Loading summary
Transcript83 lines
- [00:03]
Dena Temple Reston
From Recorded Future News and PRX, this is click here. For over 35 years, Paul Abbott worked at a logistics company in the UK with a name that was almost aggressively British. Knights of Old. Yes, Knights, as in the guys in armor jousting and maybe storming a castle. The company oversaw a fleet of hundreds of trucks crisscrossing the countryside.
- [00:46]
Paul Abbott
General cargo handling, warehousing and transportation across the UK and Europe and also international freight forwarding services across the globe. We were a one stop shop.
- [00:59]
Dena Temple Reston
Paul started out as a transportation planner and then worked his way up to part owner. Is Knights of Old like a company that people in the UK just know?
- [01:10]
Paul Abbott
Oh, yes, yeah, I've been around it. Got a very good reputation for many, many years.
- [01:17]
Dena Temple Reston
Many, many years is a bit of an understatement, actually. Knights of Old opened its doors in 1865. So in the early days they weren't transporting goods by truck. They were using the technology of the time, a horse and buggy. And they literally trotted through decades of change, from the introduction of electricity to the telephone. Its trucks rumbled under the night sky as the first men landed on the moon. That's one small step for man. And through it all, they always found a way to adapt and change, whether it was working with this new thing called the World Wide Web or dealing with the complexities of Brexit. And for more than a century and a half, Knights of Old delivered everything from books to food to farming supplies, providing thousands of jobs and countless on time arrivals. And then two years ago, after surviving two world wars and a Great Depression, Knights of Old found itself battling something it had never faced before. And it brought the company to its knees. I'm Dena Temple Reston and this is Click Here, A podcast about all things cyber and intelligence. We tell true stories about the people making and breaking our digital world. And today, what happened when Knights of Old did battle with a new kind of menace, One sitting behind a keyboard half a world away.
- [03:05]
Paul Abbott
I was in the operations office and the tech guy came through and said, look, I think we've got a problem. They identified a file that they didn't recognize. They opened it and there it was, the ransom note.
- [03:19]
Dena Temple Reston
And we look at how after decades of planning for every possible contingency, Knights of Old still couldn't stop what came next. Stay with us. When was the last time you said, hmm, I never thought about it that way? The current aims to give you that moment every single day. Hello, I'm Matt Galloway and our award winning team brings you and conversations to expand your Worldview. Sometimes they connect to the news of the day, sometimes to the issues of our time. And you'll hear all kinds of people on the current, from best selling authors to maybe your neighbor. Find us wherever you get your podcasts now, including YouTube. I'll talk to you soon from Recorded Future News. This is Click here. The beginning of the end was a day like almost any other. It was June 2023. And when Paul came into the office that morning and heard the computers were down, he didn't think much of it.
- [04:28]
Paul Abbott
I saw an email that comes from our nighttime operations guy and he flagged on there that there was problems with the computer systems.
- [04:35]
Dena Temple Reston
Do you think it was just like a software snafu?
- [04:38]
Paul Abbott
Yeah. The characteristics of what had gone wrong didn't look particularly out of character.
- [04:45]
Dena Temple Reston
So Paul and the team just decided to go old school. While it got fixed, they were texting drivers, writing out tickets by hand and manually processing orders.
- [04:55]
Paul Abbott
Keep cargo moving. But we did it.
- [05:00]
Dena Temple Reston
The hours ticked by and still no one could get online.
- [05:05]
Paul Abbott
The morning went on and we it was evident that, you know, the problem.
- [05:08]
Dena Temple Reston
Was stretching until finally Paul Abbott's tech guy pulled him aside shortly after lunch and broke the bad news. He said it's a ransomware attack. And he showed him the hacker's message.
- [05:21]
Paul Abbott
It said, you need to tell your insurance company to contact us and we'll negotiate a way where we can get back information to you so that you can carry on with your business.
- [05:36]
Dena Temple Reston
Hi, friends. If you're reading this, it means the internal infrastructure of your company is fully or partially dead. This is an AI voice. Reading the ransomware note, all your backups, virtual, physical, everything that we manage to reach are completely removed. Keep in mind that the faster you still get in touch, the less damage we cause. Paul's mind started racing.
- [06:05]
Paul Abbott
I felt a bit cold, really. It's a bit of a sobering moment. You think, oh my God, right, okay, so, okay, they're going to want a load of money. We didn't know how much money they were going to want. We didn't know.
- [06:18]
Dena Temple Reston
This whole thing came as a huge shock for all the obvious reasons. Not just that vital data had been stolen, but also because the company had been really focused on preventing something like this from happening in the first place. In many ways, knights of old were model tech citizens. They focused as much on securing their tech systems as the physical cargo they moved.
- [06:41]
Paul Abbott
You've got to have the same focus on protecting your data and your infrastructures because somebody's going to break in, not to steal goods they're going to steal your data.
- [06:52]
Dena Temple Reston
So to guard against that, they'd invested heavily in all kinds of cybersecurity in.
- [06:58]
Paul Abbott
Terms of training, in terms of protocol, in terms of password management. As simple as they were, you know, sharing PCs and desktops, we just didn't do it.
- [07:09]
Dena Temple Reston
They had cyber insurance, government certificates for their data protection practices. But even with all of that, here they were standing in a conference room reading a note from a ransomware gang. And it didn't take long for Paul Abbott and his team to decide that this wasn't something that they could handle on their own. So they turned to a different Paul.
- [07:38]
Paul Cashmore
My name is Paul Cashmore. I'm the now CEO of Solace Global Cyber. We provide first response services for people that have had ransomware type incidents. We are waiting for that type of phone call, so we're very much on standby.
- [07:54]
Dena Temple Reston
Okay, so you have, you kind of have go bags and someone says, okay, we've got something and you guys load up a bunch of vans and drive up.
- [08:01]
Paul Cashmore
Is that idea more Mercedes than, than vans?
- [08:07]
Dena Temple Reston
Okay.
- [08:11]
Paul Abbott
There was four or five tech guys that rocked up at the door. We were very pleased to see them.
- [08:17]
Paul Cashmore
Most of the execs are already there cuz they're, you know, fully understanding of how serious the event is.
- [08:22]
Paul Abbott
I joined them in what we called the war room at that time.
- [08:26]
Dena Temple Reston
Paul Abbott showed Cashmore the note and laid out what little they knew. And then the Ghostbusters meet first responder team got to work surveying the systems, trying to understand just how deeply the Akira hackers had burrowed into the company networks. They were on the hunt to determine what the group had stolen and what they had encrypted. A few days later, they returned to the war room and told Paul the extent of the damage. Kashmore explained that the hackers broke in using something called a brute force attack. They used a software program that basically cycles through a bunch of potential passwords until it finds one that works. And once it did, it gave Akira a toehold inside the company's network. In this case, they cracked one employee's password and then used that to get into the knights of old network.
- [09:19]
Paul Cashmore
More generally, once those threat actors have a foothold, they're then going to try and set up multiple backdoors, work their way through your system. They're looking for your backups, they're going to destroy them, they're going to evade your antivirus, they're going to look for your sensitive data and they're going to what's called exfiltrate. That data.
- [09:41]
Dena Temple Reston
He means take the data. And they took it. And then they went one devastating step further. Kashmore explained Paul Abbott.
- [09:50]
Paul Cashmore
It was what we call a data store attack. This is where they are encrypting at speed all of those virtual servers at a virtual server level.
- [10:01]
Dena Temple Reston
Virtual servers often host critical applications or databases or websites. So for hackers, they're kind of a holy grail. Lots of high value data is all in one place. And the Akira hackers got into those and then took data for themselves and likely stored it on their own servers and then encrypted the company servers.
- [10:23]
Paul Cashmore
So it was devastating for them because they had a all of their data encrypted. Every server that they had was completely destroyed.
- [10:32]
Dena Temple Reston
And to wreak that havoc only took the hackers minutes. It was a gut punch for knights of old. After all that work to protect their systems, the hackers got in anyway. Now that it was clear that all their data was truly gone, Paul Abbott was left with one big question.
- [10:52]
Paul Abbott
Do we look to pay the ransom? Do we try and raise the funds to pay a ransom?
- [10:58]
Dena Temple Reston
That's when we come back. You come to the New Yorker Radio Hour for conversations that go deeper with people you really want to hear from, whether it's Bruce Springsteen or Questlove or Olivia Rodrigo, Liz Cheney or the godfather of artificial intelligence, Geoffrey Hinton, or some of my extraordinarily well informed colleagues at the New Yorker. So join us every week on the New Yorker Radio Hour wherever you listen to podcasts.
- [11:47]
Carrie Schaefer Page
I feel like every year now that we hit 2025, like, people are always like, you know, what's going to be the hottest thing on the scene, right? What are we going to see from cyber? And I mean, for years now, ransomware is top of list, right?
- [12:01]
Dena Temple Reston
This is Carrie Schaefer Page. She manages a team of ransomware negotiators at an American cybersecurity company called Arctic Wolf.
- [12:10]
Carrie Schaefer Page
These groups are coming in, Akira being one of them. And like, I feel like it's like the Amazon of the dark web, right? These threat actor groups are learning from each other.
- [12:21]
Dena Temple Reston
There's actually a name for it when all these threat actor groups band together. It's called ransomware as a service. And Akira is a relative newcomer to this world. Kerry says it even has an mo. It targets companies that haven't gone the extra mile to secure their systems. Ones that, for example, don't have multi factor authentication or have employees with passwords.
- [12:44]
Carrie Schaefer Page
Like 1234, I think too, because, you know, the other thing that Kira is Known for is vulnerabilities. Right? So, yeah, you can get in from weak passwords, but the other thing they do is to take advantage of unpatched networks.
- [12:59]
Dena Temple Reston
A tech company finds a vulnerability in their product and sends out a patch. But if companies are slow to apply the patch, groups like Akira take advantage.
- [13:08]
Carrie Schaefer Page
This really open season for a threat actor to aggressively start to attack folks.
- [13:13]
Dena Temple Reston
She says Akira has been able to be effective because they're always iterating, borrowing, and learning from other hacker groups, leaving one gang, starting another.
- [13:23]
Carrie Schaefer Page
No different than any other kind of employer. If you become disgruntled with who you're working with, you may adopt some of their behaviors or attributes and then go splinter off and do something on your own. Right. It happens all the time.
- [13:39]
Dena Temple Reston
Right.
- [13:39]
Carrie Schaefer Page
These groups come together, work with one another.
- [13:43]
Dena Temple Reston
Origin stories for hacker groups are always a bit sketchy. In the case of Akira, some analysts say they're based in Russia. Others say the group just speaks Russian and is based somewhere else.
- [13:54]
Carrie Schaefer Page
When you get these different groups coming together, they can be from different areas. It's the ttp. If you've heard that tactics, techniques, and procedures. Right. That these groups kind of use from each other. So what we saw with Akira, for.
- [14:11]
Dena Temple Reston
Example, Carrie says that lots of Akira's malicious code looks really familiar. It looks like a version of code that a group called Conti used for its attacks a few years ago.
- [14:21]
Carrie Schaefer Page
There was also similarities in the way that they processed the crypto wallets. So when they extort somebody and then you get the payment from them, the addressing and the sequencing, there were similarities that were detected.
- [14:38]
Dena Temple Reston
We talked about Conti in previous episodes. They were one of the most notorious ransomware gangs in the world, a kind of boogeyman of cyberspace, taking down hospitals, governments, you name it, and then holding the critical data hostage for millions of dollars. Shortly after Russia invaded Ukraine, a bunch of their emails and chats leaked, and that set off a lot of infighting. And all the hackers that were working with them started looking for a new home. Kerry says some of them may have landed at Akira. And there's this other thing about the group. While they promise to give their victims back their data if they pay a ransom, they don't always do that.
- [15:18]
Carrie Schaefer Page
So unfortunately, if a victim chooses to pay, they're like, great, but guess what? We also took a copy of it. And now if you want us not to release that out into the, you know, the ether and the dark web, we're going to require another financial payment for you to do that.
- [15:34]
Dena Temple Reston
Ransomware negotiators explained this to the people at Knights of Old. They told them they might have to cough up anywhere between two and a half to $5 million, which is a lot for a company their size, even in the best of times. And this was not the best of times.
- [15:50]
Paul Abbott
Even before the hack, we'd just opened up a new warehouse, so our cash reserves were at probably the lowest point in the year.
- [15:59]
Dena Temple Reston
Paul Abbott was also warned that even if they did manage to scrape together the money and Akira sent their data back, it might not come in a very useful way.
- [16:09]
Paul Abbott
It might not be in the order that you need it. It might just be a bucket of numbers. You know, it's corrupted the information that you probably can't work with.
- [16:20]
Dena Temple Reston
This is the gamble every company attacked with ransomware faces. It's like a game of chicken with your entire company on the line. For Paul Abbott and his team, knowing they could pay all that money that they barely even had and maybe not even get their data back, it wasn't worth the gamble. They decided not to pay to just not respond to Akira and let the clock run out. They turned back to the business of getting back to business, trying to put Akira in their rearview mirror, only to learn that the group had left with a parting shot. The hackers released the company's stolen information on the Dark Web.
- [17:00]
Paul Abbott
There was an advert that appeared on the Dark Web, we understand, that said, oh, we've got this data from Knights of Old Group we're going to be releasing in the next few days. So it's sort of to whet the appetite of the malicious, you know, buyers or acquirers of this data.
- [17:17]
Dena Temple Reston
It turned out Akira had leaked all kinds of sensitive data, internal documents that included things like employee payroll files, invoices and other financial information.
- [17:28]
Paul Abbott
We were told by the loss adjuster that the biggest risk you've got is data, personal data, and mainly personal data of former employees that may have a grudge or may be willing to become quite aggressive with a claim.
- [17:42]
Dena Temple Reston
They held their breath, waiting for the leak to bring them more bad news.
- [17:46]
Paul Abbott
But nothing came of it. And, you know, they didn't get any money out of us, so it was all very pointless and very destructive for no gain.
- [17:56]
Dena Temple Reston
It had been a very painful chapter, but they felt like at last it was over.
- [18:02]
Paul Abbott
We just felt that this is going to be hard work, but we'll get over it as long as we keep the customers and people, which. Which we did, potentially.
- [18:10]
Dena Temple Reston
They survived for now. But a few months after the attack, they got more bad news. This one Outside their control, Knights of Old's parent company went into bankruptcy. And even this would not have necessarily been a death blow. Market conditions for their own company were pretty good, but their cash reserves were pretty low because they'd built this new warehouse and set it up about six months before the attack. Even that could maybe be something they'd overcome. They could just get a loan. But then Akira came back to haunt them one last time. The company's lender would only engage with them if they produced a variety of financial reports, the very reports that had been lost in the hack, and they were still working to recover. With a little more time, Paul Abbott said, they likely could have gotten them back. But the company's lender said, time's up. And with that, Knights of Old, the company that had survived for more than 150 years was finally forced to shut its doors. All told, about 600 people at Knights of Old lost their jobs.
- [19:19]
Paul Abbott
You know, 150 years and it's been closed. People have lost their jobs.
- [19:25]
Dena Temple Reston
And that had some ripple effects.
- [19:28]
Paul Abbott
I mean, all the employees did get paid everything they were owed. At the end, they just lost a job that they dearly lacked, you know, and a community that was broken up. Some of that communities continued to work in different places.
- [19:40]
Dena Temple Reston
But there was this general sense among outsiders. Paul said, that somehow Knights of Old had actually done something wrong, that they weren't just unfortunate victims of a hack, but somehow had been careless and brought this upon themselves.
- [19:55]
Paul Abbott
My wife witnessed a situation only a few weeks ago where somebody said something quite derogatory about the business. You know, they haven't forgotten about it. It's still hanging around.
- [20:06]
Dena Temple Reston
And that's been hard on Paul.
- [20:08]
Paul Abbott
We weren't negligent people, you know, we, we, we just ran out of luck.
- [20:13]
Dena Temple Reston
For 150 years, Knights of Old had survived everything. And now in a blink of an eye, it was gone. This is Click Here.
- [20:34]
Unknown
Looking for more of the cyber security and intelligence coverage you get on Click Here. Then check out our sister publication, the Record. From Recorded Future News, you'll get breaking cyber news from reporters in New York, Washington, London and Kyiv, among others. And you'll see for yourself why it attracts hundreds of thousands of page views every month. Just go to TheRecord Media.
- [21:04]
Dena Temple Reston
Today is Tuesday, January 28th, and here are some of the top cyber and intelligence stories of the past week. I was doing life without parole and I was locked up for more than 11 years. But he let me out. I'm a free man now. Thank you so much, President Trump. That's a YouTube video from Ross Ulbricht, hours after President Trump called his mother to say that he had decided to pardon her son. Albrecht was sentenced to life in prison in 2015 for creating silk Road, the world's largest online drug marketplace. And in the intervening years, Albrecht had become a kind of cause celeb for libertarians who saw him as a kind of hero for building an illegal marketplace outside the government's control. Albrecht was also an early bitcoin adopter. That's how people paid for drugs on the website, so crypto bros were eager to see him released as well, and rallied around Trump when he vowed to pardon him. The FBI arrested Albrecht at a San Francisco Library in 2013 and charged him with running Silk Road. Prosecutors presented evidence that Albrecht didn't just facilitate drug sales, but also had solicited the murders of people he considered threats to the business. He was never tried on murder for hire charges, and there's no indication that any killings ever took place. In its first full day, the Trump administration axed all the advisory committee members within the Department of Homeland Security, including the people that make up the Cybersecurity and Infrastructure Security Agency's Cyber Safety Review Board, or csrb.
- [22:49]
Paul Abbott
I guess the question is, do you see a continued role for cisa?
- [22:58]
Dena Temple Reston
The CSRB was actively investigating Salt Typhoon, a Chinese state sponsored hacking group thought responsible for breaching at least nine U.S. telecommunications networks in the past several months, according to a memo signed by Acting Secretary of Homeland Security Benjamin Huffman. The new administration is committed to eliminating the misuse of resources and ensuring that DHS activities prioritize our national security. Members of the CSRB include a who's who in cybersecurity, including former CISA head Chris Krebs, who Trump fired in 2020 after Krebs confirmed that the presidential election wasn't stolen and Biden had won fair and square. The CSRB also included several former Biden administration officials and was created as part of a 2021 cybersecurity executive order to review and assess significant cyber incidents impacting the federal executive branch of the US Government. It's unclear if the Trump administration will create a new committee to take its place. And finally, the X Games kicked off last week in Aspen, Colorado, and this year a new judge will be assessing the committee contestants. Let's see who the Owl AI is predicting for this final Google Cloud developed the AI system exclusively for use at the games. According to Google, the AI will analyze video footage of snowboarders at the Super Pipe event, where their tricks are so infamously quick, it's hard for judges to tell whether they did a cab 1400 or something else entirely. Now the footage can be slowed down so that the AI can accurately name the trick and provide its own score. That's shown to viewers and commentators. A brand new feature for X Games in 2025, the OWL AI, our new AI analyst that's ultimately going to enhance the complete viewing experience. For the fans, this is just a trial run. Humans are still in charge of deciding the official scores and awarding the medium Foreign.
- [25:22]
Unknown
Today's episode was produced by Sean Powers, Megan Dietry, Erica Guida, Zach Hirsch and Dina Temple Rastan. It was edited by Karen Duffin, Fact Checked by Darren Ankrum, and contains original music by Ben Livingston with some other music from Blue Dot sessions. Our staff writer is Lucas Riley and our illustrator is Megan Gough. Martin Peralta is our sound designer and engineer. Click Here is a production of Recorded Future News and prx. Tune in on Friday for Mic Drop, which features our favorite interview of the week. We'll have a new episode of Click Here on Tuesday. We'll see you then.
- [26:08]
Looking for more of the cybersecurity and intelligence coverage you get on Click Here? Then check out our sister publication the Record from Recorded Future News. You'll get breaking cyber news from reporters in New York, Washington, London and Kyiv, among others. And you'll see for yourself why it attracts hundreds of thousands of page views every month. Just go to the Record Media.