Jenn Gile 0:01

Hello, it is Thursday, October 1st. Um, after last week talking about the Shiny Hunters hack of the FBI, uh Paul and I, I think we're both um a little jazzed that some arrests were announced both uh with two groups, both Shiny Hunters and Killsack, right?

Paul McCarty 0:21

Indeed, indeed. The uh the forewarned arrests are starting to happen. So happy days.

Jenn Gile 0:30

Happy days. So to be clear, these are ransomware groups. We haven't seen these groups active in the software supply chain space, but um definitely shared tactics, similar technologies. So I think there's a lot to learn by looking at this. Um, the first thing to know is the shiny hunter's arrest is of somebody who uh is kind of purported to be the leader. Um it's a little unclear if they really are or not, but they're uh Dutch. They were arrested in the Netherlands. Uh they were actually recently released from prison after serving three years. Uh, you know, uh they're an allegedly reformed hacker, clearly not. Um, they were recently working at a security company. Um, so they have been charged. Um Paul, I see you have in the notes also for inciting two murders. I did not hear that. What's that?

Paul McCarty 1:29

All right, so this guy's name, I'm gonna murder, I'm gonna forgive the plum, I'm gonna murder his name, but it's um Pepin, it's a Dutch name, obviously P P I J N it's Pepin van der Stapp. Um, yeah, he's he's 24, I think, and he was arrested on the 15th of September. Um he's got a long history, so he's he's a known hacker, um, and he's been involved with shiny hunters and other groups you know before. He was arrested in 2023, was sent to prison for parts of three years, just got out. One of the press releases I saw said that it got out in December of 2025, the Owen said January of 2026, and this is very recent. Um, and he was on they call it probation, but in America we'd we'd call that parole, um, which are two different things. But anyhow, maybe the Netherlands it's different. But yeah, he is um all right. So, my I wouldn't call it inside baseball gen. I would say that in my research and and talking to some people that know more, he was effectively the leader of the Shiny Hunters group or whatever was the precursor for that for a while, and he owned all of the infrastructure for the group, and then he got arrested in 2023, went to prison. And anyhow, more recently, there's this kid, um, this Jordanian kid, Ray, who's kind of came over from the lapses that ridiculous lapses shiny hunters SLSH group, yeah. Right, amalgam. Yeah, and Ray is you know 16, so I'm not gonna say his name. Krebs is fully Doxton and um lives in Jordan and has taken over kind of and and he and um Umbreon. So um the Pepion's handle was Umbreon, he's been using it for years. Um, and um Ray and Umbreon were there's some sort of power struggle inside of Shiny Hunters basically over who who kind of called the shots and who owned the infrastructure. This is always a thing with these groups, whether it's ransomware or whether software supply chain, is like whoever owns the C2 infrastructure basically owns the ability to make money off of like the revenue generation side of it. So um that's super important. Yeah, so I guess these two are beefing, Ray and Jordan and Pepe and Umbrion in um in uh the Netherlands, and and Ray basically kind of outed or doxxed um Umbreon by using his uh logo, his so Umbreon is a Pokemon character, and there's yeah.

Jenn Gile 4:07

I mean, from what I saw, you know, order of timeline here, uh Umbreon was arrested, like you said, September 16th. The FBI hack happened after that, presumably by Ray, but he's trying to shift blame on to Umbreon. Lots of drama here, lots of drama.

Paul McCarty 4:27

And they somebody asked Ray, you know, is is Umbreon part of your group? And he said no. And I said, Well, if you look back at your history, it's clear he's part of your group. But anyway, I was just you know, 16-year-olds being 16-year-old. Um so uh Umbreon Pepion formerly worked for Hadrian um and then worked more recently for Neo in the Netherlands, um, is an offensive security researcher. I mean, not surprisingly. And I think we're gonna see more of this, unfortunately. We were teased this in Europe, that um, and other people have been kind of teasing this on Twitter and other places, that there's a number of arrests coming um, you know, around people that are actively in the the um uh security research space, one of whom you know, up until recently worked at um Huntress um you know, we've got an overlap here of young criminals and experienced researchers getting involved with them.

Jenn Gile 5:29

So looking at KillSec, uh, they're a ransomware group as well. Um, you know, similar MO will leak your data if you don't pay us. Uh, they're suspected of about a thousand attacks. Uh allegedly, maybe 500 of those were successful. They're kind of vague in the article, but are basically like, yeah, they've been financially um very successful attacks. Uh the article talks about uh how this particular group is um known to use AI to build and operate their infrastructure and identify potential victims. And if you look at the ages of the people arrested, that's not a huge surprise. Um so three arrests. One is a 16-year-old from Spain, the other two are in their 20s uh from the UK and Romania. There's a fourth person who was not arrested. Uh, sounds like probably the reason is he was a minor. Well, I assume he they were a minor at the time the crimes were done in the country where they live, they may be safe from prosecution because of that, not totally clear. But um yeah, similar story here, right?

Paul McCarty 6:39

Yeah, and the same thing is going on with the remnants of the team PCP crew, too, as well, right? And um with with box turtle exploiters, um, you know, somehow still on Twitter and talking. I wonder, I wonder why that could be. Could it be that they're under 18 and in their country? Uh basically safe. Yeah, could be bulkers.

Jenn Gile 7:05

You bring up a point that we're in a place in cybercrime where a lot of the threat actors are minors. They live places where they're safe from prosecution or safe to an extent. Um, you and I met someone recently who is a reformed threat actor who shared that they actually intentionally got caught while they were still a minor because they knew the uh repercussions would be light, and they were. And then that person went on to commit more crimes as an adult and ultimately, you know, did pay the price for it.

Paul McCarty 7:48

Yeah, it's important. I and I brought this up in our show notes because I'm seeing a pattern. Like we've talked about it before here, and I've talked about it on stage and other places we both have. That you know, AI agent agentic tools allow people to write stuff that they weren't able to write before, right? It brings us all a kind of a skill set that we didn't necessarily have before. Um, or even those of us that are software engineers like myself, you know, like anyhow, we all understand this like technological advance that we're all going through. What we have here is we have these very capable agentic tools and people under the age of 18 who don't really understand the consequences of their action. And there is no other place that this has better been you know advertised and seen than in Team PCP's Twitter post, their constant Twitter posting, right? Like they said, oh, we know the end is coming, but they didn't know the end is I mean, they in their head they thought they knew what the end was coming, but you don't know what prison is like until you've been arrested and stripped down and sent like they they have no idea what's coming to them. So they're operating in this kind of pretend worldview where you know there are no consequences. And and unfortunately, in some of these countries, including Australia, if you're under the age of 18, you cannot be arrested for some of these crimes, which is unfortunate. Now, I'm not saying that I want 16-year-olds to go to prison, don't say that at all. But we have a problem here where these tools are allowing people that are under the age of 18 to do real crimes. Let's be very clear. This malware that I'm seeing, just in the last week, I found two net new malware strains, and I've been because of the terrible OPSEC of the author, I've been able to track it all the way back to somebody who's under 18, which is why I'm not gonna emphasize the name and any of the details. But like, and the and the reason they have terrible offseck is because you know they feel like they're untouchable.

Jenn Gile 9:41

Yeah, well, I think it is that invincible uh attitude that a lot of kids get. You know, you and I have spent our fair share around uh kids as parents, and you know, they don't often understand the consequences.

Paul McCarty 9:57

Okay, let's I know I didn't get that 16. Sorry. I know I didn't worry.

Jenn Gile 10:03

Uh let's talk about a group that absolutely does know the consequences. Um, so also tangentially related to um malicious open source, uh, BitGet was hit in the last week. Um, so this is a crypto. Are they an exchange group? I'm actually not totally clear. Yeah, they're a crypto exchange. And um so the hackers are presumed to be North Korean. They stole $351.6 million of crypto after a back-end compromise. Uh, we've seen this before, right? This is not the first crypto exchange hit by North Korean hackers. It's certainly not the first um theft of crypto by North Korean hackers. Uh I don't know. What do you want to what do you want to say about this?

Paul McCarty 10:56

Well, I mean, you know, like you say, this is one in a long line of of large crypto heists. Um, I actually came across a really cool website. I forgot to send you the link last night, but it's called um crypto heist calendar, and basically what it does is it shows you month to month, and like it has a calendar on each day, it'll show like BitGet 351 million, and then a few days before that'll be another one. Um, so I'll make sure that I get that to you so we can put that in the show notes. But um I think what's interesting about this one is that um DPRK threat actors are getting a lot better at, I mean, just more technologically advanced and being able to do stuff to blockchain and to these ecosystems. And and it's just yet more evidence that DPRK is much more advanced than people you know in the enterprise giving credit to. Just because they don't do ransomware, enterprise security architect, doesn't mean they're not a threat, right? Because they're using this money. What do you think they're gonna use this 341 million, sorry, 351 million dollars agenda for? They're gonna use it to build nukes. It's that simple.

Jenn Gile 11:58

And probably put it back into their cybercrime programs, right? Um, there's a lot of assumptions about this country culture not having the capability to do this crime. I mean, we just see evidence after evidence that they certainly have the funding. And when you have the funding to do it, you can make it happen. Uh rewinding for a second, because we had a delayed comment come through. Uh Matt Fields over in our LinkedIn stream says uh evolution of script kitties. And yeah, for sure, back on the the ransomware thing, that's definitely what we're seeing. You know, it's uh interesting because I get asked a lot when I'm talking about um North Korean campaigns, you know, how much we're seeing in terms of indicators of AI usage. I just got it, you know, asked again a couple of days ago. And we just, I mean, certainly they're using AI, any serious developer. I don't know if anyone's gonna take uh offense to that, but honestly, everyone's using AI in their development now. Uh so of course they're using it, but it's the difference between uh enabling faster iteration and um infrastructure automation versus what we see with the ransomware groups is giving them the ability to do something that they would not have been able to do otherwise.

Paul McCarty 13:20

Yeah, and bring patterns, development patterns to you know neophyte um threat actors. Um a really good example is the fact that we've just seen this increase in binary-based open source malware. Who's my dad's calling me?

Jenn Gile 13:38

Um Well, I guess I would say like we've seen a history of um China, for example, being very good at finding vulnerabilities in legacy products and then exploiting them. I think what we're seeing with the North Korean hackers is, you know, in many cases they are finding vulnerabilities to get into these larger uh institutions. But I think a fair assumption is they're probably able to find vulnerabilities easier by using LLMs. I'm sure, you know, as we see the whole you know, CVE explosion, uh, would this BitGet compromise have been effective otherwise? Um, we don't have a lot of details on exactly what was compromised, though. From what you said, the the internet verse is saying it might have been a security tool that was compromised.

Paul McCarty 14:34

Well, it's more than that. It's it's official. Um, because basically BitGet hired a well-known um crypto uh incident response team called Slowmist. I think they're South Korean. Um and there's this whole ecosystem that a lot of people don't realize with like this whole like incident responder stuff. A lot of it is based in Southeastern Asia that you've got SEAL Alliance and you've got Slowmist and a bunch of others. But anyhow, Slowmist uh has already uh uh updated their first report, which is not long, it's only a few pages. But um basically what it says is that DPRK used a zero day in a yet un they haven't released the name of it, but it's in a security product. Um now I'm gonna say I have a little bit of inside baseball here, and I can, yeah, it's not official yet, so I don't want to like get myself sued, but like I I think what we're looking at here is I think we're looking at an exploit in one of these um kind of zero trust VPN tools. I'm not gonna say any names, but um I that's my understanding. Um, and we'll see when when eventually that that comes out. But basically, they found a zero data, they used that to exploit it. Um, and they they stole um crypto. It was it was in an unusual way in the sense that inside of the BitGet platform, when customers logged in, they still saw all of their assets in their account, but those assets had been drained, and so there was obviously you know some uh disconnect between what the customer was seeing and what was actually happening on the on the um, and it was only their hot and warm wallets, not cold wallets. So I'm like, okay, so those are the most important wallets, but anyhow, um uh more details to come, uh, but I suspect it was in one of these zero-tier kind of VPN replacement tools.

Jenn Gile 16:28

Okay, well, let's move on to uh a more close-to-home topic. You're seeing a really successful Mac campaign dropping. Um, we don't see a ton of uh OS targeting malware in our space. Often, not I will say not a ton, but like often the threat actors make an effort to make it multi-OS. So it's a little unique that it's Mac only, but as you and I have seen, uh most software developers are using Macs. So not a huge surprise that they might decide to invest specifically in Mac Mac Attack, Mac malware. So what do you see? MacTec.

Paul McCarty 17:09

Um good intro. Yeah, so um we've seen this kind of increase in Mac related clickfix, and our friends at JAMF are all over this. They're doing so much great research in this space. And in fact, I got um I got heads up on this latest evolution from them. Um, I also got okay to talk about it too as well, but um basically uh there's a bunch of Mac uh OS specific clickfix stuff, and then a new website came out, um, claude-desktop.com, and it's still up, still serving out a DMG. The DMG is about I think it's 210 megs is big.

Jenn Gile 17:44

Oh, that's interesting. After we talked about it a couple weeks ago, I looked at it and it was down.

Paul McCarty 17:48

So yeah, it's back, only it's back, it's back. Um, and they've changed the back end a little bit, but um, one of the reasons that we are particularly interested in in this stuff, um, because it's not typically soft supply chain and malware related, is that on the back end now most of the time it's being hosted on GitHub. Um, hey GitHub, you're becoming the world's biggest hosting provider for malware. Good job. Um, anyhow, um, and that's exactly what we saw. And the interesting thing now is we've seen overlap now behind. So basically, once you get behind the first stage, oftentimes now there'll be some overlap between some of the infrastructure and these click fix or um or this new evolution, which I'll talk about here in a second, and software supply chain stack stuff, like the second and third stage will start to overlap. Now, now here's what's interesting about this latest one, claude-desktop.com. It's serving out a DMG that is signed. This is an installer, it's not clickfix. This is an installer. It looks, and I think it actually is, if I'm not correct, it actually is the Claude installer, but with some extra things, a big padding uh extra bit that delivers the payload. Um, we'll have a write-up about it. Um, Jeff has done some some great work in this space, but um, I think that's an important thing. This is sign. So when you install it, your macOS is like, oh yeah, sure, no worries, go ahead and install it, right? Now I think since then Apple has killed this particular um uh partner. Um, so I think now if you try to install it, you will get an error. I haven't actually tried that today, but um, this is evidence of you know that the evolution, the constant evolution of this. The website is sexy, the DMG DMG looks great. If you don't know, the actual size of a real Claw DMG is about 50 megs. This one's four times the size. Um, we will have file hashes and all the information up on um OSN promptly.

Jenn Gile 19:42

Nice. Okay, uh a campaign I've been keeping an eye on this week that we talked about in brief last week is one that's hitting the Bailey's ecosystem. Uh, this is really different from what we usually see. So it's not, it doesn't include a rat or um info stealer or any of the like really concerning pieces of malware. What it does instead, there's hundreds of these packages out there. Um we're classifying them as malicious, but the actual risk to the user is low because what these packages are doing is they're being used to artificially inflate follower count for WhatsApp channels. So uh if I have a WhatsApp channel and I want to increase my followership, basically I can pay these threat actors. Unclear if the people paying for this know that it's being done in a sketchy way. Um, but then the threat actors are spewing out all these um copies of like an acceptable well-known Bailey's package and packages that have this little component in them.

Paul McCarty 21:02

Yeah. Yeah, and the vast majority of it, like you say, um, you know, it's just about inflating your follower account. But when you ingest those, um, what are they called? They call newsletters. When you ingest those new newsletters, it does lead to you know to other attacks too as well. So we've seen you know, C2, WhatsApp bases, C2 and uh other kind of attacks built on top of this. So we can't, while it at its heart, most of it, like you say, is you know malicious but not super impactful. Um, you know, if you are using, if if you're in this ecosystem, if you're if you need to talk to the WhatsApp API and you're using um the whiskey sockets and Bailey's libraries, you know, just be aware, because there's just a bazillion of these. Uh there is a bazillion of them. And the problem now, too, is that all the malicious detection tools are all like spun out, like, oh, we need to find all these Bailey's things. So now I'm seeing legitimate Bailey's libraries that people just Forking their own and adding it are now getting labeled as malicious when in fact they're not. Um, so you know, the vast majority of them, just to be clear, are malicious. So I'm not saying this is a huge problem, but um uh yeah, and aux came out with a really good article um talking about yeah, they did a nice job. They found like a hundred, I think.

Jenn Gile 22:20

I think so, yeah.

Paul McCarty 22:22

Yeah, Machin and his his team do a great job over Ox. Um I wish they would reboot the um the Oscar um matrix. But anyhow, um uh those guys do a great job.

Jenn Gile 22:33

Yeah. Okay, last topic, unless we get any questions coming in, is some uh DPRK research I did last week into this week. So I started noticing maybe two weeks ago um that the fake font trick they've been using for all of this year, back into last year, uh, that they had started changing the file name. So for the longest time, it's been fa-solid dash 400.wof two. Um, pretty much every example of this that we saw was pointing at that particular file. So this is the task uh auto-run attack vector where it auto-runs that file. That file is not actually a font, it contains obfuscated JavaScript that delivers some lovely malware to your machine. So, what I've been uh noticing is they changed it from 400 to either 500 or more recently, I started seeing 900. And I was like, well, that's an interesting choice. Clearly, they know that people are looking for it by file name and decided if we change it by a digit, they won't catch it anymore, which is true. You gotta hand it up. That's a stupid but smart way to get around uh a common detection that we're you know seeing people use.

Paul McCarty 23:59

Well, in Jen and I see this all the time because we're gonna get when we do these searches, and basically, you know, initially all we saw was just like the malicious versions, and then really quickly we saw all these people writing detections like their detection engineering. But here's a shout-out to y'all that are making your detection engineering. If you use very specific static search mechanisms, right? Like um solid-solid dash 400 dot wof2. If you only look for that file and DPRK or the threat actor changes that, you're gonna miss that. That's what Jen was saying here, right? Um, and that's exactly what they've done because you can see when you go to the public get a little bit of a well, it's not just that, so there's more, right?

Jenn Gile 24:38

Yeah, yeah, yeah. Yeah, so they're changing the name of the file. The second variation that I found, or you found, I think, late last week was um they're changing the location of the file. So it used to be, and probably still to some extent, the malware when it was, you know, force pushing into these repos, uh, you know, the tasks file in VS Code gets pushed up. And then the second thing is a top-level folder that's public slash fonts, and that's where all the fake fonts live. So very, very easy to like the second you look at your top levels in GitHub, you're like, oh, where did that come from? So what have they done? They uh have figured out how to plant that folder deep within a legit folder. So I've seen lots of different examples of this. Um, they're not creating a folder from scratch, they're taking something that's already in the repo. So if you're again looking uh, you know, visually at the top level, or I would assume, you know, running some kind of a top level, does this have public fonts at the top? Uh, this also is meant to bust detections, right?

Paul McCarty 25:46

That's exactly right. Yeah, it's in four. Um yeah, they also are, and by the way, you know, I originally wrote the first blog post about this back in like November of last year when I when I hit the tasks jacker um campaign. So this is even before Pollenwriter. Um, and some of those original things, so between November and like March, there's like, I don't know, four or five different sub-variants of those. Some of those sub-variants haven't have been totally, you know, not used over the last four or five months. Well, they're coming back. A really good example is that for a while there they're using fake dictionary files.dictionary. I've seen a couple of those, yeah. Yeah.

Jenn Gile 26:27

So the other one that I found just on Monday, I was like typing up my social post to share this research. And my agent was like, Hey, do you want to include this thing where there's like now a dot LLF file variation? And I was like, wait, what? Do I tell me more? Because it was keeping an eye on the repo that I was researching. And sure enough, in the time between when I had published a blog on Friday night to uh Monday morning, you know, writing the social, uh the repo had been force push overwritten again so that they um changed the file type. And so what you should know is a.lf is not a font file. It's this super obscure file type. Uh you know, some extent might be used in gaming. There's a couple other use cases, but literally has nothing to do with fonts. So uh again, they're keeping the front of the file name basically the same. So fa solid dash fill in a number. The one that I saw was 300, but instead of dot walk2, it was uh llf. Um really smart way to evade detection. Uh when we looked for it on Monday, I think you said there were over a hundred versions already on GitHub, right?

Paul McCarty 27:47

Yeah, it's it's um I just found 120. Now GitHub's search API, as many of you might know, is terrible at giving you actual numbers. So I'm seeing 127 of these using the LLF file format and suffix. I would suspect the number is much higher than that.

Jenn Gile 28:03

So yeah, and especially like keep in mind that's just searching public repos, that's not searching private. So we can make an assumption on all these numbers, but you said you did some updates to our detections, found another 8,000 or so compromised repositories. We have over 10,000 in the database right now, which puts us pushing 20,000, which is crazy.

Paul McCarty 28:31

Yeah, well, there's gonna be some sorry, there should be that should have been more explicit.

Jenn Gile 28:36

There, the those 8,000 new ones, there's gonna be significant overlap between those and ah, you're right, because they would be potential reinfection or continuing, regardless, it's a lot.

Paul McCarty 28:46

Just this often just the same file. So literally, it's just the same repo. So we've already found, but part of that because we're getting so many of these now, and because the API is so slow and rate limits you so quickly, it basically makes the whole hunt really by like after after I become a millionaire from a multimillionaire from OSM, the first thing I'm gonna do is I'm gonna go and build a replacement for GitHub that has a proper search API. I'm like, I if I I I would die happy, Jen, knowing that people can search their SCM provider and be able to find all the examples of things, right? But anyhow, um, hey, this is a good segue to talk about Canva B science. I'm going off script here, but I don't care.

Jenn Gile 29:27

Oh, go for it. We've got time.

Paul McCarty 29:30

Cool. If you took my class on Saturday, which was all day, by the way, this was a long training. Um, it was all like detection engineering stuff in GitHub. We specifically talked about you know these static uh detection signatures, things like that path that Jen was talking about, public slash fonts, and then looking for those files. But then also ways to use wildcarding and some of the things that the search API does give you in GitHub, but also other techniques to find these things in a more in a broader kind of way, which means that you have to like slice by file name and because there's like a a thousand character limit, or sorry, a thousand search limit, and then there's a four thousand search limit depending on what you're doing, all this other stupid stuff. But anyhow, we talked about that in my at length in my training. And I'm wearing, I honestly think this is one of the dopest shirts. Like this is one of the best. Kylie and and Sylvia did a great job with this year's. I mean, the whole conference was great, but like the swag this year was just um next level. We're we're big Tron fans here in my family, and um and the Minimis got some swag this year, so they're they're happy.

Jenn Gile 30:35

Yeah, you got some.

Paul McCarty 30:38

Yeah, and Matt who just came in, Matt was in my class and said so. Shout out to Matt.

Jenn Gile 30:44

Yeah, well, um, I think the thing to end on is a heads up to the community. We are hiring, we're really excited about this. Uh, we're looking to bring on a part-time malware researcher. So if you are uh looking for some part-time work at this point, or if you know someone who's got software supply chain malware experience who might want to do a little work in this space, um head on over to our LinkedIn. We've posted about it. Don't contact us directly, please. We get lots of crazy DMs. Uh, no recruiters also, please. Um, but we would love to hire someone from the OSM community. That would be exciting.

Paul McCarty 31:21

Yeah, yeah, we'd love to, yeah, what you said. I would love to see that would love to see that. Um we got we got the best swag in the biz.

Jenn Gile 31:31

All right. On that note, let's wrap.

Paul McCarty 31:34

Thanks everyone for listening. Really appreciate it. See ya.