The Growing Ransomware Threat: Targets, Insights, and Strategies with Halcyon's Jon Miller | E1877

0:00A week before the Super Bowl happened in Tampa, the Tampa Water District got hacked and somebody tried to poison the water. What? I was totally unaware of that. Wow. They stopped it because somebody was literally sitting at the computer and saw someone else moving the mouse. Whoa. That's an unplug the computer moment. Yeah. Holy cow. This Week in Startups is brought to you by Scalable Path. Want to speed up your product development without breaking the bank? Since 2010, Scalable Path has helped over 300 companies hire deeply vetted engineers in their time zone. Visit scalablepath.com slash twist to get 20 % off your first month.

0:44Northwest Registered Agent. When starting your business, it's important to use a service that will actually help you. Northwest Registered Agent is that service. They'll form your company fast, give you the documents you need to open a business bank account, and even provide you with mail scanning and a business address to keep your personal privacy intact. Visit NorthwestRegisteredAgent.com slash twist to get a 60 % discount on your next LLC. And Vanta. Compliance and security shouldn't be a deal breaker for startups to win new business. Vanta makes it easy for companies to get a SOC 2 report fast.

1:21Twist listeners can get$1 ,000 off for a limited time at vanta.com slash twist. All right, everybody, we are obsessed in 2023 and now in 2024 with how artificial intelligence is impacting essentially everything we do in business, in life, and government, education. Now, AI gives you, if you're a knowledge worker, so many amazing tools. I'm seeing people on my team get 10%, 20 % faster every month just by using these tools. It is bonkers. We've never seen anything like this. But the truth is, if the good guys can get better at their jobs, well, the black hats, the hackers can get better at their jobs as well.

2:06Just think about how powerful it is to use a language model to try to convince people of something in one of your blog posts or your email newsletters. In fact, Grammarly lets you set that. Well, the same technology could be used by hackers, spoofing emails. And the targets are always businesses, hospitals, critical infrastructure, you know all that. And the damage from ransomware last year alone,$30 billion. The Department of Homeland Security said ransomware was the second most comfortable cyber crime. And so today we have an expert in the field. John Miller is the CEO and co-founder of Halcyon.

2:41and they are building products that use AI to stop ransomware attacks before they happen and limit the damage they do. John, welcome to the program. Thanks for having me. Let's talk a little bit about the threats and ransomware in general. How does practically ransomware go down and who's doing this and what's their motivation? I mean, it's pretty obvious, but I think it's good to hear it from an expert. Yeah. I mean, it's attacker group is growing day after day. It used to be something that was heavily Russian in origin and then into Eastern Europe and then you'd see some Chinese actors at it.

3:17But now we're seeing a renaissance, right? Where people all over the world have figured out that you can just join one of these affiliate programs and you're a ransomware actor. So we're in this interesting spot where, you know, Not only do you have AI coming in and adding to automation and scale and efficiency, but more and more attackers are coming online now. And they've been kind of bolstered by this economy where, you know, you have these large ransomware groups where, you know, a lot of them have ties to FSB or GRU. And they're actually building the tooling and operating it in a profit sharing capacity with anyone that wants to partake.

4:01This is new news to me. Explain this, how Affiliate came to ransomware, because if you did have the super weapons to exploit people and do ransomware, you would probably want to keep them for themselves. But that something seems to have changed you. This is the first I'm hearing about these affiliate programs. Explain what they are. Absolutely. So a great example of it is the MGM attack that happened in Las Vegas. And so there were two distinct groups that were involved in it. One of them was called Black Hat. Those guys have ties to Russian intelligence, and they're a ransomware group on their own.

4:37However, they make their toolkit available to an affiliate network. And so the group that actually carried it out has been called Scattered Spider, which nobody's exactly sure where they are. There was some assumptions that they were based in the United States because their English was so good in their written communications. But that's been attributed by some people to the use of LLMs and help building their ransom notes. But it was a completely new attacker group where They didn't have their own tooling and they split the profits with the black. Wow. So this is interesting. The Russians or, you know, these other groups are now making the tools.

5:25They make the weapons. They say, hey, you go do your activity. Chop it up 50-50. Yeah, yeah. They do it too, right? And it's all different percentages. But it's not like they stop. The really sophisticated attackers will focus on the more sophisticated targets. And then you have tiers of these attackers where, you know, you'll have people that specialize in going out and attacking hospitals, right? Or, you know,$100 million sized manufacturers. It's interesting where you're seeing essentially the internet kind of carved up into territories. Wow. You have these different attacker groups that just keep kind of rinse and reusing the same techniques and tools over and over.

6:12How do they get away with it, I guess, is one of the questions that I think a lot of people have. Because, you know, the internet, you can be anonymous, but there are ways to trace people. And then when payments become involved, there's ways to trace people. So how do they remain anonymous during the attacks and the communications? and then how do they remain anonymous in the payment area? So the payments are normally done via cryptocurrency, right? And, you know, Bitcoin is involved, but there are washing services. There are more secure currencies like Nero that are used. But for the most part, there's no consequence.

6:50Like there's no police that are going to come arrest you, right? Right. So 99.99 % of ransomware cases out there, there's no police that are chasing you down. No FBI coming and saying, hey, we need to go stop this at the source. Would this be happening if crypto had not become so ubiquitous and available? Or is crypto the kerosene on this fire? I mean, crypto is definitely the kerosene on the fire. It's really difficult to have someone deliver millions and millions of dollars in cash. Logistically, it's complicated. Cryptocurrency has definitely streamlined the business. It did happen before there was cryptocurrency.

7:37I think the biggest thing that's really exploded it is the fact that attackers or people that weren't attackers are realizing that they can really do this consequence-free. And, you know, as long as you're not in the U.S. or, you know, a first world European nation or something like that, there's no response. The government is, for years, has tried to keep computer hacking kind of on the level of espionage, right? Where it's not kinetic, it doesn't merit a kinetic response. And it's bled over into this now, where we're not really set up to respond to, you know, an exponentially growing threat group like this that is completely willing to target our critical infrastructure, our manufacturing.

8:26At some point, this is going to be so acute that we're going to have to strike back in the real world. And that's pretty obvious. Yeah. I mean, it's obvious. I don't know if it's going to happen. It's not where policymakers are going. Where they think they can solve it is by making it illegal for people to pay ransom. So if nobody can leave. Oh, making it illegal to pay the ransom. Yeah. So imagine your business gets ransomed. or imagine you're a hospital that gets ransom and you can't provide quality service to your patients which you know results in in death right um telling them that they can't pay a ransom is a very precarious spot to be in but now crypto people always say to me oh have fun staying poor not going to make it and then when i make these points and then they also add to it well crypto is 100 % traced and the blockchain is immutable, blah, blah, blah, blah, blah.

9:29Therefore, crypto makes it easier to catch criminals. Is that just them talking their own book and trying to protect themselves? Yeah. You can wash cryptocurrency, right? You can put it through laundries, online casinos. There are services specifically for it. You can chain hop, right? Like transfer from Bitcoin to Monero or, you know, Monero to Woo or whatever you want, Dogecoin. It doesn't matter. There's enough spots where you can mix it around where you can't track it anymore. They don't really need to go to that level of extreme because no one's really going after it. It's hard to balance hiring top tier developers and keeping your burn rate under control.

10:17But these days, I see a ton of founders successfully doing this by hiring remote talent. So let me tell you about Scalable Path. It's a software staffing company that can help you build an awesome remote developer team. And the right developer isn't just a list of technical skills. We all know that. It's about their personality. It's about their work ethic, their motivation, and their fit within your team. And Scalable Path knows this. So here's what they do. Their team will get to know your vision. They're going to get to know your needs, and then they're going to develop technical challenges tailored to the roles you're hiring for.

10:52And these challenges are conducted live and on video. So there's no gaming of the system. You're going to get great people. They also evaluate each candidate's soft skills like communication, attitude, and work style. Scalable Path has completed more than 300 projects for their clients, and they have a network of 30 ,000 developers. They've been doing this for over a decade. They know what they're doing. So you're going to be in great hands. Here's the best part. Twist listeners get 20 % off their first month. If you're ready to scale your dev team and your business, check out scalablepath.com slash twist.

11:26Once again, that domain name, scalablepath.com slash twist, 20 % off. The interesting thing with ransomware you negotiate with these guys, right? Like you have live communication with them, both in the process after you've been ransomed and you're trying to get unransomed and negotiate how much to pay them, as well as they'll support you after you've paid them to help recover data. So it's not like they're hiding deeply in the shadows and there's just no need for them to. So when they did this with Caesars and MGM, Caesars, I think, just said, okay, or one of them, Caesars, just paid$15 million.

12:07Yeah, and they were back online quickly. So what they do is they take down your systems, they somehow lock them up, and they have the data of the individuals. That's the playbook? Yeah, so normally the first thing they'll do is actual trade your data. And they do it like a smash and grab. As fast as they can, they'll overwhelm the connection pipes, but take as much data out as possible. And then what they'll do is they'll run encryption software where they'll just scour the whole hard disk and create encrypted versions of all the files and then delete the originals. And then you pay them for that key to restore those files.

12:46And then they call it double extortion. You pay them to not publicly release the data that they stole. Got it. So they got you two different ways. Yeah. An interesting one is I think it was the Black Cat group. I don't want to offend any ransomware group for attributing something to another one. But about a month ago, they actually reported their own breach to the SEC where they ransomware the company. The company was trying to keep it under wraps. And they, as the attacker, did the disclosure that they were compromised. Yeah, because you do, as a public company, have to disclose these things now.

13:25That's part of the law. Yeah, absolutely. And we've had laws for a bunch of years at the state level, and now we're getting more into SEC mandating reporting. But the majority of these attacks still go unreported. If you're running a business and if you don't pay, your business is going to go under. You're going to figure out what you need to do to pay and just keep it quiet. How do people stop this from happening? Because this is a system level, you need to get keys to the kingdom in order to do one of these things, which means you have to compromise a pretty serious IT person's credentials, or can you do this with just the CEO's credentials, the CFO's credentials?

14:10How do they get into the system? What level of keys do they need? And then how do you stop it? I know your company obviously has tools and services here, but how do people practically stop this from happening? Our company specializes in, we've built an endpoint agent that complements kind of antivirus and EDR and provides another layer to stop it. And then if we miss it, actually recover the system, we capture those keys. So instead of having to pay for them, we have a copy and we can just use them. The normal ingress for these is like phishing attacks, right? Compromised credentials. There have been so many password breaches over the years that you can take someone's email address and essentially figure out what the algorithm is they use in their head for creating passwords, unless they use really random passwords everywhere.

15:00And they'll bake that into the malware and say, you know, here's what we think five passwords probably are. When you run, try to connect to them. The other interesting thing is there's another, essentially, marketplace where you have what are called initial access brokers. So there is an entire business of, all I do is go out and try to get a small landing point inside of a big corporation. And then I turn around and sell that. so if you wanted to be a ransomware actor today you don't have to hack anything you go and join a ransomware group you go to initial access broker you buy the access you take the tool that you got from the ransomware group you run it there you're done there so there are people who complexity is low now very so there is a marketplace now of people who have hacked Yeah, numerous ones.

16:01They will hack somebody in customer support, somebody who's a receptionist, somebody who's a salesperson, whatever it is. That gets you into the building, essentially. Now you run this malware that you bought. And you try to lateralize, you capture cash passwords off of the host, right? The interesting thing is these Ranch Border guys have a lot of money now. This is really successful. So they can go out and do things like buy zero-day vulnerabilities, right? Explain what that is to people. A zero-day vulnerability is a flaw in a piece of software that nobody knows is there. so an individual researcher goes out and says i figured out how to hack chrome browser the way that nobody knows instead of telling anyone or disclosing it you know there are ransomware groups like lockbit that run open bug bounty programs you just reach out to them you tell them what you found and they'll pay you for it and then they'll build that into their malware so this hacker the the black hats are offering bounties a hundred percent against microsoft offering bounties or whoever and guess who pays more i'm gonna guess the people who do ransomware pay more well they make money with it right and so i think it was like two or three years ago we hit a point where those types of vulnerabilities were almost exclusively used by governments right intelligence agencies, stuff like that.

17:33Then we hit a point where these cyber criminals are actually using more of these zero-day vulnerabilities than anyone else. Fascinating. So explain how language models and AI has changed the game, because we knew it would. Is it just people are writing clever emails now? I mean, you would be amazed at how much ransomware starts with phishing. And I'm sure you've gotten more phishing emails than you can count in your life. And normally they're pretty easy to pull off when it's like, this is broken English. Like this isn't legit. I mean, you can use an LLM to generate a phishing site for you. I don't think that it's really widely being used by the ransomware groups.

18:19They don't really need it, but it is another kind of fueling factor that's just allowing them to grow even more. You get 10%, 20 % performance uptick if you use it, right? Cut out some of the busy work and give a finished product that's going to be more successful. The thing I've recently been made aware of, because I'm in the venture capital space, there are large wires that sometimes somebody gets a distribution. So a wire goes out, you're in a venture fund, you're an LP, and we're shipping, you know, oh, we're distributing the stock from Coinbase or Airbnb or from Uber. It's got to be wired to an account, custodian account, a bank account, whatever it is, if it's stock or cash.

19:08And so there was a report going around Silicon Valley that somebody had taken a notable person's voice and then did a dialer and then attempted to change the distribution path of shares coming out of a venture firm to a partner or an LP, which I don't know, was a GP, a general partner working at the firm or an LP who was an investor in the firm. So have people started using voice now to kind of, and then these AI voice generators? I haven't seen it yet, but absolutely right. It's the other beautiful thing there is caller ID is incredibly fragile and easy to spook. So the second you call someone and it says that it's, you know, Jason calling me and it's your voice, how do you not go buy those Amazon gift cards?

19:58Starting a business used to be a pain. You needed a lawyer. There were hidden fees. It was a mess. Now with Northwest's registered agent, it only takes 10 clicks and 10 minutes. Northwest provides everything you need to start and maintain your business. Every LLC, corporation, or nonprofit at Northwest Forms comes equipped with registered agent service, a business address, a website, and hosting email, a phone number, and this is all covered by Northwest's privacy by default. Again, your full business identity will be live in 10 minutes and in 10 clicks. So here's your call to action. For$39 plus state fees, they'll form your LLC, corporation, or nonprofit and launch your business in just minutes.

20:41visit northwestregisteredagent.com slash twist today that's northwestregisteredagent.com slash twist today social media seems to be another vector i get dms all the time from people trying to get me to send bitcoin or receive bitcoin whatever but then people create fake versions of you online and mirror your entire account and then try to get people and i get dms on my main account the verified account all the time saying hey um did you want me to send you those bitcoins and i'm like yeah i sent you three bitcoins and you're gonna send me 300 back right this seems to be something that's now becoming de rigueur but people are getting smarter to it right never send money so it also um makes kyc really difficult where you have online banking and people don't want to go into a branch and show their driver's license and have someone be like, so you end up with like, we're going to do a video check, right?

21:41Like hold your driver's license up. And all of that is all fakeable now. So never do that. Yeah. It's not that you should never do it. It's just, there's more vulnerability, the more connected. So two factor, strong passwords. If people just did that, how much of this problem would be solved if multi-factor and multi-factor helps a lot the problem that you're seeing is the companies that are going down the caesars and mgm stand multi-factor they compromise how do they oh wow octa people who don't know is like an authentication management platform it's got passwords in it it's got its own two-factor but they had if they got wow does it octa now have liability then?

22:30Possibly. Right. Like who knows? That's, that's a, a much. Wow. I don't think anyone's really been held liable for a security vulnerability in their product that resulted in somebody else getting that. Right. Like Microsoft and Apple would be the two largest defenders in the world. Talk to me about these infrastructures. I know that we had the colonial pipeline, if I'm remembering correctly. So explain what, because that's a different goal. That's not just money. Now, this is like serious espionage level, trying to damage another country. So how real is that? And how prepared are we for it? That's the interesting thing.

23:07It was financial. It wasn't espionage. And it was over the line of espionage, right? Like nobody's been willing to carry out an espionage style attack of that magnitude on U.S. soil, right? You end up with a proportional response. Take out our pipeline, we'll take out two of yours. Because it was a cybercrime group, they got away with it. There wasn't a proportional response. That wasn't government-sponsored. If you know, what happened in that situation and how did it go down? There were attackers that were in the network for some time. They ended up installing some new security software where they noticed that there were some irregularities.

23:48It tipped off the attackers that they were onto them and they encrypted all the machines. They didn't go into the actual pipeline computers, but they took all of the back-end office computers, essentially offline and then demanded a ransom to allow Colonial to regain control of their computers and turn everything back. And this was another one of these like payoffs with Bitcoin. I know the DOJ in this case somehow recovered some of those. They exfilled stuff to Amazon. And so they were able, they were bouncing through like an AWS best host. And so they were able to, you know, the FBI, the Secret Service, US marshals have relationships with those cloud providers.

24:37But the second that you get out of something like that, or, you know, frankly, they left stuff around, if they had just moved it all the way off, they wouldn't have been able to recover anything. Totally get when people steal the data, the releasing of the data or the selling of the data. That's a super attack vector. But when they encrypt a machine, why don't people have backups? Why are these things not duplicated or redundant in some way? While they encrypt the machine, they go and they encrypt the backups or they delete them. If you have the ability to write to a backup, yeah, they profile it.

25:16The interesting thing is lots of people have offline backups, DLT, tape drives, Iron Mountain, all that. the logistics of importing that backup data takes weeks. There's not enough bandwidth on your network to be like, let's restore every system at the same time. So they're so sophisticated that they know where the backups are. They encrypt them as well. At least the online ones that are redundant. They get the topography of the network. Boom. They just take all the way, all the way down to they corrupt the like host based snapshots. like windows has a service called the volume shadow service where you know if an update goes bad or something like that you can snap back they'll actually corrupt that out in every major piece of ransomware it's one of the the indicators that we actually use for for stopping ransomware is tampering with that backup service ah so if somebody starts effing with your backup service that's when you know somebody's in there doing something it's one of the signs yeah absolutely Tell me more about your software and solution.

26:24How do you implement it? And how does it stop people? Is this like a constant game of cat and mouse where you constantly have to update it like the virus software people do? I mean, the nice thing about it is that's where, you know, AI really comes in and gives some superpowers instead of, you know, thousands of people sitting writing, you know, regex signatures. you know we are using multiple different types of machine learning to build models that help identify both from a pre-execution before it runs as well as the behavior when something's actually running to say we think this is bad let's stop it but the best way to think about us is we're the first complementary layer to antivirus So for years, everyone said, you don't want to run two antiviruses on the same machine because they'll step on each other and conflict.

27:22So we were the first product where we said, let's build ourselves to be a layer behind, not try to replace the defenders, the crowd strikes that are out there. Right. And then just focus on the threat of ransomware. So instead of trying to stop everything that's out there, we focus on these 200, 300 ransomware groups. what are the tools that they're using what are the techniques and then we use that to build um you know kind of like a multi-layered protection strategy but where we really differentiate is we're the first endpoint product ever to be focused on recovery too where because these guys are so sophisticated they have so much resources they're going to figure out how to beat everything at some point but because they do encryption on the host we actually capture the the key material, the symmetric keys, the entropy, and we can reconstitute that data for the users without them having to interact with a ransomware group if everything fails and they get ransom.

28:26This is a key thing. They have to encrypt it in order to give you the keys to unencrypt it. So that step in the process was such a brilliant stroke for them. However, it doesn't take all that much technology to know a machine is doing something with encryption in real time on that server, right? Or on that desktop. I'm not sure. There's a lot of encryption that's going on on hosts nowadays too, right? So there's a delicate balance between profiling something that's backup software. I mean, we also focus on the data protection side, right? When they come and they steal that data before they encrypt.

29:06We have a network driver, so we'll actually detect that data actually going and block it. Their tactics, you said cat and mouse, I mean, it's completely appropriate. Their tactics change constantly. They're always looking for a way to deliver more impact quicker. This is now becoming, in terms of corporate governance, a board-level issue. Like when these things happen, I remember Uber had a big hack and then somebody didn't report it or they try because, you know, sometimes somebody is embarrassed by and they try to, you know, maybe resolve it before it escalates. This is getting very dangerous for companies and boards because they ultimately are responsible for knowing about these things.

29:47So what's this? What's the state of the affairs? It's getting dangerous for the CSEPs, right? So in that Uber case, the person that got prosecuted was the chief information security officer. It's the same thing with the SolarWinds hack. If you remember that, the SEC just filed charges against the chief information security officer there. So if a CISO, which is chief information security officer, people don't know, if a CISO doesn't do their duty to report hacks, that's criminal behavior now? Apparently, right? There isn't a lot of clear guidance on what's good and bad. The industry has taken up with this concept of bug men.

30:30It's where you as an individual can go out and find a vulnerability in Uber and then reach out to them and say, hey, Uber, I found this vulnerability. Here's my proof. Write me a check. What's the difference between that and somebody hacking you and asking for a ransom? Right? Like attitude? too um i guess it would be the threat of taking the system down and giving it to other people as opposed to politely asking can i get 10 grand for this yeah that's what i found i guess it would be the approach and also i guess being anonymous versus not being anonymous would be another i mean absolutely you can always ask politely first and if they don't agree escalate right but it's it gets confusing from a legal perspective yeah right where if you look at that uber case and what they prosecuted that CISO for, it seemed like something that was very common that's done in corporations across the country every day.