1 00:00:00,049 --> 00:00:03,709 you found the backup wrap up your go-to podcast for all things 2 00:00:03,709 --> 00:00:06,169 backup recovery and cyber recovery. 3 00:00:06,739 --> 00:00:09,384 In this episode, we break down how ransomware works. 4 00:00:10,174 --> 00:00:16,174 By examining the five key objectives that attackers follow in nearly every campaign. 5 00:00:16,774 --> 00:00:21,634 My co-author, Dr. Mike Sailor, joins persona in me to walk through the 6 00:00:21,634 --> 00:00:27,304 complete attack lifecycle from gaining that initial foothold to delivering the 7 00:00:27,304 --> 00:00:32,884 dreaded ransomware note we talk about initial access brokers lateral movement. 8 00:00:33,235 --> 00:00:38,065 Command and control or C two communications data exfiltration 9 00:00:38,334 --> 00:00:40,405 and the encryption process itself. 10 00:00:41,215 --> 00:00:44,965 Uh, this is the first in what's going to be a long series discussing 11 00:00:44,965 --> 00:00:47,125 our new book, so buckle up. 12 00:00:47,935 --> 00:00:52,375 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. Backup, 13 00:00:52,614 --> 00:00:57,685 and I've been passionate about backup and recovery for over 30 years, ever since. 14 00:00:57,685 --> 00:00:59,905 I had to tell my boss that there were no backups. 15 00:01:00,114 --> 00:01:02,274 Of the production database we just lost. 16 00:01:02,694 --> 00:01:05,664 I don't want that to happen to you, and that's why I do this. 17 00:01:06,085 --> 00:01:10,765 On this podcast, we turn unappreciated admins into Cyber Recovery Heroes. 18 00:01:11,125 --> 00:01:13,285 This is the backup wrap up. 19 00:01:25,421 --> 00:01:26,711 Welcome to the backup wrap up. 20 00:01:26,711 --> 00:01:30,371 I'm your host w Curtis Preston, and I have two people with me today. 21 00:01:30,671 --> 00:01:34,211 We shall start with PSA manana. 22 00:01:34,521 --> 00:01:36,011 Malaiyandi, how's going? 23 00:01:36,011 --> 00:01:36,461 Prasanna I. 24 00:01:37,241 --> 00:01:37,721 Am good. 25 00:01:37,721 --> 00:01:39,041 Curtis, you have to. 26 00:01:39,041 --> 00:01:39,311 Okay. 27 00:01:39,461 --> 00:01:41,621 Really quickly, how was the show last night? 28 00:01:42,521 --> 00:01:44,621 Oh, with, uh, Esh Patel. 29 00:01:44,711 --> 00:01:46,421 Nme Nesh Nesh was good. 30 00:01:46,421 --> 00:01:49,091 He's taping a special in, uh, in April. 31 00:01:49,151 --> 00:01:50,231 Uh, so it was very cool. 32 00:01:50,471 --> 00:01:51,821 I wasn't quite in the front row. 33 00:01:51,921 --> 00:01:53,151 A lot of Indians in the crowd. 34 00:01:55,511 --> 00:01:57,551 And a lot of, a lot of comments about that. 35 00:01:58,001 --> 00:02:02,081 Um, uh, I stood out a bit in the crowd, but it was, it was very cool. 36 00:02:02,801 --> 00:02:05,921 Um, so, so welcome to the show Prasanna. 37 00:02:06,951 --> 00:02:07,911 Thank you, Curtis. 38 00:02:07,911 --> 00:02:09,621 I, it's good to be on the show. 39 00:02:10,661 --> 00:02:13,061 And of course, of course. 40 00:02:13,241 --> 00:02:15,761 We have my book co-author. 41 00:02:15,851 --> 00:02:17,261 And look, Mike, it's right up 42 00:02:17,261 --> 00:02:17,591 here on the 43 00:02:17,813 --> 00:02:18,173 I see it. 44 00:02:18,761 --> 00:02:19,991 You, I, yeah. 45 00:02:19,991 --> 00:02:22,631 I can't, that is, by the way, that is really big. 46 00:02:22,751 --> 00:02:23,111 It's. 47 00:02:23,886 --> 00:02:24,156 It is 48 00:02:24,201 --> 00:02:26,421 it's like, I think it's like 24 49 00:02:26,421 --> 00:02:26,601 by 50 00:02:26,753 --> 00:02:27,623 I was, I was, 51 00:02:27,771 --> 00:02:27,831 the 52 00:02:27,831 --> 00:02:28,281 signs 53 00:02:28,313 --> 00:02:32,213 I was concerned that was actual size, but I'm, I'm glad you, I'm glad you commented. 54 00:02:32,573 --> 00:02:32,723 Yeah. 55 00:02:33,531 --> 00:02:33,741 Yeah. 56 00:02:33,741 --> 00:02:36,621 So those, those are, I think, um. 57 00:02:37,431 --> 00:02:39,951 13 by 17, right? 58 00:02:40,011 --> 00:02:40,581 The ones over. 59 00:02:40,581 --> 00:02:40,791 Yeah. 60 00:02:40,791 --> 00:02:44,511 So by the way, for those of you, uh, you know, if you're listening, you can 61 00:02:44,511 --> 00:02:48,951 watch us on the on, on the tube, uh, by the same name, uh, the backup wrap up. 62 00:02:49,131 --> 00:02:53,421 So this is Doctor Mike Sailor, my co-author. 63 00:02:53,631 --> 00:02:54,111 Welcome to the 64 00:02:54,111 --> 00:02:54,321 show, 65 00:02:54,518 --> 00:02:55,268 Thank you guys. 66 00:02:56,931 --> 00:02:58,191 you're, you're in your new office, 67 00:02:58,191 --> 00:02:58,761 apparently? 68 00:02:58,778 --> 00:02:59,678 am in a new office. 69 00:02:59,678 --> 00:02:59,918 Yes. 70 00:03:01,161 --> 00:03:01,671 Yeah. 71 00:03:01,701 --> 00:03:03,891 Do you wanna, do you wanna talk about what you're 72 00:03:03,891 --> 00:03:04,346 doing over there? 73 00:03:04,508 --> 00:03:04,688 Yeah. 74 00:03:04,688 --> 00:03:09,068 So, uh, I think when, when you and I started the, the book, I was, uh, I was 75 00:03:09,668 --> 00:03:14,498 involved, uh, at a, to a lesser extent with, uh, some North Texas, uh, colleges 76 00:03:14,498 --> 00:03:18,638 and universities helping them with their cybersecurity computer science programs. 77 00:03:19,058 --> 00:03:22,538 Uh, and then over the last couple of months, um, um. 78 00:03:23,168 --> 00:03:27,338 My engagement with Weatherford College in particular, uh, grew into, 79 00:03:27,458 --> 00:03:31,328 uh, now I'm the department chair, uh, over business, computer science 80 00:03:31,328 --> 00:03:32,888 and organizational leadership. 81 00:03:32,888 --> 00:03:37,598 So, uh, I just can't, I can't get enough of, of more to do. 82 00:03:37,598 --> 00:03:39,848 So I'm, I'm, I'm at least succeeding in that 83 00:03:41,556 --> 00:03:41,921 Do you. 84 00:03:41,976 --> 00:03:46,746 gonna say, Mike, that you just like, you just finished your PhD last year, 85 00:03:46,746 --> 00:03:47,166 right? 86 00:03:47,228 --> 00:03:47,923 24. 87 00:03:48,066 --> 00:03:50,226 I was like, okay, 24. 88 00:03:50,226 --> 00:03:53,556 And I was like, okay, it looks like you got addicted to being 89 00:03:53,556 --> 00:03:55,506 in school or being around school. 90 00:03:55,506 --> 00:03:57,306 So you're like, okay, gonna go back. 91 00:03:57,306 --> 00:04:00,606 Except this time I will help set up or run departments and all the 92 00:04:00,606 --> 00:04:01,146 rest, so. 93 00:04:01,178 --> 00:04:04,628 Well, uh, uh, over the last couple years, I've, I've thought about, you know, 94 00:04:04,628 --> 00:04:06,668 what, what does retirement look like? 95 00:04:06,668 --> 00:04:11,468 And, uh, uh, I think I've, uh, I, I've got an idea of retiring as a, 96 00:04:11,828 --> 00:04:16,388 uh, in, in academia somewhere, you know, share, share my war stories and 97 00:04:16,388 --> 00:04:17,583 knowledge with the next generation. 98 00:04:18,593 --> 00:04:19,493 Uh, so that's that. 99 00:04:19,673 --> 00:04:20,648 You know what I'm working towards. 100 00:04:21,321 --> 00:04:25,461 feel free to, you know, I can think of a recommended textbook 101 00:04:25,461 --> 00:04:28,101 for your, for your, uh, for your 102 00:04:28,101 --> 00:04:28,761 class. 103 00:04:28,988 --> 00:04:29,668 a great idea. 104 00:04:29,871 --> 00:04:31,731 anyway, yeah. 105 00:04:31,941 --> 00:04:35,481 Um, I, I, I remember at least one of one of my books. 106 00:04:35,541 --> 00:04:38,841 Uh, I remember finding out that it was a textbook somewhere, which 107 00:04:38,841 --> 00:04:39,921 I thought that was pretty cool. 108 00:04:40,206 --> 00:04:40,536 Right. 109 00:04:40,956 --> 00:04:44,106 Being told that some, that some people are being forced to buy my book. 110 00:04:46,776 --> 00:04:50,796 So, uh, speaking of the book, we are beginning, this is at the very 111 00:04:50,796 --> 00:04:53,166 beginning of a very long series. 112 00:04:53,166 --> 00:04:57,606 We are gonna be talking about this book, literally four years. 113 00:04:57,816 --> 00:04:58,506 What's the title? 114 00:04:59,346 --> 00:05:00,396 we're gonna do like. 115 00:05:00,876 --> 00:05:05,136 A hundred episodes about, because there's so much to talk about in the book. 116 00:05:05,436 --> 00:05:09,156 But basically, uh, we're gonna just talk about the things that we, you know, that 117 00:05:09,156 --> 00:05:12,876 we, that we learned, uh, you know, some of which we, we already knew, but I think 118 00:05:12,876 --> 00:05:14,916 we learned, uh, some things along the way. 119 00:05:15,426 --> 00:05:20,586 And, um, this one, Mike, I thought we would start with that We already did. 120 00:05:20,586 --> 00:05:22,656 Uh, an episode or two, we talked about. 121 00:05:23,001 --> 00:05:28,791 We did the what is Ransomware episode and uh, I also did, um, 'cause we were 122 00:05:28,791 --> 00:05:33,806 waiting to, trying to book you, uh, you know, you're a busy man and uh, we did it. 123 00:05:34,521 --> 00:05:41,841 Y Yeah, we, uh, we, um, um, we did an episode on how DISC 124 00:05:41,901 --> 00:05:44,241 helped, but also hurt, right? 125 00:05:44,241 --> 00:05:48,981 Because the fact that backups are on disc makes them, uh, an easier 126 00:05:48,981 --> 00:05:50,781 target from a ransomware perspective. 127 00:05:50,781 --> 00:05:51,081 Right. 128 00:05:51,711 --> 00:05:57,051 Um, and now we're gonna talk about just, just sort of the, the, the attack. 129 00:05:58,281 --> 00:06:00,561 process the attack methodology, right? 130 00:06:00,561 --> 00:06:04,821 So the title here is, is five objectives of Every Ransomware Attack. 131 00:06:04,821 --> 00:06:06,201 What are they gonna try to do? 132 00:06:07,501 --> 00:06:09,991 Do they almost all follow the same pattern? 133 00:06:10,983 --> 00:06:14,673 To an extent there, there are some that, that may deviate based on 134 00:06:14,763 --> 00:06:16,803 how the ransomware was designed. 135 00:06:17,013 --> 00:06:20,913 Uh, and so there are specific campaigns to do specific things. 136 00:06:21,423 --> 00:06:25,563 Uh, but in general, yeah, they, they do tend to follow, uh, the same process. 137 00:06:27,181 --> 00:06:28,591 Can I chime in on something? 138 00:06:28,951 --> 00:06:30,151 Chime, chime. 139 00:06:30,181 --> 00:06:32,221 the name of this book that you are referring to? 140 00:06:32,881 --> 00:06:36,931 Well, it's of course learning ransomware response and recovery. 141 00:06:37,261 --> 00:06:41,821 Uh, although I appreciate the ability to plug Prasanna, there's already an ad that 142 00:06:41,821 --> 00:06:43,741 plays at the beginning of every episode. 143 00:06:45,511 --> 00:06:48,691 Trust me, I make sure they know the title of this book if they're 144 00:06:48,691 --> 00:06:49,921 listening to this episode. 145 00:06:51,061 --> 00:06:54,961 but yeah, so, and if you're watching it on, on, uh, on YouTube, you get to see 146 00:06:54,961 --> 00:06:57,061 the picture, uh, right up behind me there. 147 00:06:57,481 --> 00:07:01,711 Uh, and, uh, Mike is of course my co-author, so let's talk about 148 00:07:01,711 --> 00:07:05,671 that, that the first thing that they want to do, which, uh, and 149 00:07:05,671 --> 00:07:07,471 let's talk about, let's define. 150 00:07:07,861 --> 00:07:10,081 What an IAB is, right? 151 00:07:10,111 --> 00:07:14,401 And what this has to do with, uh, that first step, which is gaining that 152 00:07:14,401 --> 00:07:16,291 initial access to the environment. 153 00:07:18,053 --> 00:07:20,213 And so that can take a lot of different forms too. 154 00:07:20,423 --> 00:07:23,843 Uh, I think we, we, we often hear about ransomware coming through 155 00:07:23,843 --> 00:07:26,963 an email that you clicked on something or you open something. 156 00:07:27,143 --> 00:07:34,793 Um, but speaking of IABs or initial access brokers, sometimes bad guys simply buy 157 00:07:34,793 --> 00:07:37,238 credentials from some other bad guy. 158 00:07:37,523 --> 00:07:39,143 'cause that's all the, you know, that's the risk. 159 00:07:39,143 --> 00:07:40,103 That's their specialty. 160 00:07:40,103 --> 00:07:42,323 They just harvest credentials and they resell them. 161 00:07:43,023 --> 00:07:46,503 So now I don't, I don't need to rely on a user to interact with 162 00:07:46,503 --> 00:07:47,763 an email with malware in it. 163 00:07:47,763 --> 00:07:51,213 I have the credentials to log in and deploy my malware. 164 00:07:51,843 --> 00:07:56,523 Uh, so how it's initially, uh, deployed sometimes depends. 165 00:07:56,613 --> 00:07:58,503 Uh, so it depends on the, the threat actor. 166 00:07:58,503 --> 00:07:59,733 It depends on the campaign. 167 00:08:00,033 --> 00:08:01,503 And sometimes they may try both. 168 00:08:01,713 --> 00:08:03,813 You know, maybe I bought a bunch of credentials and none of them 169 00:08:03,813 --> 00:08:07,743 work, so now I'm gonna start sending emails or vice versa, right? 170 00:08:07,743 --> 00:08:09,483 I send a bunch of emails and nobody clicks on it. 171 00:08:09,513 --> 00:08:12,243 Well, now I need to go buy, I need to go buy some credentials. 172 00:08:13,306 --> 00:08:19,726 And is like if then I know you have a lot of expertise in this field, 173 00:08:20,086 --> 00:08:22,816 in your sort of experience, how. 174 00:08:23,896 --> 00:08:24,706 Successful. 175 00:08:24,706 --> 00:08:30,796 Is it sort of with the email versus, or how prevalent is the email attack side 176 00:08:30,796 --> 00:08:35,416 of things versus sort of uh, the, buy 177 00:08:35,416 --> 00:08:36,076 credentials. 178 00:08:36,183 --> 00:08:39,723 email is the cheapest and statistically most reliable. 179 00:08:40,548 --> 00:08:44,028 Uh, and then there's the other, there is the third option where bad 180 00:08:44,028 --> 00:08:46,938 guys do you know, they, they, they do an assessment of your environment 181 00:08:46,938 --> 00:08:47,988 looking for vulnerabilities. 182 00:08:47,988 --> 00:08:49,278 They find one they can exploit. 183 00:08:49,278 --> 00:08:51,978 Now they've got access that way without having to do either of the other two. 184 00:08:52,638 --> 00:08:59,103 But, um, statistics with email has, has run pretty consistent over the, 185 00:08:59,103 --> 00:09:01,938 the last man almost couple of decades. 186 00:09:02,388 --> 00:09:03,828 Uh, it's gotten a little bit better. 187 00:09:03,888 --> 00:09:06,588 Well, actually there's a bit of an e ebb and flow because, 188 00:09:07,098 --> 00:09:09,348 uh, traditional email phishing. 189 00:09:09,963 --> 00:09:14,073 We were getting better at as users at detecting, you know, bad, you 190 00:09:14,073 --> 00:09:17,493 know, bad grammar, bad punctuation, like that just doesn't seem right. 191 00:09:17,493 --> 00:09:18,513 I'm not clicking on that. 192 00:09:18,783 --> 00:09:22,743 But now with ai, those emails are written, written, pristine. 193 00:09:23,133 --> 00:09:27,183 And if, and if I can give AI enough history of how you communicate, 194 00:09:27,273 --> 00:09:30,278 I can truly make that email sound like something you would say. 195 00:09:31,008 --> 00:09:34,458 Right, because that's the other, that's the other giveaway with AI is 196 00:09:34,458 --> 00:09:37,338 that it's using language and things like Prasanna doesn't talk that way. 197 00:09:37,338 --> 00:09:38,988 He wouldn't sign his email like that. 198 00:09:39,168 --> 00:09:40,488 So now that's what I'm looking for. 199 00:09:40,488 --> 00:09:44,388 Instead of punctuation, I'm looking for like, you know, a sentence structure 200 00:09:44,388 --> 00:09:45,978 and, and the words you might use. 201 00:09:46,308 --> 00:09:49,458 Well, but ai, if I give it AI enough information, it can, it 202 00:09:49,458 --> 00:09:50,778 can, it can fool a lot of people. 203 00:09:50,778 --> 00:09:51,888 So there's been this like. 204 00:09:52,518 --> 00:09:58,128 Over, you know, prior to, uh, AI being used as a, as a tool, uh, the, the 205 00:09:58,128 --> 00:10:02,868 statistical, the statistical success of email phishing went down a couple 206 00:10:02,868 --> 00:10:05,568 of percentages, uh, percentage points. 207 00:10:05,568 --> 00:10:06,978 But now with ai, it's going back up. 208 00:10:07,458 --> 00:10:12,048 Uh, and so it's, it's usually around between 20 and 25%. 209 00:10:12,588 --> 00:10:19,248 So if I send out a million emails, that's 200,000 people are gonna click on it and, 210 00:10:19,476 --> 00:10:19,896 Really 211 00:10:20,238 --> 00:10:20,508 yeah. 212 00:10:21,696 --> 00:10:22,531 that, that's really 213 00:10:22,938 --> 00:10:23,298 It is. 214 00:10:23,298 --> 00:10:25,848 Well now, now granted, you know, you've gotta, you've gotta 215 00:10:25,848 --> 00:10:27,408 consider all the other things too. 216 00:10:27,408 --> 00:10:29,268 Like maybe I have a good email filter. 217 00:10:29,598 --> 00:10:30,288 And so 218 00:10:30,431 --> 00:10:30,851 Mm-hmm. 219 00:10:30,858 --> 00:10:34,488 don't typically get emails from Prasanna, so that's going into quarantine, right? 220 00:10:34,488 --> 00:10:36,978 So there's, there's other things that would impact that. 221 00:10:37,368 --> 00:10:41,328 Uh, so it does depend on how an environment might, uh, uh, might be 222 00:10:41,328 --> 00:10:43,968 set up to, to, uh, address phishing. 223 00:10:43,968 --> 00:10:48,348 But in general, between 20 and 25% delivery. 224 00:10:48,873 --> 00:10:51,093 Alright, so that's just, it made it to your inbox. 225 00:10:51,423 --> 00:10:57,423 Now of the 20, 25%, another 20, 25% interact with the email. 226 00:10:57,423 --> 00:11:02,553 So out of, out of 200,000 now you've got, what, 40, 40,000 people 227 00:11:02,793 --> 00:11:06,063 actually opening the email of those? 228 00:11:06,063 --> 00:11:09,543 Some, another subset would actually, you know, if it asked for credentials, 229 00:11:09,543 --> 00:11:10,713 they would give credentials. 230 00:11:11,223 --> 00:11:14,463 Uh, so it, out of a million emails, you're probably looking 231 00:11:14,463 --> 00:11:16,863 at, you know, maybe 20, 30,000. 232 00:11:17,538 --> 00:11:21,138 Uh, actually, actually interacting with it and potentially, you know, 233 00:11:21,138 --> 00:11:24,048 causing an infection or giving away their, their login credentials. 234 00:11:25,306 --> 00:11:25,486 Well, 235 00:11:25,606 --> 00:11:25,936 Of course. 236 00:11:25,996 --> 00:11:26,356 given how. 237 00:11:27,391 --> 00:11:29,821 Of course when you're saying the word phishing, for those that you 238 00:11:29,821 --> 00:11:33,331 know, 'cause we're saying it out loud, this is phishing pH, right? 239 00:11:33,331 --> 00:11:36,571 P-H-I-S-A-I-S-H-I-N-E. 240 00:11:37,021 --> 00:11:37,411 Right. 241 00:11:37,711 --> 00:11:41,671 Um, and, uh, you know, referring to this idea of sending something 242 00:11:41,671 --> 00:11:43,021 out, you're fishing, right? 243 00:11:43,021 --> 00:11:44,581 You're, you're sending a bunch of stuff out. 244 00:11:44,611 --> 00:11:45,961 Hoping that you get a bite. 245 00:11:46,291 --> 00:11:50,521 And, and the thing is, like everything else, and we're gonna say this a million 246 00:11:50,521 --> 00:11:54,721 times over the, you know, over these episodes is they, they have to, they 247 00:11:54,721 --> 00:11:56,071 only have to be right once, right? 248 00:11:56,071 --> 00:11:59,551 They only have to get one person right to click on the, on that, on that 249 00:11:59,551 --> 00:12:04,156 email and, uh, and, and enter the, the, uh, the credentials and then 250 00:12:04,156 --> 00:12:04,711 boom, they're in 251 00:12:04,758 --> 00:12:07,818 And, and on that note, it's funny that, you know, companies, companies 252 00:12:07,818 --> 00:12:10,818 do these phishing exercises and they're like, you know, out of a hundred 253 00:12:10,818 --> 00:12:12,198 people, only two people clicked. 254 00:12:12,198 --> 00:12:12,798 And that's great. 255 00:12:12,798 --> 00:12:14,238 I'm like, no, it's still two people. 256 00:12:14,238 --> 00:12:14,988 That's all they need. 257 00:12:14,988 --> 00:12:16,668 They just need one, right? 258 00:12:16,668 --> 00:12:18,523 It used to be a hundred percent, but. 259 00:12:19,726 --> 00:12:22,546 So we're, we're, we're trying to, we're trying to cover a lot in this half hour. 260 00:12:22,546 --> 00:12:25,186 So obviously the first thing they could do is, is to get in, right? 261 00:12:25,186 --> 00:12:28,786 To get some kind of, uh, either, you know, you talked a little 262 00:12:28,786 --> 00:12:30,196 bit about vulnerabilities. 263 00:12:30,226 --> 00:12:33,496 Uh, we've covered some of the vulnerabilities that happen, uh, and 264 00:12:33,496 --> 00:12:37,156 then also, but I think would, would you agree that the most common way 265 00:12:37,156 --> 00:12:39,196 is, is essentially stolen credentials? 266 00:12:39,196 --> 00:12:41,716 Is that the most common way that people get into 267 00:12:41,716 --> 00:12:42,316 environments? 268 00:12:42,393 --> 00:12:45,393 Uh, that is the most common successful path. 269 00:12:45,393 --> 00:12:45,783 Yes. 270 00:12:46,981 --> 00:12:47,311 Yeah. 271 00:12:47,341 --> 00:12:48,211 Yeah, that makes sense. 272 00:12:48,241 --> 00:12:48,571 Okay. 273 00:12:48,601 --> 00:12:51,181 And then obviously there, there are things like vulnerabilities 274 00:12:51,181 --> 00:12:52,351 that they can, they can exploit. 275 00:12:52,351 --> 00:12:54,661 Those are just, they're more work, I think. 276 00:12:54,691 --> 00:12:55,141 Right. 277 00:12:55,471 --> 00:12:58,591 Um, and, and many of those vulnerabilities require. 278 00:12:59,431 --> 00:13:01,411 I, I think this is hand in hand, right? 279 00:13:01,411 --> 00:13:04,981 So many of the vulnerabilities require that you're already 280 00:13:04,981 --> 00:13:06,361 in the environment, right? 281 00:13:06,361 --> 00:13:10,021 So the, if, if you have a vulnerability on your internal email server, 282 00:13:10,021 --> 00:13:14,041 but that internal email server is accessible via the internet, 283 00:13:14,041 --> 00:13:16,111 then you, you've gotta be inside. 284 00:13:16,201 --> 00:13:17,191 Um, does that 285 00:13:17,311 --> 00:13:17,551 sound 286 00:13:17,753 --> 00:13:20,423 Well, I am just gonna go back to my favorite word it, uh, or phrase. 287 00:13:20,423 --> 00:13:21,293 It depends. 288 00:13:21,743 --> 00:13:27,053 And so, so the, the initial part of this, whether it's identifying 289 00:13:27,053 --> 00:13:28,523 a vulnerability on your perimeter. 290 00:13:29,058 --> 00:13:35,898 Uh, buying, uh, uh, credentials or phishing, almost all of that is automated 291 00:13:35,928 --> 00:13:39,378 because bad guys are lazy and they've, they've figured out the, you know, 292 00:13:39,378 --> 00:13:41,388 the secret way of, of doing a job. 293 00:13:41,388 --> 00:13:46,488 So that first phase is almost all automated, and a lot of times the bad 294 00:13:46,488 --> 00:13:51,018 guy doesn't know that they compromise somebody until it phones home. 295 00:13:52,098 --> 00:13:53,958 And we'll get to that in a minute, but. 296 00:13:55,053 --> 00:13:58,443 Things like, um, you know, there were, there was a recent, uh, 297 00:13:58,473 --> 00:14:00,783 zero day with Fortinet firewalls. 298 00:14:01,173 --> 00:14:07,713 There's a, there's uh, there was a zero day with, um, load balancers. 299 00:14:07,773 --> 00:14:10,833 There was a zero day with some cloud services. 300 00:14:11,343 --> 00:14:15,813 All of those things, I mean, bad guys are, are keeping an eye on, on, on that stuff. 301 00:14:15,933 --> 00:14:19,173 Uh, and, and, and jumping on the opportunity to configure. 302 00:14:19,563 --> 00:14:22,353 You know, scripted attacks to take advantage of those things. 303 00:14:22,683 --> 00:14:27,303 And so it's, it's when those vulnerabilities get exploited and 304 00:14:27,303 --> 00:14:30,963 they get alerted like, Hey, this, that your sub your, your script or your 305 00:14:30,963 --> 00:14:34,113 attack was successful, that's when they start applying actual effort. 306 00:14:34,923 --> 00:14:35,553 Um, so. 307 00:14:36,541 --> 00:14:36,811 Right. 308 00:14:36,813 --> 00:14:36,963 Yep. 309 00:14:37,141 --> 00:14:37,441 sense. 310 00:14:37,441 --> 00:14:37,951 Yeah. 311 00:14:38,041 --> 00:14:38,431 Yeah. 312 00:14:38,731 --> 00:14:42,691 So let's talk about, so once they're in, right, so then what are we, 313 00:14:42,721 --> 00:14:43,741 what are they gonna do at that 314 00:14:43,741 --> 00:14:44,131 point? 315 00:14:44,193 --> 00:14:47,763 So the next part is understanding what they, what they caught, right? 316 00:14:47,763 --> 00:14:50,823 So, you know, you, you got something on the, on your line and you're 317 00:14:50,823 --> 00:14:52,323 like, this is gonna be a huge fish. 318 00:14:52,323 --> 00:14:55,083 And, you know, it turns out to, to be, you know, a little, little 319 00:14:55,083 --> 00:14:57,513 sunfish, uh uh, or a minnow. 320 00:14:58,308 --> 00:15:01,368 But, and I, and I say minnow because in some cases what you 321 00:15:01,368 --> 00:15:04,668 have is really just bait or a stepping stone for the next thing. 322 00:15:05,088 --> 00:15:09,018 But yeah, reconnaissance and understanding what, uh, what you've, what you've 323 00:15:09,018 --> 00:15:12,258 gained access to is the next step, because maybe it's something they 324 00:15:12,258 --> 00:15:13,578 don't wanna spend any more time on. 325 00:15:14,208 --> 00:15:17,298 Um, you know, it's, it's grandma's knitting shop. 326 00:15:17,718 --> 00:15:20,388 Uh, you know what, what, what's a value there? 327 00:15:20,808 --> 00:15:23,898 Uh, versus Oh yeah, I don't have time to mess with that. 328 00:15:23,898 --> 00:15:27,798 I'd rather spend, you know, the 10 hours that, that I've, that I've got to. 329 00:15:28,503 --> 00:15:31,203 Look at the next thing that that just told me got compromised. 330 00:15:31,203 --> 00:15:32,433 So I'm gonna go see what that is. 331 00:15:33,003 --> 00:15:35,673 Um, and so it's a little bit about, uh, you know, you just 332 00:15:35,673 --> 00:15:40,413 have to be less valuable or, um, more protected than your neighbor. 333 00:15:40,953 --> 00:15:41,463 Um, 334 00:15:41,616 --> 00:15:41,906 Yeah. 335 00:15:42,273 --> 00:15:42,393 so 336 00:15:42,571 --> 00:15:43,876 It is that thing about not 337 00:15:43,876 --> 00:15:44,446 outrunning the 338 00:15:44,553 --> 00:15:46,528 yep, you just have to faster than the other guy. 339 00:15:46,606 --> 00:15:47,656 Just have to run the other guy. 340 00:15:48,361 --> 00:15:53,641 And Mike are the people who do this sort of second level analysis, is that 341 00:15:53,641 --> 00:15:58,771 the same person who did the initial access broker and got in initially? 342 00:15:58,771 --> 00:16:02,251 Or is this sort of, they got in and now they just hand things over? 343 00:16:02,251 --> 00:16:05,761 Because I've heard that there are like multiple Prasannas sometimes involved in a 344 00:16:05,761 --> 00:16:06,331 ransomware 345 00:16:06,468 --> 00:16:06,828 sure. 346 00:16:06,978 --> 00:16:10,158 Yeah, there's, there's different threat actors, uh, initial access brokers. 347 00:16:10,158 --> 00:16:11,088 That's just their job. 348 00:16:12,243 --> 00:16:17,163 Uh, so they're either collecting or, or buying and reselling credentials. 349 00:16:17,343 --> 00:16:20,313 'cause sometimes, you know, maybe they'll go buy, you know, a million 350 00:16:20,313 --> 00:16:24,423 credentials and then they'll validate them and then sell them as validated 351 00:16:24,423 --> 00:16:26,373 credentials, which can bring more money. 352 00:16:26,643 --> 00:16:30,663 Versus just saying, I've got a lot of, you know, credentials and selling them. 353 00:16:30,843 --> 00:16:32,673 'cause I don't know if they're valid or not. 354 00:16:33,033 --> 00:16:37,503 So, initial access brokers, that's a job that's, that's, that's a bad guy's career. 355 00:16:37,503 --> 00:16:38,133 That's all they do. 356 00:16:38,643 --> 00:16:38,973 And so. 357 00:16:39,843 --> 00:16:43,113 Uh, sometimes there is continued interaction, so maybe I sold you 358 00:16:43,113 --> 00:16:47,853 some credentials for this target and one or two of them work, uh, 359 00:16:47,943 --> 00:16:49,833 but maybe some of them don't. 360 00:16:49,833 --> 00:16:53,283 So I may come back to you and say, Hey, you know, what else do 361 00:16:53,283 --> 00:16:54,693 you have related to this company? 362 00:16:54,693 --> 00:16:55,743 What else can you find? 363 00:16:55,773 --> 00:16:59,763 Go back out to your, your network and, and see if you can buy or 364 00:16:59,763 --> 00:17:02,223 get updated credentials, however you got them the first time. 365 00:17:03,406 --> 00:17:07,756 And, and then this, the, but the, the, the lateral movement and the recon 366 00:17:07,786 --> 00:17:09,826 that still can be automated, right? 367 00:17:09,826 --> 00:17:12,556 Like, uh, once they're, once something gets installed, it can sort of 368 00:17:12,556 --> 00:17:12,856 poke 369 00:17:13,098 --> 00:17:13,998 It often is, 370 00:17:14,026 --> 00:17:14,176 out 371 00:17:14,268 --> 00:17:14,478 it 372 00:17:14,551 --> 00:17:14,671 there. 373 00:17:14,748 --> 00:17:17,628 certainly often is, uh, the malware is designed to go 374 00:17:17,628 --> 00:17:19,248 and look for specific things. 375 00:17:19,518 --> 00:17:23,418 Like it'll say, you know, look for all the Microsoft Office related, you know, 376 00:17:23,448 --> 00:17:27,528 document, spreadsheet, PowerPoint, uh, and then give me a count and a 377 00:17:27,528 --> 00:17:29,358 file size for all of those things. 378 00:17:29,358 --> 00:17:30,053 'cause if they're all like. 379 00:17:30,843 --> 00:17:34,173 You know, 10 or 15 k, probably not interested in those, but if you've 380 00:17:34,173 --> 00:17:37,863 got a, a two or three meg spreadsheet, probably interested in that. 381 00:17:38,433 --> 00:17:41,823 Uh, and, and maybe even the file name, you know, financial forecast 382 00:17:41,823 --> 00:17:43,773 for 2026, I probably want that. 383 00:17:44,043 --> 00:17:47,428 Or, uh, uh, uh, cyber 384 00:17:47,671 --> 00:17:48,271 Password 385 00:17:48,933 --> 00:17:49,653 Absolutely. 386 00:17:49,713 --> 00:17:54,033 Or cybersecurity, uh, insurance program details. 387 00:17:54,513 --> 00:17:54,783 Right. 388 00:17:55,233 --> 00:17:55,983 Uh, so I want that. 389 00:17:56,193 --> 00:17:56,913 Well then maybe. 390 00:17:57,361 --> 00:17:57,871 Insurance, 391 00:17:58,053 --> 00:18:03,543 Maybe there's photos or backup files, you know, your, your Veeam backup file types, 392 00:18:03,603 --> 00:18:07,623 um, um, your accounting system file types. 393 00:18:07,623 --> 00:18:12,153 So it's gonna be pre-programmed to go look for this stuff, inventory it, uh, and then 394 00:18:12,153 --> 00:18:15,183 give that back to me so I can determine the value of what I've access to. 395 00:18:15,183 --> 00:18:19,563 But it's also gonna look for what other things does this device have access to? 396 00:18:19,563 --> 00:18:22,293 Do I have, am I mapped to a network drive? 397 00:18:22,683 --> 00:18:25,443 Uh, do I have credentials to a, a cloud environment? 398 00:18:25,653 --> 00:18:26,283 You know, is, is there. 399 00:18:27,153 --> 00:18:32,973 Um, um, I'm trying to, uh, I'm trying to remember the, the Microsoft service 400 00:18:32,973 --> 00:18:38,283 that runs that, that maintains your, your credentials across, uh, different apps 401 00:18:38,536 --> 00:18:39,976 you mean, uh, like inter ID 402 00:18:40,306 --> 00:18:40,636 active 403 00:18:40,653 --> 00:18:44,403 intra, but then there's a, there's actually a service, uh, that runs on a, a 404 00:18:44,403 --> 00:18:46,053 Windows machine that, that manages that. 405 00:18:46,053 --> 00:18:48,573 So it's gonna look for that too, like what services are running. 406 00:18:48,676 --> 00:18:48,976 Right. 407 00:18:49,173 --> 00:18:52,803 Um, so yeah, that, that, that kind of stuff is automated. 408 00:18:52,803 --> 00:18:53,538 That's what happened to Target. 409 00:18:54,153 --> 00:18:55,773 And there's other, there's other malware too. 410 00:18:55,773 --> 00:18:59,463 Like, uh, back in the day when, when the target was mostly credit card 411 00:18:59,463 --> 00:19:04,923 numbers, the malware would be scripted to identify, uh, point of sale systems. 412 00:19:05,373 --> 00:19:08,973 And so it, it could get in through the, the HVAC system and it will 413 00:19:08,973 --> 00:19:13,023 automatically crawl through the network until it finds and, and it interrogates 414 00:19:13,023 --> 00:19:14,373 each device it gets access to. 415 00:19:14,373 --> 00:19:15,243 Are you a POS? 416 00:19:15,243 --> 00:19:15,513 No. 417 00:19:15,633 --> 00:19:18,093 Then it'll move on and sometimes even clean up after itself. 418 00:19:18,483 --> 00:19:18,843 Um. 419 00:19:19,623 --> 00:19:23,253 Uh, until it finds the target scada uh, you know, what, what happened 420 00:19:23,253 --> 00:19:26,613 to, uh, the Iran, uh, centrifuge? 421 00:19:26,763 --> 00:19:29,523 It's very similar that malware looked for cent. 422 00:19:29,523 --> 00:19:30,933 What, what is a centrifuge? 423 00:19:31,383 --> 00:19:35,763 Uh, and it would only, uh, you know, uh, detonate, uh, when it, when it 424 00:19:35,763 --> 00:19:37,233 found what it was scripted to look for. 425 00:19:38,686 --> 00:19:43,606 And Mike, as it's doing the searches, is it hopping from device 426 00:19:43,606 --> 00:19:47,116 to device and doing searches kind of like spreading like a worm? 427 00:19:47,386 --> 00:19:50,326 Or is it just using that initial access point 428 00:19:50,793 --> 00:19:51,513 No, it wants to, 429 00:19:51,616 --> 00:19:52,096 to sort 430 00:19:52,143 --> 00:19:56,043 it wants to spread because the other objective of malware's persistence. 431 00:19:56,403 --> 00:20:00,813 So, uh, and, and I, and I, I've seen this in, in practice because 432 00:20:00,813 --> 00:20:02,618 we often get asked to, uh. 433 00:20:03,288 --> 00:20:05,958 To compromise or test the, the security of an environment. 434 00:20:05,958 --> 00:20:07,968 One of the ways we do that is custom malware. 435 00:20:08,478 --> 00:20:12,858 Uh, and so when, when we infect one machine, we want that machine to help 436 00:20:12,858 --> 00:20:18,348 us infect other machines and antivirus, especially with custom malware, it usually 437 00:20:18,348 --> 00:20:21,138 takes antivirus a week to determine that. 438 00:20:21,138 --> 00:20:21,918 That's malware. 439 00:20:21,978 --> 00:20:26,658 Well, then it updates the software, the, the signatures on this computer, 440 00:20:26,718 --> 00:20:28,518 and then our malware gets scraped. 441 00:20:28,968 --> 00:20:30,558 What's gonna do that sequentially? 442 00:20:30,978 --> 00:20:34,758 And that gives us time then to tweak our malware and redeploy it on 443 00:20:34,758 --> 00:20:36,168 those threads that are still open. 444 00:20:36,618 --> 00:20:40,578 Uh, so a no, absolutely it wants to spread, um, and maintain 445 00:20:40,578 --> 00:20:41,928 some level of persistence. 446 00:20:43,616 --> 00:20:48,211 All right, so we, so we got in, we're spreading around, and then what's 447 00:20:48,648 --> 00:20:53,838 So when it has that inventory or a good understanding of, of, uh, or it, it's 448 00:20:53,838 --> 00:20:57,198 achieved whatever it was designed to do, it's saying it's gonna phone home, 449 00:20:57,258 --> 00:20:58,938 it's gonna go, you know, Hey bad guys. 450 00:20:58,938 --> 00:20:59,608 Here's what you've got. 451 00:21:00,438 --> 00:21:01,608 Uh, lemme know what's next. 452 00:21:02,118 --> 00:21:05,448 Uh, and that, that then leaves it up to the bad guy to determine, all right, 453 00:21:05,778 --> 00:21:11,358 well, and I, I say that some, some malware is just scripted to, to detonate on 454 00:21:11,358 --> 00:21:13,123 everything whenever it gets access to it. 455 00:21:13,128 --> 00:21:14,628 So it'll just, it doesn't care. 456 00:21:15,048 --> 00:21:20,328 It doesn't care if you're, if your grandma's yarn shop or a, uh, an oil 457 00:21:20,328 --> 00:21:23,748 and gas company, the moment you get infected, it just starts encrypting stuff. 458 00:21:24,198 --> 00:21:25,068 Uh, so there's that. 459 00:21:25,128 --> 00:21:27,588 And so that goes back to the, it depends, but, uh. 460 00:21:28,293 --> 00:21:32,073 In, in most sophisticated attacks, it's gonna phone home and give them an idea of 461 00:21:32,073 --> 00:21:35,763 what they've got access to so that the bad guys could then determine, 'cause maybe 462 00:21:35,763 --> 00:21:39,033 I don't wanna detonate the ransomware, maybe I wanna maintain some access and 463 00:21:39,033 --> 00:21:41,493 start doing more recon and EA drop. 464 00:21:41,806 --> 00:21:42,706 Yeah, maybe. 465 00:21:42,946 --> 00:21:46,036 Yeah, maybe you, you don't, you don't quite have the golden 466 00:21:46,036 --> 00:21:46,516 goose that 467 00:21:46,608 --> 00:21:46,898 Okay. 468 00:21:47,056 --> 00:21:52,456 for, but maybe you've got, you can do a more manual lateral movement 469 00:21:52,456 --> 00:21:52,666 and 470 00:21:52,983 --> 00:21:53,163 Yep. 471 00:21:53,266 --> 00:21:53,686 right. 472 00:21:53,896 --> 00:21:57,076 Uh, something that's controlled by a human rather than, uh, 473 00:21:57,076 --> 00:21:57,376 than a 474 00:21:57,498 --> 00:22:00,348 And so we would consider that more of an advanced persistence. 475 00:22:00,348 --> 00:22:04,218 So it's not an automated persistence, it's a, it's a, it's a human driven 476 00:22:04,218 --> 00:22:08,808 persistence where they're gonna pivot and listen and, and maybe modify. 477 00:22:09,168 --> 00:22:09,498 But yeah, 478 00:22:09,796 --> 00:22:11,716 the deter advanced persistent threat, 479 00:22:11,716 --> 00:22:12,346 right, is 480 00:22:12,348 --> 00:22:14,718 I didn't wanna call it an A PT 'cause a lot of times those are 481 00:22:14,718 --> 00:22:18,198 nation state driven, but I like the advanced persistence part of that. 482 00:22:18,708 --> 00:22:18,828 Uh. 483 00:22:19,743 --> 00:22:22,863 But yeah, so it's gonna call, it's gonna phone home, and then it's gonna wait 484 00:22:22,863 --> 00:22:27,093 to determine if, uh, bad guys wanna do anything else or, or modify the attack. 485 00:22:28,201 --> 00:22:31,771 So when you say phone home, could you provide a little bit more details? 486 00:22:31,771 --> 00:22:34,651 'cause it's not like it's gonna like pick up the phone or just be like, Hey, I'm 487 00:22:34,651 --> 00:22:36,361 just gonna ping this IP or send a message. 488 00:22:36,361 --> 00:22:36,601 Right. 489 00:22:36,601 --> 00:22:37,531 Or an SMS. 490 00:22:37,531 --> 00:22:37,861 Right. 491 00:22:37,951 --> 00:22:38,941 What do you mean by 492 00:22:38,941 --> 00:22:39,211 phone 493 00:22:39,423 --> 00:22:43,113 So ahead of the com, uh, ahead of the campaign, bad guys will typically 494 00:22:43,113 --> 00:22:47,988 rent, uh, servers out on the dark net, so the compromised machines, uh, uh. 495 00:22:49,023 --> 00:22:52,713 Um, a virtual machine, they don't care if it gets blown away or compromised 496 00:22:52,713 --> 00:22:56,073 in the future, and they'll, they'll hold that lease for a period of time, 497 00:22:56,073 --> 00:23:00,243 usually a couple of days a week, sometimes only a few hours, and then 498 00:23:00,243 --> 00:23:04,413 they will pre-configure the malware with the IP address or the host and 499 00:23:04,413 --> 00:23:07,983 the host name of that, what we would consider a command and control server. 500 00:23:07,983 --> 00:23:11,223 It's what the bad guys are commanding and controlling their attack from. 501 00:23:12,363 --> 00:23:13,863 So they deploy the, the, the malware. 502 00:23:13,863 --> 00:23:17,103 When it calls home, it knows to call back to that command and control. 503 00:23:17,613 --> 00:23:20,313 Server, and that's where that information's gonna come from. 504 00:23:20,553 --> 00:23:24,573 That's also where the, if, if it, if ransomware is part of the 505 00:23:24,573 --> 00:23:28,473 attack, that's how they're gonna, uh, negotiate the, the keys, the 506 00:23:28,473 --> 00:23:30,333 encryption keys, the public private keys 507 00:23:30,471 --> 00:23:30,591 Hmm. 508 00:23:31,053 --> 00:23:31,743 back in the day. 509 00:23:31,743 --> 00:23:36,243 That's also why your Ransom note said you have 72 hours to reply to this. 510 00:23:36,513 --> 00:23:40,533 Well, it's because they we're only gonna lease that server for 72 hours and at 511 00:23:40,533 --> 00:23:44,133 the end of 72 hours when it gets blown away, we'll, so do your encryption keys. 512 00:23:44,898 --> 00:23:45,918 So, yeah. 513 00:23:46,008 --> 00:23:48,498 So, uh, that, that's evolved a bit today. 514 00:23:48,768 --> 00:23:53,358 Uh, some, um, some ransomware don't do the negotiation. 515 00:23:53,358 --> 00:23:55,548 It's just hard coded with how it's gonna encrypt. 516 00:23:56,058 --> 00:24:00,708 Uh, and, and that's one of the ways that, um, law enforcement's helping 517 00:24:01,008 --> 00:24:05,448 victims combat ransomware is because if, you know, if the FBI helped company 518 00:24:05,448 --> 00:24:10,413 A and it was ransomware strain, a. Uh, and then you get infected with the 519 00:24:10,413 --> 00:24:14,673 same ransomware strain, they may be able to use a decryption key from some 520 00:24:14,673 --> 00:24:16,653 other victim to help you with yours. 521 00:24:16,861 --> 00:24:17,081 Hmm. 522 00:24:17,313 --> 00:24:21,483 so again, it, it depends, uh, it depends on how the ransomware was, was built 523 00:24:21,573 --> 00:24:25,923 and that encryption was designed, but that's, that phone home goes 524 00:24:25,923 --> 00:24:27,183 back to that command control server. 525 00:24:28,651 --> 00:24:33,961 So in this episode we're, we're covering what I'm gonna call a traditional 526 00:24:33,961 --> 00:24:41,671 ransomware attack, but gonna add what has become more traditional. 527 00:24:42,001 --> 00:24:44,431 'cause it's not, it wasn't covered in the initial five 528 00:24:44,431 --> 00:24:45,631 steps that we're talking about. 529 00:24:45,961 --> 00:24:48,841 And I'm gonna talk a little bit about exfiltration, or I want you to talk a 530 00:24:48,841 --> 00:24:50,251 little bit about exfiltration, right? 531 00:24:50,251 --> 00:24:50,461 Because. 532 00:24:51,301 --> 00:24:54,871 I, think, uh, what, what do you think do, do you have any stats that talk 533 00:24:54,871 --> 00:25:00,151 about the percentage of ransomware attacks that have become double 534 00:25:00,151 --> 00:25:00,661 extortion 535 00:25:00,733 --> 00:25:01,003 It is in, 536 00:25:01,171 --> 00:25:01,651 Where, where 537 00:25:01,651 --> 00:25:02,191 they're stealing 538 00:25:02,233 --> 00:25:06,073 it's definitely increasing, especially with those that are not just automated 539 00:25:06,073 --> 00:25:09,913 attacks and what I mean, and, and so there's, there's, there's this 540 00:25:09,913 --> 00:25:12,278 development of kind of two, two generic. 541 00:25:14,523 --> 00:25:17,853 I am gonna, I'm gonna classify those two generic, uh, ransomware types of attacks. 542 00:25:17,853 --> 00:25:19,863 There's the, the low end attacks. 543 00:25:20,223 --> 00:25:24,003 And within those low end attacks, you, you have a variety of threat actors. 544 00:25:24,483 --> 00:25:28,713 Some of them are just entrepreneurs, and what I mean by that is bad guys 545 00:25:28,713 --> 00:25:30,633 are developing ransomware as a service. 546 00:25:31,023 --> 00:25:34,263 So there's ransomware, they're, they have the email list, maybe 547 00:25:34,263 --> 00:25:35,763 they have access or credentials. 548 00:25:35,778 --> 00:25:39,108 But you as the entrepreneur don't have to be technical at all. 549 00:25:39,168 --> 00:25:42,078 You just go to the dark net, you pay 'em $30,000, and they will 550 00:25:42,078 --> 00:25:45,558 launch a ransomware campaign on your behalf and deposit money for you. 551 00:25:45,558 --> 00:25:47,148 They'll take some off the top. 552 00:25:47,148 --> 00:25:50,448 There's good tech support and customer service, all those things. 553 00:25:51,828 --> 00:25:52,578 Well, so that's low. 554 00:25:52,578 --> 00:25:56,183 That's, that's on the generic low end attack because the ransomware 555 00:25:56,208 --> 00:25:59,478 as a service provider and you as an entrepreneur, you don't care. 556 00:25:59,823 --> 00:26:03,063 To go and access the environment and poke around and see what else they have. 557 00:26:03,273 --> 00:26:06,093 You just wanna, you just wanna return on your investment and you 558 00:26:06,093 --> 00:26:07,893 wanna play the statistics, right? 559 00:26:07,893 --> 00:26:08,463 So there's that. 560 00:26:09,003 --> 00:26:13,623 The other kind of generic low end attack is true bad guys, but they've just 561 00:26:13,623 --> 00:26:18,333 simply automated the ransomware and they don't, they have zero empathy for you. 562 00:26:18,333 --> 00:26:22,293 I mean, they could, they could, uh, ransomware in a completely encrypt 563 00:26:22,293 --> 00:26:23,853 a kids' hospital for all they care. 564 00:26:24,393 --> 00:26:25,713 They just want to automate. 565 00:26:26,056 --> 00:26:26,596 They have, 566 00:26:26,628 --> 00:26:30,318 have now in, in some, in most of those cases, they, they did feel 567 00:26:30,318 --> 00:26:32,178 bad and they, they unencrypted it. 568 00:26:32,598 --> 00:26:35,538 Uh, and I think mostly because other bad guys threatened them. 569 00:26:35,718 --> 00:26:38,808 It's kind of like, you know, the, the child predators going to prison 570 00:26:39,168 --> 00:26:44,658 and the other prisoners, uh, taking out anyway, so those threat actors 571 00:26:44,658 --> 00:26:46,098 don't really care what they have. 572 00:26:46,098 --> 00:26:48,048 They're just, again, playing the numbers that. 573 00:26:48,723 --> 00:26:50,493 Out of a hundred people, they encrypt. 574 00:26:50,493 --> 00:26:53,823 Some subset of that is gonna pay some amount of money in ransom, and 575 00:26:53,823 --> 00:26:54,873 that's how they make their money. 576 00:26:55,383 --> 00:26:58,593 Uh, and so they're kind of the bottom feeders as far as ransomware goes. 577 00:26:59,373 --> 00:27:01,173 Well, then you get into the other group, and that's the more 578 00:27:01,173 --> 00:27:03,933 sophisticated ransomware, uh, gangs. 579 00:27:04,353 --> 00:27:07,323 Uh, and those are the ones that really care about, uh, 580 00:27:07,353 --> 00:27:08,703 what they're getting access to. 581 00:27:09,003 --> 00:27:15,243 And they realize that most of, uh, victims today are using backups or. 582 00:27:15,753 --> 00:27:18,213 They don't have the money to pay any amount of ransom, and they're 583 00:27:18,213 --> 00:27:21,783 just gonna go with, you know, accept what they've lost and, you 584 00:27:21,783 --> 00:27:23,133 know, go buy another computer. 585 00:27:24,753 --> 00:27:29,943 So these guys realize that, uh, fewer people are paying ransom, 586 00:27:30,993 --> 00:27:35,223 and if a ransom is paid, that actually increases the risk to them. 587 00:27:35,223 --> 00:27:36,963 'cause now they're on the FBI list. 588 00:27:37,653 --> 00:27:41,043 Uh, you know, Interpols looking for them or, or whatever the case may be. 589 00:27:41,163 --> 00:27:43,713 And, and bad guys are lazy, but they're also risk averse. 590 00:27:43,713 --> 00:27:45,483 That's why they're doing all this stuff over the internet. 591 00:27:46,263 --> 00:27:52,803 So what they are doing is, is increasing, um, their tactics at exfiltrating 592 00:27:52,803 --> 00:27:57,183 your data so that if you don't pay the ransom, they can use those pictures or 593 00:27:57,183 --> 00:28:02,943 those files or that data as a second attempt at getting you to pay something. 594 00:28:03,513 --> 00:28:05,698 Um, in the event that you weren't gonna pay the ransom. 595 00:28:07,546 --> 00:28:09,841 Right, and so Prasanna. 596 00:28:10,231 --> 00:28:16,351 And sort of Mike, that last category that you talked about, um, there a 597 00:28:16,351 --> 00:28:23,251 certain type of victim that they target, like large organizations or select 598 00:28:23,251 --> 00:28:27,091 types of people, like celebrities, or is it kind of more the spray and pray 599 00:28:27,091 --> 00:28:28,921 and then figure it out by looking at 600 00:28:28,921 --> 00:28:28,981 each? 601 00:28:29,343 --> 00:28:30,243 So, um. 602 00:28:30,663 --> 00:28:35,373 The, the double extortion really only starts, well backing 603 00:28:35,373 --> 00:28:36,273 up to answer your question. 604 00:28:36,273 --> 00:28:40,803 It's still a variety of attack, uh, strategies. 605 00:28:40,923 --> 00:28:44,343 So, so there's the spray and pray, and then there's the 606 00:28:44,343 --> 00:28:45,693 recon and then the call home. 607 00:28:45,693 --> 00:28:47,733 And then they go, Hey, this company is worth double 608 00:28:47,733 --> 00:28:49,923 extorting, and they will do it. 609 00:28:50,463 --> 00:28:53,883 So any company that's of value to a threat actor in that second 610 00:28:53,883 --> 00:28:55,893 category, that more advanced category. 611 00:28:56,283 --> 00:28:59,763 Any victim that's worth continuing their attack, they will, they 612 00:28:59,763 --> 00:29:01,143 will exfiltrate data from. 613 00:29:02,013 --> 00:29:04,743 So that could be a, a credit union, it could be a school. 614 00:29:05,193 --> 00:29:09,123 Um, in general terms, back to your question about what type of targets, 615 00:29:09,123 --> 00:29:12,933 if they are gonna target somebody specific, they will likely target 616 00:29:12,933 --> 00:29:17,793 somebody that's regulated like a health, healthcare, or financial institution 617 00:29:18,153 --> 00:29:22,413 or a, uh, a school district or, um, 618 00:29:23,401 --> 00:29:24,151 Where they've got real 619 00:29:24,151 --> 00:29:26,221 penalties If data like 620 00:29:26,221 --> 00:29:26,881 personal data 621 00:29:26,973 --> 00:29:27,213 Yep. 622 00:29:27,843 --> 00:29:32,433 And so maybe the school or the hospital doesn't want to pay the ransom. 623 00:29:33,063 --> 00:29:36,243 Alright, so now they're getting double extorted and they still don't wanna pay. 624 00:29:36,843 --> 00:29:40,803 Well, now threat actors are getting pretty good at figuring out who they report to. 625 00:29:40,833 --> 00:29:44,913 So they'll, they'll reach out to their board or the regulator like the health 626 00:29:44,913 --> 00:29:47,793 and human ser, uh, services auditor or. 627 00:29:48,183 --> 00:29:52,563 The state, uh, or their insurance carrier and say, Hey, your, your 628 00:29:52,563 --> 00:29:53,943 client's not wanting to pay. 629 00:29:54,063 --> 00:29:56,073 Um, but this could be bad for them. 630 00:29:56,583 --> 00:30:00,063 Uh, and they do have insurance and so why don't we, why don't we negotiate? 631 00:30:00,723 --> 00:30:03,873 Uh, and so on, on the good guy side, there's actually a full-time 632 00:30:03,873 --> 00:30:05,943 job of ransomware and negotiating. 633 00:30:06,423 --> 00:30:09,278 Uh, and I got to sit with one of those guys once and that was pretty out. 634 00:30:11,956 --> 00:30:16,666 So, um, so, you know, the, the title of this episode was like five, you know, 635 00:30:16,666 --> 00:30:20,446 the, the five objectives, and I'm gonna say five objectives of every ransomware. 636 00:30:20,776 --> 00:30:25,876 I, I'm, I'm not sure every ransomware does exfiltration, but we'll, we'll 637 00:30:25,876 --> 00:30:27,946 add that as sort of a 5.5, right? 638 00:30:28,096 --> 00:30:30,871 Like you said, it's like an advanced, uh, way to. 639 00:30:32,011 --> 00:30:35,971 To, to do that, but let's say that, and they are gonna do, if they're gonna 640 00:30:35,971 --> 00:30:39,751 do exfiltration, they're gonna do that before they do the next step, which 641 00:30:39,751 --> 00:30:42,391 is the big payload, which is what? 642 00:30:42,858 --> 00:30:43,463 Oh, the encryption. 643 00:30:44,328 --> 00:30:44,538 Yep. 644 00:30:44,941 --> 00:30:45,301 Yeah. 645 00:30:46,231 --> 00:30:48,241 I mean, this is, this is, you know what I'm gonna call 646 00:30:48,241 --> 00:30:50,281 old school ransomware, right? 647 00:30:50,851 --> 00:30:55,801 Um, and this is obviously, that is the whole point of a ransomware 648 00:30:55,801 --> 00:30:58,411 attack, or at least the initial whole point of a ransomware 649 00:30:58,411 --> 00:30:59,761 attack is this is how they hold. 650 00:30:59,881 --> 00:31:04,801 'cause they're not literally stealing your data, They're gonna encrypt the data, 651 00:31:05,191 --> 00:31:08,881 uh, so that you, it's like it was stolen. 652 00:31:08,881 --> 00:31:11,761 It's like they took it away from you and they're holding a gun to its 653 00:31:11,761 --> 00:31:11,971 head. 654 00:31:12,293 --> 00:31:12,563 Yep. 655 00:31:12,743 --> 00:31:17,483 And along those lines too, uh, not to get too far ahead when, when your, your 656 00:31:17,483 --> 00:31:21,143 date is encrypted and you're talking to bad guys, which I don't recommend, you 657 00:31:21,173 --> 00:31:23,993 should have good backups, so you don't have ever have to talk to bad guys. 658 00:31:25,291 --> 00:31:25,651 Yeah, 659 00:31:25,651 --> 00:31:25,861 no 660 00:31:26,093 --> 00:31:29,213 Uh, but, but when you do and the bad guys are like, pay us money, 661 00:31:29,213 --> 00:31:31,578 and you'll, you know, we will, we'll help you decco your data. 662 00:31:32,478 --> 00:31:36,318 Uh, the first thing you need to do is, is similar to a, a real life, 663 00:31:37,008 --> 00:31:39,138 uh, ransom is you want proof of life. 664 00:31:39,498 --> 00:31:43,698 So you will send them examples of all these different types of files you have 665 00:31:43,698 --> 00:31:47,508 from all the different devices you have so that they can prove that they can 666 00:31:47,508 --> 00:31:49,323 decrypt those, um, before you pay them. 667 00:31:51,206 --> 00:31:51,496 Yeah. 668 00:31:51,631 --> 00:31:53,446 I was just gonna ask that question. 669 00:31:53,446 --> 00:31:56,776 I was like, why wouldn't they just encrypt your data and. 670 00:31:57,601 --> 00:32:01,921 Without ever knowing a key and have people pay the ransomware, like 671 00:32:01,921 --> 00:32:02,251 there's no 672 00:32:02,458 --> 00:32:02,878 Mm-hmm. 673 00:32:03,481 --> 00:32:04,176 that they're gonna be 674 00:32:04,176 --> 00:32:04,376 honest. 675 00:32:04,653 --> 00:32:04,893 Yep. 676 00:32:05,313 --> 00:32:08,643 And you know that they're bad guys, so they don't have to be, but they are also 677 00:32:08,643 --> 00:32:12,663 in a business, so they, they want to be, uh, so that, especially when you're 678 00:32:12,663 --> 00:32:15,993 working with an insurance company, if they, if they know that you're a, 679 00:32:16,083 --> 00:32:17,238 a threat actor, that doesn't care. 680 00:32:18,438 --> 00:32:21,408 Um, then they're not gonna negotiate with you, but if you do 681 00:32:21,781 --> 00:32:22,231 Yeah, because. 682 00:32:23,431 --> 00:32:26,431 People that do this on a regular basis, like yourself, like you 683 00:32:26,431 --> 00:32:28,921 get to know certain groups, right? 684 00:32:28,921 --> 00:32:31,711 You get to know certain threat actors in how they behave. 685 00:32:31,741 --> 00:32:36,241 And are, are there, are there groups where they've established this as 686 00:32:36,241 --> 00:32:40,351 a, as a, practice where they're, where they just don't care and, and 687 00:32:40,351 --> 00:32:40,861 so, you 688 00:32:40,993 --> 00:32:41,213 Yep, 689 00:32:41,371 --> 00:32:41,731 you might 690 00:32:41,731 --> 00:32:42,421 behave differently 691 00:32:42,533 --> 00:32:42,653 are. 692 00:32:42,873 --> 00:32:44,413 Uh, so a lot of the, um. 693 00:32:45,648 --> 00:32:50,688 Eastern European, uh, middle Eastern and Northern African, uh, uh, threat 694 00:32:50,688 --> 00:32:52,038 actors, they just, they don't care. 695 00:32:52,038 --> 00:32:54,618 They're just playing the numbers and they don't. 696 00:32:54,931 --> 00:32:56,311 That's region of 697 00:32:56,311 --> 00:32:56,431 the 698 00:32:56,598 --> 00:32:57,648 It is, it is. 699 00:32:58,098 --> 00:33:01,848 And, and, and going back to those two buckets, the, the low end 700 00:33:01,848 --> 00:33:05,088 bucket with the entrepreneurs, almost all of those are in the us. 701 00:33:06,531 --> 00:33:06,751 Hmm. 702 00:33:07,506 --> 00:33:07,826 Interesting. 703 00:33:07,878 --> 00:33:09,168 They caught one, uh, they caught 704 00:33:09,396 --> 00:33:09,886 America. 705 00:33:10,008 --> 00:33:11,628 years ago in Florida and. 706 00:33:12,033 --> 00:33:14,793 And this goes back to, you know, there's, there's a, you know, you need 707 00:33:14,793 --> 00:33:19,083 to watch enough bad guy video movies to know how to behave as a bad guy. 708 00:33:19,083 --> 00:33:19,863 And this guy didn't. 709 00:33:19,863 --> 00:33:23,553 So as soon as he started making money, he bought a big house and flashy cars. 710 00:33:23,558 --> 00:33:24,358 And that's, 711 00:33:24,511 --> 00:33:24,811 Um. 712 00:33:25,078 --> 00:33:26,163 that's, what tipped him off. 713 00:33:26,163 --> 00:33:26,473 So, yeah. 714 00:33:27,796 --> 00:33:32,116 Mike, so those three regions that you previously mentioned, you have 715 00:33:32,116 --> 00:33:35,536 any stats around what percentage of ransomware attacks come from 716 00:33:35,536 --> 00:33:35,841 those areas? 717 00:33:36,048 --> 00:33:38,538 I don't, but it's, uh, it wouldn't be hard to find. 718 00:33:38,538 --> 00:33:41,238 In fact, the UN does an annual report on cyber. 719 00:33:41,418 --> 00:33:42,733 Um, and that's probably a good place to loop. 720 00:33:44,581 --> 00:33:44,881 Okay, 721 00:33:45,001 --> 00:33:45,601 Interesting. 722 00:33:45,661 --> 00:33:46,886 link it in the podcast 723 00:33:47,281 --> 00:33:47,641 Yeah. 724 00:33:48,271 --> 00:33:52,381 and and of course the final step of the five steps, uh, not including 725 00:33:52,381 --> 00:33:57,271 the fifth and a half step, uh, is delivering the ransomware note. 726 00:33:57,271 --> 00:34:02,011 And how, how does this, is this still the, the old school of like, 727 00:34:02,401 --> 00:34:03,781 it just shows up on a screen? 728 00:34:04,303 --> 00:34:05,923 Uh, not, not usually. 729 00:34:06,043 --> 00:34:09,523 Um, back in the day, it would, it would come up as a banner or they would 730 00:34:09,523 --> 00:34:13,123 change the background of your desktop so that that's, you know, it's on every 731 00:34:13,123 --> 00:34:15,583 screen that you've got, uh, today. 732 00:34:15,763 --> 00:34:22,123 Um, 'cause that, that seemed, that, that, that is viewed as kind of, um, elementary, 733 00:34:22,123 --> 00:34:25,603 uh, by, by more sophisticated hackers. 734 00:34:25,603 --> 00:34:26,563 That's kind of a newbie thing. 735 00:34:27,228 --> 00:34:28,068 Like, look what I did. 736 00:34:28,548 --> 00:34:33,498 Uh, so most ransomware today will put a text file in every folder 737 00:34:33,498 --> 00:34:35,148 that it encrypted something in. 738 00:34:35,358 --> 00:34:37,908 So there'll be a text file on your desktop, there'll be a text file 739 00:34:37,908 --> 00:34:42,018 in my documents, there'll be a text file everywhere, uh, and that it's 740 00:34:42,018 --> 00:34:45,288 the same text file, but that is, and it'll say, you know, ransomware 741 00:34:45,738 --> 00:34:47,418 note dot, you know, whatever. 742 00:34:47,868 --> 00:34:49,128 Um, and in that, 743 00:34:49,576 --> 00:34:50,266 Read me. 744 00:34:51,496 --> 00:34:52,101 Read me on 745 00:34:52,141 --> 00:34:52,261 a 746 00:34:52,608 --> 00:34:52,848 Yep. 747 00:34:53,806 --> 00:34:55,576 Mike, I had a question. 748 00:34:56,266 --> 00:35:02,326 So you said that it'll go encrypt data, but of course it can't encrypt operating 749 00:35:02,326 --> 00:35:04,276 system files, otherwise the system 750 00:35:04,276 --> 00:35:04,546 would 751 00:35:04,713 --> 00:35:06,453 And they don't want the system to crash. 752 00:35:06,723 --> 00:35:09,753 They want you to be able to open it up and see the ransom note 753 00:35:09,796 --> 00:35:10,036 yeah, 754 00:35:10,083 --> 00:35:11,193 and see your encrypted data. 755 00:35:12,526 --> 00:35:12,706 so. 756 00:35:12,706 --> 00:35:17,506 then does it ignore certain extension types and certain directories? 757 00:35:17,506 --> 00:35:21,286 So potentially, could I put all my personal documents in the window sub 758 00:35:21,346 --> 00:35:25,306 folder be safe, or are they smarter 759 00:35:25,306 --> 00:35:25,756 than that? 760 00:35:25,818 --> 00:35:29,028 Some of them are pretty smart and they don't even care what the file's called 761 00:35:29,028 --> 00:35:31,158 because they will look at the, uh. 762 00:35:31,698 --> 00:35:35,658 The file header to determine what, so you could call your, you could 763 00:35:35,658 --> 00:35:39,768 call your spreadsheet, um, a DLL file, you know, you could rename it. 764 00:35:40,068 --> 00:35:41,268 I'm gonna trick them, right? 765 00:35:41,718 --> 00:35:46,158 Uh, so it could be, you know, passwords, dll, and put it in your Windows directory. 766 00:35:47,178 --> 00:35:51,198 The ransomware is gonna scan those files, not based on their file name 767 00:35:51,198 --> 00:35:53,688 and extension, but file header flags. 768 00:35:53,778 --> 00:35:58,428 So the file header flag is what the operating windows, particularly 769 00:35:58,668 --> 00:36:00,108 whenever you click on a file. 770 00:36:00,678 --> 00:36:06,108 It doesn't always care what the extension is, as long as the file header, uh, flag 771 00:36:06,108 --> 00:36:10,638 tells the operating system what, what application to use to open that file. 772 00:36:11,058 --> 00:36:14,658 And if it still says, I need to open this in a spreadsheet, then 773 00:36:14,658 --> 00:36:16,038 mal the malware will find it. 774 00:36:16,548 --> 00:36:17,838 But to your back to your point, yeah. 775 00:36:17,838 --> 00:36:24,198 It, it, it, it, uh, it excludes, uh, system operatings operating system files. 776 00:36:25,096 --> 00:36:27,646 because it, like you said, it wants it the system to be alive so you 777 00:36:27,646 --> 00:36:29,596 can find those files and realize 778 00:36:29,596 --> 00:36:30,106 your system's 779 00:36:30,228 --> 00:36:35,178 of the, one of the, one of the quick, uh, ways to respond to ransomware 780 00:36:35,178 --> 00:36:39,048 several years ago was that, uh, there was a particular ransomware. 781 00:36:39,288 --> 00:36:42,348 So one of the things that, that I asked if when someone calls and says, I think 782 00:36:42,348 --> 00:36:46,248 I've ransomware, I like, can you tell me anything about what it might be? 783 00:36:46,248 --> 00:36:48,048 So tell me what the ransomware note says. 784 00:36:48,228 --> 00:36:49,518 Tell me what the extension is. 785 00:36:49,908 --> 00:36:54,318 And there is a ransomware type that does not look in your trash can. 786 00:36:55,413 --> 00:36:58,503 So I'm like, delete everything you care about, highlight it, hit delete, 787 00:36:58,773 --> 00:37:01,528 and as long as it's in your trash can, it's safe for for ransomware. 788 00:37:02,551 --> 00:37:03,241 Interesting. 789 00:37:03,451 --> 00:37:04,111 Interesting. 790 00:37:05,311 --> 00:37:06,961 so, uh, one question I forgot to ask. 791 00:37:06,961 --> 00:37:12,061 During the encryption phase, when I think about encryption, uh, like I 792 00:37:12,061 --> 00:37:16,051 think that that seems like it would be a very resource intensive process. 793 00:37:16,051 --> 00:37:16,141 That 794 00:37:16,348 --> 00:37:16,568 Yep. 795 00:37:16,681 --> 00:37:21,961 a while, but what I'm hearing repeatedly is that they, they're actually able 796 00:37:21,961 --> 00:37:23,731 to encrypt data pretty quickly. 797 00:37:23,731 --> 00:37:23,941 Is that. 798 00:37:24,406 --> 00:37:24,741 Is that 799 00:37:24,813 --> 00:37:27,933 It, it is, um, but not without notice. 800 00:37:28,413 --> 00:37:32,133 So if, if you're paying any attention at all to your computer while you're 801 00:37:32,133 --> 00:37:36,873 using it, you know the mouse hesitates, you're typing, but nothing is, you 802 00:37:36,873 --> 00:37:39,783 know, you've typed the word but it hasn't shown up on the screen yet. 803 00:37:40,293 --> 00:37:42,363 Um, your email. 804 00:37:42,423 --> 00:37:44,163 It isn't coming in. 805 00:37:44,163 --> 00:37:45,963 Your network is slow. 806 00:37:46,563 --> 00:37:49,203 Um, things like that are good, are good indications that 807 00:37:49,203 --> 00:37:50,583 something else is going on. 808 00:37:51,153 --> 00:37:55,173 Um, so even though they've gotten better as far as the encryption 809 00:37:55,173 --> 00:37:57,363 a algorithms, it's still math. 810 00:37:57,783 --> 00:38:00,363 And math takes a lot of processing and, and memory. 811 00:38:00,813 --> 00:38:04,443 Uh, and so if you're paying attention at all, uh, you should be able to determine 812 00:38:04,443 --> 00:38:05,733 that something weird's happening. 813 00:38:06,273 --> 00:38:11,013 Um, and that's, uh, any, any relatively recent, uh. 814 00:38:11,883 --> 00:38:16,533 And a virus and a malware, uh, solution that you can put on your computer will, 815 00:38:16,533 --> 00:38:17,823 will help you figure that out too. 816 00:38:19,621 --> 00:38:19,921 So you 817 00:38:20,006 --> 00:38:20,166 Interesting. 818 00:38:20,431 --> 00:38:28,201 wanna have all your files on deathly slow, spinning media as far away from possible 819 00:38:28,201 --> 00:38:29,911 with a network throttle put on it. 820 00:38:30,206 --> 00:38:33,361 I, I don't think that's a, I don't think that's a valid recommendation there. 821 00:38:33,361 --> 00:38:34,041 Prasanna. 822 00:38:34,411 --> 00:38:37,441 Um, all right, well, we wanted this to be a, a quick, you know, 823 00:38:37,441 --> 00:38:39,301 overview of the five steps, right? 824 00:38:39,301 --> 00:38:40,171 Let's just review them. 825 00:38:40,171 --> 00:38:44,371 We want, the ransomware wants to get installed, undetected wants to move 826 00:38:44,371 --> 00:38:47,851 laterally around, do some recon, figure out what, what it's dealing with. 827 00:38:48,151 --> 00:38:50,911 It's gonna phone home, let the bad guys know what's going on. 828 00:38:51,291 --> 00:38:52,401 Encrypt everything. 829 00:38:52,461 --> 00:38:56,691 Somewhere between those last two steps, they will probably be looking, possibly 830 00:38:56,841 --> 00:38:58,491 be looking at some exfiltration. 831 00:38:58,881 --> 00:39:01,311 And then once it's done, the encryption, it's gonna deliver the 832 00:39:01,311 --> 00:39:04,791 ransomware note and then everything happens from that point on. 833 00:39:05,211 --> 00:39:11,721 Um, so, uh, we got a lot to cover and uh, I just want to thank you for, um, 834 00:39:12,531 --> 00:39:12,681 on the 835 00:39:12,813 --> 00:39:13,563 Hey, anytime. 836 00:39:13,563 --> 00:39:18,693 And I think some, just some add-on, uh, thoughts for, uh, future discussion is, 837 00:39:19,203 --> 00:39:24,063 you know, when, when a bad guy ex fills your data and you, you decide not to 838 00:39:24,063 --> 00:39:26,493 pay for them not to release your data. 839 00:39:27,033 --> 00:39:31,143 They, they've got things like wallet, they've got a wall of shame, uh, so that 840 00:39:31,143 --> 00:39:32,793 everybody knows you were compromised. 841 00:39:33,318 --> 00:39:34,848 They're then willing to sell. 842 00:39:34,848 --> 00:39:36,768 They become an access broker, right? 843 00:39:36,768 --> 00:39:40,068 So now they're selling access to your environment, to somebody else. 844 00:39:40,368 --> 00:39:43,038 And so there's some, there's some pretty solid statistics that if 845 00:39:43,038 --> 00:39:44,973 you get hit once you're gonna hit, you're gonna get hit again. 846 00:39:46,846 --> 00:39:47,386 Yeah. 847 00:39:47,506 --> 00:39:47,956 Yeah. 848 00:39:48,286 --> 00:39:49,636 These are the depressing things. 849 00:39:49,906 --> 00:39:51,286 Ah, thanks Mike. 850 00:39:52,936 --> 00:39:53,746 Thanks Mike. 851 00:39:54,376 --> 00:39:55,746 Prasanna. 852 00:39:55,816 --> 00:39:56,596 No, this is good. 853 00:39:56,596 --> 00:39:58,396 I'm excited for the a hundred episodes. 854 00:39:58,726 --> 00:39:59,086 Yeah. 855 00:39:59,506 --> 00:40:00,976 It's only gonna take us two years. 856 00:40:01,306 --> 00:40:01,786 All right. 857 00:40:02,056 --> 00:40:03,431 Uh, that is a wrap. 858 00:40:03,791 --> 00:40:03,911 I.