Hello and welcome to the Decipher podcast.
I'm Dennis Fisher. This is a weekly news wrap up
episode of the podcast. Lots going on this week, plenty
of stuff happening, lots of news, lots of pre RSA stuff
going on. RSA is one of those things that
I look forward to and also look at with absolute existential
dread every year. We'll get into that later.
But before we get started on the news here, here's how you can
reach us. If you're listening to the
podcast, you know how to do that.
Congrats, I'm proud of you. If you want to find us on video,
you can find us at youtube.com/decipher Sack.
All our videos are up there, podcast interviews as well as
our Hacker Movie podcast episodes, which are super fun.
Our latest one was on Star Wars with Rich Mogul and Wade Baker
came out a couple weeks ago. It's really fun.
As you might imagine, those two guys are super Star Wars geeks
and I was kind of along for the ride.
It was a good time. We have another one coming next
week. I don't want to spoil that, but
it should be very fun. We have a couple of very cool
guests who are lined up for that one.
And in other podcast news, we had an episode that went up this
week with my friend Caitlin Condon from Voluntchak, who's
very funny and very smart and just one of the funnest
interviews I've done in a long time.
We talked about a exploit Intelligence Report that
Voluntchak put out recently that has a lot of cool data on
exploits. As you might imagine given the
title, Caitlin's been in the vulnerability research and
exploit dev game for a very long time and knows exactly what
she's talking about, so I'd encourage you to check that out.
Caitlin's a lot of fun. So other ways you can find us on
Twitter and Blue Sky, it's at Deciphersec.
I mentioned YouTube and if you want to e-mail us, you can get
me a Dennis at Decipher dot SC and Lindsay is Lindsay with an
EY at Decipher dot SC Lindsay will be back soon.
Her leave is almost over. So she's she's going to be back
in the game very soon. So we're looking forward to
that. All right, let's dive into the
news. So two big stories that we have
on the site this week. First one is the re emergence of
APT 28, which is one of the more notorious Russian APT groups,
also known as Sednit, also known as fancy bear forest Blizzard,
all kinds of fun monikers for that group.
Been around a really long time. They are linked to Russia's Gru
which is a military intelligence branch and very active group and
highly capable, as you might imagine, being connected to
Russian intelligence. The group knows what it's doing,
but they have been a little bit quiet in recent years.
No one's totally sure why, but one of the things that this
group is known for is developing its own exploits, its own
malware, its own tools, obviously has a a ton of funding
and capabilities to draw from in house.
They don't have to outsource this stuff.
And some new research from ESET this week found that the
advanced development team inside Sednet, which had been pretty
quiet as I mentioned, had actually been working at least
since about April 2024 with some new tools and had been deploying
those against Ukrainian targets in support of their the Russian
invasion of Ukraine. And Eset's research, I'll just
quote from what they wrote in their analysis, says our account
of modern Senate activities begins with Slim Agent, an
espionage implant discovered on a Ukrainian governmental machine
by CERT UA. That's the CERT Ukrainian CERT
in April 2024. Slim Agent is a simple yet
efficient spying tool capable of logging keystrokes, capturing
screenshots, collecting clipboard data.
You know, typical espionage implant backdoor type thing.
But this is a new one that has had not been really seen too
much it, but it's got some code overlap, which with other tools
that had been deployed way back and you know, like almost 10
years ago. So that's one of the the kind of
hallmarks of this group is that their their tools, you know,
often have code overlaps and and similarities for obvious
reasons. I mean, why develop new tools if
you can kind of steal from the ones you've already developed?
But Sidnet also has two new tools in its arsenal. 2 new
implants, one called Beard Shell, which is an implant that
executes PowerShell commands and it abuses the legitimate cloud
storage service ICE Drive for C2, you know that kind of thing.
Using, you know, legitimate commercial cloud services for C2
is not new. It's something that AB TS do
quite a lot. And so the other tool in the
arsenal now is Covenant, which is a modified version of an open
source.net post exploitation framework.
And Sednet has reworked this framework and replaced its
original architecture with features adapted for long term
cyber espionage. Cyber espionage.
And this is, you know, this is one of those things where you
see an advanced group like this that has these really high end
capabilities and can, you know, take legitimate tools and
legitimate services and bend them to their own purposes.
Common tactics for AP TS, you know, they're it's expensive to
develop your own tools and implants and all of that.
Even with, you know, the budget that you would assume this group
has, you know, it's more efficient and probably more time
effective and cost effective to take something that's already
out in the marketplace and modify it and use it for your
own purposes. So that's the lowdown on the new
research. Again, the story is up on the on
the site APT 28. You know, Sednit Fancy Bear is a
group that has attracted plenty of attention from researchers
and law enforcement. The DOJ indicted more than a
dozen alleged members of APT28 back in 2018.
If you go read that indictment, you'll get a good a good look,
some insights into the group's activities and some of their
targets. This is the group that's
believed to be responsible for hacking the DNC all those years
ago, which we talked about the ripple effects of that all day
long, but we don't want to get into that.
So yeah, I would encourage you guys to go read the the story we
have on the site as well as Eset's research, which is very
well done as usual. Next story I wanted to mention
is a crackdown that came down at the end of this week by U.S. law
enforcement and Europol, which took down a residential proxy
network known as Sox escort. This is the second one of these
residential proxy network takedowns that we've seen in the
last couple months. There was one at the end of
January for a network called IP Idea that, you know, we, we
wrote about at the time and we talked about on the podcast at
the time. In this one, it's, it's kind of
the, you know, the typical framework of these takedowns
that you see. They seized a bunch of domains.
the US seized or froze $3.5 million in cryptocurrency,
seized 34 domains, 23 servers in seven countries.
So it's a pretty international takedown.
And the, you know, these residential proxy networks, so
they're in a weird Gray area. Like, there are legit
residential proxy services that allow you to sort of, you know,
hide your location, hide your IP address for, you know,
legitimate reasons. Activists, journalists,
dissidents, people like that use networks like this because
they're at risk. But cyber criminals use these
networks for all the reasons you might imagine.
And they've become a big problem in the last, I don't know, 3-4,
five years. They've always been around, but
they've become a much bigger, bigger problem in recent years.
So, you know, cyber criminals love these things.
They're they're all over. They're all over the world,
obviously, and some of them are very, very big.
Black Lotus Labs was one of the cooperating security vendors in
this takedown. And their research found that
this this particular residential proxy network was kind of
powered by the AV Recon malware, which has been around for about
3 years. And more than half of the Sox
escort victims were located in the US or the UK.
In this case, you know, although there were victims spread all
over the map, these were the two largest, largest, largest victim
victim sets geographically. So here's a a good quote from
the director of your executive director of Europol from this
takedown. It says cybercrime thrives on
anonymity. Proxy services like Sox Escort
provide criminals with the digital cover they need to
launch attacks, distribute illegal content, innovate
detection. By dismantling this
infrastructure, law enforcement has disrupted a service that
enabled enabled cybercrime on a global, global scale.
Europol has been doing a lot of this in the last, you know,
probably decade, but the last I would say five years.
They've really ramped up their takedown efforts and disruption
efforts on cybercrime networks, especially going after the
payment infrastructure and the cloud infrastructure that these
services thrive on. You know, without a way to move
money, they can't operate and without, you know, the C2
infrastructure, they can't operate.
So those seem to be the two pillars that they often go
after. And it's, it's been effective,
You know, like bot Nets. A lot of times these things pop
back up under different names or in different ways.
But it's always nice to see these disruption efforts target
these kind of networks. You know, like I said, there's
still others out there. There's plenty more of these out
there. If you want some good insight
into how exactly they work and what kind of scale they have, go
check out the research that Census has done on this.
They've done a ton of good research on this.
They have a lot of really good global data on the scale of
these things. I'll, I'll try and post some
links in the show notes so people can see exactly what
they've done. But Census has, you know, some
of the best visibility in the world on these, on these kind of
networks specifically and the Internet in general.
So you can, you can have a good look there.
So those are the two big stories I wanted to hit this week.
As I mentioned, I would encourage everybody to go check
out the podcasts we have up this week with Caitlin Condon from
Bolt Check. We have another Hacker movie
podcasts coming out next week. As I mentioned, not sure exactly
what day we're going to post that yet.
We haven't recorded it yet, so we'll see.
But aside from that, we're going to have a preview episode for
RSA, which is a week and 1/2 from now.
The conference is a week and 1/2 from now.
We'll post that towards the end of next week.
Lindsay and I are going to look ahead at the show.
Some of the sessions with the major themes are going to be
maybe have a little fun with some of the over the top
silliness that goes on at RSA in terms of like vendor hype and I
the AI theme this year is just like completely out of hand.
I knew it would be crazy, but just judging from the volume and
the volume of pitches I've gotten for meetings and
interviews and the number of those that are connected to AI
in one way or another, I would say it's got to be upwards of
95% of the total is 1 AI thing or another.
And I'm going to. I usually try to avoid the show
floor, like at all costs. I almost never go down there
unless somebody is forcing me to for some reason, but I might
just do it for like a 10 or 15 minute spin through to go see
what the AI hype cycle is like. I'm sure it's going to be
completely absurd. Maybe take some video or
pictures of like what exactly is happening down there.
It's going to be pretty wild. If you've never actually, if
you've never been to RSA, congratulations.
If you have never been on the show floor, major
congratulations. It is really one of those things
that you just kind of sensory overload doesn't even cut it.
It's actually calmed down there. There used to be a lot of, you
know, very questionable things happening on the show floor in
terms of like ways to attract people to booths.
That's gone away in recent years.
Now you'll just see like, you know, like C list celebrities
standing around or, you know, maybe an F1 car at somebody's
booth or you know, somebody from Mythbusters hanging at a booth,
which is cool. But you know, it's just a lot of
hype and a lot of vaporware and a lot of that kind of thing.
So we'll try and cut through some of that with the RSA
preview. And then after after RSA, we'll
talk more about what actually happened there after I actually
see what what it turned out to be on the ground.
So those are all the things we have coming for y'all.
Look forward to all of that. And that's it for this week.
Have a great weekend. Talk to you next week.