1
00:00:00,000 --> 00:00:08,400
Hello, hello, all. So who here does not know what the EFF is? Come on. It's okay. Don't be shy.

2
00:00:08,680 --> 00:00:16,420
There's some ‑‑ all right. Well, the EFF is an amazing organization and they saved my ass

3
00:00:17,000 --> 00:00:25,260
very, very much. So I'd like to thank them that I'm here and not in federal somewhere. But our

4
00:00:25,260 --> 00:00:31,100
next speaker, right, is from the EFF, an amazing organization and they do amazing work. But

5
00:00:31,100 --> 00:00:37,600
this presentation is about tracking the world's dumbest cyber mercenaries. And it's going to be

6
00:00:37,600 --> 00:00:40,460
excellent. So let's give a round of applause for our next speaker.

7
00:00:47,140 --> 00:00:53,520
Hi, everyone. How's it going? Before I get started, I want to mention that at 8 p.m. we have an

8
00:00:53,520 --> 00:00:55,240
Ask the EFF panel in the next few minutes. So I'm going to ask you a question and then we'll

9
00:00:55,240 --> 00:01:00,020
track three. So if you have further questions for me after this is over or our lawyers or

10
00:01:00,020 --> 00:01:04,640
anybody else, you're welcome to come to that. Also, on Saturday night at 6 p.m. in the chillout

11
00:01:04,640 --> 00:01:10,100
room, I am hosting EFF Tech Trivia, which will be a pub trivia style event where you can win EFF

12
00:01:10,100 --> 00:01:15,660
swag and also bribe the judges by donating to EFF. So come check that out as well if you're

13
00:01:15,660 --> 00:01:20,320
around and have nothing better to do Saturday night. That said, this talk is called Tracking the

14
00:01:20,320 --> 00:01:24,720
World's Dumbest Cyber Mercenaries. And I'm going to tell you about this cyber mercenary group that

15
00:01:24,720 --> 00:01:25,220
I've been tracking for the past couple of weeks. And I'm going to talk about this cyber mercenary group

16
00:01:25,220 --> 00:01:28,540
that I've been tracking for the last five years and all of the mistakes they've made, but why

17
00:01:28,540 --> 00:01:33,960
they're still actually very effective. But to tell this story, I first need to tell you the story of

18
00:01:33,960 --> 00:01:39,300
Irina Petrushova. Irina Petrushova is the editor-in-chief of a newspaper called Respublika,

19
00:01:39,500 --> 00:01:46,560
which was at the time in Kazakhstan. Kazakhstan is not known for its freedom of the press or its

20
00:01:46,560 --> 00:01:54,960
general democratic tendencies. So Irina had made quite the enemies of the state of Kazakhstan.

21
00:01:55,220 --> 00:01:57,820
she was doing. She was attempting to repress the government by constantly publishing negative

22
00:01:57,820 --> 00:02:06,260
stories about Kazakhstan's only president they had ever had, and also exposing a lot of his

23
00:02:06,260 --> 00:02:11,480
corruption and scandals and things like that. She made such enemies of them, in fact, that they

24
00:02:11,480 --> 00:02:17,660
ended up leaving a skull on her, a human skull, on her doorstep with a note that said, stop

25
00:02:17,660 --> 00:02:22,780
stop publishing. When she didn't stop publishing, they killed a dog and hung it outside of her

26
00:02:22,780 --> 00:02:27,820
office window with a note that said, there will be no next time. When she still didn't

27
00:02:27,820 --> 00:02:32,500
stop publishing, they kidnapped her child from the school that he went to and held him

28
00:02:32,500 --> 00:02:37,360
for ransom until she agreed to stop publishing. When she got her child back and then continued

29
00:02:37,360 --> 00:02:43,740
publishing, they ended up firebombing her office. And after that, she ended up escaping

30
00:02:43,740 --> 00:02:53,360
to Russia to get a little bit more freedom. So, while in Russia, she continued publishing

31
00:02:54,080 --> 00:03:02,340
Respublica and this site popped up around the same time called KazaWord. KazaWord hosted a

32
00:03:02,780 --> 00:03:10,100
leaked trove of emails from the president of Kazakhstan, including emails detailing his

33
00:03:10,800 --> 00:03:13,720
campaigns to spy on the only opposition politician in the country. And the only opposition politician

34
00:03:13,740 --> 00:03:18,580
in Kazakhstan. His various corruptions and briberies and things of that nature and this

35
00:03:18,580 --> 00:03:23,300
was very, and, and uh, Respublica did a lot of reporting on these emails. They made a

36
00:03:23,300 --> 00:03:29,640
lot of hay out of it. The government of Kazakhstan, the president of Kazakhstan did not like this.

37
00:03:29,820 --> 00:03:33,540
And uh, since she was in Russia and there was nothing that he could do about it anymore,

38
00:03:33,740 --> 00:03:38,380
they decided to sue her in the district court of New York because the website was hosted

39
00:03:38,380 --> 00:03:43,720
in New York. And that's where EFF comes in. We ended up giving her a legal defense. We

40
00:03:43,720 --> 00:03:49,180
And as we were defending her, she started receiving these strange emails.

41
00:03:49,600 --> 00:03:55,900
This is a phishing email she received in Gmail that pretends to be from a human rights lawyer in Kazakhstan

42
00:03:56,720 --> 00:04:01,140
that says, here's your invoice, please read the invoice.

43
00:04:01,500 --> 00:04:08,400
And when you open the PDF, it's this blurry image and then an error bubble.

44
00:04:08,400 --> 00:04:13,800
But when you open the PDF, it installs this malware, which we call Bandook.

45
00:04:14,300 --> 00:04:18,840
And we wrote about this malware in a 2015 report called Operation Mantle.

46
00:04:19,420 --> 00:04:27,440
Bandook is a piece of spyware, and it's, in its capabilities, not much different from high-end malware like Pegasus.

47
00:04:27,860 --> 00:04:34,100
It has the ability to, or any other spyware, it has the ability to capture screenshots, turn on the microphone,

48
00:04:34,340 --> 00:04:36,560
start your webcam without turning on the light,

49
00:04:37,220 --> 00:04:38,320
upload and download,

50
00:04:38,400 --> 00:04:42,860
download files, get Wi-Fi information, and it has the ability to download secondary infections,

51
00:04:43,100 --> 00:04:44,280
which will become important later.

52
00:04:47,180 --> 00:04:51,520
But the interesting thing about this campaign, when we started looking into Bandook,

53
00:04:51,620 --> 00:04:55,480
is the command and control servers for the malware were running Windows.

54
00:04:57,360 --> 00:05:04,880
And specifically, they were running the Windows Apache MySQL PHP stack called XAMPP.

55
00:05:05,240 --> 00:05:07,220
A fun thing about XAMPP

56
00:05:07,220 --> 00:05:11,140
is that by default, it leaves directory indexes open.

57
00:05:11,340 --> 00:05:15,900
So if you don't have an index.html file, you can see the list of all the files that are in the directory.

58
00:05:16,580 --> 00:05:23,420
Another fun thing is that this attacker decided to leave all their exfiltrated files within the web root.

59
00:05:24,200 --> 00:05:30,040
So we were able to, using Durr Buster, scan for these directories, find the exfiltrated files,

60
00:05:30,300 --> 00:05:34,200
and download them all and figure out information about who was being targeted in this.

61
00:05:34,360 --> 00:05:35,940
Of course, Irina was being targeted,

62
00:05:35,940 --> 00:05:37,820
but there were also other targets.

63
00:05:37,920 --> 00:05:39,680
Other folks in Kazakhstan were targets.

64
00:05:39,960 --> 00:05:44,980
And we found what we thought was maybe a Vietnamese cigarette company that was a target.

65
00:05:45,220 --> 00:05:46,500
It was all very odd.

66
00:05:47,520 --> 00:05:50,620
But we also found web panels,

67
00:05:50,920 --> 00:05:57,080
or sorry, not web panels, but the web logins for their command and control centers.

68
00:05:57,460 --> 00:06:01,720
So we found these two web logins for the command and control centers.

69
00:06:02,240 --> 00:06:04,420
And there was some fun there to be had as well.

70
00:06:04,420 --> 00:06:08,380
We also found all of these files, backups from entire Windows machines,

71
00:06:08,720 --> 00:06:12,500
and backups and files extracted from mobile devices,

72
00:06:12,680 --> 00:06:15,740
which gave us the theory that there might be a mobile component to this as well.

73
00:06:17,720 --> 00:06:19,720
So it turns out there was.

74
00:06:20,780 --> 00:06:25,940
About a year later, some people from Lookout Mobile Security reached out to us

75
00:06:25,940 --> 00:06:30,380
and said, hey, that mobile component that you mentioned might exist in your Operation Mantle report.

76
00:06:30,620 --> 00:06:31,860
We think we found it.

77
00:06:32,160 --> 00:06:34,400
And so we ended up writing another report with that.

78
00:06:34,420 --> 00:06:36,340
One of them called Dark Caracal,

79
00:06:36,480 --> 00:06:38,700
which is where we came up with the name for this actor.

80
00:06:39,000 --> 00:06:41,140
And we named the mobile component Palace,

81
00:06:41,400 --> 00:06:44,260
because that's another name for a caracal, Palace Cat.

82
00:06:44,840 --> 00:06:53,120
The Palace malware, again, has pretty standard features that you would expect in spyware.

83
00:06:53,800 --> 00:07:01,000
But it also, in this case, was being distributed as backdoored versions of popular secure messaging apps.

84
00:07:01,300 --> 00:07:03,300
Well, secure with quotes around it.

85
00:07:03,300 --> 00:07:08,420
Threema, but also Signal, WhatsApp, some other things I've never heard of,

86
00:07:08,440 --> 00:07:11,640
Orbot and Syphon, and also a copy of Flash Player,

87
00:07:11,780 --> 00:07:13,620
because what Flash Player needs is more malware.

88
00:07:16,440 --> 00:07:21,880
But they were fully functional apps that had this Palace spyware built into them.

89
00:07:22,880 --> 00:07:27,460
The Palace spyware was also able to take photos with the front and back camera,

90
00:07:27,620 --> 00:07:30,740
get GPS coordinates, turn on the microphone,

91
00:07:31,440 --> 00:07:33,140
upload and download files,

92
00:07:33,300 --> 00:07:34,160
make a hot mic,

93
00:07:34,340 --> 00:07:38,880
and it was able to collect information about the Wi-Fi access points that were available.

94
00:07:39,060 --> 00:07:40,580
Again, this will be important later.

95
00:07:41,820 --> 00:07:45,200
We found in total, because again, they were still using XAMPP,

96
00:07:45,280 --> 00:07:47,700
and the files were still within the web route.

97
00:07:47,920 --> 00:07:52,640
So we were able to find a total of 81 gigabytes of exfiltrated data from infected machines.

98
00:07:53,420 --> 00:07:56,040
About 60% of that was from Android campaigns,

99
00:07:56,200 --> 00:07:58,280
and 40% of that was from infected Windows machines.

100
00:07:59,340 --> 00:08:02,120
But another fun thing about XAMPP

101
00:08:02,120 --> 00:08:06,840
is that it has a module, it enables by default a module called Apache Status.

102
00:08:07,240 --> 00:08:13,500
What Apache Status does is it gives you a real-time log of everybody visiting the server

103
00:08:13,500 --> 00:08:15,960
that is accessible via the website.

104
00:08:16,260 --> 00:08:20,920
So you go to commandandcontrol.com slash server status,

105
00:08:21,280 --> 00:08:24,340
and you get a real-time hit of everybody who's visiting the website.

106
00:08:24,620 --> 00:08:28,480
So we could not only get the IP addresses of everybody that was infected,

107
00:08:28,640 --> 00:08:31,040
because their machines were uploading content,

108
00:08:31,040 --> 00:08:34,620
but we could also get the IP addresses of the attackers

109
00:08:34,620 --> 00:08:40,300
as they went to the web administration portals for their command and control.

110
00:08:42,840 --> 00:08:45,980
So, where in the world is Dark Caracal?

111
00:08:46,100 --> 00:08:47,900
Where are all these IP addresses located?

112
00:08:49,380 --> 00:08:53,100
There were IP addresses coming, and this was for infected machines,

113
00:08:53,380 --> 00:08:54,980
from all over the world.

114
00:08:55,100 --> 00:08:59,160
The United States, Canada, some bits of Europe, and Southeast Asia.

115
00:08:59,320 --> 00:09:01,020
But the vast majority of them

116
00:09:01,040 --> 00:09:02,440
were in Lebanon.

117
00:09:03,800 --> 00:09:06,640
Specifically, they were in mostly,

118
00:09:07,180 --> 00:09:08,760
yeah, the vast majority of them were in Lebanon.

119
00:09:09,500 --> 00:09:12,160
Also, when we looked at the admin console logins,

120
00:09:13,320 --> 00:09:17,020
all of them were coming from Beirut.

121
00:09:17,600 --> 00:09:18,560
Downtown Beirut.

122
00:09:19,140 --> 00:09:23,600
This is interesting, because when we looked up the authorship

123
00:09:23,600 --> 00:09:25,500
for the Banduk malware, which is public,

124
00:09:26,020 --> 00:09:28,920
the author of the Banduk malware, who goes by the name Prince Ali,

125
00:09:29,180 --> 00:09:31,020
claims that he lives in Beirut.

126
00:09:31,040 --> 00:09:35,320
So, hmm, things are starting to come together here.

127
00:09:37,440 --> 00:09:39,680
But we found another interesting thing,

128
00:09:39,780 --> 00:09:42,040
which was that when we put all this,

129
00:09:42,060 --> 00:09:46,500
when we put all this exfiltrated data into a Maltego graph,

130
00:09:47,640 --> 00:09:52,440
there was a, you know, giant cluster of phones that were, seemed to be,

131
00:09:52,440 --> 00:09:53,960
you know, all the real phones that were infected.

132
00:09:54,200 --> 00:09:59,940
But there was this little cluster of phones that popped up outside of any of the other graphs

133
00:09:59,940 --> 00:10:01,420
that weren't connected to anything else.

134
00:10:01,720 --> 00:10:05,840
And all those phones appeared to have test data on them.

135
00:10:05,920 --> 00:10:09,400
All the text messages that were exfiltrated were things like test, test, hack, hack.

136
00:10:10,200 --> 00:10:16,080
The only pictures on those phones were like up-the-nose shots of somebody in their office.

137
00:10:17,120 --> 00:10:21,720
And they all also only connected ever to this one Wi-Fi ad,

138
00:10:21,800 --> 00:10:23,320
oh, and they were the first phones to be infected.

139
00:10:23,560 --> 00:10:26,360
And they only ever connected to this one Wi-Fi address,

140
00:10:26,600 --> 00:10:29,260
which was BLD3F6.

141
00:10:29,940 --> 00:10:32,720
Which we thought might mean Building 3, Floor 6.

142
00:10:34,200 --> 00:10:36,720
We used an open-source database called Wiggle

143
00:10:36,720 --> 00:10:42,920
to map where the BLD3F6 Wi-Fi access point was.

144
00:10:43,220 --> 00:10:46,120
And it turns out that it's in downtown Beirut.

145
00:10:47,680 --> 00:10:49,340
Hmm, what's going on here?

146
00:10:49,420 --> 00:10:51,720
But where is it exactly in downtown Beirut?

147
00:10:52,060 --> 00:10:54,180
Luckily, we have friends in Beirut.

148
00:10:54,640 --> 00:10:57,160
They went out and looked for us.

149
00:10:57,280 --> 00:10:58,520
And what they found

150
00:10:58,520 --> 00:11:03,540
was that it's in the only building in downtown Beirut in that area

151
00:11:03,540 --> 00:11:04,580
with more than six floors.

152
00:11:06,040 --> 00:11:08,800
And it's right next to the campus France-Lebanon.

153
00:11:08,900 --> 00:11:09,660
But it's not that.

154
00:11:09,780 --> 00:11:14,020
It is the headquarters of the General Directorate of General Security.

155
00:11:14,640 --> 00:11:21,980
Which is Lebanon's CIA, FBI, and like Border Patrol, DHS,

156
00:11:22,080 --> 00:11:23,260
all kind of rolled into one.

157
00:11:24,720 --> 00:11:27,340
So we figured that this is pretty much,

158
00:11:27,340 --> 00:11:28,560
we caught them red-handed.

159
00:11:28,940 --> 00:11:29,380
Right?

160
00:11:29,820 --> 00:11:32,220
And we sent the, you know,

161
00:11:32,260 --> 00:11:33,240
after we published the report,

162
00:11:33,400 --> 00:11:34,960
we sent it to the GDGS,

163
00:11:35,000 --> 00:11:35,920
or somebody, a journalist,

164
00:11:36,240 --> 00:11:37,580
sent it to the GDGS

165
00:11:37,580 --> 00:11:38,940
and actually knocked on their door,

166
00:11:39,060 --> 00:11:40,060
which, that takes guts.

167
00:11:42,380 --> 00:11:44,820
And their response to the report was,

168
00:11:45,360 --> 00:11:47,240
this is totally untrue.

169
00:11:47,340 --> 00:11:48,000
We didn't spy.

170
00:11:48,180 --> 00:11:49,760
But if we did, it was totally illegal

171
00:11:49,760 --> 00:11:51,100
and we can do whatever we want.

172
00:11:51,240 --> 00:11:55,020
But also, this report was probably written by the CIA or Mossad.

173
00:11:55,600 --> 00:11:57,320
And you should ignore everything in it.

174
00:11:57,340 --> 00:11:59,600
But also, it's all true and it's legal and it's fine.

175
00:12:03,100 --> 00:12:04,700
So, that was interesting.

176
00:12:05,220 --> 00:12:06,500
But what's going on here?

177
00:12:06,640 --> 00:12:13,640
Why is the GDGS also hacking a opposition reporter in Kazakhstan?

178
00:12:14,060 --> 00:12:16,780
Why are they hacking a Vietnamese cigarette importer?

179
00:12:18,200 --> 00:12:20,620
What connection do these all have?

180
00:12:21,340 --> 00:12:23,460
And the conclusion that we came to,

181
00:12:24,150 --> 00:12:25,740
I have to remind myself what the next slide is,

182
00:12:25,740 --> 00:12:27,360
the conclusion that we came to

183
00:12:27,360 --> 00:12:30,480
is that this must be a mercenary op.

184
00:12:30,820 --> 00:12:34,240
We think that Prince Ali,

185
00:12:34,460 --> 00:12:35,580
who wrote Banduk,

186
00:12:35,720 --> 00:12:36,980
who, as far as we know,

187
00:12:37,140 --> 00:12:38,700
is the only one who has the Banduk malware,

188
00:12:39,500 --> 00:12:43,920
is working for the GDGS during the day

189
00:12:43,920 --> 00:12:45,500
and moonlighting at night,

190
00:12:45,660 --> 00:12:47,440
working for other folks,

191
00:12:47,620 --> 00:12:49,660
hacking Vietnamese cigarette companies

192
00:12:49,660 --> 00:12:53,380
and working for a private investigator

193
00:12:53,380 --> 00:12:54,660
who was hired by Kazakhstan

194
00:12:54,660 --> 00:12:56,220
to do cyber ops, perhaps.

195
00:12:58,640 --> 00:13:00,040
But it's really interesting

196
00:13:00,500 --> 00:13:01,420
because normally,

197
00:13:02,880 --> 00:13:05,360
targets that are clearly state-sponsored,

198
00:13:05,400 --> 00:13:06,700
which we have pretty good attribution,

199
00:13:06,820 --> 00:13:10,220
don't also do, you know, moonlight doing criminal stuff.

200
00:13:10,560 --> 00:13:12,040
So, we're still not sure.

201
00:13:12,340 --> 00:13:15,060
A couple more reports came out in the last couple years

202
00:13:15,660 --> 00:13:18,380
about Banduk, about the Dark Caracal group.

203
00:13:18,920 --> 00:13:21,220
ESET put out a report called Bandidos at Large,

204
00:13:21,340 --> 00:13:24,520
which detailed a big Banduk campaign in Venezuela.

205
00:13:25,840 --> 00:13:29,220
And Checkpoint Research put out another report about Banduk

206
00:13:29,220 --> 00:13:30,300
called Signed and Delivered,

207
00:13:31,600 --> 00:13:33,460
which detailed another campaign.

208
00:13:34,780 --> 00:13:35,980
And then in 2022,

209
00:13:37,200 --> 00:13:39,220
we found a new sample of Banduk.

210
00:13:39,860 --> 00:13:42,100
And so we decided to take a look at it.

211
00:13:42,180 --> 00:13:43,800
Banduk, by the way, in Hindi means gun.

212
00:13:44,240 --> 00:13:46,200
So there's a series of action movies,

213
00:13:46,280 --> 00:13:48,040
of Bollywood action movies called Banduk.

214
00:13:49,960 --> 00:13:53,000
It also, apparently in Lebanese it means bastard.

215
00:13:53,560 --> 00:13:54,360
So, yeah.

216
00:13:55,580 --> 00:13:56,100
Anyway.

217
00:13:57,280 --> 00:13:59,480
So, we started looking at this new malware.

218
00:13:59,720 --> 00:14:01,900
And like I mentioned, the malware has the ability

219
00:14:01,900 --> 00:14:04,160
to download a secondary infection.

220
00:14:04,560 --> 00:14:07,780
And it does that from a second domain,

221
00:14:08,100 --> 00:14:10,680
which is orthogonal to its command and control server.

222
00:14:11,320 --> 00:14:12,760
So I looked at the Banduk malware,

223
00:14:12,980 --> 00:14:13,980
I extracted the domains,

224
00:14:14,200 --> 00:14:17,460
and the first domain was a .ru domain,

225
00:14:17,720 --> 00:14:19,720
and it had the command and control server running.

226
00:14:19,880 --> 00:14:21,240
They're no longer running XAMPP.

227
00:14:21,380 --> 00:14:22,520
They've learned their lesson.

228
00:14:22,740 --> 00:14:24,540
They're no longer running Apache at all.

229
00:14:24,660 --> 00:14:26,340
The only ports they have open now

230
00:14:26,340 --> 00:14:28,240
are the ones necessary for command and control.

231
00:14:28,420 --> 00:14:29,180
Good for them.

232
00:14:29,500 --> 00:14:30,800
But the second server,

233
00:14:31,500 --> 00:14:32,380
it turns out,

234
00:14:32,400 --> 00:14:34,460
they forgot to register it.

235
00:14:35,020 --> 00:14:37,480
They never registered their command and control domain.

236
00:14:38,320 --> 00:14:39,640
So being a helpful guy,

237
00:14:39,860 --> 00:14:41,360
I registered it for them.

238
00:14:43,780 --> 00:14:45,640
They can use all the help they can get.

239
00:14:48,620 --> 00:14:50,080
So I registered the domain

240
00:14:51,580 --> 00:14:53,140
and set up a sinkhole.

241
00:14:54,660 --> 00:14:57,500
And started collecting all of the traffic from,

242
00:14:57,600 --> 00:14:58,620
or not all of the traffic,

243
00:14:59,100 --> 00:15:00,120
we're not the NSA.

244
00:15:02,120 --> 00:15:04,900
I started collecting the traffic

245
00:15:04,900 --> 00:15:06,520
coming from the infected machines

246
00:15:06,520 --> 00:15:08,420
to the secondary command and control server

247
00:15:08,420 --> 00:15:10,560
and got a good idea and a good map

248
00:15:10,560 --> 00:15:11,880
of all of the infected machines.

249
00:15:12,420 --> 00:15:14,180
And also because we're EFF,

250
00:15:14,420 --> 00:15:17,000
we wrote a privacy policy for the sinkhole

251
00:15:17,000 --> 00:15:19,080
to make sure that everybody knew exactly

252
00:15:19,080 --> 00:15:20,380
what we're doing with the data

253
00:15:20,380 --> 00:15:21,300
that went to the sinkhole.

254
00:15:23,120 --> 00:15:24,540
But what we saw,

255
00:15:24,660 --> 00:15:27,960
was about seven or eight hundred infected machines

256
00:15:27,960 --> 00:15:29,820
connecting to it every weekday.

257
00:15:29,960 --> 00:15:30,940
And on weekends,

258
00:15:31,140 --> 00:15:32,460
that number drops to like

259
00:15:32,460 --> 00:15:34,480
between a hundred and three hundred.

260
00:15:34,600 --> 00:15:36,780
So we think these are probably business machines

261
00:15:36,780 --> 00:15:38,140
that aren't being used on the weekends.

262
00:15:40,020 --> 00:15:42,120
But when we mapped out the locations,

263
00:15:42,340 --> 00:15:43,840
what was really interesting

264
00:15:43,840 --> 00:15:46,640
was that there were a few infections in the US,

265
00:15:46,840 --> 00:15:48,620
a few infections in other parts of South America,

266
00:15:48,880 --> 00:15:50,920
a lot of infections in Venezuela,

267
00:15:51,260 --> 00:15:53,480
but by two orders of magnitude,

268
00:15:53,480 --> 00:15:56,440
most of the infections were in the Dominican Republic.

269
00:15:57,460 --> 00:15:59,860
Dominican Republic is not usually known

270
00:15:59,860 --> 00:16:01,300
as a big target for hacking.

271
00:16:02,940 --> 00:16:06,900
But also, we didn't really know why.

272
00:16:07,120 --> 00:16:10,100
We didn't have a sort of victimology

273
00:16:10,100 --> 00:16:11,400
like we had in the Lebanon case.

274
00:16:11,500 --> 00:16:12,140
In the Lebanon case,

275
00:16:12,260 --> 00:16:12,980
they were hacking people

276
00:16:12,980 --> 00:16:15,780
who were on the border of Lebanon and Syria,

277
00:16:16,020 --> 00:16:18,220
presumably over spying on people

278
00:16:18,220 --> 00:16:20,120
they thought might be going to fight

279
00:16:20,120 --> 00:16:21,120
in the Syrian civil war.

280
00:16:21,280 --> 00:16:22,620
In the Kazakhstan case,

281
00:16:22,620 --> 00:16:23,980
the victimology was pretty clear,

282
00:16:24,100 --> 00:16:25,360
the Irina Petrushova.

283
00:16:25,820 --> 00:16:27,460
But in this case, we weren't sure.

284
00:16:29,060 --> 00:16:30,260
About a month ago,

285
00:16:30,380 --> 00:16:32,400
I was listening to an episode

286
00:16:32,400 --> 00:16:33,960
of Darknet Diaries

287
00:16:34,620 --> 00:16:36,280
and they did a report

288
00:16:36,280 --> 00:16:42,000
on a guy who works for a cert in South America

289
00:16:42,000 --> 00:16:45,820
who ended up finding this campaign

290
00:16:45,820 --> 00:16:47,180
or looking into this campaign

291
00:16:47,180 --> 00:16:48,520
after we published our report.

292
00:16:48,740 --> 00:16:49,940
And what he found

293
00:16:49,940 --> 00:16:51,640
was that the dark caracal,

294
00:16:51,640 --> 00:16:52,720
the Banduk infections,

295
00:16:53,340 --> 00:16:54,580
that dark caracal had deployed,

296
00:16:54,780 --> 00:16:56,980
were being used to deploy Conti,

297
00:16:57,560 --> 00:16:58,680
the ransomware.

298
00:16:59,780 --> 00:17:02,900
Which the Conti ransomware gang

299
00:17:02,900 --> 00:17:05,020
keeps very tight control of.

300
00:17:05,340 --> 00:17:07,420
So this gives us the impression

301
00:17:07,420 --> 00:17:10,700
that dark caracal is now somehow partnering

302
00:17:10,700 --> 00:17:12,200
with Conti ransomware group

303
00:17:12,200 --> 00:17:15,240
to start ransomwaring machines

304
00:17:15,240 --> 00:17:17,280
in tiny countries

305
00:17:17,280 --> 00:17:18,540
like the Dominican Republic

306
00:17:18,540 --> 00:17:20,740
where there's not a whole lot of infrastructure

307
00:17:20,740 --> 00:17:21,500
and frankly,

308
00:17:21,640 --> 00:17:22,880
the West doesn't give a shit.

309
00:17:23,080 --> 00:17:24,940
So you're not gonna attract a lot of attention.

310
00:17:26,760 --> 00:17:29,040
But we don't know what's going on here.

311
00:17:29,320 --> 00:17:33,900
Is this a state sponsored hacking

312
00:17:33,900 --> 00:17:34,780
wasn't paying enough

313
00:17:34,780 --> 00:17:37,800
so the dark caracal gang

314
00:17:37,800 --> 00:17:40,800
started turning toward more traditional cyber crime?

315
00:17:41,160 --> 00:17:41,880
It's unclear.

316
00:17:42,180 --> 00:17:46,040
But it does represent an escalation in their tactics.

317
00:17:46,400 --> 00:17:50,120
And if they go back to going after political targets,

318
00:17:50,120 --> 00:17:51,960
we might see,

319
00:17:52,100 --> 00:17:52,360
you know,

320
00:17:52,420 --> 00:17:53,940
I'm concerned that we're gonna start seeing

321
00:17:53,940 --> 00:17:55,020
like ransomware

322
00:17:55,020 --> 00:17:57,340
as an attack deployed against political targets

323
00:17:57,340 --> 00:17:58,140
to silence them.

324
00:18:00,020 --> 00:18:00,500
Overall,

325
00:18:00,880 --> 00:18:02,640
I award dark caracal the dunce cap.

326
00:18:02,880 --> 00:18:04,980
They've made a lot of stupid mistakes over the years.

327
00:18:05,100 --> 00:18:07,580
And I've learned a lot about malware reversing

328
00:18:07,580 --> 00:18:08,600
from their stupid mistakes.

329
00:18:08,880 --> 00:18:09,760
So thanks guys.

330
00:18:11,040 --> 00:18:11,520
But,

331
00:18:12,400 --> 00:18:15,940
they are the kind of derpy dragon of the group, right?

332
00:18:16,000 --> 00:18:17,020
They're not the NSO group.

333
00:18:17,140 --> 00:18:17,980
They're not the dark matter.

334
00:18:18,180 --> 00:18:20,060
But this meme is actually very appropriate.

335
00:18:20,120 --> 00:18:22,260
Because they're still a dragon.

336
00:18:22,520 --> 00:18:24,160
They've still managed to infect

337
00:18:24,920 --> 00:18:26,480
thousands and thousands of machines

338
00:18:27,040 --> 00:18:28,300
over several years.

339
00:18:28,680 --> 00:18:31,600
And it turns out that writing reports about malware

340
00:18:32,120 --> 00:18:33,940
doesn't actually stop the malware authors

341
00:18:33,940 --> 00:18:34,880
from writing malware

342
00:18:34,880 --> 00:18:36,620
and continuing to infect people.

343
00:18:37,000 --> 00:18:37,560
So,

344
00:18:37,700 --> 00:18:38,700
I don't know.

345
00:18:38,780 --> 00:18:39,840
There's gotta be a better way.

346
00:18:40,100 --> 00:18:42,040
Despite the number of mistakes they've made,

347
00:18:42,180 --> 00:18:43,240
they're super effective.

348
00:18:43,680 --> 00:18:46,460
And I think that this is a growing problem.

349
00:18:46,640 --> 00:18:48,740
The number of cyber mercenaries in general

350
00:18:48,740 --> 00:18:50,920
is growing by a lot.

351
00:18:51,240 --> 00:18:54,800
And I think that there's starting to be a spectrum of it, right?

352
00:18:54,940 --> 00:18:56,860
Not everybody has to be an NSO group.

353
00:18:57,080 --> 00:18:58,740
Not everybody has to be a dark matter.

354
00:18:59,000 --> 00:19:03,140
There's a lot of spyware and stalkerware companies

355
00:19:03,140 --> 00:19:04,940
and lower end mercenaries

356
00:19:04,940 --> 00:19:06,440
like Appen and Dark Caracal

357
00:19:06,440 --> 00:19:08,940
that I think are going to start working for

358
00:19:11,200 --> 00:19:13,620
people who can't afford NSO group.

359
00:19:13,720 --> 00:19:15,180
People who can't afford Dark Caracal.

360
00:19:15,340 --> 00:19:18,260
Maybe people who aren't acting with full state authorization.

361
00:19:18,260 --> 00:19:19,020
Or who are,

362
00:19:19,240 --> 00:19:22,160
but who don't even care about

363
00:19:22,160 --> 00:19:25,420
the vague pretenses of rule of law

364
00:19:25,420 --> 00:19:26,420
that say like,

365
00:19:27,260 --> 00:19:29,300
Israel sometimes pretend to care about

366
00:19:29,300 --> 00:19:31,060
or the US sometimes pretends to care about.

367
00:19:32,420 --> 00:19:32,940
Overall,

368
00:19:33,220 --> 00:19:34,620
I think that this is gonna grow.

369
00:19:34,720 --> 00:19:35,740
And I think that this growth

370
00:19:35,740 --> 00:19:38,020
is because of how successful encryption has been.

371
00:19:38,800 --> 00:19:40,740
Web encryption is ubiquitous at this point.

372
00:19:40,980 --> 00:19:42,520
And end-to-end encryption

373
00:19:43,220 --> 00:19:44,660
is nearly there as well.

374
00:19:44,840 --> 00:19:46,360
Three billion people are sending

375
00:19:46,360 --> 00:19:47,380
end-to-end encrypted messages

376
00:19:47,380 --> 00:19:48,240
every day now

377
00:19:48,260 --> 00:19:49,120
over WhatsApp

378
00:19:49,120 --> 00:19:51,240
and to a much lesser degree, Signal.

379
00:19:52,360 --> 00:19:53,420
But this means

380
00:19:53,420 --> 00:19:56,140
that in addition to fighting tooth and nail

381
00:19:56,140 --> 00:19:57,480
with horrible laws,

382
00:19:58,500 --> 00:20:00,080
governments are increasingly

383
00:20:00,080 --> 00:20:02,440
turning to hacking individual devices

384
00:20:02,440 --> 00:20:04,000
to spy on people.

385
00:20:04,560 --> 00:20:07,980
And if encryption was the fight of the last 30 years

386
00:20:07,980 --> 00:20:09,960
and maybe the fight of the next 10 now,

387
00:20:10,560 --> 00:20:14,040
I think that spyware is also going to be a big battle

388
00:20:14,040 --> 00:20:15,340
for the next 30 years.

389
00:20:15,500 --> 00:20:16,660
And I think it's something

390
00:20:16,660 --> 00:20:18,240
we have to start looking at now

391
00:20:18,260 --> 00:20:19,300
and stopping now.

392
00:20:20,700 --> 00:20:21,780
That is my talk.

393
00:20:22,020 --> 00:20:23,020
Thank you very much.