S624:E6🎙️ Industry Guest Speaker Andres Andreu

Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend Bob Fabien Zinga.

Welcome to the Leadership and Success Podcast with your host, Coach BZ, where we help you lead with purpose and succeed with impact. If you're ready to grow into the kind of leader others want to follow, this podcast is for you. If you're determined to elevate your success and leave a lasting legacy, this podcast is for you. As my mentor, Dr. John C. Maxwell, reminds us, everything rises and falls on leadership. Our goal is simple, to inspire you, challenge you, and equip you with insights that can transform the trajectory of your leadership journey. Welcome aboard to another episode of the Leadership and Success Podcast. With Coach BZ.

All right everyone, welcome to another special edition of the Leadership and Success Podcast. This is our Season 6, Episode 24. So this is our industry guest speaker series. So without any further ado, let me just welcome you and get this started. Today we are going to be hearing from an industry expert, many times CISO, now tech CEO. We're going to be talking about adversarial intelligence, how AI powers the next wave of cybercrime. So again, good morning and good afternoon to those on the East Coast. Welcome to this special edition of the Leadership and Success podcast. Over the past several weeks, for my students, we did build a strong foundation in network security, data protection, and artificial intelligence. We've explored how to defend systems, how to secure data, and how to apply AI responsibly. But today, we're gonna shift perspective because to truly understand cybersecurity, you must also understand the adversary. Today's attackers are not just writing code manually anymore. They are leveraging artificial intelligence to automate attack, increase precision, scale operation globally, and also move faster than traditional defenses can respond. That's why I am truly honored to introduce once more our industry expert guest lecturer, Andres Andrew, CEO and CISO. Today, we'll walk you through the concept of adversarial intelligence, how AI is being weaponized across the entire cyber kill chain, from reconnaissance to compromise to monetization. You will see how modern cyberattacks are engineered end to end. As future cybersecurity leaders, you must ask yourself, how do we defend against an adversary that is learning and adapting in real time? Because in the age of artificial intelligence, it is no longer enough to react. We must anticipate. So please join me in welcoming Andres Andrew. All right, Andres, welcome back, and the floor is yours, my friend, and thank you so much for teaching us today.

Great, thanks for having me. So good afternoon to everyone who's on, or good morning, wherever you are. Look, the, the core idea that I want to leave you with today is, is quite simple, actually. AI is really not simply adding new tools to the arsenal of the cyber criminal. It's changing the entire operating model. What used to require more people, more time, more specialized skills, now can be done faster. It can iterate faster on cycles, as we'll talk about in a few minutes. You can localize content faster. You can scale your attacks wider. And beyond that, it's changing the economics of cybercrime as well, because nefarious actors have bosses, they have timelines, they have deadlines, and they have budgets too, in the same way defenders do. And so there's a reality to what's possible now based on these new technologies. And so when we talk about AI and cybercrime, it's easy to get distracted by the novelty or the cool factor and all that stuff. You know, we talk about deepfakes, dark models, scary demos, but the real shift is operational. AI is really helping adversaries compress the distance from an end-to-end campaign perspective, from intent to execution. And it really just accelerates the cycle between an idea getting to a lure, a lure becoming a compromise, a compromise leading to monetization. And this is all done with very little friction, as opposed to in the past, a higher skill set was necessary. So this session is not a tour of shiny tools per se. It's really a look at how adversaries are actually stitching AI into their entire lifecycle. And, you know, we'll talk about offensive LLM, we'll talk about data, the data ecosystem, how that feeds attacks and all that. But let me start by framing exactly how you should absorb the, the content in this talk. So I want to cover 3 things, basically. First, I want to shed some light on how AI operationalizes scale, speed, and outcomes for the adversary. Second, I want to ground that in a real, a real attack, real artifacts, real patterns that led to a campaign that was entirely based on AI. And finally, I want to help you see these incidents as systems and not isolated, you know, tricks or techniques or TTPs or any of that stuff. We have to start looking at at all this entire landscape end to end. And so as we move through the deck, I really want you to focus on recurring themes. First one's gonna be automation. The second one is personalization. And the final one is orchestration. And these three together are what we, what really makes this wave different, what makes it unique. Attackers are not just generating content faster. They're connecting data, they're building models, they're creating channels, and they're creating their own decision loop. They're generating their own decision advantage based on these technologies we're going to talk about. And so this is really the lens that, that everything here is going to follow, you know, how AI is enhancing that adversarial operationalization and when they really care about content, about throughput, about conversion, about monetization. And so with that in mind, let's get started here with that, the reality of the baseline, the simplest factor here, which is malware. So when people hear of AI-powered malware, they— I think, you know, Hollywood's done some disservice here. I think people often imagine some autonomous super malware that writes itself, and maybe that day will come. But the reality today is, it's far less dramatic, yet more important. AI is becoming this new baseline assistant for malware creation and, more importantly, refinement. It helps with code. It helps with debugging. It helps with adaptations. It also improves obfuscation, which, you know, depending on what language you code in, can be difficult. So those advanced-type techniques are now at the fingertips of people that have a far lesser skill set. So on this slide, it might be a little hard to see because of the resolution, but the prompt example that I put there matters. It shows attacker intent translated into structured tasking. In other words, there's no magic pattern here. The operator described a goal—you see it in the prompt—defined an environment, specifies what to collect, adds all kinds of constraints, and tells a model what the output—how the output should behave. That turns the model into a force multiplier for lower and mid-tier operators. And these people may not be elite developers, and they don't need to be anymore because the AI engines that are available now can just take these prompts and generate actual functional code. Now, another important note that I just want to state for the, you know, for the sake of the audience is many of these services, as I put in one of those bars up there, Many of these services are scams. Some of them are exaggerations. Some of them are just wrappers around other dark LLMs and stuff like that. You need to be careful when you're playing around with these tools, but that, that point does not invalidate the trend. The capability shift doesn't really depend on every underground tool being real. It depends on attackers having access to these models that can assist with code generation, troubleshooting, et cetera. This is already enough to compress that development cycle for malware. And so the headline here is not that AI automagically invents malware. The headline is that AI reduces the friction across the entire development lifecycle of malware from idea to functioning code. And that really lowers the skill barrier, barrier of entry to cybercrime down to virtually zero. Now, if malware is the execution layer, dark LLMs or offensive LLMs— on the next slide— really are part of the enablement layer. And so I just chose one as an example here. We'll talk about a few of them. But WormGPT is useful because— and it's not just the name that matters, but it represents a pattern. And offensive LLMs or dark LLMs are marketed around outcomes that criminals care about: extraction, destruction, extortion, data exfiltration. In other words, collect the data, damage the victim, and maximize payment pressure or monetization. Now, notice what that means operationally. That means that one model can help draft or refine Stealer, InfoStealer logic. Another can generate or optimize a disruptive script. Another can write the ransom language, the content, in a tone designed to increase fear and compliance. And we'll talk about vibe hacking in a little bit. But the point is not whether one model does every step perfectly. The point is that the model assistant— assistants can cover different functions inside that same criminal workflow. Now, this is a major shift because historically an operator might need a team, a coder, a social engineer, somebody who understands how to package messaging. AI compresses all of those roles and it actually empowers one person to act as a whole team. Now, it doesn't eliminate human direction, but it lowers the coordination burden and the speed to productivity, to production. So when you see offensive LLMs, don't think about the model per se, even though the model matters, but think about labor compression. Think about faster drafts, faster modifications, multilingual adaptation, right? I, I don't need to speak 100 languages now. I can have AI perform that translation for me. And really, another factor is experimentation, because if you've ever designed or built anything in tech, you know you're not going to get it right the first time. There's a level of experimentation that's necessary. AI compresses that time as well. And so that's where the real value prop is for adversaries. And, you know, once this type of criminal capability becomes useful, the next big thing is, can we build a business model around it? And when I say we, I say it from the adversarial perspective. And the answer is yes. Now, this slide's important because it takes offensive AI out of the realm of myth or anything mysterious or whatever, and it puts it into the realm of economics. So once you start seeing user counts, operating costs, recurring activity, you're no longer dealing with curiosity or hackers playing games. You're dealing with a service model. This is a business. And that matters because criminal ecosystems really diffuse capability the same way legitimate markets markets do. If, uh, if a tool lowers effort and creates demand and can be priced, packaged, and supported, then it becomes accessible to a wider range of operators. Not everyone in the underground needs to know how to train a model. They just need to know how to rent access, submit prompts, and get usable output or useful outcomes. So the days of, you know, nefarious actors having this tremendous skill and being part of an elite crew, those days are over. You can just go buy this stuff as a service and perform your nefarious activity. Now, that commercialization angle also tells us something else. Offensive AI does not need perfection to be valuable. That's important. It just needs to be good enough, often enough to support the user campaigns and to be able to repeat on patterns. And in cybercrime, let's just be real, you know, good enough can still be very dangerous, especially when it's fast, cheap, and available on demand. So the key takeaway here is that the barrier is not only technical, it is now economic. And once offensive AI reaches workable economics, the scale problem gets worse for defenders. So let's take a, a broader look at this, at this space in terms of the actual in terms of the actual tools that are available. So this matrix is useful in terms of avoiding over-focusing on any single product, brand name, whatever you want to call them, the ones that are listed on the left axis there. The real story is not, you know, WormGPT versus FraudGPT or whichever one you want to pick. The real story is coverage across the attack lifecycle horizontally, because not every one of these tools address each area equally. And that's okay, because the campaign— the campaign designers will pick the tools that are effective within whatever phase of a campaign they're operating in. And so what you're seeing here is an ecosystem of tools and claimed capabilities that's spread across recon, phishing, malware development, technical code generation, exploitation assistance, etc. Now, not every one of these claims has to be equally credible. And not every capability is going to be equally mature. But the direction of the travel, if you think horizontally, is clear. Adversaries are no longer thinking of AI as one singular thing, one singular entity. They're using it as a modular arsenal. And one capability that, you know, can help gather information is different than another one that helps turn information into a persuasive lore. Another one can help write code, etc. And that modularity matters because it mirrors how real operations are run. Typically, those are different members of a team that cover their area of expertise. And so attackers don't need one perfect AI. They need a stack of imperfect but useful helpers that each remove friction from whatever part of that job they're working on. And once you think about it that way, this matrix that's on the screen becomes much more important than any individual particular name, any one of those products or projects, however you want to look at them. But moving beyond that, a big part of this arsenal here is that it's technical in the traditional sense. The real factor where we start seeing the impact of the outcome of this into cybercrime is on the psychological end of, unfortunately, the target, the victim. And so now we're moving into psychological warfare. That, that clip, that image in the middle is the first screen of a clip that you can find online from my friends at Get Real Labs. And it's a great video because it shows how sophisticated these type of emulations have become at a video level, not just face and mouth movements, but body movements as well. Anyway, deepfakes of this sort really matter because they attack, if you think about it, the oldest and most efficient security shortcut that we have, which is human trust in signals that are familiar. So when BZ comes online to talk to me, I instantly think, well, that's him. I'm talking to to the real person. That may not be the case anymore because a lot of these videos are very convincing, and the interactive aspect makes them even more difficult to detect. And so you look at a known face, you look at a, you hear a known voice, a familiar cadence, right, a tick or whatever, and the person that's on the screen could look like an authority. And those cues to a normal human are incredibly powerful, especially if that human is being pressured with the need to act on something within some point, you know, frame, within some timeframe. And so this slide really highlights some key threats, right? Convincing face, voice clones, etc., cross-lingual conversations, that starts to become quite interesting because now the language factor across the globe starts to shrink as opposed to be wide in scope. And so if you put all of this together, you get something that's really operationally significant. You know, attackers can now generate synthetic trust artifacts at scale and continuously refine them without the normal fatigue of a human, right? Scheduling, I need a rest, I don't feel well, any of those bottlenecks that humans typically bring to the table. And so that point about operating 24/7 is critical. You know, AI-enabled social engineering is not just more realistic, it's more persistent and it can hit a much larger scale than what a human-driven campaign can. And so that end-to-end nature is important because teams can run, they can test, they can fail, they can adjust and try again at a pace that would destroy a human team. But when done with AI, it can just run continuously and get to a very point of strong effectiveness. And so the strategic point here is, is that deepfakes are not just content, they are psychological infrastructure. They help adversaries manufacture legitimacy on demand. And that becomes especially dangerous when it's paired with stolen context, stolen credentials, real-time interactions. And, you know, that really brings me to what I call vibe hacking. Now, you'll hear the term vibe hacking refer to something along the lines of vibe coding. When I talk about vibe hacking, I mean the manipulation of trust signals in content, in synthetic media to create the exact emotional feel that lowers suspicion. And this is, this is more subtle than just writing a good phishing email. It's about matching tone, sentiment, pacing, urgency, familiarity, all of those cues that make an interaction feel right with a target. And if you look at some of the functions on the slide there, you'll see the system can ingest public traces. This, this is important. You'll see this later in the campaign we'll cover, but it can ingest public traces, build a target model, maintain memory, synchronize identities, perform sentiment analysis, and adapt to everything in real time. And this is a very different kind of social engineering. It's not just scripted persuasion, it's responsive persuasion, because this type of code can actually adapt to the, the vibe, the sentiment of a target. And this matters because humans often detect scams through emotional incongruence, right? Something feels off, the timing is wrong, The tone of the way they talked to me was wrong. AI helps adversaries reduce that friction. It can smooth those emotional edges, if you will, and keep an interaction coherent over time. And we're seeing this happen quite a bit these days. So when we think of modern social engineering, we have to move beyond that notion of, you know, did the email look polished? Was the— was the grammar correct, etc.? The more important question is whether the attacker can sustain a believable emotional environment across channels over time. This is what, what real vibe hacking entails. And so once you think in those terms, really the next slide should kind of fall into place because now we start talking about the emotional attack surface. At the end of the day, humans have become a part of the target space, the target landscape for attackers. And if you look at this slide, it really breaks down the problem into target parameters and real-world executions. On the left, you have the trust signals that attackers can manipulate, right? The urgency, the fear, outrage, all of the emotions that a human can experience. On the right, you see how those signals show up operationally in For example, the fake CFO call that became infamous where a lot of money was lost from a bank. You know, you can deal with multi-party deepfakes. Like, if you see that Get Real video, you'll see what I'm talking about. But this is important because a lot of attacks don't fail or succeed on technical realism alone. They succeed because they trigger really the right emotional state at the right moment. And that AI gives an adversary a way to tune that state very precisely and at greater scale. And so if you think about that example I put on the bottom there, that we met at the AI summit example, you know, this is not just about personalization. It's context mirroring. It gives the target a reason to suspend his or her skepticism because the lure aligns with something socially plausible. Let's say they saw me on stage and we spoke afterwards and I send the calendar link, that might feel like a normal next step because we had a conversation and they felt comfortable in that conversation. But if that link I send is nefarious in nature, their skepticism is lowered. And so, you know, the new attack surface that's emotionally driven is not just about identity or devices or applications. It's an emotional state. And AI is helping adversaries probe, predict, and exploit that state more effectively than really traditional mass phishing ever could. And so let's, let's connect that to an operational reality, which is the kill— the AI kill chain. So I think this is the simplest notion to absorb in this whole talk. AI is basically now touching multiple stages of the kill chain, not just one. And in some cases, it's focused on the steps in between stages. So it helps with recon, it helps with initial access, it helps with identity, discovering identity data to use to log into systems, obviously helps with malware development, as we spoke about earlier. And the reason that all of this matters is because This creates a situation that's compounding. And so if a technique or an AI technology only accelerated one stage here, you get a local gain. If you reduce friction across several stages, several linked stages, you change the tempo of the entire operation. Recon gets faster, which means you get better targeting. Better targeting will improve your lore quality. Better lures improve access. And so you can start to see how that compounding effect is what defenders are up against now. So AI is not simply making one phase more efficient. It's tightening the loop between phases. Attackers can discover, adapt, and act with less dead time in the middle of all of those stages that are listed there. And so as a defender, when you inval— evaluate AI risk, you got to get past the simple questions that, for example, can a model write malware? Obviously, it can't. You got to ask things like, what happens when recon, persuasion, code assistance, and data exfiltration all get faster together? That's a bigger shift. And it's a much more complex question that a defender has to tackle. And that is just the modern-day reality of being a defender in, in the landscape that we're facing today. Now, you know, part of that reality is scale. And AI really has introduced a brand new unprecedented generation of scale. Agentic models are where I think a lot of people start imagining autonomy. But really, the grounding is, is a little more practical than that. Think of an agentic ecosystem as a coordination model, and this may be pushing the agentic conversation into decentralized agents, and that's okay because that's going to be important in a minute when we talk about scale. But think about it like this: one, one component does planning, another one gathers OSINT data, another one generates code. Another produces content, deepfake material. All of those can happen simultaneously now. And the real value is the decomposition and coordination that you can now perform at scale. Instead of one human manually juggling every moving part that you see on the screen there, an orchestrated system can run all of these subtasks, if you will, in parallel, and the outputs can get routed from one step to another if necessary. In other words, you can have an agent that depends on the result or the outcome of another agent, and if the coordination is done properly, you have a very, a very interesting industrialization of a pipeline. The outcome, the outcome line on the slide, I think says it well: automated persuasion, parallelized campaigns, hyper-personalization at scale. This is what makes agentic systems possible and effective within the cybersecurity space, the domain, the— on the attacker side, not the defender side. But what it does is it introduces a really broad span of control for the attackers. And this is exactly why AI really changes attacker economics, like I said in the beginning. So, you know, once one operator can supervise more activity, test more variants, run against more targets, adapt faster. That makes criminal operation look more like a disciplined production system that we would traditionally pursue in an enterprise environment. And so, you know, those systems still need that operational environment to live in. And increasingly, this is becoming more social than it is technical. Let me explain that. So what I mean by that is, As an example, command and control infrastructure plays a dual role. It can be used for normal messaging purposes, let's say, but it can also be used for nefarious purposes. And Telegram is probably the biggest example, the most important example of, of exactly what I'm talking about, that C2 type infrastructure. So, you know, Telegram really has become more than a generic messaging platform. It is operational in nature for nefarious actors. It gives adversaries fast communications, private communications, private channels, semi-private channels, ephemeral accounts, encrypted chats, all kinds of functionality that would otherwise be very difficult to accomplish. And it does so in a way where the, the monitoring of all of this activity is kept to a minimum. So it's a great playground for nefarious actors. Now, that combination that I just described matters because traditional C2 is only part of the story. Operators need these other type of spaces to coordinate, to share scripts, to validate stolen material. We'll talk about credit card fraud in a second, but the way it's related to Telegram is, is super important. If you look at that code snippet on the bottom right, that was generated— this is from a real example given to me by a nefarious actor. There's nothing nefarious about that function. It's a legitimate function. It's, you know, it's a— it intercepts a web— it uses a webhook to, to actually send data to. And if you think about it, there's nothing nefarious about that. But now it Imagine, let's go beyond username and password. Imagine session cookies, imagine stolen credit card data. All of that data, irrespective of the source, would use literally a function like that to just send the data up to Telegram. And what you're looking at is a very short time cycle between the data exfiltration or theft and the data operationalization at the criminal level. And so that pipeline goes way beyond identity data at this point. It really can be any data that's used for fraud or monetization purposes. And so, you know, I labeled this slide the dark social layer. When I use that, I mean the social channel that becomes part of the attack infrastructure itself. And it's really where tooling, coordination, validation, monetization all start to converge. The next two slides I'm going to show touch upon an example of you know, Telegram being used. And unfortunately, these, these are— this is real. Um, but this is the kind of telemetry that is valuable because it strips away abstraction. There's nothing abstract here. It may look abstract, and when you think about it, what I showed at the top is just an example of a credit card, of the 4 elements that make up a credit card piece of data. Um, what you're looking at here is a feed in Telegram where stolen credit card data is pumped upstream into Telegram, but then it's also checked, categorized, and operationalized in almost real time. And so this channel is not a chat room per se, it's a low-friction operational console. And so what matters here is the workflow. Collection happens wherever. It can be an info stealer, it could be a skimmer at a restaurant, Validation happens here on Telegram. When that, when that function gets used to push data upstream, that's where validation happens. Then decisions happen here, because if you notice, one example has a red X, one has a green check mark. Those credit card elements of data were validated. One can be used, one cannot. And so routing happens here. Now, humans may still supervise the part of this process, but automation is doing a lot of the repetitive work that used to slow things down. That entire credit card feed and check for validation happens without a human involved. And again, if you think about it from the angle of the diversity of data, this is not limited to credentials or credit card data. It can be anything. It could be, you know, user details, geographies, passport data. Driver license validation results. It can be anything, and that broadens the monetization pathways and gives really attackers more options after an initial compromise. And so this is normally a video right here, but basically what you would see here is the fact that— and this is just reality— On one Telegram channel, one credit card is leaked per second from around the world. Now, that may not sound like a lot, but that's one Telegram channel. There are thousands focused on credit card data. And so if you think about it, even factoring in overlap, in other words, the same data showing up across multiple channels, one per second on hundreds of channels you can start to see where this becomes— it becomes lucrative for adversaries, because there's just— there's a reality to the volume. And so long as any percentage of those credit cards are valid and work, they're making money. And so let's just shift gears a little bit. I think distributed denial of service is an area where a lot of focus has to be given to what AI brings to the table now. So this blueprint on the screen is useful because it shows the relationship between a human operator and the AI ecosystem that can be built to facilitate a DDoS solution, let's call it. The human still sets the goals. The agentic orchestrator interprets those goals and then creates tasks, spawns off agents to pursue those tasks, and more importantly, coordinates the outputs that those agents bring back to the table. Those, those outputs then can get distributed across different worker nodes and aimed at some particular target. So the distributed worker layer is important. When you think of compromised hosts, cloud instances, IoT devices, you start to see what the operational reach can become. The AI layer that you— that would be built for something like this, and this does exist, by the way, makes all of this very coherent. It can decide where traffic goes, what tactics should be used, when there should be an adaptation. This is important because what that means is when the target sends a set of responses, an agent can adapt to those responses and let all the other agents in that ecosystem know. And you can start seeing where evasion becomes possible based on a couple of even test requests that gets sent to a target. In other words, you know, AI is helping attackers increase the command efficiency over what could be a messy infrastructure. The infrastructure can still be, you know, distributed and noisy, but the decision layer that's above it becomes far more coordinated. And so this becomes very intelligent and it can adapt to responses from the target environment. And those adjustments can happen in close to real time. That's important because can a defensive team and the solutions they've deployed operate in close to real time? I've been doing this 33 years. I have yet to see that on the defensive side. And so in terms of, you know, considering this from an advantageous perspective, AI really is giving nefarious actors a distinct advantage. And that shift is important for defenders, because what that means is, as a defender, we're not just facing traffic, we're facing traffic that is being adaptably shaped by a system that is continuously learning based on what my ecosystem is telling it. And so if you, you know, if you put all of these pieces together that we've been discussing, what you see is an operationalization factor. And this slide is really a business process type view of modern cybercrime. It typically starts with recon, and then, you know, you have some automation over OSINT or other data sources that pushes results, outcomes over to a persuasion operation where you can use LLMs and stuff like that to craft content, synthetic content. After that, you move into an access and execution dynamic where AI really can be used to write code or refine code or figure out horizontal movement, improve persistence. And after that is kind of what the ultimate outcome is for a lot of nefarious actors— monetization. And so that can become— that can come in the form of business email compromise or info— invoice fraud, many different pathways, but the end-to-end operation— operationalization, I think, is important. And I want to emphasize that because this is basically not a pile of isolated tactics. It's a pipeline now. And it's an industrialized pipeline in certain settings. And once it's a pipeline, attackers can optimize it like a pipeline the same way we do for legitimate development purposes. Right? They can measure throughput, they can test conversion rates, they can adjust and tune scripts, They can localize content. They can decide where human attention adds the most value and where automation is good enough, where, you know, the human doesn't really have to touch much. And that's, you know, that's why I keep using the phrase operationalize, because AI is turning cybercrime into a measurable, repeatable, and improvable production system. In the past, that was not the case. It is the case now.. And that, that's a fundamentally different challenge than defending against one-off, you know, handcrafted attacks. And so let's take a look at the NPD breach that took place a few years ago, because it is a classic case of operationalization and really automation. So this case matters because it really shows how a large breach can become raw material for downstream coercion at scale. I mean, literally an entire campaign was created based on this breach, but this breach was not the sole source of data for the campaign. So on the left side of the screen, you see sort of a macro view, if you will, impact timeline, the state, you know, what role AI played. On the right side, you see some of the operational, really, residue, if you will. This is data that I grabbed from when I was being treated as the target of that attack. Most people that have ever had a credit report run in their history in the US were part of this campaign. So the combination that you see on the left and the right there is really what, what you need to focus on, because a reach now is no longer just a disclosure event. It's inventory. It's the foundation for something much larger. And so in this case, it became the data reservoir, if you will, of data that could be sorted and enriched, correlated and weaponized. And that's exactly why timeline matters. Because when a compromise occurs, the data gets surfaced to some ecosystem for instance, Telegram, between that time and the time a breach is acknowledged, there could be a pretty large period when the criminal operation can monetize and/or operationalize that data in different ways. And so as a defender, you start to— you need to start understanding that the time compression factor is quite real. Anyway, getting back to this, you look at this, somebody's organizing correspondence, dates, context around specific names, the ransom language that was used, the monetization layer, small, small enough payments that they feel payable. Like, for instance, if you try to extort somebody telling them they did something naughty on their phone and you have evidence and you say, give me $10,000, people will probably balk at with that. But $1,000, maybe, who knows. And I think that was the attempt, uh, that these teams were using because they thought they could get large volume of small payments. Um, and anyway, the, the line there about the GPT-based code generation powering this end-to-end operationalization is really at the heart of the issue that we're talking about in this entire session. AI didn't create the breach itself, but it helped make the downstream exploitation entirely scalable and adaptable. And on top of that, systematic. In other words, the folks that created the campaign didn't run the campaign. They sold it to various nefarious actors. And that's kind of the broader lesson. You know, a data breach now can increasingly feed AI-assisted post-breach crime. The breach was one incident, but then that became a feed into this criminal ecosystem. And the next slide, I'll show you again some more content from when I was targeted. And as you can see, by the way, all of the content in the, in the PDFs that were sent as part of this attack, the content was accurate. They knew my name, they knew my email address, they knew my phone number, they knew my home address. They even had GPT-generated code, as you can see that image, go out and hit Google to get an image of my home. That wasn't part of the MPD breach. So that was all correlated through an AI engine. And so this is really, I think, where this case study starts to become very revealing. These emails use claims that many people have probably seen before. Alleged RDP access, webcam, microphone hijacking, right? I got you doing something on your phone and all that. I don't think any of those claims are new, but what changes is that integration with OSINT data and contextual detail. Um, this slide really calls it out as the kicker— automated integration of outside information to intimidate a target. And, you know, let's face it, some people will fall for this. This is where the threat becomes more persuasive because it's tapping into a human emotion. For example, if somebody's a, whatever, a valued member of a community, they don't want to get embarrassed if indeed they ever did something and they think this is real. And so this, these type of emails are no longer a generic scare tactic. It's personalized coercion. And so when an attacker can combine breach data, public traces, contact information, visual cues and all that, they can create messages that are unnervingly specific. And so if you think about it here, the target, the potential victim starts to say, how much do they really know? That certainty, uncertainty becomes extremely powerful. The attacker doesn't have to prove anything. They only have to create enough plausibility to trigger fear that would lead to compliance and payment. And so this is an important evolution. AI helps move psychological extortion beyond broad spam, if you will, towards very personalized pressure campaigns. And that can improve conversion for the attacker. They can get a lot of money out of that that they wouldn't otherwise, especially when, you know, the demanded amount is calibrated to hurt but be manageable. It's coercion optimized for throughput. And so the NPD is one example, but this really, it gets worse in terms of what becomes possible with the same type of operationalization. And so we start looking at things like, like AI worms and synthetic identities. So on the left, there's the idea of an AI worm, a prompt or content-born propagation, where really content is code. That's important. Because it's strategically very clear that through a prompt— it's not code, you're using a prompt— you can create executions elsewhere. So content is code. And in an interconnected, uh, GenAI environment, malicious instructions can potentially move through pipelines, automated assistance, tool-connected applications in ways that don't look like the classic binary executable of a piece of malware. On the right is synthetic identity creation. Here, the interesting point is not just the forgery of an identity, it's lifecycle management. LLMs can help generate consistent attackable persona packs and agentic bots that can age those identities over time through small transactions that look normal if one doesn't really take a step back and do analysis on the data that it's creating. And this can help the AI— it can help the nefarious actor bypass certain controls that are too static or too shallow. And if you look at most enterprise defense mechanisms, they are kind of static in nature. So this kind of stuff starts to become very concerning. Both sides of this slide point to the same future issue. Attackers are learning how to weaponize systems that interpret content and systems that trust continuity. That means the boundaries that we historically know between data identity and execution, those boundaries are now blurring. And all of this really brings us to what I consider to be an inflection point. I mean, in one sentence, I put it there: threat volume and threat speed are out— now outpacing manual defenses. So AI lowers the barrier to sophisticated cybercrime. I think we've established that synthetic media weakens trust in human signals. Uh, distributed agentic ecosystems really increase throughput, and as we push into world models, these richer models, they help adversaries with more content. That means the challenge isn't to create better malware or better phishing. It's a more adaptive and more operationalized, operationalized model for the adversary. The defender who's organized for typically static IOCs, static signatures, you know, slow incident response processes, you're mismatched against that tempo. The traditional defense mechanisms we've put in place for 20-plus years cannot keep up with this level of attack. And so I just want to close this off with a couple of takeaway points that I think are especially for anybody in the audience that's in the, on the defensive side and or looking to get into the defensive side. I'm going to close with a couple of these points. So first, I think it should be clear that adversaries are now operating at scale. And so we have to, as defenders, we have to instrument for for behavior, not for artifacts. So we have to get out of that static signature mentality. Second, AI apps need to be hardened like production systems because all of those, like I said, content is code, right? All of that can become part of your attack surface, as can the humans in your environments. They are now part of the attack surface, including all of the emotions that come with at a per-human level. And then Really, the last point, the high-risk actions that we have to go back to the old ways of verifying stuff out of band. It's funny how we've come full circle, but since digital trust is eroded now, we have to go back to things like, you know, safe words or signature patterns. Or like, for me, if I'm on a video with somebody and I have even a remote inkling that I am distrustful, I'll just call that person on the cell. Like Coach BZ and I did that one day. And when I said that, he called me on my cell. I picked up. He's watching me on the screen and he hears me talking on the phone. He knows it's me because if it was a nefarious actor that looks and sounds like me but doesn't have my cell phone, then it ain't me. And so if there's one thing that I hope you take away from this, it's AI is simply not making cybercrime louder or more effective. It's making it more coordinated, more personalized, and more economically efficient. And with that, I will conclude my session here, and I thank you all very much for participating.

All right, Andreas, thank you. Thanks a million. And I know you gave this live in the classroom. It was quite awesome. I believe I found the video that you showed about the deepfake. Let me see if I can play it now.

If you saw me online, would you think I'm real?

I really wanted to make our date. Could you just Venmo me some money quickly? This is the pill that can cure your cancer. I've been locked out of my entire mind. This is a major turning point.

This can be completely faked utilizing AI.

Kaling's new motion control lets you decide exactly how a person moves on screen, how the head turns, how the body occupies space. Earlier, deepfakes mostly did one thing: they replaced a face, sometimes a voice and a face, but the body movements and the hand gestures, those stayed human., and it was that limitation that made some scams fall apart. Now, with a single photo, you can generate a synthetic person that looks realistic. But most importantly, and maybe more dangerously, you can embody any real individual. I've been locked out of my account. I'm running in between meetings. Please just send me a link to get back in. I have no time to waste. It has never been easier than today to steal someone's digital likeness, their voice, their face, their physical presence. And no one's digital identity is protected for— by default. No proof of consent, no identity verification, no meaningful restrictions on high-risk targets. This is not some niche isolated threat. We're gonna be seeing systematic abuse at every scale, from a CEO to your grandparents to your kids. When realistic human behavior can be generated on demand with just a few dollars, visual trust is gone. If you want more videos like this, click subscribe. It's disturbing.

Yes, it really, really is. And you are right, even experts like myself can easily, easily be bamboozled, right? I believe it was, I guess, maybe 5, 6 months now, even the chief architect of Meta He saw a fake video, I think it was about ICE officers, I think doing something when they were in Minneapolis, and he thought it was a real video, but it was all deepfake, all made with AI. So what do you have to say to our audience, especially those students, about deepfake?

I would say, unfortunately, exercise healthy paranoia. You can't trust anything you see at this point. You know, you have to, like you and I did on the cell phone, you have to have these out-of-band mechanisms to validate who it is you're talking to.

Yeah, something out of band. And let me see if this is really you I am talking to right now. If it is, yeah, your phone seems to be ringing. I'm here. Hello. All right, so this is real. Yeah, it is really sad because If somebody you love, like a grandchild or a mother or an uncle or somebody, they're like, hey, I've been stabbed, or I lost my wallet, I really need your money right now. Like, you will stop thinking and you would go into action. And it's, again, it is all fake.

That's vibe hacking, right? They hack your vibe. Your emotional state got hacked and you go into action. That's really crazy.

Now, I couldn't find the exact video you showed in the classroom about Telegraph, but I have this one. Uh, I want to get your comment on this. I think this is from CrowdStrike.

Scammers are everywhere, and Telegram is no exception. From fake channels to crypto scams, these fraudsters are after your personal info and money. Let's break down the most common Telegram scams and how you can avoid them. First up, fake Telegram channels. Scammers create channels that look identical to real ones by copying profile pictures and pinned messages. But clicking on their links could infect your device with malware. Tech support scams happen when fraudsters pose as customer service reps, offering to "fix" your problem but actually stealing your info. Impersonation scams work the same way. If you get a message from someone claiming you won something, be skeptical. Then there's the classic romance scam. If someone you just met online is asking for money, they are likely a scammer. Phishing scams trick you into revealing your login details. Scammers might send fake Telegram emails saying you need to verify your account. Don't fall for it. Fake job offers sound great until they ask for your Social Security number or banking details. And crypto scams are everywhere. If someone guarantees you high returns, it's a scam. So how do you protect yourself? Never share personal info, don't click random links, secure your account with two-factor authentication, and use strong passwords. A password manager like Keeper can help keep your Telegram account secure. Start your free trial of Keeper Password Manager and protect yourself from scammers on Telegram and beyond.

All right, so what do you have to say about that?

So, I mean, those are all valid points, but that's only half the problem with Telegram. Yeah, during my talk I was addressing the other side of it where a normal user would never even encounter what I'm talking about. Yeah, so there's this entire underground that exists on Telegram. It's there, you just got to know where to look, and that's the challenge. Unless you have the right connections, I'll call them, you'll never know where to look. But if you're in that business and you do know where to look, the treasure trove of data is like, like, for instance, you can buy access to a channel that leaks those credit card data points that I showed earlier, right? And all you got to do is write yourself a script that scrapes at an API level, and you just literally have a funnel, a pipeline of credit card data coming to your machine. Wow.

So you could actually go to a restaurant and give them your credit card for your bill and they could actually scam your card?

Yeah, there are skimmers now that have 4G LTE cards on them. What that means is that if you give your credit card to the waiter, waitress, whoever, they swipe you, right? By the time they bring your credit card back, somebody's already using your card. You haven't even made it out of the restaurant and your card's being used.

That is incredible. So for our graduate student or people who are watching at large, what can they do to prevent those type of scams?

I, I think you really need to— so for example, when I give my credit card, I, I realize it's going to sound paranoid, but this is how you have to be. When I give my credit card, I'm watching that person the whole time. Yes, because if, if that card gets swiped twice, there's no need for that. That's obviously a telltale sign, right? But If I'm not watching, because they're real slick, right? Like some of those streamers are like right in there, they just, you know, they go like that and they just— so you, you have to be hypervigilant these days. That's just what the world's come to. And so I, I wish I had a more elegant answer, but I don't. You have to be hypervigilant and sort of paranoid. What do you think about, uh, Apple Pay?

It seems like it's a lot more secure, isn't it? It is. They don't use your actual credit card number, right? Right. It is.

But look, I will say this about Apple Pay and every piece of great technology that exists today. It's just a matter of time. Yeah, it is literally a matter of time till somebody just turns their focus, somebody brilliant, because let's face it, some of these bad actors are brilliant. It's just a matter of time till they turn their brilliance into that. It's the same thing that's happened with critical infrastructure. Think about it. We have yet to see a legitimate— maybe one, maybe two— but we have yet to see en masse legitimate OT-level attacks take place. Why? Because nefarious actors haven't bothered to learn those environments yet, or those communication protocols. The day they do— see, that's crazy.

Well, thank you. Thanks so much for, for your time. Before I let you go, if I can ask you one quick question. Let me see. I think it came from a student, and they ask, how can defender realistically keep up with attacker using automation and artificial intelligence? Because doing it manually, it's definitely not going to work.

Yeah. So I say two things. One, you have to educate yourself to the techniques of the nefarious actors as best you can, because if you don't understand how they're coming at your environment, you will never be able to properly protect anything. Once you have that type of understanding, and by the way, not all adversaries are going to be interested in your particular environment. So that type of intelligence is important. But once you have that intel, then you can start— I hate to use a cliché, but fighting fire with fire, if you will, because now, if they can operate at scale that your older technology cannot handle, you have to start legitimately building defensive mechanisms that can operate at scale as well. And it's an arms race. This is an arms race. Yes.

Captain Mask, I guess, making us pretty much have job security. This is not a question, but a comment from someone watching live. Monica, she says, hi everyone, really enjoying the discussion on how AI powers the next wave of cybercrime. It looks like she's in the field. So that's good. That's also another reason why I wanted you to do it here. Open up to the industry in general. But I think I have one last question from the audience. Daniel asks, is the real edge better code or a better internal code of behavior? And what does that actually look like in practice for your students and emerging leaders? It's a good question.

Better code is, is an interesting notion, and I'll say this, And this is important. It's gonna sound like, like a horrible answer. But if you take a step back and just listen to me, better code implies from current state forward. What about 30 years of code that we're still contending with? There's no way to make it better. Right now, with the technology that exists today, this is where you could kind of flip some of this on its head. You can use AI powered technologies to actually start scrutinizing all of the legacy code that we've struggled with for the last 30 years. Because to do it manually, I mean, let's just be honest. As someone who wrote C code for almost a decade for the government, I can tell you that, you know, you usually end up like this with no hair because there's a lot of legacy code in the government for sure. Yeah. And so who's going to do a security scan of all that code that got written 30 years ago where people didn't care about buffer overflows and memory leaks you know, and segmentation faults and stuff like that. And so now you have technologies that can actually take a retrospective look at that and say, hey, here are the patches. I think that's phenomenal. Yes. So I don't think it's a matter of better code. I think it's a level of hygiene, both backwards and forward. And I think we can get to a better place. But as someone who used to write code for a living, I'm— the challenge isn't writing good code. The challenge is being able to get the leeway, the time leeway to actually write secure code, because usually organizations are pushing you for productivity, not for security.

So I— okay, the very last, last question. I want my students to get a copy of your bestselling book, The CISO Playbook. Tell us why this book is critical, why you had to write it.

Because I talk about the— being a cybersecurity leader from a very real-world perspective, not an academic perspective. You know, I found that so many, so many folks have talked about being a CISO, we're talking about how it should be. No, I don't care about how it should be. I always cared about how it was in my day-to-day life. Yes. And so I wrote that book from that perspective. So folks can get ready for what it's really like. Like, you hear people go, oh, well, the CISO should report to the CEO. Well, they don't. So deal with it. This is your reality. You know, I don't care what it should be like, I don't report to the CEO. I don't have that level level of authority. Most CISOs don't really have authority, yet they're held responsible for, for things when they go bad.

And so that's the great majority are director, not actually C-level executive. Yeah, yeah, true. Well, thank you. Thanks so much for, for your time. This took a little bit longer, but I think it is really worth it. It's a very important message. Thank you so much for sharing, Andre. And this is actually your second time on the Leadership and Success podcast, and thanks again for being our master teacher today. I appreciate that.

Yeah, thanks for having me. Good.

All right, everybody, so I want you to, uh, follow, uh, Andres. So he is on LinkedIn, and follow him on his website as well, uh, Andres, Andrew.tech. And also get a copy of his best-selling book, uh, The CISO Playbook by CRC Press. You can also get a copy of one of— I think it's very first book, Professional Pen Testing for Web Application. And it would also be a great idea if you actually went back and listen to the hour-long interview we had about the CISO mindset, strategy, influence, and impact. That was season 5, episode 80. It's available everywhere podcasts are available. Okay. That is all I have for today. I will have to have a podcast later today in about an hour. I'm gonna be speaking to my shipmate, Commander Julie Rosari-Vira, US Navy retired. We're gonna be talking about leading from the cockpit Lesson in Trust, Courage, and Command. And then around 4 PM California time, I will be speaking to my adopted mentor, Colonel Michael "Check the Mic" Black, US Air Force retired. We're gonna be talking about going from Tuskegee all the way to the White House, a blueprint for purpose-driven leadership. So I hope you can join us, and thanks again for watching. Bye for now.

Thank you for tuning in to the Leadership and Success Podcast with your host, Coach BZ. If today's episode episode added value to your leadership journey, be sure to subscribe, share, and join us again for more wisdom nuggets on how to lead better and achieve greater success. Remember, leadership is the most critical skill of our time. The world will always need leaders to inspire others, drive innovation, and execute meaningful strategy. So why not count yourself among the bold leaders shaping the 21st century? Until next time, stay inspired, stay committed, and keep leading with excellence.