Latest / What's Your Problem? / Infiltrating an International Ransomware Gang

Transcript

Infiltrating an International Ransomware Gang · What's Your Problem?

0:15
Speaker 1: Pushkin. Just a quick note, this is a bonus episode
0:22
Speaker 1: of What's Your Problem, and it's sponsored by Microsoft. John
0:26
Speaker 1: Demaggio studies cybercrime for a living. It's his job. But
0:30
Speaker 1: when he wanted to understand an international cybercrime gang called
0:34
Speaker 1: lock Bit, he realized he couldn't learn everything he wanted
0:38
Speaker 1: to know from the outside, so he started trying to
0:40
Speaker 1: figure out how to get people on the inside to
0:42
Speaker 1: tell him what he needed to know.
0:44
Speaker 2: So I spent a lot of time studying going back
0:46
Speaker 2: to World War Two when they started having all these
0:50
Speaker 2: documents about how to use the human trade craft to
0:55
Speaker 2: sort of recruit and convince people to do things that
0:58
Speaker 2: they don't necessarily know that they're doing to support your cause.
1:02
Speaker 1: So were you telling me you started studying sort of
1:04
Speaker 1: World War two era spycraft.
1:07
Speaker 3: Yes, that's correct.
1:08
Speaker 1: What's something you learn from World War two era spycraft
1:11
Speaker 1: that helped you weasel your way into a ransomware gang?
1:15
Speaker 2: Everything from their ego to understanding who their adversary is
1:21
Speaker 2: and making them feel that being friends with you will
1:25
Speaker 2: benefit them because you have a common enemy, or even
1:29
Speaker 2: even being adversarial towards them and saying certain things just
1:34
Speaker 2: to see what the reaction is to sometimes understand the truth.
1:37
Speaker 3: There's also the sort.
1:38
Speaker 2: Of the plan and prepare phase where you have to
1:40
Speaker 2: go and sort of stalk them and understand who their
1:43
Speaker 2: contacts are, who their friends are, who their enemies are,
1:46
Speaker 2: where they hang out online, all of that stuff.
1:49
Speaker 1: So you have this set of strategic ideas in your mind,
1:56
Speaker 1: what do you actually do?
1:59
Speaker 3: So what I did.
2:00
Speaker 2: The first thing I did is I needed to figure
2:01
Speaker 2: out sort of their digital fingerprint, so I profiled them.
2:05
Speaker 2: I began looking across the dark web. Obviously started with
2:09
Speaker 2: the easy One, their data leak site, their own infrastructure,
2:13
Speaker 2: and I went from there and I eventually found the
2:15
Speaker 2: forums that they live on. And there's some very prominent
2:18
Speaker 2: Russian hacking forums that have been around for about twenty years,
2:21
Speaker 2: so it made sense to start there. And sure enough,
2:25
Speaker 2: they were very prevalent on that website. They were very
2:28
Speaker 2: involved with conversations, They have friends, their enemies, and they
2:32
Speaker 2: do their business. So they actually would go there just
2:35
Speaker 2: to talk and sort of hang out with their buddies.
2:38
Speaker 2: And the drama, it was like it was like a
2:40
Speaker 2: soap opera. The drama these guys would getting these big
2:43
Speaker 2: arguments are the stupidest things. I just started profiling and
2:47
Speaker 2: visually mapping out who is who, who they were talking to,
2:50
Speaker 2: what those other people's roles were. Again, then I would
2:54
Speaker 2: find the ones who are their friends, and I would
2:55
Speaker 2: try to approach them and the people who worked for them.
2:59
Speaker 1: And did it work.
3:02
Speaker 3: It did well, It sort of worked.
3:10
Speaker 1: I'm Jacob Goldstein, and this is what's your problem. My
3:13
Speaker 1: guest today is John DiMaggio. John is the chief security
3:17
Speaker 1: strategist at a company called Analyst One, and I wanted
3:20
Speaker 1: to talk with John about Lockbit, this ransomware gang that
3:24
Speaker 1: was behind attacks that extorted over one hundred million dollars
3:28
Speaker 1: from companies around the world. John wrote this sort of
3:31
Speaker 1: book length series of online posts about Lockbit. It was
3:35
Speaker 1: part of a thing John called the Ransomware Diaries. The
3:38
Speaker 1: story of Lockbit is a great window into the ransomware industry,
3:43
Speaker 1: and it is an industry with a lot of remarkable
3:46
Speaker 1: similarities to ordinary non criminal industries. Lockbitch tried to brand itself,
3:51
Speaker 1: It tried to attract talent and notch keywins, just like
3:54
Speaker 1: any software company. But then there's also the part that
3:58
Speaker 1: is not like any software company. There is the crime part,
4:02
Speaker 1: and it was the crime part where Lockbit went too
4:04
Speaker 1: far and wound up drawing the ire of international law
4:07
Speaker 1: enforcement agencies that in fact have their own set of
4:10
Speaker 1: innovative strategies. And John watched all this happen up close.
4:15
Speaker 1: He told me his key contact on the inside had
4:17
Speaker 1: the user name lock bits up, short for Lockbit Support.
4:21
Speaker 2: I didn't know it at the time when I first
4:24
Speaker 2: started talking to them, but what I found out as
4:26
Speaker 2: I began to talk more is there were two personalities
4:29
Speaker 2: behind the account.
4:30
Speaker 3: One seemed to be much.
4:31
Speaker 2: Younger, friendlier, more in tune with sort of pop culture,
4:36
Speaker 2: and the other one, who I gave a name mister
4:39
Speaker 2: grumpy Pants, because he was all business, always serious, and
4:43
Speaker 2: that was kind of how I differentiated.
4:45
Speaker 1: Tell me about the sort of conversations you had with
4:49
Speaker 1: lockbits up, like, what was the nature of those exchanges.
4:53
Speaker 3: Well, so you have.
4:54
Speaker 2: To understand that when I did the initial part that
4:57
Speaker 2: was sort of cover pretending to be somebody else. I
4:59
Speaker 2: only got so far with that, and after I wrote
5:02
Speaker 2: The Ransomware Diaries Volume one, they knew who I was.
5:05
Speaker 2: The farthest I got was talking to them is myself,
5:08
Speaker 2: and they you know, it was just I started with with, Hey,
5:11
Speaker 2: do you guys know who I am? I want to
5:13
Speaker 2: have a conversation with you, And they were, you know,
5:16
Speaker 2: said to me, yeah, your favorite researcher. We love you, okay,
5:20
Speaker 2: And they were very willing to talk, which is why
5:22
Speaker 2: I got so much farther talking to them as myself
5:24
Speaker 2: as I did pretending to be a hacker.
5:26
Speaker 1: Uh Huh. What's the thing you learned from lock bits up?
5:30
Speaker 1: What's a what's a What's one detail of your understanding
5:33
Speaker 1: that was improved by that relationship?
5:36
Speaker 2: Well, there were a lot of things, but one of
5:38
Speaker 2: the key things I had learned was information about uh.
5:42
Speaker 2: They prob internal problems that they had with affiliates. For example,
5:46
Speaker 2: they complained that they've got really good hackers, but some
5:49
Speaker 2: of these hackers are younger kids, and they're good at hacking,
5:52
Speaker 2: but they're really bad at negotiating, uh, And he was.
5:56
Speaker 2: They were unhappy about the amount of money coming in,
5:59
Speaker 2: so they talked about that and coming up with a
6:01
Speaker 2: with a model of how much they would accept, and
6:04
Speaker 2: they created sort of a formula per company, and so
6:07
Speaker 2: just things like that, things around tech resources. They asked
6:10
Speaker 2: me one time if I would buy them. They couldn't
6:13
Speaker 2: get a they they couldn't get a Domain tools account,
6:15
Speaker 2: and they wanted to know because they couldn't pay for
6:17
Speaker 2: it with crypto, they want to know if I would
6:18
Speaker 2: buy it for them, which, of course they're playing with me,
6:21
Speaker 2: you know. And it was sort of a cat and
6:23
Speaker 2: mouse fun relationship for a while of going back and forth.
6:26
Speaker 2: So it was friendly for most of our relationship until
6:31
Speaker 2: it wasn't.
6:31
Speaker 1: So okay, So you're in this world and I just
6:34
Speaker 1: want to step back for a minute to talk about
6:37
Speaker 1: what's going on in a big way. Right, there's this
6:39
Speaker 1: phrase that's sort of central here, which is ransomware as
6:43
Speaker 1: a service. Ransomware is like straightforwards something a lot of
6:48
Speaker 1: people are familiar with. It's basically, some bad actor, some hacker,
6:53
Speaker 1: hacks into some companies' computers, locks them up and says
6:57
Speaker 1: we're not going to unlock them unless you pay us
6:59
Speaker 1: a ransom. That's ransomware.
7:02
Speaker 3: Exactly.
7:03
Speaker 1: What is ransomware as a service? What is I mean?
7:06
Speaker 1: We know about software as a service, right, it's basically
7:08
Speaker 1: you pay whatever amount of a month and you get to
7:10
Speaker 1: use software. What's ransomware as a service.
7:12
Speaker 2: So ransomware is a service. There's more than just ransomware.
7:17
Speaker 2: So you have this two part model where you have
7:20
Speaker 2: a service provider. That service provider provides the actual ransomware code.
7:25
Speaker 2: They also provide infrastructure. So the provider provides these services,
7:30
Speaker 2: the hacker goes and does the dirty work of actual hacking,
7:33
Speaker 2: and together when a victim pays the extortion, they share
7:37
Speaker 2: the profit from it. The benefit from using this model
7:40
Speaker 2: is you can have a lot higher volume than if
7:43
Speaker 2: it was just five guys in a group doing it themselves.
7:46
Speaker 2: By using this model, you can have many people doing
7:49
Speaker 2: attacks on your behalf. Much higher volume of attacks, much
7:53
Speaker 2: higher revenue.
7:54
Speaker 1: So Lockbit is basically just a software company. They're like
8:00
Speaker 1: an enterprise software company. They write software and provide various
8:04
Speaker 1: tools for users. But in this case the users are criminals,
8:08
Speaker 1: are people who want to hack into various computer systems
8:11
Speaker 1: and steal data and extort money.
8:14
Speaker 3: That's correct.
8:15
Speaker 2: But the other piece to it is the service provider aspect.
8:19
Speaker 2: They're the ones that are sort of in charge, that
8:21
Speaker 2: run the show, that give direction, that step in whenever
8:24
Speaker 2: there's an issue, if there's a victim not paying, sometimes
8:28
Speaker 2: they'll come in and help with the negotiation or take
8:30
Speaker 2: over or give direction on how much you can you
8:33
Speaker 2: can accept as a payment, or even say this is
8:36
Speaker 2: what you can or cannot hack this company. So they're
8:40
Speaker 2: definitely in the leadership chair.
8:42
Speaker 1: So I want to talk about how lockbit sort of
8:44
Speaker 1: grows and makes a name for itself. And one of
8:47
Speaker 1: the things that's really interesting is kind of how uninteresting
8:51
Speaker 1: it is. It's like, oh, it's this international criminal gang
8:54
Speaker 1: and they're acting like a boring software company, and it
8:57
Speaker 1: seems like a key early moment for them as they're
9:01
Speaker 1: trying to grow and differentiate themselves in the market. Is
9:05
Speaker 1: this summer paper contest in to tell me about that?
9:12
Speaker 3: Yeah, it's it's pretty crazy.
9:13
Speaker 2: So on this long running forum that I mentioned earlier,
9:17
Speaker 2: this Russian hacking forum, lockbit really wanted to to get
9:21
Speaker 2: their brand out there. So what they did is they
9:24
Speaker 2: sponsored this hacking paper contest, meaning hackers would submit these
9:31
Speaker 2: papers on different ways to hack and lockbit they would
9:35
Speaker 2: they would take part in this and they would help review.
9:38
Speaker 2: And there was five winners and the I think I
9:40
Speaker 2: don't remember what the what the what the I think
9:43
Speaker 2: was five thousand dollars maybe.
9:45
Speaker 1: Uh, you put a screenshot in your report. And what's
9:50
Speaker 1: amazing is how banal. It looks it looks totally like
9:54
Speaker 1: some college software contest or just some boring enterprise software company.
9:59
Speaker 1: Like there's this little kind of clip art of just
10:02
Speaker 1: like a dude at a laptop with a little plant
10:04
Speaker 1: next to him, although there is also a skull and
10:06
Speaker 1: crossbones next to him. It's like, we're just coders, but we're bad.
10:10
Speaker 1: And as you said, first place is five thousand dollars,
10:13
Speaker 1: which seems like not that much. Right, they're exploiting that.
10:16
Speaker 1: They're stealing tens of millions of dollars at this point, right.
10:19
Speaker 1: And then it says like accepted article topics, just like
10:22
Speaker 1: it would in a college contest, but under accepted article topics,
10:26
Speaker 1: it says hacks any methods for pouring shells, fixing, elevating rights,
10:32
Speaker 1: your story is and tricks interesting hack stories. It's such
10:36
Speaker 1: a fantastic combination of well banality and evil.
10:42
Speaker 3: It is.
10:42
Speaker 2: But here's what you have to think about. There's two
10:45
Speaker 2: benefits for this. One what I mentioned, sort of getting
10:48
Speaker 2: their name out and getting known with hackers. But two,
10:51
Speaker 2: they're looking for those upcoming rising stars, if you.
10:54
Speaker 1: Will, recruitment. It's talents, right, and yeah.
10:58
Speaker 2: That's right, and that's why Lackbit was different than most
11:01
Speaker 2: of these are the ransomware groups, because they approached it
11:03
Speaker 2: is a business and they thought out of the box
11:06
Speaker 2: and that's kind of what would set them ahead in
11:08
Speaker 2: a part at the time from other ransomware groups.
11:11
Speaker 1: So does it work this strategy?
11:16
Speaker 3: It absolutely worked.
11:17
Speaker 2: I mean, there's a reason that people know their name
11:20
Speaker 2: and know who they are, and there's a reason that
11:22
Speaker 2: they have so many people that at the time in
11:24
Speaker 2: a way really wanted to work for them over other groups.
11:28
Speaker 2: It was propaganda and it worked.
11:31
Speaker 1: And so it seems like by around twenty twenty one
11:36
Speaker 1: they've hit the big time. And there's this one hack
11:39
Speaker 1: in particular that you write about in the summer of
11:42
Speaker 1: twenty one of Accenture, the big international consulting company. Tell
11:47
Speaker 1: me about the Accenture hack.
11:49
Speaker 2: So in the Accenture hack, you know, the affiliate had
11:54
Speaker 2: gone in compromised them, they locked down their data, and
11:58
Speaker 2: lock Bit, you know, put on their site that you
12:01
Speaker 2: know they were a victim. Reporter started to report about it,
12:04
Speaker 2: and you got a lot of buzz in the media. Now,
12:06
Speaker 2: the problem with the Accenture hack is that Accenture denied
12:11
Speaker 2: that the hack took place. Initially saying that it wasn't
12:15
Speaker 2: real and it didn't happen. The issue with that is
12:18
Speaker 2: their customer's data was on their website and you could
12:23
Speaker 2: you could go see it and validate it and download
12:25
Speaker 2: samples of it.
12:26
Speaker 1: The customer's data was on the lockbit website.
12:29
Speaker 3: That's correct.
12:30
Speaker 2: That's correct, and it was just a sampling, but you
12:32
Speaker 2: could see this information and it looked quite authentic.
12:37
Speaker 1: So so does this accenture hack sort of put Lockbit
12:42
Speaker 1: on the map in a bigger way?
12:44
Speaker 3: Oh? I mean the media surrounding that was was was
12:50
Speaker 3: very loud.
12:50
Speaker 2: I mean it was across many organizations. Lots of of
12:54
Speaker 2: of well known journalists and organizations reported on it. All
13:00
Speaker 2: this feeds into the propaganda. Now the journalist shouldn't report
13:03
Speaker 2: on it. I'm just saying, you know, lockbit plays that
13:05
Speaker 2: to benefit him as them as well.
13:07
Speaker 1: Yeah, So basically the press coverage is good for lockbit
13:10
Speaker 1: because hackers see it and go to lockbit and say, hey,
13:14
Speaker 1: I want to be an affiliate and do some hacking.
13:16
Speaker 2: Essentially, that's right, and to be fair, the same thing
13:18
Speaker 2: from me from writing these reports. Yes, it helps researchers
13:21
Speaker 2: law enforcement, but it also helps them that that's the
13:24
Speaker 2: reason that they were friendly to me is because they
13:26
Speaker 2: were fans of a lot. I have probably just as
13:28
Speaker 2: many criminal hackers that are fans of the ransomware diaries
13:31
Speaker 2: as there are researchers and you know, right, regular people
13:35
Speaker 2: that are not criminals.
13:36
Speaker 1: Well, I mean there's an ecosystem here, right, like the
13:42
Speaker 1: the job. There's a universe of people whose job is
13:44
Speaker 1: fighting criminals and a universe of people who are criminals
13:48
Speaker 1: who are trying to evade being caught. Right, And that's right,
13:52
Speaker 1: the kind of intellectual universe has got to be almost
13:54
Speaker 1: entirely overlapping. Everybody's trying to figure out what everybody else
13:57
Speaker 1: is doing. Everybody's sort of using the same tricks on
14:00
Speaker 1: each other. It makes sense that the bad guys and
14:04
Speaker 1: the good guys would be reading the same.
14:06
Speaker 3: Stuff it does.
14:08
Speaker 2: And you know that's really where that uh that that
14:11
Speaker 2: that that human framework came in because his ego was
14:15
Speaker 2: was the main thing I was able to play on
14:18
Speaker 2: in order to get information. And even when there were
14:21
Speaker 2: lies in that information, you know, I talked to the
14:23
Speaker 2: people who work for them, So I would take those
14:25
Speaker 2: lies and I would present them in a different way
14:27
Speaker 2: to those people to get a response, and that would
14:30
Speaker 2: help me to validate what's real and what's not.
14:32
Speaker 1: Is there some specific example of playing on his ego,
14:35
Speaker 1: something you said to flatter him or something.
14:38
Speaker 2: Uh well, yeah, you know one of the one of
14:40
Speaker 2: the things that that was big for him was, you know,
14:43
Speaker 2: he wanted to be sort of the Darth Vader of
14:46
Speaker 2: ransomware of my words, not his, but you know, he
14:49
Speaker 2: he wanted to be this this top person. So you
14:52
Speaker 2: know when you would talk about him changing the game
14:54
Speaker 2: of ransomware and telling him, you know, you guys are
14:58
Speaker 2: are are on top? You know, how did you get there?
15:00
Speaker 2: How did you how did you get ahead of other
15:03
Speaker 2: groups like like REvil and uh in in time, Black Matter,
15:09
Speaker 2: in groups like that, And you know he loved that.
15:11
Speaker 2: You know, it would just that was a thing that
15:14
Speaker 2: would get mister grumpy pants talking was sort of playing
15:17
Speaker 2: on his ego, you know, asking questions about how he
15:20
Speaker 2: got to be the top brand in ransomware and how
15:23
Speaker 2: he's better than all the other ones.
15:25
Speaker 3: And he fed right into that.
15:30
Speaker 1: Coming up after the break, what happens when lockbit is
15:33
Speaker 1: used to hack a hospital for children with cancer, So
15:48
Speaker 1: kind of early twenty twenties Lockbit is king of the
15:53
Speaker 1: ransomware world. And then it seems like in about twenty
15:56
Speaker 1: twenty three they sort of start going too far or
15:59
Speaker 1: their affiliates start going too far right, they start to
16:03
Speaker 1: get into trouble, and it seems like the back of
16:10
Speaker 1: hospital that is actually called Thick Kids, which is yeh,
16:14
Speaker 1: a children's cancer hospital in Canada, is kind of a
16:19
Speaker 1: turning point. And like I do wonder, like you could
16:25
Speaker 1: hack anybody, why would you hack a cancer hospital for children? Like,
16:30
Speaker 1: is it because you want to be as evil as possible?
16:34
Speaker 2: Yeah, it's because they see them as a as an
16:37
Speaker 2: easy target because a hospital has to be available and
16:41
Speaker 2: make their resources easily accessible by their patients, clients, medical organizations,
16:49
Speaker 2: and inherently the more accessible something is less secure it is.
16:53
Speaker 2: So it makes them an easy target. They have a
16:55
Speaker 2: lot of money, and they're more likely to pay because
16:59
Speaker 2: the data is so sensitive and the systems that are
17:01
Speaker 2: encrypted are so critical that it makes them a ripe
17:04
Speaker 2: target and that's the reason that they'll go after them. Initially,
17:09
Speaker 2: the hospital was hacked, the systems were encrypted, data was stolen,
17:14
Speaker 2: and they didn't they weren't going to let them out
17:17
Speaker 2: of this. They were going to force them to pay
17:20
Speaker 2: or they weren't going to give them the key to
17:22
Speaker 2: decryptor systems, and didn't seem to care that these kids
17:24
Speaker 2: couldn't get the care that they needed and the treatments
17:27
Speaker 2: that they needed. The only reason so what ended up
17:30
Speaker 2: happening was with all the media around it, it was
17:33
Speaker 2: such a bad look for Lockbit that the leadership of
17:37
Speaker 2: the group decided, after you know, about two weeks, they decided, Okay,
17:41
Speaker 2: we're going to go ahead and we're going to give
17:43
Speaker 2: them the cryption key, just because this was getting to
17:46
Speaker 2: be too hot. And if you remember, like the whole
17:49
Speaker 2: Colonial Pipeline thing with the Dark Side ransomware group, you
17:52
Speaker 2: know that got that got so much attention that you know,
17:55
Speaker 2: government agencies got involved and went after them, and when
17:58
Speaker 2: that happens, it's very bad for ransomware groups. So they
18:02
Speaker 2: essentially saw things could possibly go that direction with the
18:05
Speaker 2: amount of bad publicity they were getting, and decided it
18:08
Speaker 2: wasn't worth it the payment they were going to get,
18:10
Speaker 2: and they went ahead and provided the hospital with the
18:14
Speaker 2: decryption key so they could get those systems back online.
18:18
Speaker 1: And and in fact, their concern about a backlash was justified. Right,
18:22
Speaker 1: it seems like international governments, kind of led by the UK,
18:27
Speaker 1: do start to go after Lockbit around this point. Right,
18:32
Speaker 1: What do you do if you're a government and you
18:35
Speaker 1: want to go after a Russian hecking gang?
18:39
Speaker 2: Well, it's not easy. The things that you have to
18:43
Speaker 2: do is you have to use resources that people like
18:45
Speaker 2: me don't have available to try to figure out their
18:49
Speaker 2: their infrastructure, their hosting infrastructure, what what what where their
18:53
Speaker 2: servers live? Uh, and then which is very difficult when
18:57
Speaker 2: they're there the dark web.
18:59
Speaker 3: It's hard to figure.
19:00
Speaker 1: That out because there's this is the cat and mouse thing.
19:02
Speaker 1: They're like complicated smart systems. These people used to hide
19:06
Speaker 1: their location essentially.
19:08
Speaker 2: That's that's right, and so that's one aspect is trying
19:12
Speaker 2: to figure out that infrastructure.
19:15
Speaker 3: In some cases you.
19:16
Speaker 2: Can use legal means to take it down, but with
19:18
Speaker 2: groups like Lockbit, often they will use service providers that
19:22
Speaker 2: are in countries that cater to criminal activity and won't
19:25
Speaker 2: respond subpoenas. The other thing, though, that lawn that these
19:29
Speaker 2: governments and law enforcements try to get into is the
19:32
Speaker 2: infrastructure that is public, the panel that the bad guys
19:37
Speaker 2: use to log into with the graphical interface to control
19:41
Speaker 2: these attacks, and there's technical ways to do that, and
19:44
Speaker 2: then there's also the ways of infiltrating the people who
19:47
Speaker 2: work for the group to get their credentials access.
19:50
Speaker 1: So they're basically hacking. They're basically hacking the hackers. So
19:54
Speaker 1: in February of twenty twenty four, this international coalition of
20:00
Speaker 1: law enforcement agencies actually takes over lockbit sort of publicly
20:05
Speaker 1: facing site, right Lockbit's dark websites tell me about that.
20:09
Speaker 2: Yeah, So it was great when you went to the
20:12
Speaker 2: website that that day, it was no longer Lockbit's data
20:16
Speaker 2: leak site. Instead it was a mock site, so it
20:21
Speaker 2: looks just like it, except instead of having real victims
20:26
Speaker 2: within the site, the NCAA put the criminals as the victims,
20:31
Speaker 2: and they named affiliates with the victims, and they had
20:34
Speaker 2: a countdown timer for for lock bits up saying they
20:37
Speaker 2: were going to release his identity ha.
20:39
Speaker 1: And the countdown timer is the kind of thing that
20:41
Speaker 1: the that the bad guys use when they hack a company,
20:43
Speaker 1: saying we're gonna.
20:44
Speaker 3: That's rite yeah, uh huh, yeah, that's what they do.
20:47
Speaker 2: A count down timer for traditional victims is how long
20:50
Speaker 2: they have to pay to the data's lead so in.
20:53
Speaker 1: The same way that Lockbit was essentially marketing itself. Now
20:58
Speaker 1: the now the cops, now the law enforcement officials, are
21:01
Speaker 1: are doing that same kind of marketing. They're sort of
21:05
Speaker 1: doing this kind of propagandistic thing to attract attention, presumer
21:09
Speaker 1: what to scare off all the affiliates, like why why
21:11
Speaker 1: would they be doing it in this showy way just
21:13
Speaker 1: for attention to get good press.
21:15
Speaker 2: No, it was it was a psychological operation. So prior
21:18
Speaker 2: to this, they didn't they never did this there. The
21:21
Speaker 2: way they took sites down were just to take it
21:23
Speaker 2: down and put a message up saying law enforcement took
21:25
Speaker 2: this down. This was psychological. It was meant to put
21:29
Speaker 2: stress on the people who worked for the organization and
21:33
Speaker 2: being concerned that they no longer had anonymity and that
21:37
Speaker 2: their names and information was now being reviewed and revealed
21:41
Speaker 2: by law enforcement. And the whole goal of this was
21:45
Speaker 2: was to affect the lockbit brand and to make people
21:48
Speaker 2: not trust Lockbit.
21:49
Speaker 3: Or want to work for the organization.
21:52
Speaker 2: So it was very planned in, thought out and methodical.
21:55
Speaker 2: It wasn't just, you know, to get attention. It was
21:58
Speaker 2: specifically to hurt that brand and make affiliates afraid to
22:02
Speaker 2: work for them. And in addition to that mock website
22:05
Speaker 2: on the back end that panel that I was mentioning
22:08
Speaker 2: that admin paneled that they would use now when that
22:11
Speaker 2: took place, when the takedown took place, when the affiliates
22:14
Speaker 2: logged into that panel, they had tailored messages with their
22:17
Speaker 2: username by law enforcement saying, hey, you're logging into the panel.
22:21
Speaker 3: We know who you are.
22:22
Speaker 2: We've been monitoring the activity you've been doing. We've got
22:25
Speaker 2: your wallets. We're going to be coming to talk to
22:27
Speaker 2: you soon. So it was it was very detrimental to criminals.
22:33
Speaker 2: That was a brilliant operation in my opinion.
22:35
Speaker 1: And you mentioned that they had a countdown timer for
22:38
Speaker 1: when they were going to reveal the name of Lockbit,
22:41
Speaker 1: sup the person. Oh that you said, there's people, but
22:44
Speaker 1: at least one of the people behind this, behind Lockbit,
22:48
Speaker 1: one of the key Lockbit players. Did they in fact
22:50
Speaker 1: reveal the name of that person.
22:52
Speaker 2: They didn't when the countdown time, or they didn't when
22:55
Speaker 2: they did they at that time they didn't, but there's
22:57
Speaker 2: a reason that they didn't. But they did not do
22:59
Speaker 2: that in February. The reason that they didn't is because
23:03
Speaker 2: Lockbit agreed to tell them information about some of his
23:07
Speaker 2: adversarial group. There was a group called black who he
23:09
Speaker 2: didn't like, and he agreed to try and get to
23:11
Speaker 2: give them information.
23:13
Speaker 1: So use they used the threat of naming him as
23:15
Speaker 1: leverage and getting him to flip. Basically, that's correct. Do
23:22
Speaker 1: we know who he is now? Was he ever named?
23:25
Speaker 3: Yeah? It was.
23:27
Speaker 2: It was several months later. The site came back online,
23:31
Speaker 2: meaning the law enforcement version of the site came back online.
23:34
Speaker 2: There was a new timer, and once again they said
23:37
Speaker 2: they were going to reveal Lockfit's name, and the timer
23:41
Speaker 2: began again, and on May seventh, when that timer expired,
23:44
Speaker 2: they did. They released his name and his picture, Dmitry Koshewev.
23:50
Speaker 2: They put that out there, indicted him, wanted posters the
23:53
Speaker 2: whole nine yards.
23:54
Speaker 1: Is that grumpy pants?
23:56
Speaker 3: That's well my opinion.
23:59
Speaker 2: My opinion is that that was the younger person and
24:03
Speaker 2: the other guy's still out there, but I think law
24:06
Speaker 2: enforcement might tell you otherwise, though they do agree with
24:08
Speaker 2: me that there's two people.
24:09
Speaker 1: So he's been indicted but not arrested. Is that what
24:13
Speaker 1: you're saying?
24:13
Speaker 2: That's correct because he's in Russia and there's protections there.
24:17
Speaker 2: The law enforcement just can't get their hands on them. Unfortunately,
24:21
Speaker 2: the criminals are protected when they're in Russia.
24:24
Speaker 1: So is that the end of Lockbit?
24:28
Speaker 2: It's not, you would think it is, But most almost
24:32
Speaker 2: every other group that this has happened to, that's the
24:34
Speaker 2: end of the story, or at least it causes them
24:37
Speaker 2: to take that operation down and they have to start
24:39
Speaker 2: from scratch somewhere else with a new operation, with a
24:43
Speaker 2: new name and a new brand. But Lockbit worked so
24:46
Speaker 2: hard on that brand. I don't think he'll ever take
24:49
Speaker 2: it away until he's till they actually arrest everybody. But no,
24:53
Speaker 2: they continued, but they continued at a much lower level.
24:58
Speaker 2: They didn't have the equality of hackers still working for them.
25:02
Speaker 2: They started having to lie about attacks to try and
25:05
Speaker 2: stack the numbers and things of that nature.
25:08
Speaker 1: Do you think they'll unforcement officials campaign the whole thing
25:10
Speaker 1: of like naming the people and doing all the stunts
25:13
Speaker 1: on the website. You think that worked? You think it
25:15
Speaker 1: was sort of like Lockbit rose on marketing and in
25:17
Speaker 1: a way fell on the marketing of the governments.
25:20
Speaker 2: Yeah, well, was it one hundred percent effective, No, but
25:23
Speaker 2: it was about eighty percent effective. And prior to this,
25:26
Speaker 2: I would say that most of those operations were like
25:28
Speaker 2: forty percent effective. And what I mean by that is
25:32
Speaker 2: this actually affected the brand where people, the quality hackers,
25:37
Speaker 2: the quality affiliates. Why would they work for this organization
25:40
Speaker 2: with all this heat where they can't trust that they're
25:43
Speaker 2: going to be protected when they can go work for
25:45
Speaker 2: some other premier worgans.
25:46
Speaker 1: Like any software company. Their biggest problem is finding and
25:50
Speaker 1: keeping good people.
25:51
Speaker 3: That's right, That's exactly right.
25:54
Speaker 1: And by good people, I guess in this case, it
25:56
Speaker 1: means bad people, right. So okay, so this is a
26:00
Speaker 1: year ago. Basically, this is early twenty twenty four. Lockbit
26:03
Speaker 1: gets mostly taken down, not knocked out, at least knocked down.
26:09
Speaker 1: Where are we today, Like, what is the state of
26:11
Speaker 1: the ransomware industry?
26:12
Speaker 2: So it's changed a bit. I would say you have
26:16
Speaker 2: more groups, but you don't have sort of these. You
26:20
Speaker 2: don't have as many big organizations that sort of hold
26:25
Speaker 2: all the majority of attacks. You have smaller to medium
26:30
Speaker 2: sized groups that work more under the radar, meaning they're
26:34
Speaker 2: not doing the same volume of attacks. They're also not
26:37
Speaker 2: getting the same amount of money and ransom extortions as
26:41
Speaker 2: they did before. But they're still out there. They're just
26:45
Speaker 2: doing it, the model just changed a little bit.
26:48
Speaker 1: And so as part of the idea that, oh, maybe
26:51
Speaker 1: trying to have a big name and be like a
26:53
Speaker 1: famous criminal gang is not a good long term strategy.
26:58
Speaker 3: That's exactly correct.
26:59
Speaker 2: I think that this is what really made them realize
27:02
Speaker 2: that people are sort of lower on the radar, just
27:05
Speaker 2: trying to get money and extort, but not necessarily have
27:08
Speaker 2: this voice that's heard across the world.
27:10
Speaker 1: What's like, what's the big lesson to you from the
27:14
Speaker 1: Lockbit story.
27:16
Speaker 2: The big lesson there is being voisterous. Having this ego
27:21
Speaker 2: is actually a downfall. Being loud, getting publicity, getting your
27:27
Speaker 2: name out there, well, that might help attract people to
27:29
Speaker 2: come work for you. There's the opposite side of that,
27:32
Speaker 2: where it also attracts a lot of attention from law enforcement,
27:35
Speaker 2: and if you're a criminal group, that's not a good thing.
27:38
Speaker 2: And I think bad guys have figured that out between
27:42
Speaker 2: mainly from twenty twenty four with both the black Cat
27:45
Speaker 2: ransomware group and with Lockbit. Those were your prominent players,
27:49
Speaker 2: and those guys both got decimated by law enforcement, and
27:52
Speaker 2: that happened because of the attention that they drew to themselves.
27:55
Speaker 2: So I think That's the lesson that adversaries have learned
27:59
Speaker 2: is you have to be quieter about what you do.
28:05
Speaker 1: Lively. Back in a minute with the lightning round. Let's
28:17
Speaker 1: finish with the lightning round. It's gonna be a little
28:19
Speaker 1: more random and a little more about you. Okay, what's
28:24
Speaker 1: one thing you learned when you hacked into the Pentagon
28:27
Speaker 1: as a fifteen year old boy?
28:31
Speaker 2: Oh man, That's the reason that had I talked to
28:34
Speaker 2: these criminals and I sometimes have empathy to want to
28:36
Speaker 2: help them change what they're doing, is because I got
28:39
Speaker 2: a second chance, and I remember that fear, and I
28:43
Speaker 2: want to try to help some of these young kids
28:45
Speaker 2: to change what they're doing and not continue down this road.
28:48
Speaker 1: What actually happened there? What was it that happened?
28:51
Speaker 2: Yeah, So my stepfather worked for Colon Powell during the
28:55
Speaker 2: Iraq War. He was at the Pentagon and he had
28:57
Speaker 2: a classified system in our basement, and I had a
29:00
Speaker 2: friend over and I was really into computers and hacking
29:04
Speaker 2: figuring things out. And I didn't do anything elaborate. I
29:06
Speaker 2: just figured out his credentials and I logged in and
29:08
Speaker 2: was put looking around. Nothing elaborate, but enough that it
29:12
Speaker 2: got attention and bad things happened, and and the FBI showed.
29:16
Speaker 3: Up and things.
29:17
Speaker 1: The FBI showed up at your house.
29:19
Speaker 3: Yeah they did. It was It was not a good
29:21
Speaker 3: day for me.
29:24
Speaker 1: I'm glad it worked out in the end. It did.
29:27
Speaker 3: It did.
29:28
Speaker 2: It only worked out though, because of who he worked for,
29:30
Speaker 2: my stepfather, and the connections that he had, and the
29:32
Speaker 2: fact that I had no prior record. That's the reason
29:35
Speaker 2: that it worked. And I had a summer where I
29:36
Speaker 2: had to go work at Fort Belvoir doing community service,
29:39
Speaker 2: but I just do such a good job they wanted
29:41
Speaker 2: to hire me to work there. So it was definitely
29:44
Speaker 2: a life changing experience. And then I joined the army
29:46
Speaker 2: and became a military police officer. So that was my story.
29:50
Speaker 2: But it worked out well for him.
29:52
Speaker 1: So I understand that when you were a military police officer,
29:56
Speaker 1: you did undercover drug bys I did. What's something you
30:00
Speaker 1: learned doing undercover drug byes as a military police officer?
30:04
Speaker 2: What I learned is it's not black and white. It's
30:07
Speaker 2: not just you're a bad guy or a good guy.
30:09
Speaker 2: There are there there's still human beings.
30:12
Speaker 1: What's one thing you learned pushing carts at home depot.
30:17
Speaker 2: That you should never have an ego because I did
30:19
Speaker 2: all that crazy work and I got out and I
30:21
Speaker 2: could not get a job in law enforcement because of
30:24
Speaker 2: my tattoos. At the time, you couldn't have visible tattoos,
30:28
Speaker 2: at least in Virginia. Tried to join the FBI because
30:30
Speaker 2: I smoked weed in high school at the time, day
30:32
Speaker 2: at a zero tolerance.
30:33
Speaker 3: I couldn't get into that. I didn't couldn't get.
30:36
Speaker 2: A job, and I had to start at the very bottom.
30:38
Speaker 2: I've been working retail. I'm not even in the store.
30:40
Speaker 2: I'm in the parking lot, you know. That was I
30:44
Speaker 2: was living out of my truck for a couple of weeks,
30:45
Speaker 2: and then I rented a room at a house. That house,
30:48
Speaker 2: they were selling.
30:48
Speaker 3: Drugs out of the house.
30:49
Speaker 2: The cops raided it, rested everybody but me, but I
30:52
Speaker 2: couldn't even get in the house to get my stuff.
30:54
Speaker 3: I mean, it was a tough time in my life.
30:58
Speaker 1: I'm going to change gears to talk about something much
31:00
Speaker 1: more pedestrian. Now, what's your favorite depiction of hacking in
31:05
Speaker 1: a work of fiction? Uh?
31:09
Speaker 2: Corey Uh, there's an author, Corey Doctro, brilliant guy. He's
31:15
Speaker 2: one of my favorite authors, and he does hacker fiction
31:20
Speaker 2: if you will, and he's got a probably twenty books now,
31:24
Speaker 2: but they're they're phenomenal, especially the Homeland series. That's one
31:28
Speaker 2: of my favorite.
31:28
Speaker 1: Okay, Homeland series. Who's your favorite cyber criminal in real life?
31:36
Speaker 2: I would probably say the hacker known as us D
31:39
Speaker 2: O D. He is a He is a hacker who's
31:43
Speaker 2: not Russian. Uh. He lives in Brazil. I became very
31:46
Speaker 2: good friends with him. I've never written about him. He
31:51
Speaker 2: wasn't a target of mine. He helped me actually when
31:54
Speaker 2: I was going after ransom VC and he gave me
31:57
Speaker 2: a lot of good insight information and we just became
32:00
Speaker 2: friends for a long time and we talked and he
32:03
Speaker 2: was somebody who I really had wanted to help. He's
32:06
Speaker 2: in jail now, so you can figure out if I
32:07
Speaker 2: was able to help him or not.
32:10
Speaker 1: Why? Why him? What was what was that relationship?
32:15
Speaker 2: You know, he had issues like like everybody, but you know,
32:20
Speaker 2: he was a he had a good side to him.
32:22
Speaker 2: There was a side to him. He was a decent
32:24
Speaker 2: person and I really thought if he hadn't become a criminal,
32:29
Speaker 2: he's somebody that would have been in the cybersecurity field.
32:33
Speaker 2: He did have empathy for people. He hated law enforcement
32:37
Speaker 2: in the government, but he did have empathy for people,
32:40
Speaker 2: and he was somebody who I could talk to and
32:42
Speaker 2: and actually feel like I could I could make a
32:44
Speaker 2: difference with the conversations that we had.
32:53
Speaker 1: John DiMaggio is the chief security strategist at Analyst One.
32:57
Speaker 1: Today's show was produced by Gabriel Hunter Chang. It was
33:00
Speaker 1: edited by Lydia Jean Kott and engineered.
33:03
Speaker 3: By Sarah Buguer.
33:04
Speaker 1: I'm Jacob Goldstein and we'll be back later this week
33:07
Speaker 1: with another episode of What's Your Problem. A port Asner
33:17
Speaker 1: SA