Hackers Dox ICE

0:00Emanuel:Are all batteries the same? That's like asking if all soccer players are the same. Take Messi, the most decorated player ever. Is there any other player who has achieved that? No, just him. Now take Duracell. Is there any other battery with Power Boost ingredients inside? No, just Duracell. Remember, goats only trust goats because they're built different. And Messi only trusts Duracell.

0:33Hello, and welcome to the 404 Media podcast, where we bring you unparalleled access to hidden worlds, both online and IRL. 404 Media is a journalist-founded company and needs your support. To subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to the best comments. Gain access to that content at 404media.co. I'm your host Joseph and with me are two of the 404 Media co-founders, the first being Sam Cole. Hi. And Emmanuel Mayberg. Hey, I'm back. I feel like I haven't been here in many years. You come back. Jason's now gone.

1:14Who knows next week. Speaking of Jason, though, he published what is you know our first short documentary uh it's called how artists are keeping the lost art of neon signs alive i've put a link to the youtube uh there's the video on youtube in the show notes there is an accompanying article as well but this is exciting stuff right we obviously before we launched 404 media we all worked at vice that was you know infamous i would say for its uh documentaries we had the pleasure of of working on some of them um i definitely didn't do a lot on it um i think all of you did more than me but now that we run um the company we can start to experiment and branch out and and dabble into doing documentaries um ourselves and i know that that's i think that's a very exciting time to be in um emmanuel is it i know obviously you haven't done a documentary with 404 yet but like it's going to be pretty different moving from a big company like vice all those years ago where there were teams upon teams of people to do this to doing it ourselves like and i feel like you touched it maybe more than me or maybe i'm misremembering what do you what do you make of the us doing it now uh i think sam actually has done the most both in helping the video teams make their own videos, but also she hosted a video, which I hope she can talk about.

2:55I'm really excited. Vice did really good videos. We supported them. Motherboard made really amazing series. One that I really liked that Jason worked on very closely was about right to repair. Super viral video about how farmers fix their tractors and such. I hope that we're able to match that level of quality. It'll be hard. It's going to take a while to hit that, but we have enough support now from our audience to at least try to do that. And we obviously have plenty of interesting, worthwhile subjects to make videos about. So I'm stoked. Sam, what did you work on video-wise

3:43Emanuel:back at vice slash motherboard um i did an episode of crypto land which was my episode was about um crypto being used for sex work so i went out to vegas and went to like a content house basically for um crypto and it was really fun it was cool um yeah obviously video documentaries are really hard um it's a complicated process so um i'll be interested to see how it goes now that we're uh dipping our toe into doing our own so but yeah jason's i mean the neon documentary is really good you should go watch it it's really interesting uh the main character in it geo is such a character so i want to go hang out in his shop in la yeah i mean it's great and when we say we're doing it ourselves it is very much that jason took the podcast uh sorry the camera he usually uses for this podcast and went and filmed this you know short film so that that's literally what we're doing and of course as we get further into it i'm sure maybe we'll we'll bring help on and outside contributors and that sort of thing and that's all very much tbd down the line but hey It's just an exciting time that a couple of years after launch, as you say, we have the support where we can diversify and start to explore different stuff.

5:07And I definitely have ideas of what I want to try to do. All right. Well, for this week, Emmanuel, do you want to lead us through this first story? Yeah. So our first story is from Joe. The headline is, Hackers Docs Hundreds of DHS, ICE, FBI, and DOJ Officials. So, Joe, what is this data exactly? And what is the scale of the hack or docs or whatever you want to call it? Like, how big of a problem is it, would you say? Yeah, so the data itself, this first story we're talking about, it's mostly DHS. And of course, that includes ICE as well. And then there's some FBI and DOJ as well. But it's something like nearly 700 DHS officials in total.

5:59And that includes their official email address, which helps verify that they're a government employee, their name, a phone number. Sometimes that looks like a personal number. Sometimes it looks like an office number, but there's definitely some personal ones in there. And then addresses. And again, this is also sometimes some sort of government facility. but the ones I looked at they sure look like residential addresses when you put them into google and a zillow listing comes up and it's like oh I don't think that's an official dhs facility or something like that so it's straight up docs and obviously that is a lot of personal data that people could do various things with and in this case it landed in the hands of a group of hackers who are financially motivated, I would say.

6:51And I'm sure we'll get into that as well. So the first thing we do when we find out about a leak or a doc like this is we try to verify that it's accurate. Otherwise, we wouldn't report on it. How did you do that for this story? Yeah, when a hacker reaches out and they say, I have this data, it could be absolute BS. You have no idea if they've fabricated it and they're trying to do it for clout or prestige or maybe just to troll the journalist or whatever. We've had it before where hackers targeted telemessage, that signal clone that the Trump administration uses, and we broke news of that hack.

7:30Way back then, there was a bunch of data about customs and border protection officials in there, like phone numbers, that sort of thing. In that case, I just phoned them up. I asked them, hey, is that blah, blah, blah from CPP? And they say yes. And then I say, my name is Joseph Cox, I'm a journalist, blah, blah, blah. And then usually they hang up immediately when I start, you know, actually speaking. So I did that way back when, and I could have done that for this, but I actually just felt like doing a different approach, which is that I took this docs provided by the hackers. And then I turned to data provided by a company called District 4 Labs.

8:10They have a search tool called Darkside. And I log in. And basically, it brings together all of these different data breaches from all over the internet. So back in 2016, I remember that there was a wave of breaches, LinkedIn, and all of these other ones. And if you were a journalist or a cybersecurity researcher, you had to go and download that data, then search for it yourself. And maybe that was useful. I seem to remember some stories from the time where, oh, I need to verify who this person is for this story a couple of years later. Oh, let me go through the data breach of XYZ company. You don't need to do that anymore because companies like District 4 Labs exist and they just bring it all together and then they allow researchers or journalists or threat intelligence analysts, or I presume government as well, allows them to log in and you can just search all of these databases at once so i started taking phone numbers from the dhs and the ice docs put them into this tool and very quickly it was apparent that oh yeah these are real docs of ice and dhs officials there were some interesting cases where i would put in the phone number and would bring up the matching dhs email from a breach of a parking app.

9:32And that shows, oh, that DHS official must have signed up to that parking app with their official email address. The name matches, the phone number matches, all of that sort of thing. Other ones where you would put in the address and get the phone number, or you put in the phone number and you get the address. So that did indicate this data is legitimate. Now that said, there's the chance that these hackers have just repurposed all of that data that's already out there. You know what I mean? They've like, oh, they also have the parking app data and now they're repackaging it and going, oh, look at us, we doxed ICE, we doxed DHS or whatever.

10:09But when I was verifying, it was spread across so many different data sets that just didn't seem likely. And sometimes the data didn't appear in previously breached stuff at all as well. So it was basically building a mosaic and an understanding of, well, this data does appear to be legitimate. It does appear to be new in a lot of cases as well. And it really does appear to relate to specific government officials, including DHS, ICE, DOJ, and FBI.

10:52Emanuel:this show is sponsored by better help october 10th was world mental health day and this year we're saying a heartfelt thank you to therapists and people who show up listen and help millions take meaningful steps towards mental health. If you've tried therapy, think about those powerful moments where something unlocks. You get the right question at the right time, a safe space to let something go, or that feeling that something just clicks. Sometimes that moment can come outside of your session when you're not even thinking about it. Therapists make that possible. And if you haven't tried therapy, now's a great time to start considering.

11:33Emanuel:BetterHelp has been helping people connect with licensed therapists for over 12 years with more than 30 ,000 therapists and over 5 million people served worldwide. They're the world's largest online therapy platform. And with their therapist match commitment, finding the right person to talk to is easier than ever. BetterHelp's flexible platform makes it easy to schedule, reschedule, and go to your sessions on their all-in-one online platform. This World Mental Health Day, we're celebrating the therapists who have helped millions of people take that step forward. If you're ready to find the right therapist for you, BetterHelp can help you start that journey.

12:12Emanuel:Our listeners get 10 % off their first month at betterhelp.com slash 404 media. That's betterhelp.com slash 404 media. You know that hoodie you can't stop reaching for? The one that feels like a second skin, soft, warm, and somehow makes you feel a little more grounded? Well, I found it. And trust me, It's not what you expect. It's called Paka, spelled P-A-K-A. And if you're tired of hoodies that stretch out, pill, or feel heavy, this is the upgrade you've been waiting for. Paka makes performance apparel from alpaca fiber, one of the world's most sustainable natural fibers. Their best-selling hoodie is softer than cashmere, warmer than wool, and breathable.

12:56Emanuel:It's lightweight, but still cozy, doesn't stretch out, doesn't pill, and somehow keeps me warm when it's cold and cool when it's hot. Basically, it adapts to wherever your life takes you. This hoodie is built for real life, thermoregulating, odor-resistant, durable, and made to last. The weather has finally cooled off here in LA. And when I need something to walk my dog, lounge around in the house, grab a dinner or drinks, I find myself regularly tossing on my pack of hoodie, which is regularly earning me compliments. Right now, when you order your pack hoodie, they'll throw in a free pair of their alpaca crew socks, which might be the only thing better than the hoodie.

13:34Emanuel:These are seriously next level. They keep your feet dry, never smell, and on top of that, they're just insanely cozy. Plus, have you ever had socks that come with a lifetime guarantee? Paca dares you to wear these out and if you can, they'll replace them. If you've been thinking about leveling up your hoodie game, this is your sign to do it now. To grab your pack hoodie and free pair of alpaca crew socks, head to go.pakaapparel.com slash 404media and use my code 404media. That's go.pakaapparel.com slash 404media and enter code 404media.

14:23so this story was a huge traffic bomb for us and i think the reason for that is that in a different time, the fact that there was a hack or a dox of a bunch of people who work for DHS and ICE would not be that interesting to so many people. But it's happening at a time, as we reported over and over again this year, where there's increased attention on DHS and on ICE because of the way that it's operating, masked agents in the streets. picking people up, deporting them, etc. And the timing of this docs, I think if you don't read anything about the story, if you don't click through and read a single line of reporting, you might assume that there's some sort of hacktivist activity here or motivation to the docs.

15:28That is not what is happening if you are familiar with the group behind the docs, which I think is the most interesting part of the story. And I guess to start on that, Joe, because it's so complicated. Like what this group is, the names it has, the motivation, the history of other breaches that they've been involved with, all that stuff. So like to start this, I would challenge you to like, what is the, And use as many words as you want. You don't have to be succinct because it is complicated, but it's like, what do you think is the most accurate, fair description of this hacking group? I think this group, which is called Scattered Lapsus Hunters, which we'll get to, which is obviously a very complicated name, and I'll explain what that means in a minute.

16:19But that group is a financially driven extortion gang. That is what they do. They breach companies. They steal data. They then try to extort maybe the individual customers where that data has been taken from or the overarching technology and service provider, which in this case is Salesforce. They're a financially driven extortion gang. That's how I would categorize them. I think that's fair, but I feel like that kind of, like, if you were to just say that, you're missing some other important context, which is, I would argue, the fact that they are primarily English-speaking, it seems, that they appear to be young, or that many of the members are young, and that they've been involved in real-world violence as well.

17:16Yeah, go ahead. Yeah, so that was definitely the bullet point. But now to step back, and you're absolutely right, to give that context, I'm even going to step several steps back. So there's this thing called the comm, right? Right. And it's short for community. And there's a lot of different ways to describe it. I think recently I've called it like an online phenomenon. It's almost like a cultural thing, almost an anthropological thing. And what this is, is thousands and thousands of people on Telegram and Discord, usually English speaking, as you say, Canada, the United States and the United Kingdom.

17:57And it's gamers. It's people hanging out on these chat apps. people playing Minecraft, people playing Roblox is often how they get into this world. And it might start with cheating in those games or stealing valuable Roblox items or something like that until eventually people in com are hacking, they are doing fraud, they're scamming, they're doing sim swapping. At least they did a lot of that. I'm sure they still do, but things have escalated somewhat now. And it's this massive community, as I said, of thousands of people doing all sorts of things from trolling to beefing to crime, right up to, as you said, the commission of serious physical violence.

18:45I've seen, well, we've all seen videos of people having their ears chopped off, attacks with hammers, all of this stuff back when I covered comm much more like a few years ago. I've just been focused on other things recently. So they come from that ecosystem. Now, out of comm, again, because it's not like a group or really, it's again like an anthropological thing. Out of comm, you get these various groups or nexuses of activity. So a really famous one is going to be Scattered Spider, which was sort of the most well-known one, I would say. They were amazing at sim swapping, really effective at that, started joining forces with Eastern European ransomware gangs, have been linked to the ransomware attacks on MGM resorts, that sort of thing.

19:36So really going from stealing Twitter handles, because it's a proper noun and it looks cool to have at dark or whatever on Twitter, right up to hacking MGM and other companies. So you have Scattered Spider. You have Lapsus, which actually came before. And I covered them when they broke into Electronic Arts and stole a bunch of data from there. That was involving buying login tokens for Slack that was also pretty novel at the time and lowered the barrier to entry for hackers again. So you have Lapsus. Then you have Shiny Hunters, which almost like a forum administrator, more of a data broker slash seller, although it has connections to hacks as well.

20:17And then that brings us to this latest evolution of this sort of ecosystem, which is this kind of specific group called Scattered Lapsus Hunters. And they are the ones that have posted these docs of DHS ICE officials. And that sounds like a bunch of names and it is just a bunch of names, but it shows that, you know, we're not just talking about Chinese state-sponsored hackers breaking into OPM anymore and stealing the data of US officials. We're talking about probably pretty young people who have escalated from stealing stuff in Roblox to becoming a top-tier national security threat. I mean, it's insane when you put it like that.

20:58Yeah, and notably, again, not hacktivists, like not looking to do good, not anonymous, right? It's like if you just read the headline and you assume that's what this is, it's not that. To follow up on something, in your brief definition of them, you said they're financially motivated, which is what made them dox these people. can you explain a little bit more how that would work and also i believe there was like another like stated uh mechanism through which they thought they would like gain profit yeah so i don't think the doxing of dhs and ice is specifically linked to the extortion but to give the context on that um this group or people for the eight of it whatever broke into a bunch of databases which were using tech from the tech company Salesforce, which we all know.

22:00A ton of companies were using this, Disney, Hulu, Toyota, UPS, all of these companies. This group, again, people working with them, broke into those, stole all the data, and now they've been trying to extort Salesforce. Maybe they've gone to individual companies as well, but they've gone more to Salesforce and said, we're going to leak all of your customers' data if you don't give us, you know, presumably millions of dollars or whatever. Salesforce has said, we're not going to do that. That's what Bloomberg reported. And then when I've spoken to a member, they said, oh yeah, we're sort of done with Salesforce and now we're just posting these docs.

22:37And the reason being, and I didn't include this in the article because, you know, I don't take it as a verified fact, but I feel like I can give people just a behind the scenes thing on the podcast, which is that one of the members told me they started doxing DHS and ICE because one of their friends got deported. So I don't know, man. Like I asked, well, can you give me the name of the person who was deported? Then I can verify it. And they didn't want to provide that. And because presumably that could, you know, reveal their identity or something like that, which I get they're not going to hand that over.

23:07But that's why I didn't put in the article. So they are extorting Salesforce or they were extorting Salesforce. Now they're almost just doing stuff to cause damage. And that's like a key feature of these groups as well is that they just do stuff to start fires sometimes i was i was going to give my completely subjective reading of it but it almost feels as if they haven't been in the news for a minute and they were like oh you know what we could do to really get some clout right now is docs a bunch of dhs and ice officials because that's what everybody's talking about and they were right you know it's like it did work and they have a history of trolling and making a mess just to make a mess so i definitely i can't prove it but like that i believe that that is a motivation here um so you published the story we just talked about then a few days later you publish another story with the headline hackers say they have the personal data of thousands of NSA and other government officials.

24:10So what did you learn to justify publishing this new story? Yeah. So a little while before that, almost around the time of the original DHS and ICE doxing, these hackers also posted the apparent dox of a specific NSA official in the Telegram chat. I mentioned that offhand behind the blog that we published on a recent Friday. I then do this one. Then again, this member reaches out and says, oh, we actually have a much more data, much more data, they say of 2000 NSA officials, 22 ,000 something like in total of the US government. And they start sending me the personal data of a lot of government officials.

24:56And again, it's the same thing. It's names, email addresses, phone numbers and addresses. And honestly, the number of agencies was dizzying. There's Defense Intelligence Agency, Federal Trade Commission, Federal Aviation Administration, the CDC, ATF, Air Force, State Department. And what I did was I did much the same thing. I took those pieces of personal data, turned to that dark side tool again and verified what I could. Again, it looked legitimate. So then we published that as well. And initially, this story, at least in my head, was going to be more about the Salesforce connection because that was a question where they initially published the DHS and Ice one.

25:43So where are they getting this data? It's probably the Salesforce stuff they stole, but I don't really know. The member reached out. That's what they said. That was going to be the headline. But then when they started sending all of this other personal data, I was like, oh, this is like a really broad um i think attack is too strong like a like a broad uh incident with the u.s government it's not just a dhs and ice thing anymore any other agencies that you want to talk about that were impacted or anything else you want to say about where they got this data yeah but i mean there's fda in there as well health and human services and the mentioned State Department, I think the last thing I would say is that I find it really interesting that I mentioned several years ago, Chinese state hackers targeted the Office of Personnel Management, OPM.

26:36And they took all of this very sensitive data that could be used to identify, I think, undercover officials and that sort of thing. When you attack the HR department of the US government. You're going to get a lot of very sensitive, interesting data. That's why the Chinese hackers did that. Here, I'm definitely not saying they're equivalent. The OPM stuff would have been way more sensitive because there's like background checks and stuff in there as well. But what's happened here is that a bunch of English-speaking, probably young hackers have managed to build dossiers on US government officials themselves, not by attacking the US government directly, but going to all of these other companies that happen to use Salesforce.

27:21And of course, it also reminds me of the Snowflake AT &T breach, where young hackers broke into a Snowflake database run by AT &T, which included the call and text metadata records of nearly all of AT &T customers. Again, that is something that you would usually attribute to top-level state-sponsored hackers from Chinese, Iranian, Russian intelligence, something like that. And we reported, they did a lot of interesting stuff with that. They looked up members of the Trump family in that data, various politicians, all of that sort of thing. Almost the same thing is happening here. It's not Snowflake this time.

28:03It's Salesforce, but they've gone and got this very sensitive data, including, again, personal data of NSA officials and other intelligence community officials as well. The Telegram channel is gone now. People are saying it was shut down by Telegram. That seems like the most likely explanation. There are rumors that members have been arrested, but I haven't seen strong enough confirmation to put that in an article or anything. But I don't know. If you're starting to dox ICE, DHS, and NSA officials, I think that the US government is probably going to come knocking pretty quickly. All right, should we leave that there?

28:48After the break, we're going to talk about one of Emmanuel's stories. He's going to bring us up to date on what's happening with Wikipedia and AI. We'll be right back after this.

29:09Emanuel:The holidays are upon us and businesses are hiring for seasonal roles. Haunted house ghosts, turkey carvers, even Santa is probably hiring for his workshop. That means that people with specialized skills, experience, and licenses are in high demand and can be tough to find. Whether you're hiring for one of these roles or any other role, the best way to find the perfect match for your role is on ZipRecruiter. and right now you can try it for free at ziprecruiter.com slash 404 media. Whether you're hiring for an office job or a haunted corn maze, ZipRecruiter's matching technology works fast to find top talent so you don't waste your time or your money and you can get someone in the door on the timeline you need.

29:52Emanuel:With ZipRecruiter, you can immediately figure out just how many qualified people are in your area looking for your role and you can instantly unlock top candidates info with ZipRecruiter's advanced resume database. Let ZipRecruiter find the right people for your roles, seasonal or otherwise. Four out of five employers who post on ZipRecruiter get a quality candidate within the first day. And right now you can try it for free at ziprecruiter.com slash 404media. Again, that's ziprecruiter.com slash 404media. ZipRecruiter, the smartest way to hire. It's a business owner's dream, but also kind of a problem.

30:30Emanuel:Your idea takes off and suddenly you're the CEO, the accountant, the designer, the marketing team, and the IT department all at once. There's just not enough hours in the day. I felt that way with 404 Media. We're not just the journalists, we're doing everything. Thankfully, having Shopify in our corner has simplified everything and made it easy to run our own merch store. Shopify is the commerce platform behind millions of businesses around the world, powering 10 % of all e-commerce in the US. From household names like Mattel and Gymshark to, well, 404 Media, Shopify gives you the tools to build, sell, and grow anywhere, whether you're online, brick and mortar, or both.

31:09Emanuel:What I love best about Shopify is you can set up your store in just a few minutes with hundreds of easy-to-use templates and be on the world's most powerful and easy-to-use backend in a snap. A little secret, your Shopify store will look like you've been selling for years even if you only spend a few minutes setting things up. Shopify has made it so easy to add and manage inventory, handle shipping and returns, and refresh your items like we just did with a new line of merch. That's the great thing about Shopify. It wears all the business hats that maybe you don't feel comfortable wearing. So you can have top-of-the-line design, logistics, and marketing, letting you launch email campaigns, run social media ads, and connect you with your audience wherever they scroll or stroll.