Srsly Risky Biz: China's botnets are worth disrupting

0:04James Wilson: Hey everyone, I'm James Wilson and welcome to this week's Seriously Risky Biz. This is our cybersecurity policy and intelligence podcast and it is based on the phenomenal newsletter written by my colleague Tom Uren. Head on over to our website, risky.biz, where you can find Tom's newsletter, Seriously Risky Business, and you can read it there and also subscribe to it so that it lands in your inbox each week. Tom will be along shortly to chat with me about his newsletter, but first I want to say a big thank you to our sponsor this week, which is Dropzone AI. On Monday, I posted an interview with Dropzone CEO Edward Wu, where he and I talked about how the old adage of attackers have to be right only once and defenders have to be right every time actually doesn't stack up quite so well in modern times.

0:53James Wilson: But back to Tom's newsletter, three topics this week. The first one is on how the China's private sector botnets are really worth disrupting. And the interesting thing here is Tom talks through some of the ways in which he was surprised about how these botnets are operating, how long they've been operating, and just the importance to them, the importance of them to elements like China's MSS and PLA, and how there is sort of like this interplay between the importance of a botnet, which can obfuscate activities and the increasing use of AI, which can, if used in interesting ways, make attribution even harder or at least a bit more confusing.

1:33James Wilson: The second item is around how this ATF hack that we talked about yesterday on the main show might actually be a bit more of a big deal. What was originally referred to as an isolated system seems to be a little bit more critical and containing interesting information. And that will have some interesting implications for the ransomware group behind this, I think. And lastly, we touch on the notion of this Watershed 250 initiative from the Trump administration, which is going to parachute a whole bunch of consultants into the Texas water system to fix it all up and make it safe, sound and secure.

2:09James Wilson: But will this actually have a lasting impact on raising the bar for security for water treatment plants and anywhere where there are these OT devices, PLCs that we've talked about previously? And Tom's got a pretty interesting nuanced take there and we look at sort of the difference of approaches that the US has taken versus some of the advice coming out of the UK. But I'm going to drop you here into the interview where Tom starts off by talking about his surprise around some of the elements that have come to light with this new takedown of Chinese botnets. Enjoy.

2:42Tom Uren: This week, last week, the Department of Justice said that they disrupted a third Chinese cyber espionage botnet. So it's a complicated system, had many moving parts. They disrupted two parts which had hard-coded domains in them. So like they've gone for the easy target. It turns out it was developed by this group, which calls themselves QTFY. And that is, they're employed by a Chinese technology company. So, so far, so normal. This is the third Chinese botnet that's been disrupted in the last couple of years since I've been writing this newsletter and it had a part that did basically worldwide scanning for target and vulnerability discovery and then it had another part that did covert comms so it would forward comms all over the place so that you can't tell it's the Chinese hackers were behind it that's pretty standard stuff what really struck me was how long this group had been operating.

3:54Tom Uren: And the earliest reports are the first hacks traced back to QTFY in an affidavit from the FBI was as early as 2018. So almost getting close to a decade. And that's at least as far back as. So it could be further back.

4:16James Wilson: Yeah, interesting. Okay, So despite it being a bad day in the office for whoever architected these two parts of the system with hard-coded domain names, which is how this takedown was facilitated in this case, what's the so what here? What have we learned from this botnet, the botnets that came before it in terms of how they're used and their importance?

4:35Tom Uren: Yeah, so I guess being a bit reflective here, by the first time a botnet was taken down late 2023, a Chinese botnet that is, it struck me as, wow, this is a shift in tactics. And then pretty quickly after that, the same year, there was another botnet that was taken down, Raptor Train. And so my take at the time was, ah, the Chinese have shifted their tactics. They're adopting these botnets. And this is a new thing. It turns out that looking back at it now, this in fact happened five years ago. So they were operating for several years without being discovered or disrupted. And the KV botnet, which is the first one that was disrupted, that was linked to Vault Typhoon, which is the Chinese group that's going around compromising US critical infrastructure and it seems like to be able to sabotage it in the event of some sort of conflict.

5:40So that's fairly serious stuff, right?

5:43Tom Uren: And that botnet had only been operating for two years. So at the time I thought, oh, yeah, two years, like that's not good but it's not a decade. So all these botnets since then have been around for actually a lot longer than the KV botnet. So that to me is striking. And it's the sort of thing where you go, the Chinese have invested in a long-term effort here. Where's the long-term effort in response?

6:15James Wilson: Well, that's one thing that, you know, I was thinking back to our episode last week where we talked about how Chinese APT operations are getting quite interesting now because of their use of AI. And they were, you know, sort of taking to your point, and get a formal spec of what the remote access Trojan should look like and then spit out seven or eight different versions of it. And we talked a little bit about the attribution challenges that that poses, but I'm curious as to whether, you know, how do these two things sort of play together or is there an overlap here? Does this make the botnet more important?

6:44James Wilson: Does it make it less important because they can just do, they can confuse attribution in other ways?

6:49Tom Uren: I mean, they're all parts of a system, right? And I think disruption efforts are great because you temporarily, I don't know if you entirely stop it, but you cut off one avenue, right? So they have to rebuild, retool, whatever. I think the thing about AI is it's probably going to make everything just quicker. It will be faster to rebuild these botnets with slightly different configurations using a different domain name, for example. and coming up with more robust systems. So it's a contest that is continuing and will go on. So, for example, Lumen, which is the company that has discovered all of these botnets, I think, they point out that the KV botnet was taken down.

7:40Tom Uren: There was a sister botnet that wasn't taken down that's since doubled in size. So there's efforts to make these systems resilient or to bounce back, I guess. And so this takedown, it's a win in a battle, but the war goes on. And, I mean, you know, there's no resolution. It's just how much do you devote to tackling these different things? These botnets, because they're used by multiple different customers, so the FBI reckons that both the PLA, People's Liberation Army, and the Ministry of State Security, they both used this botnet, We're customers of it. And so if you can disrupt multiple intelligence agencies at the same time, it seems like a kind of good place to attack, especially if it's just, yes, we'll seize a domain name.

8:32James Wilson: Yeah, it seems a pretty good bang for buck out of this one.

8:36Tom Uren: Yeah, I mean, of course, that'll change. They're not going to make that same mistake twice. But it's a point of leverage, I guess.

8:43James Wilson: Hey, one thing before we leave on this one that I was a little bit unsure about, but interestingly you commented on it being just sort of run of the mill was just the relationship here between this QTFY group. They're employed by a private Chinese company and that Chinese company then has its customers are the PLA and MSS. What's the nature of this group? Like, are they just a bunch of hackers that have come together and said, hey, we can build this capability, but we need a shell company around us? They just help we understand that relationship a little bit more.

9:10Tom Uren: Yeah, it's not really clear from the documents. So the documents talk about the company that is, they work for this company. And it says that they call themselves QTFY and a couple of different QT related names. And so to me, it's ambiguous because, you know, if you're a team in a company, like, you know, an actual small team in, as we would understand it in a normal company, um you know maybe that's just i've been in organizations where the org structure is you've you've got a you know qt not qt exactly in fact i was in qa once though um so so it could be as

9:53James Wilson: simple as that but it seems odd that that would end up as a line in a doj press release like i was just curious like why why do we need this additional detail of what could be somewhere between a hacker group or an internal team within this private Chinese company?

10:10Tom Uren: They're pretty clear that they work for the company Nanjing Shinweizhu Network Technology. That's not quite right, but something like that. So it's employees of the company, separate sub-working group or sub-team or something like that.

10:26James Wilson: Well, listen, let's move on to the next story because we've got a lot to cover in this episode. This one is around this ATF hack might be a big deal. Now, we touched on this briefly in the main show yesterday, and all we knew at that time was that this was a ransomware attack. It was supposedly the Qilin, the Russian-speaking group, was potentially behind this. And all we knew was it was an isolated system that contained information about targets that the ATF, of course, the Alcohol Tobacco and Firearms Bureau, was investigating. What do we know now, Tom?

11:00Tom Uren: Yeah, so the head of the ATF, he came out and said, yes, just confirming this was our CLEA system. So CLEA Communications Assistance for Law Enforcement Access, I think. But anyway, it's their lawful intercept system or part of their lawful intercept system where they provide warrants to, say, telcos and telcos send them data back. And so this is like, that's a pretty sensitive system. It tells people who they're targeting, what they might know about them in terms of phone numbers, IP addresses, that sort of thing. So subsequent to that information coming out, the director saying it was a clear system, Chi Lin briefly published, is the word that was on Twitter, a dump of 6.3 gigabytes.

11:55Tom Uren: And I suppose in terms of an extortion campaign, it's the here's the proof of what we've got. And it included mobile phone forensics, case files with details of targets. So I think that's pretty sensitive stuff. It seems consistent, maybe. I don't know why you would have phone dumps on that server, but somewhere in the clear system, maybe that makes sense. the ATF hasn't confirmed that that was actually their data but this all struck me as the sort of thing that is kind of embarrassing for the ATF from a government perspective you would really rather not have criminals hacking your system and releasing data willy-nilly it's kind of not good for business and in times past the you would just go okay well nothing we can do we got owned bad job.

12:55Tom Uren: But it occurred to me that about a month ago, was it even a month ago, a couple of weeks ago, the Trump administration said, yes, we're going to enlist private sector hackers to tackle cyber criminals. And it seems like, yeah, well, this is a good example of, there was no priority list of how they would decide what to actually go after. But it seems like, I think you could try and shape cyber criminals' activities and sort of draw a line in the sand and say if you do this kind of thing, we're going to come after you because you've got more capacity now.

13:31James Wilson: Well, do they have more capacity? I mean this memorandum, yes, it was a couple of weeks ago, but it was just a call to action for various other bureaus to then or parts of the administration to come together.

13:41Tom Uren: Right now they don't have more capacity. But I think the memo had a 90-day, we shall come up with a plan within 90 days. So, you know, pretty quickly.

13:53James Wilson: Yeah, it's 90 days. It's different from the old two weeks that everything used to be. So that's an interesting development. And look, Tom, if you don't mind, shameless self-promotion. There's a Risky Business Features episode that comes out today, which was Brad Arkin, former CISO of Cisco, Adobe, and Salesforce, and I talking about his experience of firsthand working with law enforcement on cyber investigations and his thoughts about how this is, I think he phrased it as, you know, this is taking Release the Hounds from three up to four out of ten to see if it might work. But he's got some interesting thoughts around, you know, who gets to actually hack the hackers.

14:31James Wilson: And so that comes out today. So I just thought I'd mention that as well.

14:33Tom Uren: Yeah, great.

14:35James Wilson: How do you reckon Chi Lin's feeling? Like you talked about the US government perhaps being a bit embarrassed about this, not a great look for them. But Chi Lin, ransom the ATS-Kalir system. Is this like dog caught the truck or is this good job, guys? Like it just seems odd that it was Chi Lin up here in a Kalir system.

14:54Tom Uren: Yeah, so some ransomware groups have deliberately said, we're not going to hack certain things. And they've actually carved out critical infrastructure, hospitals, governments. and they've tried to portray themselves as much as you can as the responsible ransomware actors. And, you know, there's a plethora of different approaches. It's a kind of free market. So others have actually explicitly said we're going to hack these particular groups because we think we can get better ransom payments from them. so Xilin obviously hasn't laid down the law to its affiliates so usually it's the ransomware as a service the providers of the ransomware kind of shared services like negotiation and often they provide the malware that does encryption they haven't laid down a law to stop their affiliate from doing it so I suspect they don't I mean they just haven't thought about it or don't care Yeah.

16:04James Wilson: I mean, you phrased it well, right? I think from the newsletter, you said there's a far higher chance of all pain and no gain than there is if yielding a big payday in this case, I think.

16:13Tom Uren: Yeah, yeah. I think governments are very reluctant to pay. And not to mention the amount of attention. Like, imagine if we were a couple of months ahead on this idea of having private, you know, cyber privateers that could go after this.

16:24James Wilson: Like, I think it'd be a pretty bad day for them to have suddenly that, you know, canon of private security or cybersecurity experts suddenly channeled in their direction. But I don't know, I guess time will tell. The other thing that I wanted to touch on with you briefly, Tom, is the third story in the newsletter this week, which is around water, water everywhere, but no money. Again, picking up on something that we talked about on the main show last week, which is this very, very Trump, he's been the mouthpiece for this in all the media about how there's going to be a huge effort to start off in Texas, fix the water supply and treatment OT systems in Texas as a six-month pilot, no cost to the treatment facilities.

17:09James Wilson: But my take on the show yesterday was the problems that they're going to run into in terms of securing all these networks are going to be so unique and so specific to every facility that I just can't see how this scales. But I'm curious as to, is that your take as well, or is there more nuance to it here?

17:26Tom Uren: I think that to improve security, you actually need to do work in the water sector. And America's water sector, it's really extremely decentralized. So the numbers are, you know, 50 ,000 different water, they call them community water systems. And that has a particular definition. and most of them, something like 80%, serve less than 10 ,000 people. So these are not big, centralized, sophisticated places. They're bare-bones systems. And the problems that they've had with Iranian hackers in particular are what I would call the bare minimums, so things like not connecting your systems directly to the internet, changing the passwords, using good passwords.

18:15Tom Uren: you know they've gone from they would be going from zero security to some security okay so we're

18:22James Wilson: far away from like the military grade of security and then i guess ways of managing these systems but even that makes me wonder like what good could even the most well-intended army of consultants that land into this and try their best to fix it actually do in terms of having a lasting effect because security doesn't last, right? It rots.

18:43Tom Uren: Yeah. My take on the reporting was it seemed like they've got a range of companies that will provide free tooling and maybe do testing. And so I think the best case is you get, you know, water facility. Here's a list of problems that we've detected. You go and fix them. And I think the problem there is that they just don't have that many people with expertise. Yeah.

19:06James Wilson: Well, I mean, if the things are literally keep them off the internet and change the passwords, that falls into the could have, would have, should have, but yet they haven't.

19:12Tom Uren: Yeah, and I mean, they may not know where those systems are or what they have. I think it's pretty common for companies or organisations not to know, not to have really good asset control. And so I think that could be helpful, right? Here's a list of things to go and fix, but they still have to go and fix them. And I think the Iranian attacks provide some motivation to do that, but they don't change the dynamic of not having enough people. So I think it's like it's not totally bad. I just don't think it'll – the best we can get to is bare minimum security at some places.

19:49James Wilson: Yes, yeah, it doesn't address that fundamental need for people to be involved in actually doing the fixes. But you remind me – you were mentioning that there was some actually good advice that came out of the UK's NCSC around securing OT.

20:03Tom Uren: Yeah, yeah. So they just earlier last month, they published a fictional case study of a water sector utility. And here's how you would implement. They have these secure principles. And I think there's eight of them. And they're all sensible, right? Now, the problem with sensible security advice is that it's actually a lot of work and it's things like decide what the cost benefit is for you. Do you really need this? How do you implement it safely? What's the plan for doing this and replacing it and making sure that it's secure? and I suppose there is a genuine question about whether AI changes security all that much and I think AI boosters would say yes it's going to totally reshape the landscape and it'll be AI magic dust sprinkled everywhere and we'll be secure.

20:59Tom Uren: I guess I'm more cynical and I think that security is kind of a thing you have to work at and if you do that work you'll be secure and that AI, sprinkling AI on top won't fundamentally change anything. I think maybe it will give you, it'll make things easier. Like maybe it will give you those lists of here are the problems that we can discover in a way that's easy to digest and maybe prioritized.

21:24James Wilson: Yeah, so if I sum this up, whether you have good advice ready to go or you're reliant on a bunch of consultants coming in to give you the good advice, all roads lead to the same place, which is you've got to have the people to actually do that work. And that's the thing that is scarce here. And yes, you could layer on AI, but AI still needs people to be driving it or to be determining its outcomes, et cetera. And so we come down to the fundamental lack here is people to manage the security and get to these outcomes. Well, Tom, look, fantastic newsletter. Again, I've enjoyed all three articles.

21:54James Wilson: Thanks so much for dropping by to have a chat with me.

21:57Tom Uren: Thanks, James.

22:07fan.