Unspoken Security Ep 10: True Stories from the Dark Web

I think that when this started out, the idea behind a lot of these was privacy. A lot of these platforms had very high level of privacy. It was very difficult to get into these platforms. The idea was that everyone was trying to conduct these negotiations, just conduct their business in the private, away from the eyes of researchers, from law enforcement, et cetera.

Welcome to Unspoken Security by ZeroFox, the raw gritty podcast for cybersecurity professionals who want to understand how threat actors are leveraging the internet. In each episode, your host AJ Nash engages with various industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding security. Ultimately, the lessons learned will enable security professionals to take an intel-driven, proactive approach to physical and cybersecurity that extends past the perimeter. Let's get started.

This is how legends are made.

Hello and welcome to another episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. I'm your host, AJ Nash. For those who don't know me personally or are first-time listeners, I'm a traditional intelligence guy. I spent about 20 years in the intelligence community, both with the US Air Force and then as a defense contractor. Most of that time was spent at NSA. I've been in the private sector for about 8 years now. I primarily build or help other people build effective intelligence-driven security practices. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I'm also deeply committed to servant leadership, which is why I completed my master's degree in organizational leadership at Gonzaga University. Go Zags! We're having a tough year this year on the courts, but I think they'll pull it out. So listen, the goal of this podcast is to bring all these kind of elements together with some incredible guests like what we have today. And we're going to have some authentic conversations, unfiltered conversations, really debates sometimes. Hell, we might argue with each other about a whole wide range of challenging topics. It's not your typical podcast. This isn't going to be all polished. It's not a bunch of fancy audio and video graphics going through, and it's not a big sales pitch. We're not doing any of that crap. Here, it could be anything. It's going to be really just gritty, right? You might hear or see my dog. She's around here someplace. People might swear here. I know I'm known to, and we might argue, as I've said before, and that's all okay. So think of this podcast as the conversation you might overhear at a bar after a long day at one of the larger cybersecurity conferences that we're all gonna be at here pretty soon. So these are the conversations we usually have when nobody's listening. Now today, my guest is Roman Sanikov. Roman's awesome. He's an expert on all things related to cyber threat intelligence, particularly when it comes to the Cybercriminal Underground. Uh, I've been lucky enough to, to travel a little bit with him and speak on these subjects and actually watch him speak more than anything, and he's just brilliant. So he started his career working at FBI, and then after that moved into the private sector. He's worked with some of the biggest and, you know, most well-known companies in our industry. Right now he's leading his own consulting firm as president of Constellation Cyber LLC, where he helps companies around the world produce and benefit from threat intelligence. Roman, welcome, uh, to the show today. And is there anything I left out that you want to add to your intro?

AJ, thank you so much for having me. This is great. So my goal for today is to find a topic that we vehemently disagree on so we can have an actual argument. And to get that going, I actually had, you know, 3 or 4 beers before this so that, you know, in the spirit of that happy hour after, you know, after DEF CON meetings and stuff like that. So I really got into the mood here and yeah. So hopefully we can find a heated topic that we disagree on. It's probably, it's unlikely because because I know we've spent some time chatting and unfortunately we pretty much agree on most anything. But maybe if we have time, maybe we get into some sort of a sports disagreement or something at the end or something.

We'll figure it out. I'm glad you're gassed up. This unfortunately is non-alcoholic, so I won't be able to catch up. But you know, as anybody who knows me, I'm fiery enough all on my own, so we should be all right. But no, man, I appreciate it. Yeah, maybe we'll find some things that we do disagree on. We'll see as we get in. You know, it hasn't been much yet, but you know, If we do, that's, that's what this is all about. So listen, the title of today's episode is True Stories of the Dark Web. Now listen, that's the kind of title, you know, it's the topic that almost everyone wants to learn more about because, you know, there's all the mysteries surrounding what goes on in all these areas where most people can't see or, or they just can't participate, right? So, but before we get into the real discussion, it occurs to me there's a lot of different terminology here, right? And so there's a lot of possible misconceptions or misunderstandings when we talk about, say, the deep web versus the dark web versus the cybercriminal underground versus, you know, a criminal marketplace. There's all these other terms, right? So as an expert, you know, one of the, one of the measures of an expert is how, how somebody can take something complicated and large and quickly boil it down into something that any dope like myself can understand. So can you help make sure myself, the audience, we're all speaking the same language here on, on deep web, dark web, cybercriminal underground, all these terms, right? What are we talking about, man?

Sure. Before I say that, you gave me the subtitle from the book I'm gonna write, so The title was going to be How Dark is the Dark Web? And the subtitle is going to be True Tales from the Dark Web.

Nice. I'd like your royalty.

So thank you.

You're going to owe me 8%.

Absolutely.

I don't know.

There you go.

I don't know either.

Go ahead, man. So, so yeah, so it's actually a great question. And part of the problem is something that we might actually talk about later is that a lot of times these terms are used partly as marketing. So everybody has their own. Way to describe it, and I know some organizations actually vehemently disagree about what to call this. Essentially, what we're talking about is an area of the web, of the internet, that is difficult to access. So that has barriers to access. So typically, the way we used to define it is it's something that, you know, Google isn't going to analyze, isn't going to scrape. Although even that's not necessarily the case, you know, I've seen posts from, from Exploit and from other major forums commented or reflected on Google searches and things like that. But essentially we're talking about is an area of the internet, an area where individuals communicate relatively openly because there is a barrier to entry. So the barrier could be either financial, meaning you have to pay, or it could be reputational. You have to be vouched in by someone. You have to know someone to gain access to this platform, or in a lot of times, in a lot of cases, both. You have to both know someone and you have to pay. So, but essentially that's kind of what we're talking about. It's something that— barrier to entry.

Got it. All right. So they're sort of closed environments, right? And, and so unless I'm mistaken, you know, they're just in the deep and the dark, you know, is— I mean, it sort of depends on how you look at it, right? There's, there's the open web we all know about. That's that indexable, Googleable web, right? And then people talk about, you know, that's, what was that, 10%, 20% of the web. It's the number always changes depending on which ice structure you want to look at that's in a graphic on somebody's slide, but it's a small fraction, right? And then, then you got the deep and then the dark. If I understand is, is that's where the dangerous stuff is. Like the deep is just stuff that's not easy to get through Google, but it's not necessarily nefarious. It's just, it's just the rest of the web. It's sort of like the radio stations that aren't assigned, but they're out there, right? Uh, for those who are old enough to care about radio anymore.

Well, it could, it could also just be things that are proprietary, things that are part of a corporation, part of some sort of network that again is somehow closed off and things like that. So the dark web typically is what we talk about when we're talking about malicious activity. It's something that the reason I think we call it dark is because it's hiding in the shadows. It specifically wants us as researchers, as law enforcement, as other individuals to not be able to see what they're doing. So I think that's the easiest way to kind of look at it is really something that is purposely hidden from view.

Got it.

Okay.

So this is the place where you can buy or sell pretty much anything when it comes down to it, right? Whether it's products, services, you know, or horrible things, right?

Happens.

Exactly. Got it. All right, cool. So I think we're all on the same page now. Hopefully that makes it easy for people to understand, you know, what we're talking about here. So let's just jump in, man. You've been doing this for a long time. I'm not to be insulting. We're, we're both kind of old at this point. So, you know, experience, right? Seasoned. Those are better words for old, I think. But we've been doing this a while. You've been doing this a lot specifically, which means, you know, you're one of the most knowledgeable people I know on the subject. And you go back a way, and again, not to poke at this case, but things have changed over time. Like somebody who's been doing this a long time, like any environment, you know, just like anything, pick a social media platform, right? We've seen them change over the years. But you've seen all that going on in these spaces, in these deep and dark spaces, right? So, Can you talk a little bit about what have you seen in terms of changes over the last, you know, years, 10 years, decades, and maybe what have you seen that hasn't changed? What are the consistencies when we get into these environments in the deep and the dark web, man?

So I'm going to switch that question around a little bit. I think I'm going to talk about— Sure, why not?

It's not like I wrote it for us or anything. Go ahead.

Haven't changed.

No, go ahead, man.

Switch it around. I'm just going to flip it. Don't get offended. I'm just going to flip it. That's all.

I'll give you the first one. Are we just reversing the order?

Exactly.

That's all right. That's all right.

That's all right.

That's all right.

Cool.

Okay.

Yeah, so I'm gonna focus on what hasn't changed because I think that's kind of fundamental to what the purpose of the dark web is, of this underground, let me just call it that so that we don't offend any companies about the name. So is the reason you have this area is because you have essentially, when you're talking about cybercrime, you're talking about individuals conducting business people who don't know each other, people who have never seen each other most of the time, people who have very little kind of control over each other, each other's actions. And at the same time, they have to trust individuals who are criminals, who are inherently not very trustworthy. That's why there's that saying, you know, no honor among thieves, is they're not very trustworthy. They will rip you off if they can. And essentially the underground provides some sort of a community that allows these threat actors, these individuals, these criminals to have some sort of recourse. So if you're in a community like a forum, like a Telegram channel, like a Discord channel, where there's other individuals, if you do something illicit, if you rip somebody off, if you do something, that will— that has the potential of ruining your reputation with others. So then you will have a harder time conducting business with other individuals, be it selling it, buying it, et cetera. So essentially, I know, I think sometimes for sales purposes, companies will say forums are dead or this or chat is dead or this and that is dead. And I disagree. I think there's always going to be a need for some sort of place. Yes, Threat actors may eventually go to private messaging, but there's a need for this initial area where individuals who don't know each other, who haven't worked together, can come together and have some level of comfort in giving money to someone who's a criminal and think that you're going to get something back from them that somehow resembles what you want. And forums in these places, channels and et cetera, they've created things like escrow services, similar to when you're buying a house or something like that. There's reputational damage. There's all sorts of ways that they've worked out over the years to create that level of trust so that they can work together. Obviously they're working together for a bad cause. But still, you have to look at it from just the operational needs and operational necessities. So I think that's something that's stayed even when people have— when, again, the threat actors, the bad guys, the criminals have moved from, be it from forum to forum, from forum to shop, from shop to Telegram channel to Discord to Jabber to whatever it may be. The idea behind all of this has been the same, that there has to be some way to communicate, to conduct transactions when you're not being able to like literally hand somebody a suitcase or a duffel bag full of cash and receive some drugs right there on the spot in return. So I think that's something that's maintained.

Well, that makes a good, you know, you made a good point there, right? Or a couple of them, actually several, but you know, you talked about, yeah, I know people talk about, hey, they're, you know, this is going to go away, people can go to one-on-one relationships, etc. And I think you're exactly right. There's supposed to be a place to meet, you know. I, I mean, it's, it's sort of like, it's not the world's best example, but sort of like dating. People still go and meet people, you know, they meet at bars. I realize people go to apps now too, but even that's its own community at some level before you meet in the app or whatever. There's still got to be some place where you can come in and meet strangers, right? And then from there you figure out if you can, you know, split off and go to this one-on-one relationship or these small relationships, but there has to be a place to start. Right. You know, and as you said, criminals, not surprisingly, not the most trustworthy group of people or the most trusting group of people. So you, and you don't have a Better Business Bureau, you don't have anybody, you know, to be these middle, middle men and women, this rating. So you have to have something, you know, I know we talked about it before. It's, it's a community for people who aren't good at community, basically. Like, by definition, criminals aren't generally great at being part of society, right? To a point, right? You know, we can go into a lot of detail there, but The fact is they live a little outside the boundaries usually, right? So a community for people who aren't great at community, that's not gonna go away. I agree with you. I think we are seeing more of that move to let's do this quickly and let's move someplace quieter and, and you know, Discord and, and Telegram and those kind of things, right? And there's, there's collections in those areas now too, but there has to be a place to meet. There has to be a place to start. You know, you can't just get on Telegram and find a person necessarily, right? You gotta have a place where you're gonna start. And, and you mentioned Some really important pieces I, that I don't think people think about is, is the other services go with this, like escrow services, you know, like I know there's an appeals process if somebody has a complaint, like there's a whole system to this that has been around for a while, you know, and these reputation pieces, that's a pretty strong infrastructure. So I'm with you in that I think this is still gonna continue to be like that first area that a lot of these criminals come to. So it's nice to hear you say that hasn't really changed much over the years. That seems to be enduring. So what have you seen? I think you were done with what hasn't changed, or you're not, you just tell me, keep going. But what have you seen that have been the big changes in your mind with the trends over the decades that you've been seeing this go on? What have you seen as big changes, man?

I just to follow up on what you said, I agree completely with what you said. It kind of makes me think of those t-shirts that you see, the Anti-Social Social Club. Whenever I see those, that's what I think of is these dark web forums and channels and exactly. But for those who may not know, things Black escrow services are literally where you have a trusted individual on a platform like a forum, and that you go to them and you say, okay, I'm going to conduct the transaction. I'm gonna sell a bunch of credit cards, stolen credit cards to someone else. You know, once they send you the agreed upon amount, you tell me that you have the money. I send the cards to that individual. And then once that individual confirms that they have the cards, they'll let you know, you release the money to me. That's how it works. Again, very similar to when you're buying a house or something like that. And I know that the mechanics are different between things like Telegram channels and Discord channels and things like that, but I think that's more important for the threat intel providers because of how they collect the information, how they scrape the information, how they get access to this information. But for real intel, I don't think it matters that much. I think these are all still that dark web platforms where the communication happens. Getting back to your question, how things have changed is I think that when this started out, the idea behind a lot of these was privacy. A lot of these platforms had very high level of privacy. It was very difficult to get into these platforms. The idea was that everyone was trying to conduct these negotiations, just to conduct their business in the private, away from the eyes of researchers, from law enforcement, et cetera. At some point over the course of the last maybe 6, 7 years, there's been a bit of a shift, and that is, the way I see it, is there's kind of this more open communication between researchers and threat actors. You'll see, when I was at one of the companies that I won't mention right now, but one of the companies, we got into a little bit of heat because we published an interview with a pretty prominent threat actor.

Yep, I remember this.

One of my colleagues that, and I had the fun, the pleasure of actually translating this interview and editing for clarity and helping with some of the questions and stuff like that. And we got some heat because it was seen as we were promoting and kind of making this individual more of a celebrity. I disagree because I think that to me, it seems silly that somehow individuals who would read this interview would somehow think, oh yeah, this guy is 100% correct. It's kind of like, I don't know, listening to the interview with Putin and saying, hmm, you know, maybe this guy isn't the killer. Maybe he's, you know, he's got some good points. Yeah, exactly. I don't think that a lot of people in the industry all of a sudden decided that, you know what, I don't think I'm going to go after these ransomware guys anymore. I think they are just a bunch of good pentesters, et cetera. So I think that that was just kind of this level of animosity that some people in our industry have against these individuals. And it prevents us from kind of opening up our minds and really seeing the world through their eyes, which I think is really key to understanding their motivation, what they're doing, how they're doing it. It's like, you know, really, you need to know the enemy to understand what's going on. And so I think, I'm kind of going off the topic a little bit, but my point is that I think over the course of the last 5, 6 years, there's been like more of this openness. So you're communicating relatively openly. I've been able to ping individuals openly as They know who I am. They know what they do. And I've asked them, I said, hey, you know, I think that this is happening in the cybercriminal, you know, what is your take on this? And, you know, again, not to say that I take everything they say as gospel truth, but—

You can't trust them? Is that where we're back to that again? You can't trust these guys?

Trust but verify.

Trust but verify.

So there you go. Yes. But, but yeah, but I think it is important to, and honestly, they like being listened to. So believe it or not, when they have a bit of a platform and people ask them, I think a lot of times, maybe not, maybe they won't be completely honest about what they're doing specifically, but when you ask them a more general question about trends and about methodologies and TTPs, I found that they're actually fairly open in this collaboration and kind of a Funny twist to that. Back when I used to work with the FBI and when we used to arrest individuals who were engaged in criminal activity and cybercrime, particularly cybercrime, maybe not all criminal activity, but cybercrime, very frequently after we had our kind of sit down and we'd arrest them, go through all of this stuff like that, you know, literally within like a day or two, they'd be like, hey Roman, how do you become an FBI agent? You know, and I would invariably say, well, you kind of start out by not committing felonies.

Right.

That's a really good start. Yeah. But, but it's like they would, a lot of them would cooperate and they would feel like all of a sudden they're part of the team and they're on, you know, Team America or Team, you know, whatever country they had been picked up by. Uh, but, but again, I think that one of the things I've seen, again, this transition is that there is a much more open level of communication between the bad guys and the researchers. And I'm not saying that that's necessarily improved everything because obviously we still have a huge problem with cybercrime and with criminal activity. But I think that if we as researchers, as security professionals are smart We will take that information. We'll incorporate that information. I've listened to a few of your podcasts before, and we will put it into intelligence. We will help make the better decisions for our clients. So I think that's one of the things that's definitely changed is this kind of new level of openness. And I think a lot of that has come out of the fact that a lot of these threat actors realize that a lot of their platforms have been infiltrated by law enforcement, by researchers. And so it's kind of this bit of a cat and mouse thing. And to some extent, it reminds me of, again, when I was working with the FBI, a lot of the work I did contractually was also investigating organized crime. And a lot of times we would monitor these Russian organized crime groups and sometimes it'd be other organized crime as well, not just Russian. But a lot of times they would be hanging out literally in the same bars and restaurants as the cops and the agents and stuff like that. And so they were essentially, they were kind of rubbing elbows. And it reminds me what's happening in the cybercrime now, kind of reminds me of that a little bit, is essentially we're kind of rubbing virtual elbows very frequently with these threat actors.

Well, it's interesting. I, I, this reminds me of something years ago now, but psychological profiles have been done and the psychological profile between a police officer and a criminal are almost identical. Like you can't tell who's who apparently. I'm not a psychiatrist or a psychologist, so if somebody's listening and wants to correct me on all the details, I'm good with that. But as I recall, if you put 'em next to each other, they're essentially the same profile. And it's one of those mysteries of what makes somebody choose one side or the other, right? Because people are very much wired the same in terms of their their, you know, acceptance of risk and, you know, and, and some of the other motivations they have. It's just you end up on one side or the other. So it's not surprising to hear, you know, you mentioned with organized crime, you know, both in the physical world and, and talk about the cyber criminals, it's not, not surprising to hear that they want to mingle and mix.

Mm-hmm.

These are same kinds of people. They're just on the opposite side of, of the discussion. Right. So, but it's interesting. I think the point you made, I remember the presentation years ago when, when there was a presentation and you guys were talking about this specific actor, which Everybody knew who this guy was anyway. It's not like you guys made him famous, but I remember some of that hubbub of, uh, should they have done that or not? You know, these guys want fame and fortune and now you're highlighting this. And it's, it is interesting you mentioned how much that's changed now, cuz that was, oh God, that had to be 7 years ago, I bet, give or take. You know, so it's interesting now that you're saying, yeah, it's just kind of a normal thing, which it is. I've seen, I know researchers that talk with, you know, criminals out there and, and get information. Like you said, they won't rat on themselves, but They'll tell you trends and some interesting stuff. Mm-hmm. Knowing your enemy's really important. You know, it's any way you can find out about them. And you know, so I, I agree with you. I think that's, that's a really interesting point that that's changed a lot. What about specific like TTPs or scams out there? Like, you know, romance scams for instance, or pig butchering or whatever. Like there's a lot of 'em out there. Are these, have you seen an evolution of things? Have, have new things arrived that didn't used to exist or have things just improved over time? Like what have you seen in some specific scams or, or TTPs?

Man, so those, the couple that you mentioned, and I know we've talked about this before, this is something that kind of like breaks my heart because these are some of the earliest scams that I helped work on. One of the very first cyber-related scams or cases I worked on back around 2002 was actually a, so we were working with some Russian law enforcement, uh, MVD individuals, and this is back when We were all sort of on the same side. Yeah, exactly. And kind of this halcyon years for about, about maybe 10 years or so before things went backwards.

Yeah.

I was going to use a slightly more colorful term, but yes. They came to us and they said, look, we've got these 3 individuals in this, you know, fairly large city in the middle of Russia that are scamming people all over the world, like $3,000 or $4,000 at a time, but they've gotten to the to the point where they have about half a million dollars worth of scams that they've, that they've done. And they wanted people to, to submit cases to them. They needed, they need, because all the crimes are committed outside of Russia. And so they needed victims, they needed individuals to, and they had victims from Australia, from Canada, from various states in the United States, Finland, just all over the world. And I remember specifically, again, with the FBI's blessing and through the FBI, but reaching out to some of the law enforcement organizations, regional organizations in Texas and a couple other places where these victims had— were located. And the attitude was really, if they sent, you know, $3,000 to some Natasha, you know, thinking she was going to come over, then, you know, that's, you know, uh, it's on them kind of thing.

No empathy, no sympathy.

No, absolutely not. And in the end, the only country that did file, that submit these was China, from what I recall. But none of the Western countries took it seriously enough. And that's what's heartbreaking is because now, you know, 20 years later, over 20 years later, we have people who are essentially falling for the same scams. The pig butchering scams, almost all the pig butchering scams start with a romantic relationship. There's some sort of, you know, and I can't help but think that had we taken this more seriously 20 years ago, had we done more education 20 years ago, had we had more empathy 20 years ago, then I think there would be a level of maturity in victims, in individuals that would prevent a lot of this from happening. And so, And like I said, that really breaks my heart. In terms of one of the things that has changed is really what we're seeing is a lot of people kind of outside the industry and surprisingly to me, even inside the industry sometimes, people at that clients who we talk to, they still have this image of a hacker from like a 1990s movie or something like that, where it's some usually guy who basically does everything from, you know, hacks in the computer, transfer funds, cashes out funds, goes, you know, to the ATM, grabs the correct funds or whatever, you know, starts— exactly, exactly.

Criminal.

Exactly. And this is something that really hasn't been the case for many, many years now. And it seems like almost every year they're coming up with a new platform, a new way to, you know, ransomware as a service. Before that, there was DDoS as a service, you know, X exploit kits. It's almost kind of like when you think about, I don't know how many of your viewers remember Jack London, but this is a person who went to the Klondike to strike it rich, found no gold, but figured out that he could make it rich by writing stories and by all that kind of stuff. In a lot of these places, the people who are actually making it rich, making a lot of the money, are the ones who are providing the infrastructure. So ransomware, these aren't the individuals who are breaking in and who are literally ransoming you. These are the individuals that are providing it as a service. They created a platform, they created this business model. And the same thing, you know, I worked with one of the first individuals who created malware as a service where they rented malware, which made it so much more difficult for us because before that we could get a sample, we could buy the malware, and then we had control over it. We can reverse it, we have something. And this young man, you know, very smart smart guy who I still keep in touch with. Fortunately, he's on the straight and narrow now and is a productive member of society. But he created the idea that, hey, why would I give something to them? Let me rent it. This way, I still maintain control over it. And it was so much harder for us because we didn't get the samples. We couldn't— so that's something that's changed. And again, now you're seeing fraud as a service. You're seeing all of these as-a-service things. Where people are, where the criminals are really specializing on specific services and really making their money that way, as opposed to, you know, doing the whole soup to nuts and opening themselves up to so much more risk. Right.

Well, yeah. And they piece it out, right? I mean, these, these are smart business people, you know, so if you're in carding, you're not, like you said, you're not, you're not getting the cards. You're not also doing, you're not doing the skimming. You're not doing the fraud work. You're not doing the cash outs. You know, you've got mules do bits and pieces. You're selling pieces around. Like, you're not doing everything because you can specialize. It also, you know, it lowers your exposure. Like, you got little bits and pieces to handle some of that, so the exposure changes. And then you're taking, you know, your fractions off of all of that stuff. So it's— I mean, it's smart business. Listen, these are not dummies, right? I mean, the people in this enterprise are very bright, generally speaking, and savvy business people. They just happen to have a business model that's not legal, but it is really, really effective and efficient. You know, I hear things like half a million dollars in cash, and I think maybe I'm Maybe I'm on the wrong side of the business, but I'm not. Don't worry, don't call the FBI. But I get a little jealous by the money occasionally. But a lot of these guys go down. So, okay, so we've talked a bit about, you know, what you've seen in terms of what didn't change over time, some of the things that have changed and some of the new trends and new, you know, technologies are out there and tactics and techniques like ransomware. Frankly, I've just had, you know, a discussion on ransomware, you know, an episode that just went out actually not too long ago. And we went into detail on, you know, ransomware and double ransomware and triple ransomware and quadruple. So if anybody's listening to this and didn't listen to the episode with Brian Stack from Experian, I recommend you go back and catch that cuz he did a real good deep dive on that as well. You know, it's a very cool piece. But knowing all of that, you know, the next question, you know, is what are people, what are people doing wrong in terms of deep dark web or how are they thinking wrong about the deep and dark web? We have all these misconceptions. Like you said, there's vendors out there that are doing this work. We've got companies that are, in my opinion, foolishly setting up their own efforts to try to do it, which is really dangerous. I, I will say this, you know, for the 80th time probably in my career at this point. First of all, you shouldn't set up your own deep and dark web collections. Don't do it. Don't get out there if you're not a professional and expert. It's a bad idea. I tell people it's sort of like going into a biker bar wearing a suit and tie. Even if you can get in the door, and you probably shouldn't, it's gonna be clear you don't belong. Nobody's gonna really interact with you, and there's a chance you're gonna get hurt.

So I just put a helmet on and some dark sunglasses and you're good, right?

You'll be fine. Fake mustache, you'll be good.

Exactly.

But I always tell people, and I know, you know, people have said it seems self-serving cuz I work in this industry, you know, on the vendor side. But listen, I worked at a bank before and I said the same thing. Don't set this stuff up yourself. Mm-hmm. There are certain things you always want to outsource. And I would say deep and dark web is one of those things that you just want to outsource. The, the time, the effort, the energy, the risk, it's, it's just not worth trying to do yourself. But anyway, The question was for you, not for me. What are people doing wrong in terms of deep and dark web, or what are their misconceptions when it comes to these spaces?

Man, so there's a lot of things that, you know, how many hours do we have? So one of the things that I'll just touch on really quickly, because I already kind of mentioned it earlier, I think we as an industry have a little bit kind of too much of this us versus them mentality. You know, they're all scumbags and they're all horrible and they're all evil. Which may be the case. I wouldn't— I would say that probably not all of them are scumbags, but a good percentage of them are people of low moral values. But that doesn't mean that we shouldn't interact with them, that we shouldn't listen to them when they say things, that we shouldn't try to see things through their eyes. And that's something that I think a lot of times there is a lack of. I think a lot of times there's too adversarial a relationship there's kind of, you know, I mean, I'm sure you've seen like, my job is punching bad guys in the nose kind of thing. And it's funny, you know, it's good marketing. But when you really, you know, again, I laugh at that. That's cool. You know, I want to do that too. But when you take that too seriously and when that's really your attitude, then you're, I think you're closing yourself off from a lot of valuable intelligence and from really understanding. I think the way I got into this, I was actually a translator and interpreter for many years working with the FBI as a contractor. And it turned out that I was able to understand the criminal element, first organized crime and then it's cybercrime, all these things, because I was able to kind of, again, I'm not saying I'm a specialist. There's a lot of people who are. Are wonderful at this. But I think my approach was, why are they doing this? How is it, you know? And so I think that really helped, whereas a lot of people are like, these guys are just, you know, take them out to the woodshed and stuff like that. In the long run, that doesn't help us understand, and that doesn't help us stop them, and that doesn't help us. So I think that's one of the things that we as an industry frequently get wrong. I can go into a lot more detail on that, especially around things like ransomware, where I've gotten into some heated discussions with some people. But the other thing that also drives me nuts that I've come across recently is, you know, talking to client companies, and, you know, I've heard some people say this, that, you know, they're going to people and they're like, well, we don't really care about the initial access. We don't really care about credentials. We don't really care about this stuff. We know that they're going to get in. We need to stop them once they get in. We need to. And it blows my mind. And it's kind of like, you know, we just saw the Super Bowl. And to me, like, the analogy is kind of like, all right, it's like giving the other team the ball on the 50-yard line, because chances are they're probably going to cross the 50-yard line sooner or later anyway. You know, most, even when they don't make, even when they don't get a touchdown or a field goal, most of the time they at least cross the 50-yard line. So then why don't we just give them the ball at the 50 and focus on stopping them during that last, you know, that drive and stuff like that? That's essentially what we're saying. What we're saying, well, we don't care about the initial access. And my argument is, if you're really focused on ransomware, you're too late. Oh, exactly. Because you should be focused on that initial access, on trying to stop them. Them from coming in. And it's not easy. I know credentials and all that stuff, but you can't, you know, intel is important.

What it sounds like organizations that are saying, they might be saying, we don't care. I'm going to tell you my translation of that is they've just given up. They can't do it. So they've changed the message. We don't want to say we failed. So we'll just say, well, we don't care about that. We're not gonna worry about that. We're worried about it here. But you're waving the white flag. Listen, you know, We're in security business, we're in intel business. It would be like saying, I don't care if you break in my front door, I assume everybody's coming in the house. I'm just going to try to keep you from stealing my television. No, I'm actually going to try to keep you from getting in the front door. I've got a lock on the door. I've got a camera. I've got alarms. I've got dogs.

I'm going to try and keep you from getting in the door.

Like you may get to the door, but I'm going to make that hard first. And then if you get in, I've got, you know, defense in depth and all that, you know, people talk about, right? It sounds to me like people have just changed that conversation to say, well, we're not going to worry about that. It's because they've given up because they can't stop it, so they've given up, which is a weak position to take.

Absolutely. I think, and partly maybe it's our fault or maybe it's the marketing fault because, you know, everybody's talking about it's not if you get breached, it's when. But the thing is that you're not just going to get breached one time. It's not like, it's not like if anybody ever saw the movie The World According to Garp where, you know, they buy a house and the plane crashes into it and Garp says, you know what, we should buy it anyway because it's kind of, it's disaster proof. You know, it's already— yeah. So if that's not the case with cybercrime, I've talked to several companies this year that got popped by ransomware multiple times. So it's not like, okay, we got breached. All right, now we don't have to worry about that ever again.

No, it's the opposite. This isn't lightning striking.

Criminals learn, right?

If I breach you and it works, I'm going to come back. I'm going to keep coming back until you prove I can't get in the door. Like, if you broke into my house, like, you know, using that same analogy, the door open, you come in, you steal my stuff. You're gonna come back.

You already know you can get in the door.

Like, why wouldn't you come back until I either run out of things to steal or I lock the door? Like, and you know, I put an alarm up and I, I, I, you know, do some other things from a security standpoint. Why wouldn't a criminal continue to come in? Criminals care about success. They, they care about whatever they wanna do. They wanna succeed at, they want to, they wanna steal the thing, they wanna cash out. You know, they care about success, care about not getting caught, and they care about, you know, value. And, and they're like water. They look for the path of least resistance. If you're not gonna provide resistance, as you said to them, 50-yard line, well, yeah, I'll take the ball there. I got a better chance of getting through. So, you know, it's, it's interesting because I hadn't thought about it, but yeah, I— there are some folks who've just kind of given up on stopping these things, which is— it's sad. And you're right, we've all said you're gonna get breached eventually. It's true. We got to make sure they understand everybody gets breached. It doesn't mean you don't stop trying to get from getting breached, because if you stop, you're gonna get breached a hell of a lot more. You know, this isn't binary, you know, have been or haven't been. You're all gonna be, but are you gonna be breached once or 138 times? Like, you still have to try to keep them out at the door. So I think that's interesting you mention it. You know, the other one that comes to mind, I'm gonna steal some of this a little bit because I know we talked a little about it, is the organization say, ah, we don't care who did it. Drives me crazy.

What do you mean you don't care who did it?

Ah, we don't care who did it, we just wanna stop it. Well, if you don't care who did it, you're gonna have a real hard time because you don't know what their motives were. You don't know how to stop it necessarily. You don't know where they're going now that they're in your org. You don't know if they're gonna come back. Like, I Attribution matters. It's not— you can do things without attribution. You absolutely want to stop the bleeding immediately. But I think it's much more important than people seem to think. But what are you seeing? Are you seeing the same thing when we talk about attribution?

I saw a really great presentation recently about like recovery after a ransomware event. And I agreed with the vast majority of what the individual said. It was wonderful. But the one thing that again just made me jump out of my chair is he was very adamant about he doesn't care about attribution. You know, don't like throw that at me. I'm dealing with— well, you, if you don't know who did it and what you don't know, I mean, they walked out, they didn't just lock your systems, they walked out with a lot of your data, a ton of your data, and you don't know where that data went and you don't know what's going to happen with that data. And that's actually like, not to plug my company, but that's actually my next project that I'm working on now. Is specifically tracking the leaked data, a lot of these extortion sites, and looking at, like, the secondary and tertiary victims who don't know that they've been impacted by this because it is so important because you need to know, is this a nation-state actor? Am I liable to be a victim of intellectual property theft as a result? Are my plans now being discussed at some company that's an adversary in a foreign place? At a hostile power? Is this a hacktivist? Is this some crazy individual? We've seen individuals shooting up power plants. Is this something that is going to impact my physical security? So you can't just silo and say, you know what? All I care about is getting the systems back up, getting things running, getting my shit back up again. Excuse my language.

No, no, we swear all the time here. Don't worry about it.

You need to— You need to have the background. You need to incorporate that as well because you need to deal with that. And that actually goes to one of the other things that you and I have talked about is sharing information within the industry. I understand it. I don't know how to deal with this. Honestly, I don't. I'm not a lawyer. I don't play one on TV. But the advice to most victims of breaches is Unless it's PII, where you have to provide that information by law, provide as little information as possible. We've been impacted by an incident. Well, what does that mean? What does that mean to your suppliers? What does that mean to your affiliates? What does that mean? So what's been breached? And there isn't that sharing of information. And I've seen, and I'm sure you've seen as well, a lot of companies that are impacted, again, not to toot my own horn, but that's why I'm working on this new project is to specifically allow for these other entities to understand what of their data is now out there as a result of this breach because I think it's so critically important. We're kind of sometimes sticking our head in the sand and saying, well, these are bad guys. They're throwing it up on bad guy channels. And but just because we're not looking at doesn't mean that the initial access brokers aren't looking at, doesn't mean that all these other individuals aren't looking at all of your data and now using it as a vector to go, to go after you or your, again, your clients, your affiliates, et cetera. And I think that's one of the other things that the industry or we as in general have to figure out a better way. To share that information, to figure out a way to— and maybe they'll kill my project and my company if we do that effectively, but I'm willing to take that chance.

Nobody's done it yet, so you're probably safe.

I'm hoping that we get to the point where we figure out a way to share the information. Hey, listen, somebody broke into my house and stole this data or stole these documents. And by the way, they happen to have you know, that contract that you and I signed about this, whatever. And so basically now they have all of your information about your activities and all that kind of stuff. So somebody all of a sudden starts to, you know, come to you about this type of stuff. Just remember that this is now out there in criminal hands. So we need to figure out a way to disperse that information. Right.

Well, like you said, we have a PII, right? So, you know, if your PII is compromised, I don't know about you, I've had letters from so many companies, hey, you know, we're going to give you this free tracking of your credit, you know, because we screwed up and all your stuff's been stolen. So many times more than I count, right? But at least I get notified. Oh, okay. I got to watch my credit a little bit. See if somebody's using my information, see if somebody's stealing my ID because with PII, they were required to tell us and we all know this, right? And other things they keep quiet. I know I used to work in finance and, you know, this is what the ISACs were designed in part to do was, you know, they're sharing organizations. If a bank gets breached, we should all get on a call. We should, you know, they should be able to share, here's everything we know, here's the TTPs, here's what they've taken, here's what we think their motives are, here's what we think it is. So everybody else can batten down the hatches and get ahead. So it doesn't become a series of events, but then the lawyers get involved. None of that happens. And again, I'm with you. I'm not blaming lawyers. I, they got a job to do. It's, you know, where's the line between being transparent and, and taking on risk and how it's gonna work. But ultimately you end up having what would be, to put it in, in physical criminal terms, a murderer. Becomes a serial killer because nobody mentioned the murder, and then the next one, and the next one, and nobody's sharing the information. There's a pattern here, it turns out. And so this, this same person goes on murdering, in this case, just, you know, robbing banks digitally because people didn't share the information. So it becomes one after another after another. Great win for the criminals. Or you run into it, you— hell, we see the same thing with, with, you know, if you talk about pig butchering, for that matter, you go back to that even.

That's more personal.

But people don't want to share because they're ashamed, right? So you, you have the risk factors with lawyers, you know, and all those things that go with it from a business standpoint. But also people don't often share because they're ashamed. And that can even happen in business too, where some executive got breached, they don't want to tell anybody. I know you've seen it, I have too, ransomware where they sideline it, pay it off themselves because they don't want anybody to know about it. They just want to get their laptop back. And it never goes well, by the way, for anybody wondering. If you get compromised, if you're going to go grab yourself some Bitcoin and think you're going to solve it yourself, chances are pretty good you're not. I'm sure it's not within your company policy, so you're probably going to make things a lot worse. You're just going to pay off somebody who probably doesn't give you your stuff back anyway. So if you get had, just go talk to your security people immediately and just, you know, this is what happened and try to deal with it. Don't, don't go buying crypto and trying to solve it yourself. It doesn't go well. So anyway, yeah, I think that's all interesting stuff. And again, you talked about the attribution piece. I wonder if that isn't again, just like the whole, ah, we don't care about breach. If it isn't just that people have said they've just given up, it's hard. Attribution's really hard. So maybe instead of saying we can't do it or it's hard, it's just, ah, we don't want it. It's kind of almost a sour grapes. We don't want that anyway. Or maybe it's a matter of, and I'm curious what your thoughts are here on just prioritization. We can only do so many things in a day. We've just accepted these are too hard to get done. So we're just going to say we're not going to worry about it. Important or not, we're just going to punt it because I don't have the time or the energy or the money to fix it. Even though, as you said, it's going to cause all these other problems by not really knowing who did this and what their motives are and what the likelihood of return is and what they're likely to do with the things they've stolen. It's, it's critical. It's very valuable, but organizations just move quickly and say, well, that's just too hard. It would take a lot of energy and a lot of time and money to try to figure it out. So I wonder if they're just punting because it's just hard and they just say, well, we're not going to do it.

I think sometimes it's because they don't know how to use threat intelligence effectively. And maybe partly it's our own fault because we don't present it in the proper way. I don't know. But I think a lot of times, because again, good threat intelligence can save you time. It's not just a cost center. So instead of getting spun up. I mean, most companies still get some sort of alerting about various incidents that may impact them. So good threat intelligence will help you figure out, okay, is this threat actor— if we're talking about attribution— is this threat actor likely to do this? Does this threat actor have the capability to do this? Is this someone who's just some random Joe Schmo that most likely isn't selling a zero-day to, you know, an Apple product for $5,000, you know. So essentially, it's a good way to actually get rid of a lot of the noise. People frequently think of intelligence as noise, as additional stuff that I have to worry about. But again, good threat intelligence or properly tuned threat intelligence actually helps you figure out what to focus on and what to ignore and make that calculated decision And then defended that decision because sometimes you'll get it wrong sometimes. But if you can say, hey, look, based on these criteria, I decided to give this less attention. And, you know, and chances are your leadership is going to be okay. You know, they didn't screw up just because they were lazy. They had some sort of a factor why they didn't focus on this, et cetera.

So yeah, you've got a methodology for scoring risk essentially, right? And so you can figure out which things, because again, nobody has enough time or energy or money to do everything. Nobody has enough people, so you gotta be able to prioritize. But I'm with you. I tell people a lot of times, Intel, it's, you know, tell 'em what happened, tell 'em what they can do about it, or tell 'em what happened, tell 'em why it's important, tell 'em what they can do about it, right? Those are the three, the three things. But also one of the things I say is that Intel, we're the only ones that can tell 'em not to worry about it, or at least with some level of confidence. You know, I, I know when I first went to the private sector, my first gig was at a bank and I learned very quickly little differences between the government space and the private sector is people really freaked out about almost everything that was in the news right away, it seemed like. And context was an issue. And early on, you know, you're learning this stuff and you got, you know, CISOs and they come down and they're just, you know, freaking out and they want to know everything about everything and everything's, you know, everything's on fire. But getting to the point where you could say, hey boss, you really don't have to worry about this. And here's why. Like, I know the headline said that, but really this is actually not a new thing. This has been around for years. It's a minor variation. Or this is, this is an organization that's not going to attack us. They'd never attack a bank ever. This is not their motivations or whatever they are. Right. Helping the C-level or the CISOs say, okay, I don't have to worry about this. Great. Cause I only got 612 other things I got to worry about. So that one I can take off my plate.

Sure, Winston.

Yes. So I mean, it's nice to be able to take one away, right? And Intel can be really good at that with some level of confidence. This doesn't have to be your top thing today, boss. It might be tomorrow. We'll talk again, I'm sure. But being able to tell them this isn't the thing, right? And so I think that's really important. And like you said, you know, that does come from some of this attribution component, which is, which is really, really challenging. So again, the show was really about like, you know, stories from the deep and dark web, right? We haven't even gotten into the really cool stories. We talked a little bit here and there, but you've been doing this a long time, man. So I keep saying that, I keep picking on you. I'm probably older, but the best part I think of all these discussions is the really cool stories, right? So what do you have, man? What do you have that's just, you know, I'm sure you got a couple of things without, naming names or shaming anybody, of course, uh, you know, whether it's customers or, or employers or whatever, but do you have some very cool stories or some myths you wanna bust? You know, can I honestly hire, you know, somebody to murder somebody on the dark web? Can I buy, you know, can I buy human beings on the dark web or kidneys? You know, are there myths you wanna bust or stories you wanna share? What do you got that's really the cool stuff people are gonna walk away going, holy cow, that's amazing.

So as you've pointed out several times, I've been doing this for quite some time. So I have a large, library to choose from. So I'm just going to give you a few teasers because, you know, these things can, can, you know, go on for quite some time. But one of the things that I remember being really fun was, man, this is probably around 10 years ago, maybe a little bit more. There was a really big case in, in the New York office and other offices called Aching Mules. And you can actually look it up. There was actually a CNBC special on this where some of my friends were interviewed. Of FBI agents. And but the way, one of the ways this started was actually 3 young ladies from Kazakhstan came into the New York office of the FBI. And because they had their, they were J-1 students, they were here and they were kind of taken advantage of. Some guys got them to do some illegal things, open bank accounts and stuff like that. And They were really freaked out and their boyfriends told them, you're stupid, you're gonna go to jail, you know, blah, blah, blah. Mm-hmm. So they came and they kind of gave themselves up and they were, you know, and this was actually kind of how this case started. And they came to the office on, on a Saturday. You know, New York office is one of the biggest FBI offices in the US or in the world.

Mm-hmm.

And the aid, the, the kind of intake agents downstairs, they had no idea what to do with these people.. And so they called the Russian squad, and one of my friends who's not a cyber guy, but was an interpreter on the Russian squad, he took down some of the notes and he's like, I, you know, the Russian organized crime squad has no idea what to do with people, you know, opening bank accounts and stuff like that. That's not what they usually deal with. And so this stuff kind of got to my desk and I wound up looking through this. I'm like, holy crap, they're talking about You know, literally driving with somebody who's got a laptop open, this older woman who was like, I think she owned a flower shop and she was transferring funds live from various victim accounts to this business account and then having this money transferred to these young ladies' bank accounts as though they were employees and stuff like that. And it wound up being actually a really big case that spun, spanned several years and there was eventually. A really big arrest where over 20 people were arrested at the same time across several different states. And it was really big. But one of the ways that it started out was actually just these young ladies coming in, and it totally, you know, kind of by accident, it came across my desk. And then I went to the supervisor of the Cyber Crime Squad. I said, dude, this is our purview. This is, you know, us. And it took a little while to convince him. He's, he's actually a friend of mine as well. But finally he's like, all right, yeah, you're right. This does seem like there's some cybercriminal activity involved here. And again, it wound up being, there was like millions of dollars.

3 million.

Yeah.

I'm cheating. You told me what it was. I looked it up. It's, it's for those who wanna look up the full story on this one, by the way, it's September of 2010. Uh, I think it's all broke out. It's 37Mules, $3 million. Very interesting story. The, the actual indictment is out there. If you, if you actually Google aching mules, that comes up and some interesting names there in the, in the Southern District at the time, but also Wired has a good article on it. I'm sneaking a peek here. It's the advantage of doing this live and having a bunch of computers. So yeah, $3 million, 37 people, 21 separate cases. Lots of Russian names is all the list of them here. Yeah. Long list of Russian names, basically ages anywhere from 21 to 26. Well, there's one 29. 9-year-old in the group. So really interesting stuff, man. And, uh, that must have been just really wild to work on. And this is 2010, so this is a while ago. I mean, you're talking— not to make fun of you and age, this isn't about that anymore— but 14 years ago, you know, when you said they didn't know what to do, right? This was not a common thing yet. And this is, this is pretty new still comparatively. So like, that's some of the early days, and that's a pretty sophisticated ring. That's awesome stuff.

So one other case, just really quick. So going back to my organized crime squad, those of you who are actually looking at this on YouTube or something, you see that I've got my golden locks hanging down. I was involved in a case where I was interpreting for a Russian organized crime investigation. And part of the case was we had, I was working out of the Albany office of New York at the time, going to school up there. And we had this Russian, for lack of a better word, a head of a criminal family. And we invited him, we were trying to get him to do some criminal activity. We, the FBI essentially, were trying to get him to do some criminal activity there that they could monitor and arrest, et cetera, and break up the gang. Mm-hmm. And so I went up to this very fancy schmancy resort in northern New York called Saranac Lake, I believe it was.

Mm-hmm.

And again, like really expensive with very kind of a lot of hoi polloi people. And we, this was up kind of in the Adirondacks or just outside the Adirondacks. So the reception there wasn't great. And we were, we had to monitor the cooperating witness who was there hosting this, this bad guy because the cooperating witness at the time had, I think, a million-dollar bounty on his head. He had been arrested. He was being, he was kind of one of these accountants for Russian organized crime groups. And so we have to make sure that he was going to be safe. And so what I was doing is I was walking around with this, back then we had to have a suitcase. The silver suitcase that the receiver— and so I was listening to everything that he was saying and the bad guy was saying to know that he's not taking him out to the woods and doing something horrible to him, like in one of these Russian gangster movies. And at one point we lost him and we lost the guys and we're— it's a fairly big resort and we're running around trying to find where are they, you know, want to make sure that they didn't take him out to the woodshed, right? And I come around the corner and I'm face to face with these guys and I've got one of those like big earpieces coming outta my ear, you know, very inconspicuous, kind of like one of those old-fashioned Secret Service agents with like wires hanging and all that.

Please tell me you had to pretend you were deaf or something, right?

Maybe there's a hearing aid. No, I, I, I took my hair down. Oh yeah, sure. I took my hair down. Perfect. And they, and it covered it and it covered it really well. And so I wound up sitting down and listening, and the guy had— everybody there is wearing like white and very Hamptons kind of thing. And this guy's there in these little tiny shorts and topless, and he's got his huge sun tattooed all on his back. And you know, again, just like something out of Eastern Promises or something like that. And so I'm sitting behind him and just kind of like listening to make sure. But, but yeah, so that's where, you know, when fun time where my, uh, Mike Moff helped, uh, the FBI case and made sure that this guy wasn't, the cooperating witness wasn't harmed. So we have a really fun case.

That's awesome. I didn't think about, sure, the hair makes perfect sense. And again, for those who aren't watching, if you're just listening, which is perfectly fine, cuz with me you're much better to listen than to watch me, I promise. But if you're not and you get on YouTube, you can see, you know, Roman's got some pretty great hair. And yeah, it probably would do a really good job of covering that up. So That's brilliant. Let your head out. Listen, you got one more story, man. I know you, I know you have a lot. You got one more? We got time. Come on.

You got one more?

Okay. So, so, so another one that was really fun. I'll try to make this quick. No, you're good, man.

Don't worry about it.

One time I actually got to go to Russia and with a victim of a cybercrime. This was one of the very first cybercriminal cases that I ever worked on. Those again, this was back around 2001 and I got to go to The Russians actually arrested the individual who had hacked into this institution, and the institution was actually provided— so the Russian law enforcement and the court invited them to come testify to the losses, and they actually did, which the bank is no longer around. They've been bought several times over. I still won't mention, but it was really cool. The problem was that the case was in late November. In Siberia. So we flew to this place and, and the, the MVD guys in Moscow were making fun of us saying that, you know, like the air, the airport would like drop us off the airplane and then the reindeer would pick us up and take us through there. And so that wasn't the case. The town we went to was actually a fairly, you know, it was good. It's kind of little Houston because that's where all the Russian oil and gas companies were based at the time. So we had a really, you know, they They treated us amazingly. We went to, we testified in court. I got special permission because theoretically you're only allowed to interpret in court, in Russian court, if you are a citizen. But the judge gave me dispensation since I'm not a Russian citizen, but because we wanted to limit the number of people who knew about this, the victim wanted to limit. And the, you know, but after all the testifying and everything, the Russian cops, they, they took us to this dacha, this, this bathhouse, and which was way out there. And they drove us through these snowy roads and there was a lot of drinking. There was some, some young ladies there who they introduced as, as secretaries, although I don't think that's what they were.

They weren't taking any shorthand.

No, they, they weren't.

A lot of typing going on.

Yeah. They were, they were spending a lot of time in, in the, in the, the banya with the, with the various individuals and stuff like that. But I just remember them, you know, the cops driving us, getting like incredibly drunk and driving us at very high speed back along very snowy, icy roads. And myself and the representative of the victim institution sitting in the back, you know, kind of between these young ladies and thinking to myself, man, you know, if I crash. And this stuff is, you know, somehow gets into the news later, then, you know, it's going to be very difficult to explain this. So, so yeah, that was a funny story. Fortunately, everything was safe and nobody's, at least from the American side, nobody's honor was compromised in this case. But it was a very interesting situation, kind of surreal. My co— the victim, he had a special sat phone and he goes, he's looking at it. He's like, the sat phone is saying, where the fuck are you? You know, just, that's so far out. That's not a good voice. So they're able to pick up anything.

So yeah, it's, I'm picturing the Rocky movie where he has to go to Russia to fight Ivan Drago. I'm just picturing that. That was Siberia, right? And just, you know, the cars, the old Mercedes and the, you know, the heavy snow and not being able to get anywhere. I'm just picturing that except exactly. Apparently everyone was drunk.

In this case too.

Exactly. They should have had a movie that's probably more realistic. So, but I, I'm assuming you didn't knock out Ivan Drago at the end of this or anything. You didn't win a big fight and turn Gorbachev onto our side and all that.

I guess this was not that. My liver survived and I, yes, I'm, I'm good.

Nice. All right, listen, so we always close out the show with the same question for everybody, and this has been my most fun part of the show usually. In this case, your stories, I think, are more fun. But that being said, The name of the show is Unspoken Security. So with that in mind, tell me something you have never told anyone before, something that's been unspoken so far.

So this is, this is kind of embarrassing.

Oh, I like it. Rough to a good start.

It's, it's probably something that a lot of people feel, and I think actually some of your other guests have, have mentioned something similar, but I am just really amazed that anyone knows who the hell I am. I am very flattered because I don't know if you want to call it imposter syndrome or what it is. But, you know, in my mind, I'm still some 25-year-old kid who just got out of college and is trying to figure out what the hell he wants to be when he grows up. And so when people come to me and say, oh, I read this work of yours, or I heard this interview with you, or, you know, One young man who's brilliant once talked to me and actually called me legend, and I almost fell off the chair because I was just like, I mean, and I'm not gonna pretend false modesty. I went down, ran to my wife, and I was like, told her. Yeah, somebody called me legend. Exactly. And so it was really cool, but I've had, like, I frequently just feel like a, you know, depending on your age, you'll get this either Zelig or Forrest Gump. But that I find myself in these instances, like I've literally been standing between the former director of the FBI, Robert Mueller, and the current and former head of the FSB, Evgeny Prigozhin, and Patrushev in the Spasahaus, which is the residence of the ambassador of the US in Moscow. And I was interpreting between them, these, and really in this close proximity and just literally standing with them. And afterwards, as we were leaving, the ambassador actually pulled me aside and told me I did a great job. And I was just like, I thought I was going to pass out. But that's, you know, it's one of those things where for any of you out there who experiences imposter syndrome, everybody does. I'm, you know, as AJ mentioned, I'm in my 50s and I've been working in intelligence since I was in my early 20s. And I still feel like I'm just some kid who's trying to figure it out. And so don't be embarrassed if you feel that way. You can succeed if you try, you know, you work hard and you don't have to feel like you've got everything and all the answers and stuff like that. But I don't think I've ever actually said the extent of how frequently kind of unsure and stunned I am by these various things and sometimes have to kind of like do a little tap dance when people come to me with questions. But, you know, that's where research comes in and being a curious person comes in. So yeah, that's my, that's my kind of unspoken.

Well, and I love that, man. And I appreciate it. I'm sure a lot of people will because listen, it does come up occasionally, right? And it probably will continue to as I do this. I've been told that people with imposter syndrome, like it's a sign that you're probably both good at what you do and humble, right? People, listen, narcissists don't have imposter syndrome. It's not an issue for them, right? You know, it's the opposite of Dunning-Kruger. There's plenty of Dunning-Kruger. There's plenty of people out there who think they're great at everything and they aren't really good at much of anything. And they don't even know it because they're so out of touch. They don't even know they're not good at things, right? So I have been told people with imposter syndrome generally are high-functioning performers, but they're also just humble and they don't see it, right? Or they're so good at what they do, they don't realize how hard it is for other people to do. That's what people have told me before. Cause I, I, I suffer the same thing. I don't know why anybody listens to anything I have to say about virtually anything at all, frankly. And when people ask for my advice, I keep looking around trying to figure out who they really mean. But I also recognize, yeah, but I also recognize there's things I've had people say, you know, yeah, you did a great job. I'm like, yeah, but it wasn't hard. And they're like, no, it wasn't hard for you. And I have to remember that we all have our own skills, right? There's things I can't do that you can do amazingly. Differently. I'm sure. Well, I know for a fact, in fact. I'm sure there's some things I do that I find afterwards, I'm like, it wasn't that hard. And they're like, no, I couldn't do that. And we don't realize that about ourselves. I don't think, you know, a lot of people in this industry and it's really prevalent in our industry. I think even more so than others of just, we don't realize that we do things differently than somebody else might do it. Might be faster, might be better, whatever it is, you find your niche. And that, I think that's the key, right? If you find where you're supposed to be and you're you're good at that thing and it just comes sort of easy. I mean, it's work, but it fits, right? I think that's when we get into this track, right? If you're constantly struggling and fighting to do something because it's just not your nature and you're in a bad fit or whatever, you never really worry about it too much. You don't have imposter syndrome because you're barely getting through as it is, right? And when it gets kind of where it's just, it's a good fit, you know, I've had plenty of things where I get done and people give me accolades for whatever the thing is I did. And I'm like, geez, I kind of feel guilty about it because I think if you knew how little work that to do that thing, you wouldn't be so proud of me anymore. But it's, you know, it's all relative. So, but I think it's a great message. I think I appreciate you sharing it. I'm sure a lot of people will because yeah, you are a legend, dude.

You've been in this, you've been doing this, as I said, a long time.

I keep telling that to you, but, but you've done amazing things. Like you could tell stories. We could have you for hours. We could go on and on. Your stories are awesome. You, you've, your knowledge is amazing. I've been lucky enough to, to present with you and to, and to see you present separately as well. And you are a legend. It's true. But it's hard to see when you're in that, you know, when you're in those shoes sometimes, I think so. And I think it's a good message for people to know no matter where they are, you know, if it's somebody you're just getting into the industry or if you've been doing it, you know, as long as we have or longer and you have these feelings, just everybody does, man. I don't know anybody who's really good at this stuff who doesn't have that feeling. Cuz again, if they don't, they're probably just a narcissist and I don't spend a lot of time with those guys. So like if you, if you're doubting whether you belong. Just keep driving through. Like, you probably do. And especially if other people think so. I've gotten to the point where I look around, I'm like, they think I'm doing a good job, I guess I must be. Because I, I've long ago given up on thinking I'm doing a good job.

So, but anyway, well, just to, to final comment on what you said, I think a lot of times, you know, like one of my favorite sayings is like, you, um, can tell the worth of an individual by their friends. And so Like whenever I'm feeling a little bit kind of, you know, a little down or a little unsure of myself, I look around and I go, I've got some kick-ass friends. I've got some really great people that I can call on when I need help with something. My network has some amazing individuals in it. And I'm so proud of that. And that says, you know what? I trust their judgment enough to say that I must be doing something right, you know, because otherwise What the hell would they be doing? You know, like picking up the phone. Like I, you know, I've reached out to CEOs who I really respect and they'll respond to me. And these are individuals who are like way more powerful, more successful and wealthier than I am. And so, and again, not to say that, you know, it's all about CEOs. There's this wonderful junior analyst who I reach out to who I'm like, oh, this is awesome that this person is willing to help me. Answer this question. But I think that's something that also, you know, trust yourself when you have other individuals whose opinion you respect, trust you, and see value in you. That says a lot about your capabilities.

Yeah, no, I agree. That's a really good point. I mean, I often joke, you know, when you're on or somebody else, whoever's, you know, I don't know why this person hangs out with me. I don't know why they're friends with me. They just haven't done a better job of picking their friends. But, you know, putting that joke aside, you're right. There's lots of people I know that I'm like, all right, this is a pretty good group and they seem to think all right of me. So like, it is a reflection at some point, right? If so many impressive people are willing to pick up the phone, are willing to take time, you know, prioritize you, you're important enough to them that they value your, you know, opinion or input or whatever it might be. Yeah, it's a reflection. At some point you got to accept, hey, I guess we're doing okay, right?. But I also like having this, like a little humility is good. So I don't know if I'd ever want to get to the point where I thought I was good at anything. I'm good enough apparently to get by on some things. And I think I'm comfortable with that because nobody wants to hang out with the asshole who thinks he's good at everything. You know, nobody likes those people. So, all right, listen, man, this has been great. I really appreciate you coming on. You've done an amazing job. Awesome stories. You know, we could, we probably have you on again at some point because I know you have a bunch more of them too. I really appreciate you taking the time to be here, Roman. It's been a lot of fun. I can't thank you enough for it, man. I'm going to wrap it up here. For everybody listening, please, if you like the show, you know, like it, download it, subscribe, tell your friends and neighbors, you know, get on the highest mountain and scream about it, whatever it is, right? And if you don't like it, then just shut up and don't tell anybody. No, it's fine. Tell me if you don't like it too. We'll see what we do to make it better.

But next time I'm coming out to Minnesota and we'll be in the same location. It'll be like one of those again. Like sports things where we'll be sitting there with cool mics and talking to each other in person. So that'll be—

that'll be cool. Come on out and do it. Or maybe we'll do it on site at one of the locations. I mean, we do conferences, but yeah, anytime, man. I'd love to have you back on. So listen, that's going to wrap it up for this one. Again, for everybody out there, thank you very much. This has been another episode of Unspoken Security. And until next time, you know, be safe and we'll talk to you again soon.

Thank you.

That's a wrap for this episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.

This is how legends are made.