to, for his identity to give him up? Or was it more of a bluff to give that illusion so that, like, was he serious is what I wanna know. Right? Did he... Deep down, did he have that paranoia of I left the seed somewhere and now people can tie it back to me? Or did he actually, like, what... Or was it all a ruse? And this was a famous, thing. And the... What's interesting is the x o x o from Prague originally came from, the Everest DOS, which, happened a few weeks before the, lock this. And, apparently, allegedly, the same researcher or the same group went and took down, locked it and dumped the panel... The back end panel. Now we don't know who did the locked it one, but it's not public. But what we can do is we can assume since it's it's really meant to point you to the same individuals. So when you're a threat actor and some... And you get compromised over and over and over again, and you have your entire database or parts of it leak online for researchers and for others to consume, to analyze, to nitpick, to scrutinize, what is your comeback? What is your analysis? Because a lot of this data didn't just include usernames, which were pseudo anonymized, and and each internal username was a new username. It was not something that came from the outside. It was like John, Jason, It was, like, John Jason. First names like that, which were completely fictitious. But you also had access to Bitcoin addresses and wallets, and a lot of them can be used on privacy, wallets, of course, but not everyone all the time uses proper offset. Right? And you're looking for the cracks. Threat actors are looking for the cracks to get into companies and to export companies, But it's the same idea with threat actors when you're trying to, you know, minimize them and expose them. You're looking for the cracks and you're looking for the disease. So someone has you a copy of the lease panel database. It has an affiliate login, routine, text, password, and it has victim negotiation checks. Now we've seen this quite a bit. We've seen this in a lot. We've seen this in a lot. We've seen this from silent recently. What... And we've seen this from the gentleman as well. What do we do? You try a few of the passwords of the gang's life panel to permanently work. Right? You see this with, like, brief forms, for example. Or you hash it when you receive it, which is part of making sure that if you tamper with it or if you change something, you can always go back to it. Right? And you're seeing a digital fingerprint of the file, then you analyze it offline in an isolated environment. You keep victim's data for... Have personal data out of it, and, you check for payments on chain. A great tool to use, again, not sponsored, but a great tool to use that I like is, Breadcrumbs. And, it allows you to have a nice raffle interface to follow and and and chain your transactions together. There's free accounts available. And... Or c, you publish the negotiation chats, to this... To shame the victims who paid. Now this could be, what the affiliates would wanna do, because not... The interesting part of this whole world of negotiations and shame sites and stuff like that is the fact that if you get, put up on a shame site, you might wanna tell investors that you didn't pay. So even if you paid, you can tell the group, don't take me off the pay... Off the shame site because that way you have the illusion to show publicly that you didn't pay positions in your name. Right? So it's very hard to tell who pays and who doesn't pay. And looking at it from an outside perspective, it's impossible to tell who's paid and who's paid. Right? Alright. Let's see if I can get the audio working here. Yeah. So this was a big one. Evolve Bank trust is a huge, big, massive data chest. And the problem was that it wasn't even the proper victim's data. So a lot of the times when threat actors go into an environment, they could also mislabel the information and and mislabel the leak. So a group says it's breached the Federal Reserve and has published 21 archive links. So what we wanna do is we wanna also make sure that this is actually... Because a lot of this essential essential... Essential, all of that, the words to prop up and make news and, shortcut them whether themselves into the limelight. Right? And create that fervor of this, excitement behind a group and and get their name on the zeitgeist. Big big claims are usually completely full of it. Right? So this is why we wanna work out whose data it actually is. But downloading victim data like this without the victim's permission isn't... You have to make sure that that is something that you're allowed to do because it's not a... I know in a lot of places that it is not something you're allowed to do. So you'd have to verify if, that is something you want to do. So let's go with me. So FungSec was an interesting group. FungSec was a group that really wanted to be part of the community. Right? And they revived... There's a a a a a time where Bajorka revived the Baboqu brand. Even though Baboqu had been dead for years at the time, they essentially revived the branding of this and co opted the the Beagle brand and started to publish their... Bejorca's old brand and old leaks and breaches. But, also, they started to look at old and fake data a lot. Right? Oh, it it... Audio... Okay. Let me restart the stream here and see if that helps. One sec. Is this better? Perfect. Let's go again. So I'm just gonna skip back to where we were. So a lot of other groups will capitalize on the data of other groups. So collecting from leak sites needs its own pipeline. It needs to also be verified on the ethics. But at the same time, there's a lot of forensic that needs to keep going on this. And let's go take a look at our next workstation. Let's talk about Snowflake. So an inflow stealer, most of you are familiar with it, is a small piece of malware that runs for a few seconds and is... Whole point of it is that unlike ransomware, it does not want to be noticed. Right? And it could be a crack game. It could be a a free tool. It could be a POC. It could be anything. Right? As long as you execute it. And cookies matter most because you can basically leverage cookies to steal sessions, bypass, and replicate live logins. You can bypass, MFA. And a lot of this is really becoming a priority for threat actors now. And a lot of the times, you can have passwords that you've already accounts, especially in enterprise, not necessarily in your home lab, but in enterprise, you can have... If you don't have proper, access controls and identity management set up, you can have accounts that you've never... That you don't know about and that have been forgotten as local accounts. And when a machine gets compromised with this dealer log, those credentials, if they're reused or have, connections to anything else, you can have a serious compromise on your Hey, Tammy. hand. Sorry. to. interrupt, but we're actually looking at the wrong screen. Would you mind, we're looking at your Google Meet. Oh, sorry. That's interesting. Let me... Thank you. very much for that. No problem. Is this better? Perfect. Okay. Okay. So your Steela logs monitoring turns up a 2021 log that holds a client contractor Snowflake credential. The client says it's three years old and can be ignored. So do you, a, agree because logs that old are just noise, or do you treat it as live? You recommend rotating the new new passwords, checking for m m... MFA, and reviewing that account's access logs. So you can test the credentials yourself to see if they still work. Potentially, you want to isolate, contain that account, and then verify because... Then you can also understand that if you have three year old accounts that have never been cycled, that's another issue. But you can also look at different things and see the validity of these, credentials, right, and the source. So I would do, like, a mix of b and c as... At the same time, but definitely b. So we've been seeing a lot of talk about shiny hunters and especially with the... In light of recent events, this puts a lot of things into different perspectives. And not only do we have to trust, it really puts a big question on trust and who do you trust, even the good guys, even the bad guys. And I think this is going to be something that we're gonna work towards and figuring out different methods and different, best practices and guidelines for defenders and practitioners on how to better handle trust and, essentially, how do we work towards a more secure future, especially when dealing with threat actors and criminals, when the criminals are the ones doing also the defending sometimes. So a vendor post that a platform's employee infected laptop causes a mass breach. The platform calls it inaccurate, and then the post disappears. So this is called a flash claim. Right? So do you repeat the vendor's claim in your client brief because it was more specific, or you report both claims and mark that the root cause is unconfirmed and wait for the incident response findings or you assume that the vendor has pressured... Was pressured into removing it, so it must be true. This is a really interesting one. I'd love to see what everyone thinks of this. B. B. B. That's right. So keep going. So this is Wayfoo for those who... Or Judesh for those who, who follow the news, which is most of you I know. For me, it's the paranoia. And Judesh, aka, was extremely paranoid to the point where Wei Fu was reaching out to researchers and asking them about what they knew about him, what they knew about the case, and the sinking despair of being found kept encroaching and kept, like, feeding off of him. And to the point where it affects your capabilities, your mental state, your day to day, and to the point where it becomes an illness and a sickness inside of you. Definitely follow me for that sentencing update. I'll be following it very closely on, the October 27. So a press release says redline no longer functions, and a client asks whether they can stop watching for redline logs. So the thing is, as we know, you can tell them yes because the threat is gone. But you can tell them, no. The old logs circulate and they keep circulating, and they kept... They get repackaged and redistributed and sold in... Over and over and over again. And monitoring this gap and this, lag is extremely important. So we're gonna go with... So Steeler logs are full of live passwords, session cookies. We know this, and this is what we track. And it is becoming such a commodity now. It has become such a prized possession that even criminals are accessing or trying to access serial log databases, right, and... Or serial log services or or, Telegram accounts. Right? And, it is becoming extremely important business... Part of their business for initial access and also for criminals to try to, docs themselves. And now let's take a look at the next story. So we've established that the leak is real now and that the next question is the second priority of intelligence requirement is how did the attackers get in? And this is why we need to follow... I know IT and security measures and walking down, like, corporate laptops and corporate systems is important. But installing anything willy nilly is definitely a recipe for disaster. Let's explore Intel broker. So attribution is one of the hardest things to do. And when you're working on investigations, not not... Your job might be to attribute, but a lot of the times, because you can't necessarily always attribute, Your objective can also be defined credibility more so than attribution to a group. And being... And attribution, like, knowing a group's reputation, part of their attribution model is, of course, part of understanding credibility. But you can argue as well that you can establish credibility of an unknown group as well, which is hard. But they're going to hand in hand, of course. So Intel broker was compromised by a small $200 transaction, I believe, which is wild to think. Sample is what broke him. To have your same RAM email address on your Coinbase is wild. And what's interesting is as well is the cross contamination of cookies. Right? And if you're using a machine to do your criminal activity and then you're using the same machine to access your Gmail, tracking cookies follow you, and your advertisement profile is 100% exposed. Right? And this is all collected and given to beta and Google, which will absolutely give that information up to law enforcement. So when you're creating these these, these... I got, like, skipped where you don't wanna have any contact with the dark... With the the world and you wanna be anonymous so that you protect yourself from criminals, but also you don't tamper with the evidence of active law enforcement investigations and you wanna be as a fly on the wall, it's a very... Like, the private sector interfering with law enforcement is an issue, and we gotta be mindful of active investigations as well. And playing vigilantes isn't always the the best way to do things. So let's take a look at this next question. You're, you've traced one crypto payment from a form persona to a wallet registered in a real name. How do you put that into your report? Now do you write that person... Like, do you confirm the attribution? Right? Or do you write it up as one link with a moderate confidence? The payment traces to a wallet registers to this person, and you're seeking independent cooperation. Or you just post the link publicly so that others can confirm it. Now depending on the type of individual you are, if you're more on the journalistic side or your public appeal is part of your reach and it is part of your research, you might wanna do that. But at the same time, you could be exposing and you could be, interfering with someone else's investigation. So let's go with me. To be arrested with damages of $25,000,000 is is quite steep, And law enforcement is really good at leveraging you to go after others, and we're seeing that with, shining unders right now, where putting pressure on one gives up the other, which is a fantastic way of doing it. So your persona never bought anything, but it did pay a forms registration fee from a wallet you've once topped up from an exchange account in your own name. So you decide it's only a fee and nobody traces that. Law enforcement can. You retire you retire that persona because it's a seed. Right? And from now on, you fund personas only through a reprieve documented path that never touches your identity. And with crypto getting more and more regulated, right, it becomes a way to do it. But you... Or you can see you can run the wallet through a mixer to break the trail. So it would be. So let's take a look at the next room. And being part of being part of having ways to sign PGP is very important because if you look at recently, there was the cyber leak for the GTA six leaks, and there were so many copycats going around that you never knew who was actually eating information and if it was a legitimate leak or if it was AI generated. So that was interesting to see that even to legitimize the attribution is something that we need to do as well. Let's talk about Bybit. This is a recent one. If you want more information about crypto and how to track crypto, you can also look at my previous talk, Kryptos, which we go into exactly, like, on chain work and leveraging an actual case study. So you can definitely find that in the Discord group, from one of my previous talks. So you're following the 50 wallets, and one of them sends funds to an address that also takes deposits from thousands of unrelated, users. You see this pattern a lot. You decide that the attacker's main wallet and you report on it or you decide that it's probably a service, you identify it, and then you send it a freeze request with the transaction hashes, which are unique IDs of the transactions, or you stop there because you can't trace through a service. Right? Mixers, tumblers, this is what you see often, especially when you start to look at, public data for ransomware payments. You can see that the affiliates, and the ransomware as a service group will leverage these types of services automatically sometimes, or they will manually initiate it, to clean and to sort out their crypto. So you linked a wallet, to the theft an hour ago. When do you share your address? So, you wait and share it after a full write up the next week. You share it with, exchanges and freeze channels along with transaction hashes, and the write up can follow. You never share it because public... Publishing tells the fees that you... What you know. So we're gonna go with... So a freeze only works while the money is sitting somewhere that it can be frozen. Not every exchange will comply with a freeze order. So making sure that you can mobilize as fast as possible here is what you wanna do. And we're gonna run up a little bit over probably another ten minutes. So if you wanna stay, thank you very much. If not, I understand. Have a wonderful, wonderful rest of your week. But we're probably gonna have another ten minutes of this. So let's finish off here with this workstation. Alright. And I think we're gonna end it here. There's probably two more rooms if you wanna go and take a crack at them yourselves. And I will be publishing in the Discord the actual website, that you can go and explore this whole world and this whole deck and this whole, workshop on your own time at your own pace. And, and you can actually experience a lot of it, yourself. So I will be looking over here. And... Yeah. So I hope... Like, a lot of it is... Again, it might have been glitchy on your side. I apologize. Trying something new. But if it was, to your liking, let me know. And I had a lot of fun, creating because it's a lot more smooth on the actual event page here. So, let me know what you thought, and, I will be going into the Discord in about five minutes to, continue the conversation, in the voice chat. So see you there soon, and have a wonderful rest of your time.