Unspoken Security Ep 57: AI, Deepfakes, & the New Ransomware Playbook

we can actually do something here and we can make a big difference here. And so that conversion took me a little while. And I say that because I think it's really important for organizations to think about too, because I think there's a lot of people that's like, oh, it's just a criminal.

Yeah.

It's just fraud. Right. Or there's so much fraud. Like we can't even get like local police offices to like, they don't care, be able to handle it because it's just too much. Or like an FBI is getting 3,000 tips a day on it. They can't like, right. They can't do that. There's only so many people.

Yeah.

And so to me, like, I haven't talked about that as much as I could, but it's important to say because organizations need to know that too. Like, it's not just these large existential threats that you're thinking about. It's a lot of different tiny threats. Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place. Place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. Been doing intel a long time. I'm an old guy now. I got about 20 years in the government space. Well, 19. Counterterrorism, counterinsurgency, trafficking persons, chase war criminals. Been in the private sector about 10 years focused on intelligence-driven security practices, building security programs, consulting, doing all this thought leadership type stuff. Today, as you might notice, different location. Because I'm live from RSAC Conference here in San Francisco. Very excited to be here. It's a very cool conference. We're gonna do a lot of fun stuff today. And it starts for me right now today because we have an awesome guest. So Cynthia Kyser, she's the SVP of Halcyon's Ransomware Research Center. She spearheads their threat research program and public-private partnerships dedicated to ending cyber isolationism. Joining Halcyon, Cynthia was Deputy Assistant Director of the FBI Cyber Division. So she's served in two presidential administrations as a member of the Cyber Safety Review Board. She's also been named a top cyber executive by the Cyber Guild, by FedScoop, by CyberScoop, by WashingtonExec, by GovCIO, and I'll throw in by Unspoken Security. Why not? We'll just add one more credential, right? Anything you want to add to that resume?

No, I'm excited to be here and I am excited to learn from you because you have a lot more time in industry than I do. I'm only 9 months, like a baby in industry.

So it's a fun transition for sure.

It's been a great transition. Well, I'll be happy to talk about that.

With you. We won't do it today because they want to camp out, but we can definitely do that today. You're a better guest than I probably deserve, so I'll try to make the most of your time while you're here. So the interesting thing that we're going to talk about today is we talk about ransomware, right? And ransomware, it's an industrial business at this point, right? I mean, this is not kids, you know, script kiddies. This is not a minor affair, right? So I want to jump right into that. Tell me, we'll do a little background for those who don't know. Like, let's talk about the history of ransomware. Can you kind of run us through where we've been and where we're going at this point?

Yeah, I'm going to start a little earlier, right? Because ransomware has been around since 1989 when I think a bi— I think it's a biologist created some kind of snail mail campaign that encrypted, you know, a bunch of researchers' data and demanded money in return. Yeah, so, you know, it started there, but there was a money problem. Like, how do you actually take money in an anonymous way where law enforcement can't track you? So then you fast forward to like 2010, so 2013-ish, And you have the introduction of Bitcoin. So as Bitcoin's been introduced, this is a little bit more of an anonymous way in which the actors can actually obtain information and so— or obtain money. And so a, you know, one variant starts becoming multiple variants and it really kicks off. So you see that, that's kind of that 2013 period, like you're going, you're going, you're going. 2019, 2020, the actors say, "I can do more than encryption. I can actually steal data too, and I can hold that for ransom as well." Is that the double ransomware? That is, that's double extortion. Double extortion, got it. Yeah, yeah. And now even you see triple extortion, right? Where they're like calling CEOs, threatening to brick their houses, or they're DDoSing groups.

They're also calling customers, right?

Aren't they? They've called patients at hospitals.

Unbelievable.

It's crazy.

Yeah.

So, you know, in the backdrop of all this is this professionalization in the underground, and, uh, you have almost what's an entire business model behind them. We get a glimpse of that in about 2022 when Conti is— you see these leaks come out of all of their chats, and it basically looks like a small tech company.

They have HR support, they've got these, you know, they've got good customer support to help you.

They would love to help you pay.

Yeah, they are really good at that. Better customer support than most companies I've worked with.

Yeah, it's right. And so you kind of get this glimmer of, hey, this isn't just a bunch of people in their basements, you know, on a computer. Like, they've really figured out how to make this an industry behind the scenes. And I think some of the people even doing this in other countries, they think of it as their job. They're not even thinking about those ugly ramifications that we see on our end.

Sure. Yeah, it's unbelievable when you see how far it's come. You know, like you said, you know, from ransomware, I mean, I didn't know it goes all the way back to '89, so that's a great story, obviously. But you know, the double ransomware or the double extortion, the triple extortion, and like you said, these are professional criminals, right? I mean, anybody could do it. I guess I could pick up as a hobby, I could be a ransomware criminal, I suppose. It's not hard to do. The tools are readily available now, would appear.

You just go and you get a kit, say you wanna target someone, then you go to a different part of the underground and you get passwords, usernames, you buy 'em from those people. They're called initial access brokers, right?

Sure.

And you can just put it all together. I mean, yeah, you're gonna have a high success rate, you and me? Yeah, maybe not. But like, I don't need a lot though.

You don't need a lot.

If you go from zero to 10, that's pretty good.

I mean, how much money are we talking about in ransomware?

Oh goodness.

I mean, hundreds of billions? Millions?

It's interesting. I don't think I, I'd have to look at the numbers that come out for 2025, but let's take 2023 to 2024. In 2023, it was over a billion, but then when you got to 2024, Chainalysis puts out these reports and they're tracking this across the ecosystem. So across the blockchain, they're looking at this, it actually went down by over 30%. Between 2023 and 2024. Yeah, of course I like to attribute that to some of the FBI's actions. I, yeah, but I, I really think that's true. I think what happened is you had FBI doing a lot of these operations where they took down these really big groups. It had huge market shares, the nefarious activities that were going on. And then when they all broke up, they got into these smaller groups. They're a little more closed off, makes them a little more durable to law enforcement disruption. However, It also means they're not getting the benefit of the full marketplace of technical skills. So they have to go after smaller victims.

Not whales, just fish.

Yes. And so it's funny, attack percentage went up that same year. But what's happening, you're going after a dentist office and it's $10,000. So you have this—

You gotta make it up in volume then. You gotta have more targets, more attacks, right?

You do, you do. But I think it's this pendulum. You saw that breakup. Of a lot of these big groups throughout, you know, 2024. But then I think you probably by the end of last year, we were seeing a lot more consolidation around big groups like Shein, Akira, Play.

So it's, it's actually like being in tech. I know you said you're relatively new to the private sector. You're going to see the same thing in tech. You have all these little companies and then there's consumption. Big companies buy them up and then a whole bunch of other new little companies come out. It's the same thing we see in tech.

What a great analogy. I like that.

Yeah, you'll see the same things here. And a lot of in tech, a lot of it's tied to budget, obviously. People don't want to manage so many vendors, so they consume things together and then they want to, you know, have more innovation and want to pay less. They get a bunch of little people and then it all cuts over. So the FBI is less involved in that one. Hopefully that's the—

I think so.

But it's interesting to see if that pattern is going to hold. That'll be interesting to watch. So when we talk about the past, obviously, right? What's changed over the last 5 to 10 years? I mean, have we seen major leaps forward in their technical capabilities and their TTPs? What's been the change?

Absolutely. I mean, right now I think it's really hard to see where cybercrime ends and state sophisticated actor activity begins. And some of that's because it's really convenient for nation-state actors to use cybercriminal tactics. It allows them to obscure what they're doing, give them strategic ambiguity. And you might also just have nation-state actors who are like, I can make money in my evenings doing this activity.

Moonlighting, yeah.

Right, exactly. So it's really difficult to even tell the difference. These criminal groups are very sophisticated. And part of that's because they just had experience and they've had time. And part of it's because they're almost— they actually are almost the startups.

Oh, yeah.

Just the entire cyber threat world, because they can innovate fast, try. It doesn't matter if they fail, right? They can keep going. And so you really see some of these tactics at the forefront of the criminal groups. And let me give you a good example. Speed. Just even in the last 2 years, attacks have gone from, we maybe thought like, oh, we had weeks, right? They got on, wait, and then they initialize their attack. We had this dwell time, right? Time to detect them. Now we're seeing attacks in under a day. And actually we'll be having some research from Halcyon come out. We've seen one of the major groups, Akira, be able to conduct attacks in less than an hour.

So most of the processes that we have in the SOC that are not going to catch that. I mean, they're not set up to do things that fast.

So you have to have automation to be able to set that up. I mean, imagine most of these are also happening after hours, right? So it's not going to happen at 10:00 in the morning when all the folks are coffeed up and ready to go, right? It's going to happen at 8 PM at night. And so it's really difficult. And this is part of this overall industrialization, though, because not only do we see Akira getting really fast, but we see them putting a ton of effort into developing decryptors, which is like the key to the lock, right? And that's what they give out to victims when you pay the ransom. Now, in most cases, those decryptors, I mean, criminals don't put a ton of effort into fixing things that they've like, right? They're going to put a lot of effort into breaking. I know you're shocked.

They're not working out for us, huh?

Yeah. Can't trust you. But, but, but Akira wants your trust. They want you to know that if you pay their ransom, you will get a functioning decryptor. They're actually putting more effort into those so they get a reputation and they get more—

yeah, if you have a reputation, somebody who doesn't actually give you back the data anyway, why would I pay you, right? And, and I have heard that. I was gonna ask— that was one of the questions I was going to ask. I've heard that there are plenty of these cases where people pay and nothing comes back to them.

Absolutely.

Find out they aren't capable. They've encrypted, they don't know how to decrypt, they're just going to take your money anyway. So it's interesting that you're saying a group has figured out, hey, we're gonna actually have to build a better reputation so people pay us Everybody knows paying us is— you're not gonna get your stuff back anyway, then your business model's just completely broken then.

That's right. So Hellsand, we'd also put out— it's really fun to be in this position now to like be on the forefront of like really new threats and getting ahead of them. One of them was a group called Sakari. They'd obviously used AI in an ugly way, AI, right? Like AI, like each step and then like tried to like ugly chain it together. I'm not gonna go into all of it, but what they forgot to do is create something called a master key. And let me explain this. Let me explain this, right? You need 3 things for ransomware to work, right? You need a lock, you need to encrypt it, you need a key, you need to be able to decrypt it. Then you need, I mean, they call it a master key, really it's like a hole. Like it's that hole that you're gonna put the key in, right? They forgot to build that.

So they've got a lock and a key, but they can't use the key.

So you might as well set your money on fire. Yeah, yeah. I mean, like you're never gonna be able to get it. It's interesting, at the beginning of the Iran conflict, we saw this group go out, say, I know our stuff doesn't work, but go encrypt everything anyways. So they knew.

It's destructive at that point.

It's destructionware. Yeah.

So they're not trying to make money and they know, they know they're just trying to cause harm, which, you know, big shock.

Right.

They're bad guys. Right. That's kind of the point.

Yeah. I would call it like a mixture of like criminals, AI edition and content, right?

But that's, so when we talked about, you mentioned a couple of these groups, right? Where— who's most prevalent? Is it by, you know, by nation and criminal organization? Is it Russians? Is it Eastern Europeans? Is it Europe? Is it Asia? Is it everywhere? Like, what are the most prominent groups and their origin?

We typically say Russian-speaking, and that means that they are probably mostly in Russia, but they may be in, you know, former kind of Soviet bloc countries. The reason we know this is the ransomware is actually created in a way so that it will not encrypt. If they find that Cyrillic is the primary language on a computer. So that's a big tell.

That is a tell. They read the computer settings to figure out what your primary language is. And if it's Cyrillic, then it has to be the primary though, right? It should be a secondary language.

I can't load Cyrillic. I don't know that. Um, but yeah, it's really interesting. And I think that's why I was actually really excited when the latest executive order on cybercrime came out from the White House because it talked about actually holding the states allowing these actors to be in their country, like holding them accountable, which is huge if we can get it done.

Right.

Huge. Because you know, the Russians know, right? Whether it's their FSB they went to school with or, you know, the intelligence service, right? Like, like guys they went to school with. It just strategically, they, Russians would want our network security to be the worst.

Of course.

Right? They want chaos. They don't have to say, go attack. ACME Corporation on this day to say, you're fine, go have fun, right? And it meets their strategic interests. And like, we should hold that accountable, right?

Yeah, I mean, we've known for a long time the Russian government and the criminal enterprise there have a relationship. I mean, it's been understood that if— as long as you don't do harm domestically in Russia, and as long as you're willing to do whatever the government asks if they tap you on the shoulder, you're pretty much good to go. You break one of those two rules, you fall out of a window. I mean, that's kind of a known thing, right? But I'm also thinking, I don't know if you've seen this, so I'm asking a question when I ask. China and North Korea is money motivated as a country, right? They're almost, the country is a criminal enterprise in and of itself. So I'm curious if you've seen a lot of that in the ransomware space since it's so profitable. And then you mentioned moonlighting earlier, and I know I've seen some of this in the past where some Chinese military have been known to moonlight other things. Is that also including ransomware?

So a little bit. And in China in particular, we saw ransomware deployed right after an espionage operation last summer. So a Chinese state-sponsored espionage operation had been compromising on-premise SharePoint servers. Well, right before it was about to be disclosed publicly, a bunch of ransomware went—

I'm sure it's Chinese.

I'm sure, I'm sure, right? We got a hold of a sample. Our team looked at it and they're like, this is professional grade, right? This is professional. This is not what a new criminal group that we'd never heard of before, how they would've developed. This is how a state would've developed. Now, Does that mean it was the state? Does it mean it was people who used to work like with the state or moonlighting? Those answers, you know, hopefully the intelligence community does, but I can tell you it was Chinese state-aligned or state-tied. And I think that's important. There's less in China, but there is Chinese ransomware. Oh, you see ransomware from Iran. That's where you see the moonlighting in a big way. So people in their free times going out, and as long as they don't go to— they don't do it too bad, right? As long as you don't go after targets that like really bring the heat, you're going to be fine to put a blind eye towards it. You have a lot of contractors. But I also— it was interesting because when we were at the FBI, we found that especially if you're a contractor or like someone slightly tied to the regime, if we were able to name you, to put out sanctions against you— hey, there's a $10 million reward from State Department if it leads to your arrest— most Iran aren't moonlighting so that they can stay in Iran forever.

Yeah, the goal is to escape, right?

Right. So that was actually a big deterrent. We found that especially that naming, it really helped deter these kind of quasi-state, like half-aligned-to-the-state actors. And that was an interesting evolution. Our mindset on, okay, let's do things that make sense and things that are effective. Let's go after them. We see Iran. You asked about North Korea though. Al-Flag, we, FBI put out, has done indictments against North Korea for conducting ransomware attacks. Some of it was against hospitals, which is a whole—

Yeah, it used to be off limits and then suddenly it wasn't anymore.

It's awful, right? If you ask Cynthia Kaiser, it's terrorism. And it is. But what we've actually seen from North Korea is, yeah, you sometimes see that occasionally, but they've put a lot more effort into those IT workers and the crypto thefts. And the crypto thefts have allowed them really to have, like, get bigger payouts. So it's not that we don't see ransomware from North Korea. We do. I would also say it might just be— looks like more kind of like funding their own activities, not like— that's not their main profit driver.

Well, I know you mentioned the crypto exchanges. I know they've been very big on hitting crypto exchanges. I think they're the world leader in that, I suppose.

They stole over $1 billion in one heist.

Yeah, it's pretty incredible.

It's crazy. I mean, I think that buys a lot in North Korea.

$1 billion? Oh yeah, it buys a lot everywhere. I'm pretty sure it still buys a lot here. Even in San Francisco, it buys, you know, a good house.

I was like, maybe, right? Maybe a duplex.

Right. So when we talk about how things have moved forward in the technology. You talked a little bit, I want to dig a little deeper, AI component, right? You talked about how poorly it could be used, right? And people can stitch things together. It's clearly AI stitched to AI, vibe coding. You don't really know what you're doing. You get a mess. But where are adversaries using AI well? I mean, what are you seeing as far as speeding them up? Is it giving them better hooks? Getting them better technology? What are they doing with AI?

Well, it's a lot easier to lie with AI.

Oh yeah, that's true.

So we see it primarily deployed in initial access. That means in a lot more and more convincing phishing emails, the just deluge of these phishing emails that are coming into them.

Yep. Deepfakes.

So by that I mean both synthetic video and synthetic voice. That's harder because security professionals like us, we know not to click on a weird link in an email you aren't expecting, right?

I mean, I don't know any Nigerian princes, that kind of a thing.

But if you get a call from your CEO says to get on this, I'm— get on this other call right now, I'm sending you a link.

Right. Or you get on a call and they get you on a Zoom and you look right at somebody who's supposed to be the person you think they are.

Exactly. Exactly. And it can end up giving them access. We saw Scattered Spider, which is that more Western-based ransomware group. Over the summer, they were using deepfakes to do some of their help desk, like, right, impersonate employees. A lot of times those employees weren't in the office at the time. They're on vacation.

Sure.

And they're impersonating these employees to get their help desk resets, like activate multifactor authentication, registrations for themselves. So it's a problem. And this is where AI can really help these actors. There's the rapid exploitation of vulnerabilities. Once a vulnerability is known—

So fast, like you said, right? Hour or less.

Right.

So it used to be days. They don't have that time anymore.

Right.

Which is interesting.

I think you also see the adversaries, they're using it to make their code, like to check their code, to make them a little more efficient.

Sure.

And a lot of the business processes we see, what I would say is mostly in initial access, you have these discrete tasks that they're doing. They're not creating this whole orchestrated campaign because they're really effective the way they are now. They, they're not going to take some agentic orchestrated campaign— has a much lower success rate than what they're doing now— and start using it. That's the purview of wannabes. Doesn't mean they won't get there. It doesn't mean as you play with the technology, that's how you experiment, right? And you get better and then you can integrate. But we're not there yet. The one thing I'd flag that really worries me, report from November where they came out there, they had an AI orchestrated Chinese espionage campaign. Yep. We can talk on that, Anujam. But what was really interesting is the actors were using AI once they were on a network to identify high value information and then take it off the network in small amounts.

So it wasn't detected.

So it doesn't get detected with our normal detection.

That's right.

That stuff worries me.

Yeah. Well, it's interesting. You made two points in there. You made many, but two that come to mind that that show the professionalization. One, if they're going to do this, you know, deepfake impersonating somebody, oh, they're on vacation at the time. Well, that says they did recon first. That wasn't accidental. They weren't lucky enough to know that this person was on vacation, which means they're, they're either getting into their systems first to get that information or they're at social media. They all, that person probably posted on social somewhere. I'm going to Hawaii for the week or whatever it was, right? They're doing their recon first. So it's still traditional intel process to get here. Right. And then as you said, when you're getting in there, using the tools to know exactly what to look for. They also understand how our tools work to detect things. Small exfiltration that looks like it should be normal activity because it's tied to an authenticated user. You know, oh, this person should be grabbing these things. This would be normal for them to move these files around because our systems are set up. You can't alert every file that moves everywhere. We'd be inundated.

We'd be overwhelmed.

So that's interesting because that shows to me that level of professionalization. These are not amateurs. These people have done their research. They know their background. They know their target. They know our technologies. I mean, I guess it brings up the tough questions. What's next? How do we, how do we fix that? What do we do about it? How are we gonna get better?

So I still actually really believe that AI, benefits of AI are weighted towards cybersecurity. What I mean by that?

Yeah.

Right now, the way in which you can deploy kind of behavioral detection and really look, see like what looks weird be happening on my network. There's a lot of cool tools now that weren't available even a few years ago. So it's kind of a fun time, right? To be in industry. Be able to see those tools. One of the things I'm really excited about too is being able to have almost self-healing hardware, self-healing software where you identify the vulnerability and it's fixed rapidly, that they can't be exploited. And we don't have to have all of us humans who make mistakes. Like, I don't want to be in that loop. There's a lot of good reasons AI, human in the loop, but for that one, like, I'd love for us all to be out of that, right?

And just have— Zero day, as soon as it's reported, you can say, hey, you know, AI, go fix this thing.

Exactly.

Have it be constantly monitoring and make these changes faster than humans good so we can get ahead, as you were saying.

But we're going to have like a decade of legacy hardware, software that's going to be more vulnerable too. So, you know, it's good, it's bad, but I think that element is really important. But really, cyber hygiene, like the basics, like identity, good, like, right, harden your identity, rapid patch, like patching of vulnerabilities. You want to have also though, like resilient, I'd say detection, but it's like detection when it's on your system, like assume breach, Yep. Assume someone's going to get in. So how do you quickly identify and then in an autonomous way, right, actually contain and stop them from getting further? We can't, you can't stop every attack from happening on your network. And you just have to have that mindset.

Yeah. Well, I agree. I mean, it's, like I said, I did a lot of counterterrorism work in the past. You're not going to stop every attack. Goal is to stop it all, but you're not going to, right? So you also have to have compensating controls. Same thing here as we try to understand what happens and I think, I think you're right. And the technology to help us see things faster and adapt faster and respond because we, there's no way to do it manually, right? The systems just aren't built for that. The processes aren't built for that. If the adversary is going to use AI and going to be able to turn a zero-day into an exploit that they've actually taken action on within an hour, do that with people. So it's going to take the tech. I think it's also interesting. So you'd said when we opened, you mentioned, you know, you're new to the private sector, right? How long were you FBI again?

20 years.

20 years, right? Okay. I chuckle a little bit because I think you're right, by the way, before I I say this, but when you start talking about, you know, basic hygiene, etc., been saying it for a decade out here and you know how bored people get when they hear it, but keep saying it. They're like, stop telling me to, you know, passwords and two-factor authentication. I said, well, start doing it and I'll stop telling you. I've been saying the same thing for a decade because it's still true. People don't do the basics. They're going to come to places like this and they're getting very excited about all these amazing technologies, right? And they're very cool. And AI and agentic AI and all these things. And they won't do the most basic things still of just, you know, two-factor authentication, you know, password, you know, complicated passwords, right? It's amazing, you know, how the simple things keep getting missed or ignored because they're boring. Talk about them, but they're not going to be, there's not going to be a booth here this week that's going to talk about two-factor authentication probably. I wouldn't think so. A booth here talks about, hey, let me teach you how to have a complicated password, right? They're not, selling that. So I'm glad you're saying it, especially I've been out of the government now long enough, and I wonder, all right, what's new? What have I missed? You know, when I came out to the private sector, I was, okay, let me bring everything I know, whatever that is, and help people. And it's good to find out that still there are brilliant people like you coming out and saying some very cool things that are new, but also saying a lot of the same things we've been saying for so long, because it's still some of the same problems.

It is. I do wonder sometimes if we haven't come up with some of the right solutions to help. I think especially in the operational technology realm, where we say, oh, just patch your vulnerabilities. Some of this OT equipment, it can cause this cascading failure effects. And I'm not sure we've had the right nuanced conversations around that to really help some of these OT operators get back and figure out how to patch in a way that helps them. But like, look at Iran. I mean, Iran is going to target unpatched OT.

Oh yeah, betta.

Part of this conflict. The FBI just warned last fall, they were already like looking at that back in the Gaza conflict. They were targeting you, they ended up targeting US and Israeli, you know, water infrastructure. I mean, this happens because they want to get onto something and then lie about it, right? More. But you see how vulnerable still some of our most critical infrastructure is because there isn't patching, because there isn't two-factor, because there's shared admin passwords.

Some of the biggest breaches are still misconfigured S3 buckets, you know, in cloud. You're like, yep, and it happened, right? And as you mentioned with Iran, I mean, they have a history, right? Going back, I mean, they've taken shots at the infrastructure before, they've taken shots at the banking system. If you want to go back, you know, 15 years or so, it's public knowledge. Reasonably sure now. It is.

So it's good. It is.

I'm over here talking like, I'm pretty sure I'm not saying anything I'm gonna get in trouble for. But yeah, I mean, this is what they do. And I mean, let's say it's a metric warfare. Those are the things they have available for them. Right. So that's causing much harm. So you're right. It's, and we're going to see this. So I'm going to ask one question, this one, but it comes up because of that. So one of the other things I noticed in the private sector, and you will, is that people don't emphasize or focus enough on the geopolitical aspects when we talk about intelligence-driven security, right? It's, it's very technical, very tactical. Makes sense. There's a lot of numbers to go with it. I can, you know, a lot of ways of, you know, showing value, etc. And it's very hard to consume the geopolitical and the bigger picture things. But it matters, right? Put more sanctions on North Korea. The North Koreans are going to do things in response to generate revenue. If we attack Iran, the Iranians are going to do things in response to cause harm and try to deter, right? As somebody who's relatively new to the private sector, Do you have any ideas on how we're going to help people understand how much the big picture matters? Because this isn't actionable, right? A lot of big picture on day one isn't actionable. So people keep ignoring it. It's all actionable, actionable. I'd be curious, and you don't have to solve this, by the way. It's a trick question because nobody's solved it yet. But if you, I'd be curious what your thoughts on how you're doing it at Halcyon, how you're going to tell other people how to take a look at this big picture and have this influence where you're planning and what you're expecting to see.

So I think we keep cybersecurity and IT—

Mm-hmm.

Even found this at the FBI, by the way, like the executives, especially early on with cyber, they're like, oh, I guess like, right, we're gonna let the nerds do it.

The geeks are all in the corner. Right, right, right.

It wasn't that they didn't understand, like they didn't know it was an issue, they just didn't understand the technology. So it becomes easier to be like, I can focus on these things I know.

Right.

And so I think that happens in a lot of corporations that you have these IT teams and like, they got security, that's what they're in charge of, I'm just gonna go over here.

Yep.

Misunderstanding of the larger risk to business if something happens. I actually think the Iran conflict's a great way to talk about this because the advice I've been giving companies over the last few weeks is, what I want you to do today is get out your incident response plan and make sure your marketing or PR teams have seen it, thought about it, and know what your public stance will be compromised. Because Iran often lies, right? They do something, they get onto something, they're going to come out and be like, hey, look at all the things we did, look at this massive attack we did. And I mean, like, because they're points to sow chaos, uh, and it points to a message internally too, right? So they— more likely than not, they're going to go out publicly and lie about it.

Sure.

So have you involved the people who are responsible for managing your public business risk. And so I think having those kind of conversations a little more tactical, not like this, like larger, you should really think about geopolitics. That's pretty, that seems pretty thin.

It is. Yeah.

But if you can talk through like, these actors go out in public and lie, have you involved your PR? Have you thought about your mark, your public risk? If someone, if they just compromised like this one HMI OT machine over here, but they're gonna go out and say the entire water infrastructure is compromised.

That's an interesting idea. I haven't, I don't think I've actually heard that one before either. I think that's a good idea because when you talk about business risk, you said business risk and you're right on, obviously, in the private sector, to be honest, that if you can't tie it to business risk, nobody cares. So like, nope, it's just a reality. But I think it's interesting because you made a point I hadn't thought about before, which is helping them understand, hey, you can tie this to the PR component and the messaging, how you mitigate a lot of business risk, not tank when something happens. If you can say, hey, it's not what they said it was, here's all the research that shows it, here's all the data. They said it was all this, it was really just this. We weren't really compromised. It was a third party was compromised and they got some data, or this wasn't a new dump, a data dump of a new leak. This is actually recycled stuff from long ago. Your messaging to your corporate messaging folks, the more you can mitigate that business risk, that damage. That's a really interesting way of looking at it. I haven't pitched that to anybody before. Well, now, because I've been the dummy for the last decade. You got to know all these big things for all these reasons. They're like, I don't have time to know all this. And I'm just going, no, but you have to. And I haven't had a very compelling story, frankly. So I think that might be a better story to tell about here's how you can action it because actionable matters. And now you're talking about taking actions that can actually prevent things.

And I think it's just important to really contextualize. And we don't tell stories enough in the cyber field. We talk on technology.

Yes.

This thing in this IT context, and that's all important for certain audiences, but people remember stories. They remember like, oh, this is what Iran did this time. And I'd like add something to that is I think a lot of organizations don't understand on ransomware, that if you pay, you aren't automatically decrypted, right? It's not magic. It's like you're still going to be down for a few weeks. It's like these are clunky. You may not get back all your data. You're known as somebody who pays.

So you're on a list.

So you're much more likely to get hit again.

Yeah. It's been the government's position, right? Don't pay ransomware. That's been the FBI's position officially. I know the government position officially forever is, and I'll be honest, it's been my position to people too. I said, unless it's life or death, I get it. The hospital situations, there are times when I understand it. But I've said if you pay, you're just going to get hit again. What you're doing is creating more problems for yourself. People who don't pay don't get hit again. Like, not often, at least I wouldn't think. It doesn't make a lot of sense because you're notorious for not paying. So have really strong backups, have the ability to account for this happening, endure it so you don't have it come back to you again. But it's hard. It's a hard sell for people, especially when they're— they know if they can pay it, keep it quiet, you know, their stock will stay up. There's a whole lot of other valuation components. And so you see, like when the Vegas casinos were hit, Right. The two major casinos, right? Mm-hmm. Two different positions. One paid, one didn't. And then you got to watch the fallout of that. And you realize, by the way, casinos apparently print money. I had no idea how much revenue a casino can make in a day. But you end up seeing that business discussion of should we have paid, should we not have paid? But I, I, I tend to be one of those people who still says don't pay. Yeah.

It, it's so hard, right? Hard to make that business decision. I will say I've seen a major corporation pay and then the group leaked the data anyways, cuz they just made a mistake and they're not professionals.

Yeah. Oh, sure.

But I understand, I understand that business decision, but I think what organizations and C-suites need to know is that this isn't a feelings-based conversation where we're like, hey, we really feel like they'll attack you more.

Like, no, they will.

There's numbers behind that. You will get hit much more likely again.

Yeah, that's a good point. It's data-driven. Again, in our industry matters.

People want to know data.

You're right, feels don't matter. Show me data, overwhelming data in some cases if necessary, to say If you do this, this will happen. It's your choice. Just understand you will see this again. Will you be better prepared next time, or are you just going to keep paying criminals to give you back the stuff that you should already own? Mm-hmm. Which is a problem, obviously. Listen, I can talk to you all day. This is, this is, I know you have a busy calendar.

Yeah.

They're going to kick us outta here eventually. But, so I'm gonna, I'm gonna wrap up now. As you, the name of the show is Unspoken Security, and with that in mind, I ask every guest the same question. Tell me something you've ever told anybody before, something that's been unspoken until now.

So I'm gonna say something I haven't spoken a lot about before, which is I was a late convert to thinking ransomware was a huge problem.

Oh, really?

Yeah. So most of my career, I spent my career as a North Korean analyst for a lot, missiles, counter-intel, all that stuff. And came into cyber, really cared about it. I was on the nation-state side, right? Russia, China, North Korea, Iran. And I was like, this is the existential threat. And like, as the cybercrime stuff starts coming up, I'm like, yeah. But I mean, like, they're not like trying to attack our way of life. They're just trying to steal money. Right. Like, and you know, for a lot, probably longer than I should have really put it in that bucket. And I think I really started to see, you saw Colonial Pipeline come where you're like, oh yeah, this could have like, and like that wasn't even on the OT side.

Right.

But it had, and like, I started to see these implications and as I looked at it, I was like, oh gosh. But what affects Main Street is ransomware.

Yep.

You know, yeah, like we can say, like, I'm worried about China. I'm worried about them lying in wait on our infrastructure and all of that.

Yeah.

But what's really a problem to like our parents, our kids, businesses in our town, it's ransomware, it's cybercrime, it's financial fraud. They're stealing a generation of wealth. And I'm a little embarrassed at thinking like, gosh, before I was really thinking like, let's like, this is what I really need to focus on. China, Russia, right? All of this. Now I'm like, gosh, like we can actually do something here and we can make a big difference here. And so that conversion took me a little while. And I say that because I think it's really important for organizations to think about too, because I think there's a lot of people that's like, oh, it's just a criminal. It's just fraud. Right? Or there's so much fraud, like we can't even get like local police officers to like, they don't care, be able to handle it because it's just too much. Or like an FBI is getting 3,000 tips a day on it. They can't like, right? They can't do that. There's only so many people.

Yeah.

And so to me, like, I haven't talked about that as much as I could, but it's important to say because organizations need to know that too. Like it's not just these large existential threats that you're thinking about.

Yeah.

It's a lot of different tiny threats and they're what's gonna really affect all of us.

Sure.

Like including attacks against our critical infrastructure that might feel financial to the criminal, but things like attacks against a hospital where patients die.

Exactly. Right.

So yeah, that's my kind of unspoken or little spoken thoughts.

I think it's, so first, you, you had no reason to be embarrassed. I think a lot of that is governmental. I, I, I was the same. So when I came outta the government space, again, a lot of counterterrorism, et cetera. I was lucky enough, my first gig was actually in a financial institution. So a lot of fraud, a lot of criminal activity, obviously where we focus on. I started seeing it as you were talking about the same kind of things. It's a much bigger deal. 'Cause I was, I was very nation state, right? Counterterrorism, et cetera. And crime existed, but like you, I was like, oh, it's crime. I mean, criminals are always gonna be, that's how it works. Crime's crime. Somebody will fight that. I started seeing the same thing you were, and I was like, no, this is a bigger issue. It causes more harm on a daily basis to the average American. Now the nation state has— it's got that big bang effect, right? Nothing will happen. Nothing will happen. Then a nuclear drop. I mean, we have to always worry about the really, really bad things, right? But it's a death by a million cuts with the criminals every day. All the money that gets bled out of people, the elderly, you know, the vulnerable, obviously a little bit worse off, but everybody really can get hit. Doesn't matter who you are, right? I agree with you. And because there is that overlap, as you said, it can be, it can be financial and still become detrimental to, you know, the infrastructure because they're a bit of both. You know, they attack a water system. 'cause you wanna get money out of, you know, whoever the company is providing it. Nobody's got water, right? You attack a hospital, as you said, and people die. So I think you're right. I think myself also, last, I don't know, 5, 7 years, something like that. I worry almost exclusively about criminal activity now. Now also, to be fair, on the private sector, we don't see the nation state the same way either. I had to get used to, and you will, if you haven't already, get used to not having access to everything I had access to before. Which is also one of those complicated things of, I think I know what might be happening here, but I can't ask anybody any more questions I would, because I used to be in that room and now I don't have that opportunity anymore, which is a bit of a challenge. We have some sharing agreements with the government, but they're not, you know, it's not the same, right? I appreciate that. I think that's a good message to share to people that, hey, this is a bigger deal. Realize it's not just crime. You can't just write it off. It affects everyone. It's massive. And as you pointed out, these are professionals who are continuing to get better. Faster. This isn't going away. Ransomware is a huge problem. Next time I'll have you come back, we'll talk about business email compromise.

Oh, listen.

Which is my pet favorite topic to talk about.

Oh my goodness. I mean, something that like, right, gets shuttled around, who's gonna work it because it's not as complex.

10 times more damage.

Right.

We're teasing that one. I haven't done any of that show planned, anybody, so don't get excited. I'll see if she'll make time to come back. I would definitely do it. But thank you very much for taking the time here on the first day of RSA conference. I know it's very, very busy. I appreciate you taking time to meet with me. I definitely would come back to talk about BEC or pretty much anything. And if anybody wants any more information, they can reach out to you, I assume, at Halcyon. You must have an email address, something like that.

Oh yeah. So you can always go to halcyon.ai. You can go to the research tab and see all the research coming out of the research center, or you can contact us at ransomwareresearchcenter@halcyon.ai.

Very cool.

All right.

Well, listen, I'm going to go ahead and wrap it up and get out of the way for other people. Thank you again. I appreciate you being here.

It's been great being here.

Thank you, everybody who's been watching and listening. If you like the show, please tell people about it. Subscribe, all those things. If you don't like the show, shut up. I don't want to know. No, I say that every time. The truth is I do want to know. Help us make it better because the show's really about people out there and it's about guests like Cynthia. It has nothing to do with me. So I appreciate you all taking the time to be here. That in mind, we're going to have a great RSAC conference and we're going to wrap it up. So this has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time. Legends are made.