Unspoken Security Ep 58: Stolen Credentials, Fake Hires, and the New Insider Threat

Over 90% of breaches are enabled by preventable gaps. It's something we talk about in the report. And there's a flip side to that, is that despite the speed, despite the scale of these attacks, there's room for optimism. Because if 90% of them are preventable, that means security is solvable.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place. Including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry. Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. Spent about 19 years in the intelligence community, mostly NSA. Been building and maturing intelligence programs in the private sector for 11 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University, and I continue to deeply be deeply committed to servant leadership. So this podcast brings all of these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not your typical polished podcast. My dogs do make occasional appearances. Just heard one outside the door. Let's hope we don't get one today. People argue and debate here. We even swear sometimes. That's all okay. I need you to think of this podcast as a conversation you'd hear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. Now today, I have a really special guest. I'm joined by Dan O'Day. He's Senior Consulting Director with Unit 42 by Palo Alto Networks, specializing in digital forensics and incident response. Now, if that sounds confusing for anybody, just think of Dan as a cyber firefighter, digital arson, arson investigator. When he isn't uncovering the truth from a sea of the ones and zeros we all look through, he's normally found with a head buried in one of his books. And I can assure you, That door behind him, that closet is full of them. I just saw them. Or he'll be sipping on a mug of coffee or tea or maybe the occasional beer. Dan, anything you want to add to that bio before we get going?

No, just that I, uh, have a background that includes public sector, most of that time between military and federal law enforcement. And I've spent over the last decade now in the world of private sector consulting. So kind of have both vantage points also.

Outstanding. I'm biased. I think that helps, obviously, because that's my background too. So. Listen, before we jump in today, we're going to talk about, you guys have a new report, right? Unit 42, Palo Alto, you've got this Global Incident Response Report. But for those who don't know, we should probably set the stage a little bit. You know, I want to talk a little bit about who is Unit 42 and what is this Global Incident Response Report we're going to chat about today.

Yeah, absolutely. So Unit 42 is the threat intelligence and cybersecurity services arm of Palo Alto Networks. So we focus on kind of 4 areas and threat intel is one of those 4 and it kind of is the underpinning layer of all of them. But it includes incident response, it includes proactive services, and it includes managed services, managed detection and response, things like that.

Well, and I'm familiar with some of the work you guys have done. Like, for those who don't know, Unit42 has a really cool website with some great profiles on a lot of threat actors and groups. And anybody who's spent any time doing intel, we're all hoarders of that information. So you go to every vendor you can find, you pull all that stuff together, and maybe you're able to understand enough to try and protect yourself. It's obviously complicated and ever-changing, but you guys have always done a really good job. I'm a bit of a fanboy, I guess, of some of the work that Unit 42 puts out. Between you and me, and now everybody who's about to hear this, I once applied for a position at Unit 42 and wasn't good enough. I think that says a lot about the quality of the team. I joke about not being good enough. There were a lot of talented people in the world, but you guys have a great team, and I think you guys do a lot of work. If somebody had told me like 750 major cyber incidents a year is a big chunk of the work you do for this particular report we're about to talk about. Is that right?

That's right. So 750 cases we looked at just from the past year, like you said, for the report itself. We actually work more cases than that. It's just that we can't always use all of the data. So for example, certain public sector cases, we might not be able to use that data for contractual reasons. There might be other customers we don't use data from, et cetera. So there's over 750 that we can talk about in aggregate and anonymized and things like that. But we do work more than that. And that's just incident response, just to be clear. That doesn't include all the threat intel research we're doing, all the other initiatives, all the proactive, the stuff where we're trying to lay out that blueprint for cyber resilience for all of our customers, right? This is just the reactive IR piece is where we derive a lot of this data from.

Obviously that tells us there's a lot of content that goes into this work and be able to bring that down explains why these are annual reports and not monthly reports, right? There's a lot of content to go in. So I think we should jump right in and talk about, because I had a chance to read through this report. I had kind of an advance read on it. It's a pretty good read, frankly. A lot of these annual reports are dry, frankly, but you guys have a pretty good read and there's some really interesting things. So I want to jump in based on the work over the last year. What are your key observations? What should people be looking at and taking away right now?

4 key observations that we highlight in the report. The reality is, like, you know, I mean, there's so many things we could talk about in any given year, but we emphasized 4. So the first one was really about AI becoming a force multiplier for threat actors. And we talk a lot about speed when we talk about that in terms of how fast things are getting and just how much AI is compressing the attack lifecycle. From access to impact and introducing new vectors as well. Yeah. It's not really a buzzword anymore. AI is a real friction reducer for threat actors and takes a lot of that grunt work out that used to have to go into all that kind of stuff.

Yeah. I had seen attack velocity, right? You know, how fast actors are getting from, you know, initial intrusion to exfil. Accelerated massively. I think the report said it was down to 72 minutes. Yeah. And that's just in one year. It was 285 minutes last year. I have a couple notes in front of me for anybody who's wondering. I'm not, my memory isn't that amazing, but I was impressed by that stat.

Right.

And that's, that's AI. I mean, that, that is what's causing that. Right. So you got a, you got a 4x increase in speed or, you know, 25% is, is what's left of the time. However you want to do the math, 75% reduction in time. That's remarkable. Right. And it tells us I mean, I guess we also have to be getting better at AI, clearly, because it is a, a force multiplier for adversaries, which means, like it or not, we got to figure out a way to keep up with them. I don't know if you have any thoughts on how that happens, how you guys getting into the response piece, or I might be jumping ahead, by the way. I thought that was an interesting statistic, is just how much faster things are getting. And then I know another big piece that I had seen was identity. You know, that you were talking about identity, it's becoming more of a reliable path for attackers to succeed. Is that right?

That's the second main trend we talk about. The issue is that identity played a material role in almost 90% of our investigations, which makes sense, right? Because you have to authenticate, generally speaking. And so increasingly, we're just seeing the attackers logging in with stolen creds and tokens. And they're just exploiting these fragmented identity states to escalate privileges and just move laterally. And that's a really big piece, right? And it's no longer just usernames and passwords, right? We're talking API keys and access keys and stuff that enables using cloud workloads and things like that too, that folks aren't always thinking about.

Yeah, it's much easier to get into a system if you have access than it is to try to hammer your way through, right? Why bother with encyclopedia attacks or brute forcing if you can just convince somebody through deception or just 'cause they made an error. If you can get ahold of somebody's credentials, it's a lot easier to get in the door. And I imagine less detectable, right? If somebody comes in with creds that are valid, it takes a while to realize, hey, valid creds, not a valid location. Now, two-factor authentication should resolve some of that, but I'm gonna gamble that there's some people that are getting around the 2FA issues as well, or we wouldn't be getting this far. What are some of the other big trends? I know you guys had a few of 'em. What's another big trend that we should be watching for?

Yeah, so the software supply chain risk is our third one. Really, this has moved beyond just vulnerable code, not to minimize vulnerable code because it's still a problem, but to move beyond just vulnerable code to the misuse of like trusted connectivity overall. And so this includes things like SaaS integrations, vendor tools, application dependencies, you know, further up the chain of which is like defined by saying supply chain, but also like stuff in the CI/CD pipeline itself and tools within that, or exploiting the code repository itself, or, you know, features or bugs within those platforms. And that really just shifts that impact from isolated compromise to like widespread operational disruption where you could get something baked into your product that shouldn't be there, which is a big problem.

Yeah. And supply chain, people have been talking about supply chain for years, right? Third-party risk, supply chain risk, they're interrelated. They're not quite synonymous, but they can be pretty close to it, right? And we've been talking about it for years. It's a pretty difficult nut to crack, right? Because everybody has vendors, dozens. I, I'd seen a report that the average company had, I don't know, it was 40 vendors or 70 vendors. It was a really significant number, but you can't keep track of all of them. I mean, you just, you can't. And the interdependencies are just there. That's how business gets done, software as a service and platforms. So we're all absorbing some of these risks, whether we like it or not. And so, I guess it goes, you know, it's not surprising that adversaries would be going after that, right? But when you talk about vulnerable code, I mean, being in a position where somebody could theoretically manipulate code, and so a trusted vendor is now providing you content that you trust that you shouldn't, and becoming untrust issues. And we've seen that before, right? Colonial Pipeline, if I remember correctly, that was how that started. That's a few years ago now. Was faulty Microsoft updates, if I remember correctly. And we've seen some of that, right? Is that, that kind of thing you're talking about, among other things, is when we talk about supply chain risk?

Yeah, stuff like that. And even as really recently, right? Axios and things like that. And a ton of stuff with the Node package manager, npm. There's been a few prominent ones lately, you know, TriviaLite LLM, all that sort of stuff. We've got stuff on our blog all about that kind of stuff. And, you know, it could be small stuff. And although one, one of my favorite examples, which is kind of a, A fun one, several years ago now, was whoever it was, I believe the package name was Kik, K-I-K, if I remember correctly. Long story short, my understanding is the maintainer of that package had some other package that was far less consequential. It was like a left pad or some kind of visual hack, whatever. Turns out it ended up being dependency of most major websites on the internet. And the company, I'm not here to talk about or say anything about specific companies. It just happened to be that name of that. And the company ended up asserting that that was its trademark, then acquired that package. But as a result of that, the maintainer rage quit and pulled all their packages and then broke a good chunk. If I remember correctly at the time, it was, you know, like Twitter and major news networks and major social media sites, things like that. All depended on that. And that wasn't a security issue, you know, but just, it just goes to show the interconnected world. And, you know, I'm sure many viewers have seen the, the XKCD comic too. It has the one, one guy in Nebraska supporting this open source project, thanklessly, that everything depends on. Yeah.

And everybody's got stories like that. It's funny you mentioned that because I don't think that's something people think about. It should. When we talk about a third-party risk or supply chain risk, right? You've got the malicious, which people focus on, right? You know, somebody's either impersonating a third party or they are manipulating third-party data that's already trusted, data downloads, things like that. But you've also got just a third party's insider risk is your problem. A third party's corporate culture is your problem. A third party's layoffs can be your problem. And we've seen stories like that where companies do these massive layoffs and then they find out, oh, well, we shouldn't have laid these people off 'cause it turns out the only person that knows how to do this, we just let go. And then you can't get that person back. And it can be somebody who maintains code, like you said, or somebody who's vital to a process because on a large spreadsheet from a large corporation, those specific skill sets don't necessarily get mapped out when somebody's doing budget cuts. So it, it's an interesting point you make that that's just another aspect of supply chain risk. The XKCD cartoon you mentioned is very valid. There are a lot of vital, important systems that people don't realize just how few people are actually managing. Or controlling that system, the wrong person doesn't show up on the right day or rage quits and they just take their toys and go home and you realize, oh man, there's a whole bunch of stuff that doesn't work anymore. Now I don't have any good answer. I don't know if you do either. And if you don't, I'm not gonna try to put you on the spot. I don't have a good answer for how you manage all of that. Like, it's good to understand your vendors. I don't know how you can account for the rage quitting or the cultural shifts that might cause some of these things to happen, but it would be nice to know enough about your vendors to understand, hey, what are your plans? What are your contingency plans? What kind of redundancies do you have? How many people are actually maintaining this piece of equipment that I have now built my business on top of? Seems like things we should be asking our third parties, our vendors.

Yeah, absolutely. And just being aware of those dependencies is really step one, right? Like the foundation, it's been true for decades, but the foundation of security is asset inventory, right? Doesn't change when it becomes a software bill of materials, right? And the SBOMs and such. And so understanding the configuration management, if you will, it's really important to understand that. And that includes like SaaS apps. Like understanding their ownership and their scope, right? Having a good inventory of all those integrations and where OAuth tokens are floating around and things like that. You know, the same things apply, right? Departed user from the organization that was using something and making sure that any integrations that are no longer needed are severed as needed. And then there's gotta be books to revoke tokens. There's gotta be ways to rapidly just disable those connectors. Isolate the vendor agents without improvising during upstream incidents. So kind of like a break glass, like severing that whole thing as needed, right? And using the legacy code, things like that. And then of course you got to log everything, right? You've got to have good auditing of the usage of these things to know like, oh, it's not normal for our OAuth token to be used to pull everything in this application, third-party application or whatever from this integration. And then of course, just standard stuff like software component or software composition analysis, right? SCA. And you really look at hardening that build and all that kind of stuff, right? One of the things we talk about a lot on our blogs is pinning versions to the actual commit ID, the hash, the commit hash, like in assuming Git here, pinning stuff to the hash, not to the version, because a lot of these recent supply chain attacks, for example, have just reapplied the version tag to something malicious. And everything just kind of runs with that. I could go on and on and on about all the things that could be done, but that's just a few top-level ones. But yeah, it definitely changes things a bit.

You make good points. Having playbooks, worked for a few companies over the years, and usually when you leave a company, your stuff doesn't work. I can't say that's always happened. I have worked for some companies where, out of curiosity, I checked and it turns out my platform credentials still work. I don't abuse that. I tell somebody and shut it off, but it does happen. Where companies just don't have the right documented practices or there's no automation to it, or somebody just misses something. It'll happen from time to time.

I think with developers— Oh, you're good. I think with developers, that's where it's probably often most problematic because, like, with a standard employee who's— everything's integrated into SSO and you've got everything kind of mapped together, it's fine. You revoke that. But how many temporary AWS access keys did this dev create? Over their lifetime. How many of those are still floating around in IAM user they created as a test for this app that isn't actually associated to their main identity? And so that's the kind of stuff we often see is like some dev account or test thing or some long-lived access key, right? Where like a just-in-time template credential would've just done fine where they could've just assumed the role, Well, it worked. We dev'd, you know, it was developed that way and then it ended up in production that way with some long-lived credential. And even times where you see the same credential being used in both a dev and production environment, right? And of course, we all know that dev usually doesn't have the same security requirements as prod. You know, just things like that. That's where it gets a little bit more complicated. And it's not just developers, right? Because nowadays you have salespeople integrating third-party apps into Slack or their CRM or things like that too, right? There's all these sorts of things too, but it Do those always get terminated through the downstream thing? Depends.

No, there's lots of ghost architecture, lots of phantom architecture. And I don't know if you heard or not, but with AI, everybody's a developer now.

I think that's right.

Everybody's a developer now. We're being forced to, like, hey, companies are mandating, you will use AI, you will do these things. AI is great, great, a lot of amazing technologies there, but it's amazing how quickly companies are mandating that people use a tool that they don't understand how to use. Most people who are using AI don't understand how it works, and many don't even understand how to use it well. I use it a lot, and I think I use it relatively well. I probably am making all sorts of mistakes myself because this is a massive technology that was thrust on us really, really quickly and has gone from a, oh, this is really cool, to actually a mandated thing. So yeah, we're all devs now. We're all doing all sorts of things, and I'm sure we're creating all sorts of problems for a lot of enterprises that are going to keep adversaries very, very happy and allow reports like yours to come out every year to let people know, hey, we need to stop doing some of these things. Speaking of adversaries, now I know you guys had a fourth pillar. I know you, it's a really extensive report and really good report, but I know you guys had four pillars, which made it easy for me to understand. I think the fourth one, if I remember correctly, is about nation-state actors specifically.

That fourth trend is about how these nation-state actors are really adapting persistence and stealth tactics to adapt to these enterprise operating environments. Examples of that would include things like persona-driven infiltration, using fake employment. Which we've seen a ton with deepfakes being used in conjunction with that, that for job interviews, but also just for day-to-day interviews, things like that. So creating synthetic identities and then just deeper compromise, especially once you're an insider, right? The compromise can be a lot deeper. We're also seeing a lot of times where they're trying to compromise core infrastructure and virtualization platforms. So, you know, deploy their own VM, deploy their own compute work, you know, resource in the cloud or whatever. And oh, you, you thought you had 100% coverage, but you didn't know about the VM that got deployed by the threat actor, right? And so it doesn't have your EDR tool on it. It doesn't have this or that. And that's why you've got to have that control plane visibility too, not just the endpoint. You need all the above. And then there's really been early signs and, you know, lots published on this, but early signs of AI-enabled tradecraft as well, really for them to make, reinforce those footholds.

It's, you know, when you talk about the nation states, right? One of the things I saw not long ago, which was pretty interesting, was North Koreans specifically, right? It's come out, 100,000 was the last number I think I saw, right? And dozens of countries where North Koreans have actually acquired legitimate positions through illegitimate ways, right? You know, false personas. They've actually gone through interview processes and been able to pass the interview process and been hired. And some have actually been quite productive from what I understand, you know, actually getting good reviews and being good employees. Meanwhile, clearly their insider environment, as you talk about this insider threat, I mean, we're letting people in, you know, which seems to be a mixture of, you know, a more remote world, obviously, and better AI. And I don't know, maybe worse interview tactics. I'm not an HR expert, so I can't really speak to that piece. But I do find it fascinating. Listen, I've been doing intel for, like I said, decades. I don't root for the adversaries, but I do like smart bad guys, you know, and that's a pretty smart scheme they've come up with. It's been going on for a long time and it's fooled A lot of Fortune 500 people who have had this happen to them aren't bad people or immature organizations or fools, for lack of a better way of putting it. This is a really interesting scam that's really picked up a lot of steam. And you talked about these false personas, another AI component to be able to create much more compelling false personas than you used to be able to, even to the point of doing AI interviews, video interviews that are compelling enough to be believable. I find that fascinating. I don't know if you, you mentioned 4 pillars and they're all very important. I don't know that I would rank one above the other, but are you like me that this one's the most interesting to you? Or maybe you find one of the other ones more interesting.

No, I think, I think the, the insider threat from nation state stuff is definitely very interesting and it's increased quite a bit from our perspective. It's jumped up to, I don't remember the exact number here, but 7, 8% ish of our overall caseload for insider threat. In general, the bulk of that being malicious insiders, which could be North Koreans or other things as well, but often North Korean involvement. And so, yeah, it gets really interesting. And, you know, what they can do, like you said, you mentioned about them being good employees, especially if they have like a team of people working on something, their productivity can be actually quite good. Um, we've had examples of that where we, Maybe join the call with legal and HR to break it to the manager of the person about an approach we're going to take to sever their access or whatever. And they're like, oh, that's my best employee. So yeah, we've seen a lot of stuff like that. You got a blog post about, I think it's called North Korean Synthetic Identities or Deepfakes. You Google it, you'll find it. And yeah, it has a bunch of stuff on there, but it has specific mitigations and recommendations for HR folks, for security folks, et cetera. So it's not just the technical, but like we have some recommendations out there focused on even the business process type stuff. So yeah, some good stuff.

I think I'm more concerned that they're going to be such good employees that companies start deciding the risk is okay. Hey, this guy's really producing a lot for us. We'll manage that risk. We can't really afford to lose him, you know, because he's really killing it on the code we need done and it's good code. It compiles well. And so he steals some of our stuff.

So he takes your intellectual property and eventually holds your company hostage. Yeah, but not this quarter.

And this quarter our numbers are going to be good and I get my bonus on this quarter.

So.

I can't really worry about what happens 2 quarters from now.

We've seen, I know we're being facetious, but we've seen them partner with ransomware operators on a few occasions. There's some public reporting on that. Or just straight up, like speaking of rage quitting, straight up literally blowing away all the source code repos, blowing away everything, permanently deleting stuff, wiping out, removing resource locks, whatever they have to do to fully remove stuff and then holding it hostage and make demanding some exorbitant amount of money, basically to get your business back. And so that's dangerous stuff. So obviously the risk outweighs the benefit, which we know, but it is funny how in the short term, sometimes they do a good job to get more attention to work.

You got to do good work early on, at least so that you, like I said, you build that trust. And then people are like, yeah, no, Johnny's really working out. He's a good hire. You know, he got me one award last month. And meanwhile, he's just back here planning your destruction. It's not a good time to be an HR, I guess, if you're going to kind of figure all that out on top of everything else. You know, it's a tough job market and somebody shows up and they're really talented and they're willing to work cheap. So that's what companies want.

And sometimes companies do a good job with their hiring processes, but they partner with vendors or with a temp agency, and that ends up being the vector. And we've seen that kind of thing happen before too.

That makes sense. It's metrics driven, right? You're a vendor that's hired to do contracting, hiring people, right? Your contractor is your HR recruiter or whatever. My job is to fill roles. There's a requirement there. And I'm not saying that they would intentionally put a North Korean into a role. Of course not. But you're in a hurry. There's a lot of roles to fill and it's metrics driven and that's the business model, right? So if you're not prepared, if you're not trained, if you don't, if you haven't read a report like the one you guys put out and don't understand that the thing, which I can't expect recruiters to know this, it's in the news, they're figuring it out, but it's hard to keep track of. Every new possible threat. And this is very novel approaches. So it makes sense. They're just moving quickly, right? And so they move quickly with a candidate that seems good, passes all the checks. They pass it off. That person passes interviews. Still, ultimately the company is responsible for having hired them. And then they're productive and then eventually they can destroy your business. So I find it fascinating. And it kind of gets into my next question actually overall, right? As we dig deeper into the paper, what are you seeing as the most concerning or novel discoveries in the past few years? Like overall, not necessarily just this year, but at least the past few, if you want to, obviously we just talked about this, I'm sure a lot of them will be AI related, but what other cool, interesting, novel stories do you have that people should know about?

There's a lot of stories. I would say like at a high level, I think we're moving away from these like isolated one-off incidents, you know, mature organizations who have good zero trust stuff in place and they're isolating stuff early in its tracks, they're still able to, you know, stop stuff before it gets too far oftentimes. Good conditional access policies and host integrity, like all that kind of stuff. But when folks don't necessarily have all that in place or playbooks in place that are taking automated action, especially around identity compromise, we're seeing a lot more widespread operational disruption and it can really just take down entire ecosystems at a time, right? And they're just moving so fast. Like I mentioned already, right? You know, we used to measure stuff in days and hours and now we're measuring stuff in minutes and You know, that just goes to show you, you brought it up already about the 72 minutes for our fastest attacks, right? And how big of a drop that is. We've even seen examples where new CVE PoCs drop and folks are scanning for that in like 15 minutes. And we've seen, if, so when we focus on that 72 minutes, we're looking at like our fastest quarter of incidents really. But if we just take all the incidents overall, all of them, more than 1 in 5 of them see XFill in the first 72 minutes.

First hour.

So it's 22% in that dataset we looked at. And we certainly think that AI is a huge driver of that. Sometimes we can demonstrate that, like you can clearly see, you know, you start seeing emojis and well-commented code and you're like, okay, I have a good sense this is—

The giveaway, huh?

AI gen. But then you also see examples where like, you know, it's a little bit more speculative, but you know, sometimes you see the threat actors themselves discussing it in,, you know, underground forums and things like that, Chix for prompting stuff, whatever. So we know it's happening, right? Because of those things. But you mentioned stories. So what, one good story, I mean, not good for the organization who unfortunately was there in the one story. But, um, Muttled Libra, which is a term we use really for a grouping of tactics more than a specific actor. Part of a group that's often tracked is the comm, which is this larger group of largely teenagers. You probably know that. So Muttled Libra is more commonly known as Scattered Spider in the media, but our term is, is muddled deeper for this conglomeration of tactics. And so we had an incident where it was a call on a weekend to the help desk. And this person was pretending to be a C-level executive in the organization, requesting password and MFA reset. And help desk followed the policy. They asked for their name, their title, their manager's name, these sorts of things. But for an executive, that's really all public information. If you think about it.

Yeah, LinkedIn.

Yeah.

Or even if you're a public company, the public filings, there's a lot of ways to get org charts.

You know, Zoom info, people sell lists, all that kind of stuff, right? And so the agent ended up resetting the creds, the actor got in, and then after logging in, they went into M365, they accessed some IT-related documents, they looked at the corporate directory, and then an hour later or so, they call the help desk back. And that time they pretend to be IT. So now they're like, hey, I'm IT. And because they have access to corporate directory, they can pass that identity check that was in place for that org. And then that's where things get worse. A lot of times these orgs have recordings of these phone conversations. So you get to hear these help desk interactions recorded. And the help desk agent asked one fateful question, and that is, do you want to reset your user account for your domain administrator account?

Oh my gosh. Yes, I do. Absolutely, I do.

What a great idea. Exactly.

Thank you for being so helpful.

Exactly. So of course the threat actor responded, both please, right?

Yeah, let's do that.

And so they had to call back a third time to get instructions on how to use the VPN, right? And then they were off to the races. They signed in with legit creds. They moved laterally from the VPN directly to a bunch of systems. And they were on file servers and a domain controller. And they created a virtual machine in the environment so they could hide in plain sight, ended up exfilling hundreds of gigs to Mega, and then encrypted a bunch of the virtual infrastructure. And so the next day they sent a ransom note. Uh, I think they made an account even and sent the ransom note from a new email account. And all this happens in half a day, this whole timeline. But within hours, right? Domain admin. We've seen faster timelines than that for getting domain admin, but this is a recent example. And these sorts of attacks are unfortunately becoming the norm. A lot of phishing. We're still seeing for calling employees pretending to be IT. It's really popular, especially groups that kind of have established playbooks and kind of precept others in those playbooks. Why change what works, right?

Yeah. And the phishing gets better. Again, AI has made that a lot better, right? So you can do very convincing phishing now. I mean, it was always somewhat good, but I shouldn't say always, but it certainly is now. I mean, it's, the AI is incredible. You know, last year, uh, 2 years ago, I guess now, at a BSides event. Somebody asked my permission before they did this, by the way, but they asked if they could do a demo and use vishing as their example. So they used my voice and I said, yeah, that's fine. And they did a live demonstration through PA system. So everybody could hear it and had a conversation with me, supposedly, that I was trapped in a stairwell and needed— it was a physical security thing. And it took a while for people to realize. I had to wave my hand in the back of the room and be like, hey, I'm right here. I'm not, That's not me. And that was already like 2 years ago. The technologies have gotten considerably better since then. Again, AI is making it easier, but I mean, it's a great story. The customer service aspect of that one, right? We've spent so many years telling IT people that they're such a pain to work with and everybody just wants them to help us out and they're always difficult. Now you find somebody who's like, hey, how can I do this for you? Can I supersize that for you? Absolutely. Let's do the whole thing, please. And cause these problems, right? And that's bold. I mean, it's the model Libras you mentioned, you know, those are teenagers, right? That's a very bold strategy on their part. Unfortunate, right? You can have— they ran all the right playbooks from what you said. Everybody was running, was doing what they're supposed to do. So where's the fault at that point? Like, how do you improve your playbooks to improve your interrogation? And how do you balance that? Because if it truly is a CEO or, you know, a C-level executive or whatever, they're not likely to tolerate being interrogated for very long. They're in a hurry. They need something. So where's that line going to be? I've said before that part of the challenge I think we have in cybersecurity is corporate culture. This goes back a few years now, but a few years ago there was a significant business email compromise, uh, attack. It was like $80 million. And, you know, it came down to, in my opinion at least, it was like, well, this person who had the ability to move money around, who was in accounts payable or whatever, was being pressured and yelled at by what they thought was the CEO. And at that moment, they've got to calculate, am I— what's worse for my career? Possibly sending money that shouldn't go somewhere. And creating a fraud problem for the company, or telling the CEO who's yelling in my ear, no. I think a lot of people are going to decide telling the boss no is worse for their career and more dangerous for them, and they're going to go ahead and be intimidated into doing the thing, right? That's a little off topic for what you're talking about, but it is sort of the same concept in that corporate culture plays a role in this. If people are afraid to tell executives no, or in this case, they just followed the policies and it worked out nicely, but in that sense, of, man, this doesn't feel quite right. They're probably just going to go along with it because I don't think I want to ask the boss more questions than they're comfortable with because that doesn't always work out for people in my position. Right. So I'm sure you have a lot more stories, but go ahead.

It's easy to critique, but it's easy to excuse the C-level thing for sure. But it goes to show, especially around domain admin creds, having some additional policies, even if it's just, I'm going to ping you on Slack or Teams or whatever. To say, hey, just confirming this is you, or calling the number that's on file, or things like that. That's just, I don't want to not get those recommendations in there because there's such good stuff. And making sure if this is being outsourced, like BPO, that they're following your policies for these things as well, for sure.

100%. Yeah, 100%. Uh, you know, it's multifaceted, right? All these things are. I never want to say like, it's, this is the fault, right? There's a lot of areas that we can look at and say, well, if all of these things contribute a little bit, right? It's what makes it difficult. It's what makes security difficult. And the adversaries are, you know, they're good. Like I said, I don't root for adversaries, but I do enjoy seeing the smart ones. You know, you got to tip your hat a little bit to the smart criminals.

Yeah. And they're using LLMs even more. Like, speaking of smart criminals, they're using LLMs more just for straight-up communication. Everything from negotiating in, like, a ransomware context or extortion context to even now, like, a lot of times when we get a ransom note, it used to be like the ransom notes were very And they still can be because especially the ones that are baked into like a ransom binary, but we're starting to see, we don't know 100% if this is what's happening, but it looks to us like somebody took the file listing of data that they exfiltrated, fed that into an LLM and said, summarize the content and write it out. So it's very like detailed sometimes, like we have this and this, you know, and it's like, oh, that's it. It's so well written. You're like, huh, you wonder, you know, that's smart. Yeah.

Why not? You've got all this stuff. Hey, go ahead. AI, give me an inventory of what I've already stolen. I don't tell them if you stole them, but Give me an inventory of this, right? And then you take that and pitch it back in and say, hey, this is everything we have. Yeah, it's a pretty compelling ransom note. You know, again, smart use of the technology and rapid, right? Like you said, the ransoms used to be kind of this bland thing that, you know, then it's like, well, I don't know if they got anything or they didn't. You ain't gotta go through rounds of discussion. And now they're like, no, I can give you a whole page that shows exactly what I got. And it probably took them less time to write that one. Yeah. And puts more pressure on somebody to go ahead and pay the ransom, you know, whether they should or not is a different discussion, but. Listen, we've talked about a lot of bad things here, right? And there's a lot more, by the way. I know that.

Yeah.

We're not gonna be able to do justice to the entire report in the time we have, but we should at least talk a little bit about the other side of this. So with all the scary developments, what recommendations do you have for defenders that are trying to protect against all this stuff?

Yeah. One of the most frustrating things is that over 90% of breaches are enabled by preventable gaps. It's something we talk about in the report. There's a flip side to that, is that despite Despite the scale of these attacks, there's room for optimism because if 90% of them are preventable, that means security is solvable, right? As Lee likes to say, Lee Kleric from our organization, right? Security is solvable. And so the factors that drive a lot of that risk, visibility, complexity, too much trust, et cetera, they're preventable. And so to move from like reactive defense to that proactive resilience, really there's 3 questions we focus on in the report. So we give lots of recommendations in the report, but There's really 3 questions. And at a high level, are you empowering your SOC to move at machine speed, right? You know, this at a high level, right? You've got to, you've got to have consolidated telemetry, right? Be able to have that unified view that's not just spitting out alerts, but able to make decisions in seconds, not hours, right? And you have to move past alerting into acting, right? And so, you know, there's that. And then the second one, just in the interest of getting them out. Are you treating identity as a new perimeter? We've been talking about zero trust for years, and that's still very important, right? Tightening up identity access management, IAM, to remove that excessive privilege. Using strict segmentation and robust identity controls. Segmentation also of users, not just of systems. That can stop lateral movement before it starts. Using one example you brought up earlier, MFA. There's phishing-resistant MFA, and then there's just MFA. You want MFA., but then like for a domain admin account, maybe, and maybe even for everything, but using phishing-resistant stuff. So this is everything from passkeys, FIDO2 hardware keys, and don't hit, because I see this sometimes happen, well, what's most important then? Where am I going to focus my focus? Vulnerability management or identity? Like you can focus all day on patching, but a leaked cred gives you the exact same exposures that an unpatched system, right? So bottom line is the attacker still gets in the house, right? Yep, exactly. Um, And then the third one is really securing the entire software supply chain. That's the other big, big thing, right? Embedding security in the ecosystem itself, right? From the first line of code all the way to that cloud runtime, right? And so easiest way to do is start shrinking the attack surface itself, right? Does the dev environment need to be on the public internet or can it be behind site? Right? Things like that already could just reduce so many things. And then of course, considering the browser itself is part of that attack surface, because a lot of intrusions begin there these days. So those would be my big 3. And there's so many things we can talk about, but those would be—

Well, and it's interesting in the ones you're talking about, and I get them, right? And like you said, nothing is more important than anything else. They're all important. It doesn't do you good to go deep on one and not another one, but a couple that interested me the most, like stronger identity management, right? Moving past MFA and getting into like FIDO2 and just-time access, right? All really good. Meanwhile, most people haven't even done MFA still. We've spent years and years, like I talk about this, I'll tell people, the number one thing you can do to secure yourself is simply have MFA. You can have terrible passwords if you have MFA. We just talk about strong passwords, like, yeah, that'd be nice, but just have MFA. It's amazing how quickly that resolves some issues. I myself, just in the past couple weeks, I don't know why, but I'm suddenly getting pings Somebody's trying to get into one of my email accounts or a couple of my email accounts. So I'm sure there was a breach data someplace out there and something got loose, right? And so I'm constantly getting pinged. Somebody from the Philippines trying to get in, but I need you to hit your MFA or somebody from Turkey or whatever it is. Well, it's not me, right? And so I've had to go back and be like, ugh, all right, let me go change my password for my accounts. So that's what stopped happening. But MFA is all I needed and it took care of it. Now it was annoying. I'm getting pop-up after pop-off, so I've gotta go do something about it. But it was a simple solution and people haven't done that. And now we're gonna be like, ah, you know what, MFA, you gotta go past that. Now we gotta get into FIDO2. We gotta hardware keys. It's the right answer, but I worry about how hard it's going to be to get people to adopt it because we haven't been able to get people to adopt MFA. And then you talk about the secure app lifestyle coding. Well, we just talked about how everybody's being pushed into AI and vibe coding. And so people who aren't coders, people who don't understand code are now quote unquote writing code. I say that with myself included, by the way. So I can barely understand and read some bits of code and now I'm able to develop a platform. I'm sure I'm creating all sorts of messes in the background. Definitely not things that are secure. So again, on the one hand, we're telling people, hey, you really gotta work on a more secure app lifecycle and building security directly into your development, which is totally counter to the message of we need more people doing AI, we need AI involved more in this coding, and we're gonna have people who don't really code get into coding 'cause they can do it faster and quick, all those kind of things. Are there any thoughts on how we're gonna balance these things out and get people to adopt these best practices and these improvements when it seems like we're swimming upstream on some of these things? Or are we just going to spend the next couple years, like we've spent the last decade, telling people MFA? Now we're spending the next decade talking about FIDO, you know, FIDO2 and secure code as they ignore us.

I hope it's not the latter.

I mean, there's job security.

There's that. Yeah. I mean, like I said at the outset, I think it's solvable, right? I think it's important to, like I mentioned, having this baked into the build cycles itself, baked into the tooling itself, right? Which, a big part of this, you got to have the right scaffolding in place. You've got to have all the telemetry feeding, you've gotta have the data lake, you've gotta have all that stuff. 'Cause if you wanna take automated actions, you've gotta have the visibility to know and the authority for something to do it. And, you know, as people are doing these things, we have to prevent that governance drift that happens everywhere, right?

Yep.

And have that continuous lifecycle management. And so that's key, is making sure that we're centralizing identity, right? Using tools that can keep everything in one place and monitor those and not allowing just like, oh, you can just create temp IAM users and access keys galore and all these things and long-lived creds. But like, no, you're going to use, even in dev, you're going to use like, because you know, then we don't have to rewrite the code to do it differently when we go into prod anyway, if we're following good practices here. And you know, whatever that looks like, are you going to have any key storage? You know, whatever it is, key management, whatever, trying to get those. I know it's a hard problem to solve and I know legacy makes this hard. So when I say this, I almost apologize ahead of time, but Service accounts. Okay. Oh yeah. Service accounts, right? Getting those onboarded in these solutions as well.

That's huge.

And then also we've been talking about AI and vibe coding and all this stuff that I'm doing it too, right? But the moment, I don't want to drop specific product names, but we do look at agentic security, right? And we do have ways of solving that problem too, because an incredible amount of permissions are being granted to a whole bunch of people's machines in the environment. To some AI model that can do whatever. And yes, it can increase productivity, but it can also wipe every file in the system. Uh, that's right.

AI is— it could be your biggest insider threat, and we're giving it access intentionally, administrative level access. We're just, yeah, you do everything you need to do, man. Just go make things better. AI is going to be a huge insider threat for a lot of organizations who I don't think yet realize that. That's right.

I think agentic security is really important, right? Because you're looking at, you're doing integrity validation of the steps being taken by these agents and going, does that, do we want to RMRF the entire machine? You know, do we want to wipe everything? You know, like, is that really the intent here? And limiting even what it has access to, right?

Yeah, 100%. And it's so easy. Like, I'm, again, I'm guilty. I'm a career intelligence professional, a career security professional. I had Claude just yesterday rewriting registry entries on my computer, which I use for basically everything. Okay. Yeah, just go ahead. Run, do that thing. I need that thing done. Just go do it. I've had it completely reshuffle all my file, like all sorts of it. That's really, even I know as I'm doing like, ah, let's hope this doesn't end poorly for me, you know? And that's just my rig and just me playing around with it. I'm not on somebody else's corporate network, at least., but it's hard to ignore because there is this much productivity. I guess it maybe goes back to, it's just like that North Korean that you hire that you know is dangerous, but no, no, he's my most productive person. Claude is, or not just Claude, by the way, I'm not trying to call anybody out. It could be ChatGPT, it could be anybody. But these AI elements are our most productive tools right now. So it's hard to, it's hard not to just kind of overlook this risk. I, I, I think it's gonna be interesting to watch. I suspect that'll be a big part of next year's report that you guys put out. Yeah.

Is this objective. But that's a good thing. Hopefully next year. Yeah, we're talking next year too about Defender use of AI too, right?

No, that's a good point.

It's our tool too, like the same way I'm using it to doing registry key stuff for you so that you don't have to go in there and create a new DWORD for this and some other things so that you could change some setting that whatever version doesn't want to make easy to change or whatever. That's the kind of stuff that, that's not necessarily a bad use, you know? And so if folks can get the right foundation in place, right? Like sensors, data lakes, all this stuff and place. And AI can also be very useful for us as defenders. And that's something Palo Alto Networks has been saying for a while and using for a while with our Precision AI, right? So we can fight AI speed attacks with human speed. We can't keep doing that. We have to fight AI with AI, but also building out those even just traditional playbooks, like just writing a playbook, not just to deal with resetting a password, but also revoking a token and something like that and moving past just users, but treating identity for, you know, humans, but also for machines and also for AI and all these pieces. And as we move towards that, I think it's very doable to move from always being reactive, always on defense to being proactive and being resilient. I really think that's possible.

We all hope so, right? That's always been the goal. We keep trying to get left of blue and be more proactive. I mean, you make a good point. A lot of those policies, you know, hey, listen, AI can write those for us, which is nice. So that'll make it go faster. It'll be interesting to see what the next year brings in terms of some of the facts you guys have talked about and the speed of the actors, but also how we're going to use AI as defenders to improve. That's what makes this all interesting. Every year there's always something interesting that comes out and the data tells us what really is happening and we figure it out. Again, it's a really interesting report for anybody who hasn't seen it. I highly recommend checking it out. We'll have links to that in the show notes. And I think we may have a QR code to download it at the end of this. If I can figure out how to add that to the graphics properly, we'll figure out a way to make sure people get this right. It's a really cool report. It's definitely worth checking. Out. With that said, I gotta wrap up the show, right? So, listen, the name of the show is Unspoken Security. Everybody gets the same closer question. You don't get a pass just 'cause you're smart and pretty and read a lot of books. With that in mind, can you tell me something you never told anybody before? Something in your life so far that's gone unspoken?

I did not finish, but I was briefly in a PhD program focused on computational linguistics, kind of with a cybersecurity interdisciplinary bent at Purdue. My wife and I have been trying to have kids for several years at that point. She got pregnant and decided to change life direction. But the real reason I pursued that PhD, even though I was working in cybersecurity my whole career, the real reason is because I'm a dork and I love ancient history and textual criticism of ancient historical and religious texts and things of that nature. And really enjoy that and saw computational linguistics as the most adjacent thing I could use, or I could kind of play with those skills for fun outside of the cybersecurity context. That was part of why I pursued that. I didn't end up finishing that, but I've still been able to play with a lot of that on my own regardless. Uh, if you can find something that also aligns with your own personal interests, and not that cybersecurity is not a personal interest, but I have these other interests also.

That's really interesting. Like you said, I assume you didn't put that in your application at Purdue. I imagine if you were getting any sort of company tuition assistance or anything, you probably didn't mention it there either because a lot of us try to get these roles and educations that tie to our role, right? Because companies will kick in some money, which is always nice because education is expensive. But I think it's actually really interesting that that was your thought process. Good news is, you know, having a kid will cost as much as a PhD. So the money will be well spent just in a different way. I don't think there's a tuition assistance program for kids available yet. That's a really interesting story. And I appreciate you sharing that one. Every time I do this, I get something. I've never had anybody say the same thing that somebody else has said. People have just diverse lives with really interesting things. Do you think you'll go back and do the PhD at some point? Or just keep hobbying, you know, just going through as a hobby on these things without trying to— PhDs are hard. So if you don't attack it, I don't blame you at all. But do you think you'll go back to it at some point or just good with where you're at?

I'll never say never, but at this stage I'd rather get on all fours and play horsey with my kids or something. So it might be a while before that ambition is there again to do that part.

Well, it sounds like for what it's worth, I'd say you made a really good choice. Like, there's not much better than hanging out with the little ones and PhDs are hard, but, but it's a heck of a story. And now we all know a little bit more about you and what your passions are outside of chasing bad guys and writing cool reports. So listen, I really appreciate you taking the time, Dan, to share this and to go through this with me and with the audience. I find it fascinating. Like I said, I had a chance to read the paper in advance and I thought there were some really good things and we only covered a portion of it, right? A pretty big, important portion, but there's a lot more in this that's worth checking out. I thought it was one of the better reads. You know, we get all these annuals every year. People get a bunch of them. You gotta put out one of the better ones. It's like I said, not very dry compared to some and good graphics and really easy to understand.

And I highly recommend it.

With that, I'm gonna wrap up for today. Do you have any last thoughts before we do check out?

No, it's been great experience. Thanks for having me on.

Well, thank you for being here and listen, everybody who's listening and watching, thank you for taking the time. I know we're all really busy. You could do other things. I always appreciate you coming on. If you like the show, please, you know, like it, subscribe, tell others. If you don't like the show, shut up. I always say that, but it's not true. If you don't like the show, let me know and we'll see what we can do to improve it. Because I, I really like having the opportunity to have guys like Dan on here, you know, some of the brilliant people in our industry. And the goal is to make sure that they are represented well and that people who are listening and watching are getting something valuable for their time. It's not about me, it's about all you guys. So please keep letting us know. With that in mind, the show notes should have what you'll need as far as being able to get the report and reach out to Dan and the team if you have more information that you want to get from them. So I'm gonna go ahead and close out for today. Thanks again, everybody. With that in mind, this has been another episode of Unspoken Security. That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.