Huge ransomware resurrection! And the irony is astounding, plus MORE from CISA!

All right, good morning, my friends. Happy Monday to all of you. Is it really Monday? I— let me tell you, I was in— if you count Tampa where I live, I was in 4 cities in 5 days last week. So I think everything is like this big blur and the weekend itself was just like an attempt at recovery. It's really good to be back home in my happy place here in my studio. But man, it was really good to meet a bunch of new people. And I think even broader than that opportunity to go see so many good friends and speak at some events and really just diving deep into cybersecurity insurance, which has become one of the hottest topics in the market today. Right. So Really good. If I saw you this past week, shout out in chat and let me know. It was great to, to be on the road, but I got to admit, I am glad to be back home. I've got spring break coming up and looking forward to doing some great things with the family. So on a Monday, what better news than covering some incredible stuff that's happening? And I don't mean incredible in like the great way, honestly. I mean incredible in some things I don't think we thought would see we would see, we're seeing a resurrection in a ransomware threat actor. And I wanted to cover that today. I wanted to dive into who they are, what they're doing, the implications, which are pretty important, and even some of the irony that exists in all of this. Also, some news from CISA last week. They released a new tool. I'm going to cover that tool. It's kind of an interesting, very interesting perspective. It will see how useful it's going to be. I'm curious to see what everyone else thinks. And also we're going to talk a little bit about deception. Deception is a topic that I mention periodically, but we don't do enough around it. So you may be like, I don't even know what you're talking about today, Wes. What is deception? Well, I know what it means to deceive, but what do you mean by this? What's the relevant context? We'll dive into that too. So if you're watching today and there's a whole bunch of you on, just let me know in chat. I've got it up and just say hello to us. Let us know you're here. Glad you are in with us. And I think without any further ado, let's just jump right in. So first of all, before I say anything more, this is all brought to you by my friends at Empath, which I kid, I am Empath. Um, and man, we're doing some amazing things. If you're an MSP and you're really trying to learn cybersecurity, and maybe you're in a non-technical role, maybe you're somebody that is really trying to figure out this whole world of cybersecurity, trying to understand, um, what is this, how do you grow in your knowledge around cyber, Empath is for you. What I've noticed over the years is there's lots of great technical training that's out there for people that want to go in a technical direction in cyber, but for people outside of that, there's literally nothing out there, and Empath is solving that problem. So take a look at— I mean, just look at the stuff we've been blitzing through of late in the community. I already mentioned one of the tools we're going to talk about today. We've got a really awesome webinar coming up very soon in a couple of weeks on data flow diagrams. You don't want to miss that. We've got some really cool things happening with Intro to the CIS Controls. If you've heard of people talking about the CIS Controls and how to make sense of them, this Wednesday we're going to dive into an intro level. I'm going to introduce you to why they're awesome, how to start using them, how MSPs are diving into them. It's going to be a phenomenal session. You do not want to miss this thing. We talked a lot about supply chain risk. There was some really interesting things that happened last week that Amazon got caught up in because of a supplier of theirs. And boy, in the live stream, a lot of folks are like, yeah, we're not ready for this, we're not doing a good job talking about all this. Um, Tim Golden checking in saying hello. Tim, I got you right here. I'm excited to jump in with you.

Where did you go?

There you are. On data flow diagrams. If you're not aware of what Tim's doing, um, really amazing stuff at ComplianceRisk.io. Um, so anyway, I just want to show this to you. It is just blitzing, it is alive, there's so much great stuff happening. And if you want to dive into Empath Cyber, you can absolutely do that. Just empathcyber.com/join. If you want to make Matt Lee mad, I've got a QR code right up there that you can just go and sign or click. It'll just take you right to my website, empathcyber.com/join, and you can jump in. It is so affordable to jump in. One of the best decisions that you're going to make throughout the year. Would love to see you jump in if you're ready to grow in your knowledge in cyber. Or maybe there's somebody at your MSP, they're like, I need them to get in. Just get 'em in, right? Reach out to me, let me know, love to have them in. All right, so let's jump into the first piece of news that we have today. This comes in from Bleeping Computer and it's pretty staggering stuff. So Clop, does anyone remember Clop? C-L-O-P, Clop ransomware. So these punks, these guys have been around for quite some time, I think since like 2019, to be honest. And they've been some miscreants on the scene for quite some time., and I want to share why this one is, is, is so interesting. So Clop ransomware gang claims to be behind the recent attacks that exploited a zero-day vulnerability. Now we know what that means, right? It just means a vulnerability that's been discovered that the, the manufacturer, the supplier was not aware of. Generally speaking, high level, that's kind of what we're talking about, right? Um, specifically in this Go Anywhere NFT, MFT. Oh man, my, my crypto just slipped out. Did you hear that? My crypto NFT. No, not Go Anywhere NFT. Sorry about that. Let's try that again. Go Anywhere MFT. It's a file transfer tool. And, and Clop claims that they stole data from over 130 organizations. Now, first of all, we can't confirm that it's been 130. That's just what they say. Bad guys are notoriously— they have a lot of bravado. And they'll say anything that they need to say to put pressure on companies, to hit the scenes, to get attention, to get people talking, to get people concerned. So I don't know that this whole bravado thing with 130 orgs is accurate. We'll have to find out over time. We'll have to find out. Okay, so let's go back to the news. Um, some interesting things here as we dive in. Security flaw is now tracked as CVE-2023-06- 6.9. Now that one is in CISA's list of key exploited vulnerabilities. If you don't know the KEV list, you need to go find— I guess I'm not going to cover that today, but basically what CISA is doing is they're pushing forward to say, just at a high level, we want to make sure that organizations know there's a lot of vulnerabilities that are out there. Some are highs and crits, some aren't. But what I really want to know is, are there things that are being exploited in the wild? And if there are, and I'm using those things, I should drop everything I'm doing and go tackle that issue. Taking that platform offline. If there's a patch, deploying the patch, understanding mitigation. So the kit, the KEV from CISA is really important. And believe it or not, this vulnerability in this tool, this GoAnywhere MFT— got it right that time— tool hit the KEV. So that's why it's really important. Okay, so, uh, Klop reached out, uh, to Bleeping Computer. And so, so Look at this. In this case, the ransomware actor themselves are leveraging news media. I'm a huge fan of Bleeping Computer and Lawrence Abrams. Like, they do amazing stuff as a company. But just be aware that the bad guys, like, they read the sources we read. They actually reached out. Isn't this incredible? To Bleeping Computer and said that they've already stolen data. So like, they're like, hey, Bleeping Computer, look what we did. We stole data. You should be aware of this because what are they trying to do? They're trying to amplify the pressure on these organizations. They're basically taking it, you know, like when you've got a forge and you're like the billows and you're blowing oxygen into like heat things up. That's exactly what these bad guys are doing. Exactly what they're doing. Matt Lee checking in. Matt, what's going on, my friend? It was so good to see you last week. Matt invited us to his swanky hangout with JP and had a great time going to see my friend Matt Lee. It's good to see you on, brother. Okay, so let's move on a little bit more. So, so, so So this— so, so at this point they say we've, we've, we've hit 130 orgs. We don't know if that's true or not. We know that it has something to do with this, this new vulnerability, this zero-day that's scaling up. And by the way, we're not out of this yet. This is still a big deal. If you're using GoAnywhere, you need to go drop this livestream and go take care of that. I'll show you why when we get to this in a minute. So it hit the Kev list. I mean, it really started to blow up. Now, they— Clop claims that they can move laterally, deploy ransomware because the vulnerability allows them to deploy code and do whatever they want to do inside of it, according to them. Right. Bleeping Computer, we couldn't independently confirm all of their claims.

Right.

So, so we don't know about that. But then look, Huntress checking in. Let me just say a little PSA here. And by the way, I just realized the irony. I'm wearing a Huntress shirt, which is super cool. Huntress is— I just love the fact that they're always on the scene. We're in an age now where Huntress, who's traditionally been a channel tool that's been an amazing company doing awesome stuff for MSPs, is now— just think about this— is now— and this is not the first time, they get quoted all the time, but I feel like they've grown up in the sense of like, I'd love seeing that they are quoted inside of Bleeping Computer, inside of Threat Intelligence, that they're cited from CISA. They're just mentioned, they've been mentioned in headline, like, you know, Wall Street Journal and places like this. I just think it's awesome. It's, it's good for this, it's good for us as MSPs for credibility to say we, we have one from among us, a vendor that's an amazing company doing amazing things, and they're being quoted in headline news. Like, that's, that's huge. So not just— I mean, huge kudos and thank you to Huntress for sure, I want to say that. But I also want to say we also all reap a little of those benefits. Just to say, like, this is a tool that so many MSPs use. It shows MSPs are growing up, and companies like Huntress have helped us in that growth journey. So just wanted to throw that out there, just say thank you. No, Huntress is not sponsoring this. They paid me $0, not for the shirt, not for the live stream. I just saw it show up, I didn't know. I'm like, awesome, there's Huntress quoted. Yes, it could have easily have been like CrowdStrike. I just think that's awesome, awesome, awesome, awesome. Okay, so Hunter's Threat Intel Manager Joe Slowik quoted this and they're tracking it back to TA505.

Don't worry about that.

That's just a threat actor. That's just like saying this is who we are attributing. This is the bad guy we think is doing this, that's running this. So it's pretty interesting. It is being like actively exploited. If you, if you scroll down here, look at this. This is a Shodan. This is basically showing where this tool is showing up. There's about 140 or so of these instances where the actual web admin platform is exposed to the internet. And this is where, from what we're seeing, the zero-day is occurring. It's a zero-day against the admin platform. When the admin platform is exposed to the internet, boom, nasty things happen, right? Okay, so I wanna kinda like, there's more to this in the article. You can go check this one out from Bleeping Computer. But what I want to do is cover a couple other things. So this came in months— a month before, February 6th, exploit released for actively exploited Go Anywhere MFT zero day. So like, here's what's interesting. This thing is coming up, and I realize this is all from February. I'm covering a month-old news, but it's gonna come up in a— I'm gonna show you why I'm, I'm jumping into this. Okay, so also a few days before that, the exploit code was released, which is pretty interesting. So you could go and see the exploit code, you could see how it works. It's not like at some point we went from zero day to like, we we all know about this, and bad guys released this. But here's what's kind of interesting to me. Look at this. Here's the irony in all of this, and maybe I'm just gonna— I'm gonna, I'm gonna give you a hot take here in a minute, and maybe I'm like way off my wheel, way over my skis, off my rocker. You guys tell me what you think, this what I'm about to say, okay? Maybe I'm just way off here, okay? But there's irony. Look at this irony. GoAnywhere MFT. Man, I just want to say NFT every time. GoAnywhere MFT is a web-based and managed file transfer tool to help orgs transfer files with partners, keep audit logs.

Look at this.

Paying attention? Its developer is Fortra. Okay, Fortra. I think I've heard of them. What's Fortra? Oh, I don't know. Formerly known as HelpSystems.

Look at this.

The outfit behind the widely abused Cobalt Strike threat emulation tool. Are you kidding me? Are you kidding me? So this tool that Clop is used to allegedly go after 130 organizations is the same tool. Let's go see if that's true. Let's just see. Here's Fortier right here. We go take a look at their products. Here's a whole bunch of stuff. Yep, there's Cobalt Strike. Bam. There it is. Huh. Interesting. And as we go down a little bit further, we will see GoAnywhere. There it is right here. Go anywhere, MFT. So look, all I'm saying is this. I'm not, I, I'm not throwing shade. I'm not saying that Fortra doesn't care about security because clearly they do. They got a lot of security tools. But I am saying, isn't there irony in the sense that like we've seen Cobalt Strike being used for years by bad guys, which is a legitimate tool? In fact, it's used so often that people that like are not like heavily into the security, like pen testing and like that, that type of scene, the red team scene, would probably tell you if you interviewed them on the street, Cobalt Strike, what is it? Like, oh yeah, that's a bad guy tool. That's, that's how much it's been abused. Legit. So what am I trying to say here? Isn't it interesting that a tool that's been so widely abused by bad guys, now we see another tool from the same company that's being abused with the zero-day that's caused a whole bunch of damages? I'm just saying there's something there. And what I would want to know from you is, am I off my rocker here to say, like, does this all go back to CISA's comments in the national— really, the National Cybersecurity Strategy's comments around holding manufacturers liable?

I don't know.

Maybe, you know, the coin hitting heads twice doesn't mean that it's always going to hit heads twice, right? Maybe commonality and causality and all this kind of stuff. I don't know, but I just saw Fortra and I saw the irony of, huh, the same company. Now I realize we could also make the, the argument, well Wes, how many times has Microsoft been in the scenes? Over and over and over and over again, right? So I get that, right? But I just saw that and I saw some irony there. And maybe I'm just, maybe I'm just off my rocker a little bit.

I don't know.

I'm just curious what you guys think. Matt checking in. LOTL is going to happen. If it's a tool, it can be a weapon, just like in real life. Yeah, that's, that's super true, Matt. Completely agree. They should make illegal activity from Eddy against their software usage agreement solved. Yeah. Yeah. No more. Right. Don't—

that's it.

We draw a line in the sand. Right. Exactly. So I don't know. Tim saying no such thing as a coincidence. I really don't know. I just— I hope you see the irony in it. Maybe we shouldn't draw any lines there, but I see the irony. Okay, so let's go back a little bit more and I want to cover what Washington Post says. I love their Cybersecurity 202. I am such a big fan of Washington Post for doing this. It comes out every week. Here's the timeline on all of this and here's why I am going to pick on Fortra a little bit more. So Fortra identified a private notice on its customer portal on February 1st. Remember, before all of this, February 10th, the, the code was released February 6th, at least for the news article. So at least a week before they were notified about this, of the zero-day, as cybersecurity journalist Brian Krebs first reported. So in fact, we can go even see what date that was when Krebs reported this. So here it is. This is— where's the date on this sucker? I'm not sure why I'm not seeing it. My brain is hurting today with Mastodon. But anyway, so he reported it presumably at least a week before. And then one victim, Hatch Bank, noticed that they, they, they've sent a notice they were, they were impacted somewhere between January 30th and January 31st. So even this butts up a month before, right? So this has been around burning for at least late January. So on February 7th, Forture released a fix for the vulnerability. I'm okay with that, right? Like if, if it was late February— I'm sorry, early February, when, when Fortra was notified that, hey, we have people that have been hit by something. It looks like it came through your tool. It takes a few days to unpack that, to figure that out. Right. Totally get it. But here's the issue. As Washington Post says, the company has faced serious questions about what it told customers. Software maker Fortra told its corporate customers that their data was safe even when it wasn't following a ransomware attack on its systems, quoted from TechCrunch. You know where I'm going with on this? I think you do. I don't understand why— I'll never understand why corporations will say things that they think is true, that they want to be true, but cannot prove that it's true. What is it Ryan Weeks always says? Evidence of absence is not absence of evidence. I say that right. Absence of evidence is not— absence of evidence is not evidence of absence. Yeah. So we can't prove at this point, Fortra, that no one was impacted. But that doesn't mean that you can't say that wasn't. And these are the things that always come back to bite you in the rear. Always. I mean, Why is it that we are so pessimistic in this industry? I will tell you why. It's specifically because of stuff like this. So really poor statement that I think led us down, or Fortra down, kind of a negative, a negative direction, right? Two victim organizations told TechCrunch that they didn't learn they'd lost data breaches to the hackers until they received a ransomware demand. When asked about this by email, Fortra spokesperson Rachel Woodford said, would not comment, but did not dispute what the two organizations had told us or that Fortra had told their customers their data was safe. So they're basically like, yeah, I'm not going to dispute that. Maybe he shouldn't have said that.

Right.

Moving on a little bit more. The Fortra immediately took multiple steps after being made aware of suspicious activity. And I think that's clear. They did. Right. It took them, you know, a week or so less than the better part of a week to go address and correct. Good for them. I mean, that was fairly well done. I think it takes some time to get through all this, right? They're notifying customers, working with CISA. It went on their must-patch vulnerabilities list, like I mentioned before. So there you have it. So they, you know, and of course they say the same thing. Take Klops' claim to have hit 130 victims with a grain of salt. So here's what I think is interesting about this, all from the Cybersecurity 202. If you want to take a look at this is for sure. We're seeing this new era where, well, first of all, let me say this. Clop had really went silent for the better part of a year. So what happened with Clop is they had a bunch of arrests. The feds, international sting, whatever you want to call it, went after, arrested a bunch of the Clop people. And most people said Clop is probably done. We'll just see. We'll see like the remnants like go spin up into a new threat actor group. Well, wouldn't you know it, that didn't happen. Um, after those arrests were made, there was definitely some upheaval, and now Clop is hit and they're back on the scenes again. I think our average estimate of damages and like money that, that Clop has stolen since 2019 is somewhere around $500 million. So they've been successful in what they're doing, and we're seeing this resurrection from them. And what we're seeing out of this, and here's why this is relevant, I want you to listen to this. The relevance is this: these threat actors are many times shifting. They're always looking for what's the, what's the weak point that I can, that can I, I can exploit. And so for Clop, in this case, it was the GoAnywhere MFT platform from Forza. They discovered, whoa, this thing has got a major vulnerability. If we put a lot of our time and attention into this and we sink everything into this, we might be able to use this to do something really nasty. And that's exactly what they did. That's exactly what we saw happen. They took advantage of it. They broke in and they went after dozens of organizations. They claim 130. We can't authenticate that, but we know some really big ones out there. In fact, one of the biggest ones was— and I didn't cover it for whatever reason— was Procter Gamble, P&G, big massive multibillion-dollar company, was one of the ones that got hit in this. So this is where we're seeing an evolution with bad guys, and we've seen this I think for years, even as far back as 2018, everyone remember the vulnerability between Kaseya and ConnectWise, one of the very first times we saw MSPs get hit en masse and we saw what GandCrab was able to do with that. You look at many of the attacks, the SolarWinds attack, you look at the Kaseya attack of a couple of years ago, you see bad guys really start to say, you know what, we found a weakness, we're going to go all in on this weakness and we're going to leverage it to pop as many organizations as we can. Happen, period. Bam. And that is where the damage occurs. That is where the risk is. And we've got to be ready for that, because here's the thing: you're just operating, you're doing your normal thing as a business, and then some tool that you use somewhere down the line has some big issue, and you are exposed to it, and really bad things happen. So this is what we're going to continue to see over the years, is maybe a threat actor group goes silent for a little while, we don't hear of them, and then they find something and they go all in on this for weeks to see what can we do with this, what can— what kind of damages can we do, how many orgs can hit, and then bam, they release it and really bad things happen to a whole bunch of organizations. This is how they operate. This is the new era. We've got to be ready for it. So this case, it was Clop. The, the victims were tons of organizations, and the entry point was specifically through that GoAnywhere MFT. So I guess this all comes back to a bunch of things. You've got to pay attention to CISA's KEV list. You've got to have mature patching regimens and hygiene. You really need to do threat modeling in the sense of like understanding what is exposed, what can a bad guy hit? And you've got to be on your toes. But you also got to realize I can put all the things in place that are right and still get smacked by something. So what am I going to do after that happens? Man, so much good comment happening in chat. I hope you guys are listening and reading into the chat because, man, really, really good stuff. It's all happening right here from amazing people like Matt Lee and others. So I want to pause for a minute and I want to do a shout out. To two conferences that I would love for you guys to consider attending. I am not being paid a dollar for this. I'm not a social media influencer that takes money so I go promote and, and say things that people are paying me to say. Nope. I just love to promote my friends, and I love to, to make sure that other people are aware of other things that are happening out there that you might have been thinking about going. You may have seen, or maybe you haven't. And the first one I want to show to you is is this one right here. I don't know how many of you guys are thinking about going to MSP GeekCon. This thing is happening in 54 days, May 21st through the 23rd. If you're somebody that's in a technical role, or maybe you're somebody that manages technical people and you really want to take yourself to the next level, you guys all know MSP Geek, an amazing community of tens of like 10,000+ people. I mean, they're awesome. So I want you to check out MSP GeekCon. I'd love for you to go. I'm gonna go there. I'm gonna speaking. This is going to be a really solid event. Go check this out. Thank you, Tim, just put it in, in Slack. MSPGeekCon.com. Um, really good. Early tickets now, early birds, $399 instead of $499. So jump in, get reserved, go look at all these amazing people that are speaking. Like, and by the way, like, you're talking top-shelf speakers here. Have you ever heard of Kyle Hansloven, the guy from the shirt, right? The guy that was just mentioned, or the company John Hammond, a security rock star. Ashley Cooper, everyone knows Ashley, she's amazing. Erin Chernin, the one and only John Strand. Oh my goodness, John, like he's one of my heroes, just an amazing person. Kevin Talagar, like this is awesome. I mean, and so many people, I just look at all the amazing people are gonna be speaking. The cool thing is like I'm looking at these pictures and I'm like, I know you, I know you, I know you, I know you, I know you, I know you. They're all, it's incredible. You'll have to excuse this guy down here that wears a shirt his own name on it. That guy's got to be a joke. Never trust anyone that wears a shirt with their own name on it. Um, this is going to be jam-packed. I mean, there's— here's the thing, you could throw a conference together and have a few people come and speak, it's kind of like whatever. But when you have like titans come in that are speaking like really good content like this, this is awesome. So I want to see you there, it's going to be incredible. The other one I wanted to pitch and throw at you is this one from Jennifer Bleem. Again, Jennifer's not giving me a cent to say this, I just know it's awesome. This is sort of like the other side. This one's coming up June 13th, and this is going to be in Orlando. The Ultimate IT Growth Conference. What I love about this one is it's really focused on the, the softer side of the house, right? So maybe you're like, okay, I love MSP GeekCon. I'm not in a technical role. It's not as much for me. No worries. Go send your people to it. And this one may be the one for you. And I'm going to be at this one as well. So I'm promoting both of these, not just because I'm there, but because I know they're going to be awesome. I wouldn't go to something if it wasn't gonna be awesome, right? So this is all about really kind of taking your business to the next level. Um, I want you to go— could you go take a peek at this one? What Jennifer is doing is just awesome stuff, and she has a security one as well. Jennifer, I don't know if you're watching right now or someone wants to link me to it, um, but, but I want to see you go to both of these. They, they'd be really, really solid, and I love what Jennifer's doing. I love Jennifer's message and how she's really pushing security, and she's doing a lot of what we're doing at Empath too, is really trying to help those on the non-technical side of the house to just grow and learn in cyber and understand how this works, especially in sales and messaging. And how do we get that on board and get that going? So I want to throw both of those out there as just a quick little plug. Becky Teal checking in. Becky, good to see you on. MSP GeekCon is going to be fantastic. Yes, it is. It absolutely is. Okay, so I want to jump into another topic here, one that I think is a, is an interesting one. It's one that I haven't talked to, uh, like a whole lot about often, but I do, I do want to talk about it a little bit more today. So, and it's this topic of deception. So let me throw this out to the live stream, to all you awesome folks that are watching. Um, what does deception mean to you? What does it mean to say cyber deception? What's your definition of it? Um, How do you, how do you think through what deception is and what is, what does it mean for maybe your organization? I'm curious to see what you think. So, and the reason I say that is because I'm going to show you this and I think it's interesting. Before I show it, I don't know. I don't— let me, let me caveat before I show this to you. I don't— I'm not saying this is a game changer because it's not. I don't want to use heavy language.

Switch.

But I do think that it's an interesting take. Okay, so let me just say it this way and I'll see what your take is. So this comes in over from the Hacker News, and this is from our side, our friends on the other side of the pond. So UK National Crime Agency sets up fake DDoS-for-hire sites to catch cyber criminals. Okay, interesting. So like a sting, is that what we're saying? Like, you know how we drug dealers, you know, sometimes you'll see cops, you know, we all watch the TV shows and, you know, you have like undercover cops. So we have like undercover, like hacker stuff going on too. Is that what we're saying? That seems to be exactly what we're saying. So deception is interesting because deception leverages a strength that we have on the defender side that I don't think that we tackle enough. I'm going to get back to the article in a minute. Deception is all about, okay, we have to work as bad guys. We have to work with anonymity. While we might have networks set up and forums we communicate with, none of us can go share our actual identity because if we do, bad guys or the good guys are in the same forums. They're just going to go see it. And they're going to go hit us. They're going to go— they're going to use that to come after us. So we all have to stay hidden. We have to have our Guy Fawkes mask on. We have to be— we have to operate in the shadows. That gives us the opportunity as defenders to operate in those same shadows, and we can leverage the same strength that they use to their advantage to stay undercover against them. We can use the same capabilities of your need for anonymity. Anonymity. I can jump into that. Thread and say, I also can use anonymity and I can use that to potentially uncover some things. Let me give you an example. I've given this before, like on Cyber Call and other places. I know a bank— I won't say which one— that intentionally releases fake credentials onto dump sites, like names of customers that do not exist. Why? The reason they do that is because they know that they're fake. Bank credentials and only the bank knows it. And then they have their SIEM set up to alert. It's almost like canaries. So they ever see a single hit, a single login, a single anything to one of those user accounts, emails, bank account numbers, whatever that they know are fake, they automatically know this is malicious use. And then they can use— even though the bad guy can't do anything with fake credentials, they can then use that to go correlate, almost reverse the maze, so to speak, and say, what else do we know about what that attacker has hit? Maybe they've also hit this account, this account, and this account. Oh, Well, we know those are real, so that's probably compromised accounts. That's the idea of deception, of using what we know and you don't against you. Another example is— Tim says here in chat— is canaries. Canaries are a great example of that. We deploy canaries around and we're looking for something to hit it. We know nothing should ever hit it because it's not real, and I can use that to do something about it. Okay, so deception is not going to solve security for us. But deception can give us an early warning system. Deception can leverage some of the same tools that the bad guys use against them. And it's something that I just don't think that as defenders we do enough with. And I also think the government is better positioned to do deception much greater than we are as a whole. And so I— that's where when this article came back, I'm going to dive back into it, um, that's why I was interested in it. So let's go back to the article.

Okay.

Yeah. And like Eric says, it's kind of how they do marked bills in today's digital landscape. Yeah, exactly right. Matt says a good example could be checking to see if your employees are susceptible to being recruited by an insider threat. Yeah, right. That's, that's an interesting one, right? Okay. So in what's a case of setting a thief to catch a thief, the UK NCA revealed that it's created a network of fake DDoS-for-hire websites to infiltrate the online criminal underground. So if you don't know what DDoS is, it's basically these tools that have existed for a long time. That just smash a website or a domain or an IP address. So much traffic shuts down. This was like the cool thing way before ransomware was like the big deal that it was. And you even had certain threat actors that would do DDoS for service and they'd say, hey, we hit you with like, you know, 10 minutes of outage. Did you notice that? If you don't pay us a Bitcoin, we're going to hit you for days or weeks. You know, we've come after you, so you better pay up. You know, it's literally like the old school, you know, protection rackets from mafia, right? All the NCA-run sites, which have so far been accessed by several thousand people, have been created to look like they offer the tools and services that cybercriminals use or whatever to execute those attacks. Right. So they spun them up. They're just like all the others. I remember seeing these from like the days of LulzSec and all the rest. You basically log in, you give them some amount of like Bitcoin or crypto, then you get access to their network and however much you pay is how much access time you get. To these, these services. Right. However, after users register, rather than being given access to cybercrime tools, their data is collected by investigators. So that's the purpose here is they're like, they don't do it. These tools spun up by the government, they're not really doing anything. They're just getting you to go to them to try to sign up. And then they use that for intelligence to say, what else can we gather? Because we know it's probably either bad guys or researchers. That's going to be who's going to be using this stuff. Right. Effort is part of an ongoing international joint effort called Operation Power Off in collaboration with authorities from the US, Netherlands, Germany, Poland, and Europol aimed at dismantling DDoS-for-hire infrastructures worldwide. So a question would be, do you think that's actually going to do anything? Like, are we going to see any good out of this? Is it going to fix anything? You know, I'm curious what you think about this. My view is, is this: I think it helps, but it's not going to solve the problem. Right? Um, I think that from my perspective, those kind of things are an interesting take if it helps government to say, we spun some of this up, it was low effort, and it gave us some intelligence that we can use with other campaigns, other threat actor tracking, other intelligence that points us in another direction. I don't see how this is bad. I don't see any negative in this. I wouldn't go so far as to say this is like the most brilliant thing ever that's going to solve security, but I also don't think it hurts. I don't think it like causes us any challenges or any like, oof, yeah, but man, you're gonna really— like, that's gonna have a really negative downside over here, you know? Like, I don't see any of that. So I think it's interesting, right? I just wanted to share this and say I would love to see the federal government continue to do more around deception. Um, I happen to know there are some groups inside the government that actually do more than this. One of the things that you'll see some do— and I guess I don't have articles and links I can show you on this, but it's true because I've talked to the people that do this and I know it's true— um, sometimes the federal government also pays attention to data access brokers. These are bad guys that, um, that, that, that are— that get access to a company like what we call initial access to a phishing attack, something like that. And then they sell that access to a ransomware actor because it's easier for them to just get initial access to a company and then sell it to somebody to do the nasty than try to do the whole thing themselves. So it's like a supply chain, right? And I do know federal government actually watches some of those groups and they actually purchase access from those access brokers and then they use that to go to the company and say, hey, you've been popped. Here's what we know about it. Do something about it. I actually think that's awesome. That's another form of deception. Bad guys like looking and lurking in the same places that good guys are watching over. So I don't know. I think deception is something that we just— I'll close with this and I got one last thing to talk to you today on. I'll just close with this. I think deception is— oh, look, Sue, we got a guest coming in here. Let's see if we can bring this gentleman on. Let's see here. Matt Lee, what's going on, brother? It's good to see you all.

You know, gentleman might be a loosely defined term, I suppose, by that, uh, but that's fair. That's great.

So deception, Matt, talk to me about your thoughts on this. Why do we not talk enough about deception? Is it just too impossible? Is it just a, a rabbit trail that we just can chase forever?

I think the first part of it is, is that we don't talk about deception because that's the first rule in deception. No, I tease, but You know, I think it came up recently for me, right? There was an MSP that you and I both know that's pretty mature, and they had a threat actor try to offer $1 million for someone to come in on a Saturday and give access to the RMM. And you can imagine what that would be for, right? And so it made me think, how do you solve that? Well, you do the basic things like principles of least privilege, limit what they can access to the best of your ability, increase the detection. But at what point do you start using deception and counterintelligence methodologies for your own benefit, right? And I gave an example and I was being a bit hyperbolist, but also not, right? And here's where it comes into a third plane of thought. What if I was to tell my employees I am going to check to see if you can be recruited by a threat actor as part of my own counterintelligence? Well, if you tell them that, now every time they get that request, they're going to wonder, Right. And so you think about if you get back into the spy game in the '50s and all the talk about it, and we've all loved it in our James Bond. But if you really get in the tradecraft, deception is always part of this, right? Like it is. You have to know thy enemy. You have to be able to manipulate things. So I think— I don't know why we don't talk about it much. I would probably make it akin to our own lack of maturity in understanding cybersecurity and the threat actors as a general public and as a whole. In my thoughts.

So yeah, I completely agree. And you're right, going back to even like just war history, you know, deception has always been part—

I mean, going back to the days of Trojan Horse thing, I don't know, Sun Tzu's writings. Yeah.

Yeah. It's been around forever. I have a friend who has a lot of World War II memorabilia. He's just sort of a collector and he has a, he has a dummy bomb. It's like wooden. It's the same size as one of the cluster bombs that were dropped from the B-52s. And it's wood. And so they used it for training purposes. And he said, this one in particular is a really interesting one. I said, why? He goes, this one was actually dropped in war. I'm like, what? It's wood. Why? He said, so, uh, there was a period of time in World War II when the Allies were getting ready to come after Germany, when, you know, the war had really kind of— we had gotten through Normandy and it's really a push to Germany. And so what the Germans had done at this point in time was they spun up a bunch of like fake tanks that were all made out of like wood but but painted them to look real, but they're all made of wood. And we saw them with our spy planes. And so Germany was hoping that we would just misallocate our forces and apply a bunch of weaponry to these, to something that wasn't real. And so what they did was they actually sent a B-52 over, dropped one bomb. It was that actual wooden bomb, just their way of coming back saying, we know this is fake. We see that it's wood. Here's a wooden dummy training bomb. That was when they dropped—

take that same thought forward. And right before we did storm the beaches of Normandy, We used a similar deception campaign that they themselves fell for, right? They themselves made a choice to deploy forces to reinforce that state.

And those were inflatable. Isn't that crazy? But it worked. It worked.

It worked. And I think back, bringing it back to cyber though, I think you do see certain practitioners using, you know, canaries, right? Huntress, other players have had canary files and folders that are those sacrificial pieces. But I think you'll see more and more of these type of deception campaigns. There you go, Ernest, coming in with the Army Signal Corps. Yeah, but the point is, yes, I think deception campaigns and trying to understand the TTPs of the enemy has matured both at our level and the government level too. I mean, if we're honest, you know, if you look at the MITRE ATT&CK framework and the data gathered about TTPs, not even mentioning the secret involvement, right? I think there's been two major players that I know of for sure that a lot of their delays in reporting things was because the US government was involved quite secretly trying to gather TTPs about some threat actors that they knew and were actively tracing. Right. So we are seeing a bit of it being used for sure. I don't know how effective— I'm with you when you were saying that and I was listening, you know, I don't know how effective this particular one will be. But to your point, the more they can take that data and use it to aid in other scenarios is good. But remember, the ephemerality of of our tech, right? Like, an IP address on DigitalOcean might be mine today and someone else's in 3 days. So, uh, that side of that gets really tough.

But yep, exactly, exactly.

Thanks for asking me the question, man.

Um, I, I think it would be— what would be fun at some point is to have a bunch of smart people get together and say, especially in the channel, and say, let's create a— we don't have any answers here, but we want to just do a think tank, kind of like a 2-day deep dive with a bunch of folks and say Hey, can we get together and talk about deception? What ideas can we throw out? What opportunities could exist? I mean, imagine a whole bunch of smart folks all coming together, you know, tackling that and coming out with maybe 2 or 3, maybe projects that a bunch of vendors and MSPs could work on together and some things we could do. I just, I don't think we've expanded on it.

Collaboration. The other thing I want to toss out that's been on my mind recently is the, you know, we've all talked about shared responsibility matrices, but I'd love to see a shared responsibility matrix done through a RACI methodology, right? Instead of just yours or mine, it's who's responsible, who's accountable, you know, who's consulted and who's informed. But that'd be one for the Think Tank Post-it board, I suppose, for us to talk.

It'd be fun. We should get one of those going one of these days. It'd be a lot of fun. All right, Matt, the last one I had that I wanted to share about today. You don't have to leave yet if you can still stay on.

I got 5 more minutes, 10 more minutes. I'm good. Perfect. Perfect.

That's about what I've got. So last week, CISA had shipped out the— I keep wanting to call it Untitled Goose Game. I don't know if anyone played that on the Switch and all those other games. You're literally— it's like a goose simulator, you know, like stealing keys from the farmer. I suppose that's where this joke comes from. So they have the Untitled Goose Tool. And so first of all, I love that CISA has some humor in them from the whole thing. But this article is talking about it. What I'm going to do is I'm just going to jump over to their fact sheet. And I think this is an interesting tool. I don't know how many MSPs will be able to actually leverage this in day-to-day use. And it really does seem to be a, you know, an incident response tool. But I thought it's pretty interesting, right? So what it does is it gathers some data, especially in an instance where a SIEM may not exist. So you don't have all the logs. And so I can't tell you how often IR comes into a situation. There's never been a SIEM in place. And so they're just missing a lot of data that doesn't happen to exist. And so where do I get some of it, you know, from, you know, what is the ground source to get some of this? And so that's what this tool is doing to gather some of this data. So you can see here sign-in and audit logs, the UAL, Azure activity logs, Windows Defender for IoT, blah, blah, blah. So you see all the stuff that it provides. Even I love like their tools here, the Guzzi Grays and Guzzi Haul. Yeah, yeah, yeah. But I thought this is pretty cool. Matt, what are your thoughts on this? Do you think you'll see MSPs using this? What are your views?

I do. And here's why. I, you know, I can't remember the name of the tool that Matt Topper and our team used. For gathering this data. But every time we'd have a BEC, whether it resulted in a loss or whether it resulted in something, but every time someone had a compromised credential or believed they had some threat actor in, we didn't know necessarily if there was a loss. There wasn't necessarily. So we'd start an incident response. But do you call your insurance if there isn't a loss? Do you file as an incident and do containment and do checking to make sure you've eradicated the threat actor? Do you hire an incident response team for this at every time? Do you spend the $15,000 with no known loss, especially as you're talking to that client about whether they do that on their own based on their own choices. Right. And so the challenge for me was we needed something to gather and store that data somewhere. So my, my answer might be that these type of tools that are going to gather some of that telemetry and information— I haven't dug deeply into what all this grabs— are still requisite and usable in my opinion. I think if you don't have other tools to your, to your point of a SIEM or something that's redirecting those logs in some form or fashion. And if you're using a tool that's made by CISA, I think you would build a lot of defensibility in the gathering that was done around that tool, especially the more and more automated and hopefully the more and more broad and deep it becomes. But I do genuinely think in those non-loss incidents where you need to document, you need to preserve evidence, you need to prove that you did the containment options and things that you knew. Those should be pretty scalable on cloud infrastructure like this, especially AD, right? Identity centrism aspect of it. So yes, that's my short answer. I do think we'll start seeing these tools used for mainly that purpose. I could be wrong. Somebody in the chat tell me I'm crazy, but that's where I would see us having used it at Iconiq in the past.

Yeah, I think that makes a lot of sense, Matt. Really does in terms of like where that use case could belong, especially as you mentioned, non-loss. But how do we prove it? You know, going back to what I said originally in the livestream, stream, what, you know, Ryan always says is absence of evidence, not evidence of absence, right? What do we really know and prove? And before we open our mouth, like we see Forza did, you know, how do we, how do we know that?

So I might be these type of tools that start building that at least some degree of evidentiary trust, right? That says, hey, I did this, I got a green button out of it. And I'm not sure that this goes that deep. This is probably much more evidentiary gathering. You still have to prove that you know how to read what's there and understand the impacts of what's there and that kind of stuff. That comes into it. But I like seeing if we take it away from just this tool, I am actually very happy to see a CISSA GitHub in general starting to be built with things like this. Right. I think there was an ATT&CK simulation thing that we saw a couple of weeks ago. I can't remember the name of it.

Yep.

But you're starting to get more of these things that are appearing. I haven't looked into Scuba Tool.

A lot of cool stuff though, huh?

Yeah, yeah, yeah.

I think it'd be, it'd be a lot of fun for someone to create like a whole series map of YouTube videos.

I'm chewing on it right now.

Yeah. Nice. I'm going through every tool, what they do, where they, how they could be used, you know, use cases. Because yeah, there's a bunch. I'm like, look at this, Scuba Gear M365 Secure Configuration Baseline Assessment Tool. Yes, please. That looks great. So I'm with you.

Even call out the licensure, right? You need an AAD P2 and you need Defender for Office P1, right? Or something encompassing that. That's pretty awesome. They're making, I like that. I hadn't seen this, but they do have some great licensing. Assumptions. Sorry, I didn't mean to cut you off.

No, you're good. Yeah, so yeah, really amazing stuff that's in here. Well, that's— Matt, that's what I had for you, or for all of us today. Um, thanks for joining in the last few minutes and giving us some comments and thoughts. And nobody— you know, I appreciate you, brother.

Really, always, man. I love what you're doing at Empath.

Thanks, man. I appreciate that. For everyone else joining, um, hope you guys enjoyed this. Share this out with a friend. Continue to give some comments. You can keep the conversation going and rolling even after the live stream's over, so please do that. Many people watch it later.

So feel free to join in and give us those Matt, you're an idiot comments that I asked.

Haven't seen them quite yet, right? Haven't seen them quite yet. Um, all right, Matt, thank you guys so much. Um, really appreciate you all joining in. And, uh, until next time, my friends, we will talk to you later. Thanks.