Video: A Hacker’s View of the Cyberthreat Landscape in 2024 – PPOV Bonus Episode Part 1

hey Channel insiders I'm your host Katie boso and Welcome to our first ever bonus episode in these episodes I interview industry experts Who weigh in on what's impacting the it Channel and this time I'm speaking with Cody cretsinger principal security adviser at Galactic advisors and former LC hacker Cody's experience on both sides of the cyber security equation make him the perfect source of knowledge about this year's threat landscape who's at risk who's behind the attacks and how Channel providers can and should prepare for a challenging 2024 welcome Cody it's great to see you yeah I am so incredibly happy to be here Katie I like I I've been looking forward to this for for a long time I'll just put it that way since I reached out on LinkedIn and I was like hey do you want to do a thing and I was immediately like yeah let's do the thing because I'm like all for this Cody you are somebody where I like talk about that I know you like I know you know George Clooney you really blow my mind with just your career your background and everything you bring to the table would you mind talking to us a little bit about yourself my background essentially started in cyber security I went to school for cyber security got involved with a um a little activism group for a short period of time and then face the Reaper cussions and then turned all of the bad things that I've done in my past into good and provide uh a really interesting unique opportunity to be able to educate um not only uh clients like former clients like businesses but also be able to help uh inform msps on kind of best security practices one of my crowning achievements was uh uh building a sock from nothing into a full 24x7x365 organization that provided a lot lot of really awesome things and I've taken those experiences and I'm giving back to the community as much as I possibly can to better help and better protect and better secure people uh going forward do you mind if we talk a little bit about the uh the the elephant in the room the elephant in the room yeah so I I was one of the hackers in in LC uh in fact um Sabu the kind of the ring leader of that organization recruited me when I was in college I recruited one of my uh fellow dorm mates in college uh and we were responsible for a number of uh different hacks the the one uh specifically that I was responsible for was the Sony Pictures hack that's not the one you're thinking about with the movie and all of that stuff it's not that one it was before that um before that all happened in fact before it was cool to hack Sony you were doing it when everybody hated Sony we hacked them is essentially what happened um no but we just gave Spider-Man to Marvel were like enough we're not standing I'm kidding but that's not what happened world yeah yeah so we we broke into a uh a Ghostbusters website downloaded a lot a lot of database via SQL injection and then created a torrent distributed all that information obviously got caught by the FBI they knocked in my dorm room door at 5:00 in the morning uh and suffered said consequences which included uh you know a federal felony as well as some probation in jail time I have Googled you uh and I really think that the real crime is the courtroom drawing of you that I've seen because it is it looks nothing like you at all I actually have the original of that courtroom drawing and when when I reached out to the individual who drew it years and years and years later she's a sweetheart by the way she does good work I promise maybe I'm saying it's bad it's just I don't know who this person is yeah I'm I'm both 20 and 9 in this drawing at the same time uh but I did reach out to her and and purchased it but one of the questions I had for her was how often do people buy your courtroom drawings and she goes well you know judges and the prosecution and some lawyers do it all the time I said well wouldn't the last time anybody that has been prosecuted bought it and she went I've never had that happen I said all right this is the first can you talk to us about what you do right now uh your your day job yeah so the the biggest component of what I do on a day-to-day basis there's really two components the first one is taking adversarial tactics techniques and procedures and automating them in some particular way that's one component of what I do the other component of what I do uh is security research and then also creating content so that msps can understand the security side of things if that's something that they want to learn more about very cool and here we are uh I'd really like to talk to you a bit about what we're seeing across the cyber security landscape this year in 2024 and at the time of we're recording this it's very early February and there's already been a lot of uh contentious events happening in the technology space NBC is saying that there's been 24 hacks on Health Care Systems ransomware attacks specifically on Health Care Systems in this calendar year alone we're also seeing the Vault typhoon Chinese government linked hacker group out there really causing a lot of issues especially on the federal government side where we're seeing them need to disrupt from them attacking infrastructure of Wastewater facilities of communications facilities we're also seeing some more smaller companies that are not Hospital systems that are not giant infrastructure systems within the us being attacked including any desk uh where that's not connected to volt typhoon at least not at this time we don't know uh we're still learning more as this has just come out within the last week but we are seeing that this these uh remote software companies are still being targeted is it fair to say we're seeing a lot more even if we're just talking about the hospital systems and the healthare systems are there more brutal attacks ransomware attacks malware attacks happening on these facilities I wouldn't say that there's more I think there's probably more light being shed on it although there are some threat groups that are actually basically taking the Kid Glove gloves off uh and going after Healthcare facilities and that might sound weird so let me back up for a moment the at the end of last year in December the FBI tried to take down uh a very specific uh threat group that is notorious for ransomware uh they're a ransomware group and in fact they even sell access to their ransomware so that way other individuals can deploy it in networks that they have access to uh and get a cut of the pie of the The Ransom uh the FBI attempted to take them down and unfortunately what the FBI didn't do and this is this is okay it's part of the investigation process uh it can be very difficult sometime to identify all the assets that are involved but what they didn't do was understand the true scope of how large the infrastructure that supports this ransomware group uh really was and what I mean by that is they took down a couple of Key Systems but the bad guys were able to take control back in some circumstances and really what it did was actually anger them which is really unfortunate so the threat actors these this ransomware group has now taken any kind of restrictions off of uh what can be Ransom where they did have some ground rules before they they said previously you couldn't ransomware you know critical infrastructure or Health Care Facilities also like a gentleman's agreement almost yeah kind of like the high seas agreement with piracy they wouldn't go after some certain boats but they would others or maybe I'm glad can make that relation in 2024 to what was going on in the 1800s of the golden age of piracy but the problem is the retaliatory kind of aspect of this is now there's no limit to what uh the The Ransom word uh can be deployed on the rules have been removed now we're starting to see health care hospitals some of those usually not targeted type uh environments they're actually being targeted and I feel like we're probably to see more of that in 2024 for sure so the bear has been poked essentially yeah in fact I would I would even go a little bit further it's it's we've taunted the bear for quite some time and now we've poked it and now they're really really angry I I expect this ransomware group and probably several others frankly um probably to take the kid gloves off uh a little bit more and and make it a a fairly painful 2024 and just so I can really make sure that I'm I'm giving examples in real time of what we're looking at we've officially crossed into the second week of the largest Children's Hospital in Chicago the Lorry Children's Hospital is in its second week of dealing with this ransomware attack and their operations have been minimized drastically they're still trying to do as much as they can because surgeries and and Healthcare have to go on um but you're seeing a lot of families who are struggling with kids who are suffering from terrible diseases and Cancers who cannot get the full treatments that they need so these are real people being affected by what's happening because of this ransomware attack which is what it is and I want to double click on something that you said Cody about you said kid gloves but you've also like referred to these these hackers who who are they in my mind I'm I'm thinking of volt typhoon right a a hacker group that is yeah a hacker group that is connected to the Chinese government um and this is all information that we've been told from our federal government from the cisa and the FBI but as far as where we're seeing some of these large scale operations are they as big as Vol typhoon that's actually a really good question so in the case of the ransomware group it's they're specifically Eastern European um and they are um specifically uh anywhere between 18 to maybe 25ish years old or so um they're typically just kids or young adults that are good at computers but they're also uh cyber criminals um however there are other threat groups that outside of like volt typhoon which is really um uh you know a nation sponsored uh threat group so it's it's going to run the gamut but there are others like scattered spider for example uh and this is a group of what we know is essentially 15 to 18 year olds uh which is incredibly scary uh given some of the capabilities uh that they demonstrated last year the MGM hack is directly attributed to scattered spider um who again uh is a group of 15 to 18y olds and there is some talk on the streets that they may have actually been behind another casino cyber security event at Caesar's properties and this is just one threat group why I mean how are they operating is this something where we're seeing it where they all meet at one place at one time and they're able to go uh on all these computers I'm thinking of the very Getty Images sort of image in my head of what a hacker would look like if you Google that um how are they communicating how are they operating do you know yeah it's actually uh it's actually very interesting so they have a recruitment Channel that's actually done via um like games so they'll they'll play Minecraft or Call of Duty or any of these things uh and they kind of indoctrinate new younger uh individuals to join this Discord server where they kind of figure out whether or not they would be interested in maybe participating in some of the cyber crime and then once they do that uh they then transition into kind of a more private chat and then after that they have uh telegram channels where they can communicate uh via encrypted methods so um they have an entire recruitment process as well as kind of like a a way to to become a member so scattered spider has a a tendency um to to not only do digital cyber attacks but also phys IAL in person attacks as well there are specific cases where they've actually assaulted individuals in order to get passwords or other kind of sensitive information that they then can leverage in a uh cyber crime attack there's not too many threat actors outside of like nation states that are willing to go quite that far the flip side of that is most people considered scattered spider as this kind of nebulous group of people that are spread out all across the world and whatnot by and large it's 15 to 18 year olds in the United States so uh we're actually kind of aware of who they are um and it's just kind of a matter of time before uh the FBI and probably the Secret Service uh get to them at some point Cody as as an elder in this space yourself oh no what would you say to them as far as the access that they have to being the white hat hacker rather than the black hat hacker well the first component here is to just stop doing crime um that's just it's only going to make it worse right uh the the next component is and this is for this is essentially for everybody else that's looking into cyber security I'll I'll get back to your question in just a moment there are ways to become a cybercity professional that don't include um cyber crime or hacking into an organization and proving yourself now um I was on kind of that tail end of um of of folks that could kind of get away with that and to be fair it has created a lot of a lot of um Stress and Anxiety or in my life right in terms of being able to be employed even that because that was a struggle as as soon as I reentered the the job Force because I to proed to everyone that I was doing it for good and clearly now I've got the credentials to do so now however when young individuals commit a cyber crime there's essentially destined to never work in the industry ever again the kids that have committed these crimes are going to have a very big uphill battle um going forward um and had they just used something like hack this site or hack this box or or any of the other online tools in order to test their chops to hone their skills uh they would have been able to get into the cyber security field and really do something interesting um because red teaming or or penetration testing is a awesome challenging rewarding job and as a recovering red teamer uh I can tell you right now uh it is it is super super awesome sometimes it's the most complex puzzle you'll ever ever encounter and there's just no way of knowing if you're going to be able to solve it uh which is both awesome and Dreadful at the same time um but where I'm headed with all of this is that if you can't do it legit then you're not going to be able to do it legit uh and you really have to you have to make sure you're not breaking any laws because there's there's there's not going to be much forgiveness in terms of of of doing it so really it's it's a matter of if you want to be part of the cyber security Community you've got to do it the legitimate way now because there is a legitimate way to get into the the field uh uh unlike what there was previously and I do want to make sure that we draw a difference between what um something like scattered spider is compared to Vault typhoon uh they're a nation state hacker group we're looking at them um having political reasons driving their intentions that's uh a big one that you're going to hear a lot in the channel because we are seeing a lot of Vault typhoon vulnerabilities related to some of the networking uh technology that comes from a lot of vendors in the channel and it's not that they've been designed with flaws or vulnerabilities it's that somebody out there has figured out how to exploit that um in this case full typhoon so I mean Cody what do what do the channel providers who are supplying and using um some of these foret or Cisco based Technologies networking uh appliances what do they need to be concerned about with this information out there right now yeah when it comes to volt typhoon there's a lot to unpack with volt typhoon so I'll I'll stick to specifically the network appliances because I think there's a much larger discussion you and I can have just in general about some of the um some of the tactics and procedures that these guys have but I think what it does is it highlights the incredible importance on any of these Network appliances or anything that's running firmware software at all the necessity in order to keep things updated uh just as we're recording this last night there is a critical foret SSL vulnerability that allows bad guys to to remotely execute code and that's a big fancy way of basically saying gain access to a system right that's that's that's all it really boils down to and that's just last night that that dropped um and foret not alone you can look at all of the other vendors that are out there and point to a significant vulnerability that has been discovered um within the last year they're all impacted uh and they're going to continue to be and the reason why is traditionally firewall like that is the first and last point of kind of security in an organization which is the reason why most bad guys are targeting these and why they're so important right so if that is the system boundary or the network boundary and the first thing that they come across if they can exploit that and work their way deeper into the network of course that's where they're going to focus a lot of their time and energy in and in fact security researchers are doing the same thing and so are other bad guys they're constantly hammering away at these systems because it allows them that first step into a network that really highlights the need for the adoption of uh kind of the zero trust Network that everybody has been talking about at least in on on some different varying levels right because the Reliance on that Appliance to do all of the work to totally protect the organization is now distributed amongst every asset within an organization every endpoint every Network device every I iot device as long as they're all following zero trust it makes it incredibly more difficult for the bad guys to compromise the entire organization when it's just one device and it's limited in whatever scope it can possibly you know have access to I hope you enjoyed part one of our first bonus episode but stay tuned for part two with Cody coming to you on Tuesday and check out channel insider.com for more Channel Insider partner POV episodes and never miss an episode by subscribing to our YouTube channel @ Channel Insider newws and Trends as well as our podcast on your preferred podcast platform I'm Katie boso thanks so much for watching and I'll see you next time

This transcript was generated automatically from the video's captions and may contain errors.