A (2:27)

I love that. And I know that you and your team, like Stephanie and Alex and others, have really good relationships with the researchers, the bug hunters. And what is that like? What is that group of people like? How would you describe them?

C (2:41)

I would describe them as very diverse. We have a very wide set of researchers around the world. If you look at the last Year of bug bounty submissions, you have people from 59 different countries that have submitted vulnerabilities. We also like you have people that are still in high school all the way to people that are well experienced, close with PhDs. So everybody brings a different angle, different perspectives and we really benefit from from them.

A (3:11)

Now in the past couple of years I have sort of seen the advent of being a bull researcher or a bug hunter as somebody's just entire source of income. People say, you know what, I am kicking it on bug bounties. I'm making a lot of money on this across the board. And they just do that full time. How much of the community is like that? Like, is that a real thing?

C (3:37)

That is definitely a real thing. Some of those folks are a part of our program and they submit to us, some exclusively, some will submit to us and also some other bug bounty programs. There's a pretty wide array of how much people are involved. There's people like you're describing who get up and they look for bugs all day long. They come up with techniques, they'll try it against Microsoft, they'll try it against other vendors and they'll try to monetize that and that is the way that they make their money. But then you also have people that may be doing it for fun on the side, on the weekends, late at night. Some of these folks are just learning they may not have a job in Infosec yet and you know, all kinds of different.

A (4:20)

And that goes back to that diversity you were talking about across hobbyists and professionals and early in career, super senior and all that kind of stuff. And help me understand too with MSRC is that every Microsoft product like pretty much everything.

C (4:36)

So we take vulnerability submissions for anything that's Microsoft awesome. We pay out, we try to incentivize research in certain areas. And so those are going to be the areas that we have bunk bounty for. We do not have everything under bug bounty.

A (4:52)

And I know that last year, year there was a new program called Zero Day Quest and that was announced by Satya in November 2024 in Chicago at the big Ignite conference, the Microsoft conference. And tell me what Zero Day Quest is exactly.

C (5:09)

So Zero Day Quest, we did it for the first time in April of this year. We had a qualifying period where we said, hey, these are areas that we want to see people do research in. They were focused on cloud and AI. We asked people to submit bugs in those areas and then we took the top people and we invited them to an in person event at Redmond.

A (5:31)

Oh what happened at this in person event? Sounds fun.

C (5:35)

Yeah, so it was a lot of fun. We had the researchers on campus, it's our main campus, so a lot of the product development is there. So we had people working hard to find vulnerabilities. Our team would in person go and assess them. It was really great for our team to be able to go and tap the researcher on the shoulder and say, hey, we want to understand this a little bit more. Then we would submit the bug to the product team for them to go and address. And then in many cases we would say, you know, these folks are here on campus and, you know, the product team would show up and say, hey, how did you find this bug? What's going on? And so the engineers that are actually developing the features learned a bunch about, you know, that hacker mindset, how people are approaching trying to find security vulnerabilities. And then the researchers were like, hey, can you tell me a little bit.

D (6:20)

More about the architecture?

C (6:22)

How does this work? How does that work? So that they could further their research and own where they're going to go and look to find vulnerabilities.

A (6:29)

That's so full because it compresses that timeline from bug finds, a bug fix into what, a day, the, you know, the fix.

C (6:40)

So certainly the, the submission to go and triage was like super quick. The mitigation of an issue is going to vary depending on what that product is. And we have to be very intentional not to be too fast and break things, but certainly our time to mitigate is something that's very important to come to me.

A (7:00)

I think it's really interesting since I've come to Microsoft, seeing just really the scale of Microsoft deployment. A lot of people think about like Windows or Edge browser or obviously Azure, but Microsoft has such a massive split print, not just within the Windows ecosystem, but Was it Mac, iOS, Android, across IoT devices? And you're taking all those bugs in across any Microsoft product. That's huge. How many bugs do you say come in a day?

C (7:33)

We don't publicly talk about the number of bugs that are coming in.

A (7:37)

Are you tired for snap?

C (7:39)

I would say that we are very smart about how we triage things. So if we're going to use technology to go through, not every submission that we get is like a critical issue. And we're using a lot of AI now to go and triage things and prioritize and work through all of the issues that are important.

A (7:57)

I've heard a lot about AI. It seems to be very popular. Tell me now you've talked before about the ethics around responsible disclosure. Kind of help me understand how MSRC implements those kinds of values.

C (8:12)

Yeah. So everything that we do is to protect customers. Right. And Microsoft, that's another way to protect customers. The first part is that coordinated vulnerable disclosure that we talked about earlier, where people are going to partner together to get the issue fixed before we go and disclose. The other thing is we want to be intentional with how people engage and what, you know, how far they go with their research. You know, we don't want people to find a vulnerability and then start using that to touch customer data and things like that.

A (8:44)

Right.

C (8:44)

One of the things that we did during Zero Day Quest is we set up these things we called Flash challenges where we said, you know, can you go and read this email? Can you go and find the ability to look at the SharePoint document and things like that so that people could go a little bit further than they normally would, but it's all within a contained boundary that would be responsible.

A (9:06)

I love that. I think that, you know, having such a massive footprint like Microsoft does, being committed to ethical, responsible disclosure is kind of our like mantle foundationally in the world. Like to protect the global digital landscape, we have to be willing to have rigor and discipline and approach things in a really clear ethical way. Which I think is fantastic with MSRC and everything that I've done with MSRC because I've worked with your group quite a bit. That value is in every person and every project and everything that we do there. So it's pretty cool. So how does all of these pool things like Zero day quest, bug bounties? How do all of these kind of contribute back into the big focus of Microsoft, which is security and the secure future initiatives?

C (9:57)

Yeah, one of the pillars is to accelerate response and remediation. I'm the pillar owner for that.

A (10:03)

You're the pillar owner? What kind do you have a crown or a scepter or what do you get? What do you get for being a pillar owner? I get a bag of concrete.

D (10:12)

I get a lot of work.

C (10:16)

So certainly we put a lot of energy into helping everyone across the company understand the vulnerabilities to accelerate the ability to mitigate those issues quickly. But if you think about the longer timeline, you know, security really starts from the time somebody envisions what a feature would look like. It's well before somebody's writing code and you know, threat modeling, all of it. All those things happen at Microsoft. By the time a security researcher is finding an issue, that means the landscape could have changed. There are new threats that are understood. The researcher may have a different perspective on things than we did. And so that's all feedback. That's the feedback channel that we use to change the way we think about things. So it might be, you know, we missed something. Let's go at some static analysis rules. It could be. Let's make sure that people that are doing threat modeling consider this perspective when we're going and designing new features. So it's all just a feedback.

A (11:17)

It's a great partnership, I think, between Microsoft's Career Response center and our Microsoft software engineers. Software developers. I work through your group doing a lot of workshops for those software developers. And it's a really different mindset working with somebody who considers them a, considers themselves a software engineer versus people like us who kind of are security people. And I always say, you know, the developers are the makers and we're kind of the breakers on the security side. And sometimes I just wish I could live in that software developer world where I just wanted to give people cool features all the time instead of feeling a little disruptive, where I'm going to try to find problems and bring them up.

C (11:55)

Well, I think it's a great partnership. I worked on the office team for 23 years and we were shipping features but I was always responsible for how do we do this in a fast way, but in a secure way. And so it's really about building that awareness, building the partnerships with the software engineers because they're going to be well equipped to go and address the issue if they're aware of how to go and do that.

A (12:20)

I love the way that Microsoft handles these things because we have the scale that we have. Let me ask you now, Zero Day Quest, are we going again in 2025?

C (12:30)

And we started the next phase. It's a qualification phase. We opened it up on Monday. That's through October 4th. You should check our blog. We're accepting submissions right now. Basically the way that you submit is find a vulnerability in cloud and AI products. Submit those, you're going to get paid for them. We have even multipliers for critical issues that are being filmed. And then we'll take the COP people and invite them for that in person experience that we described before.

A (12:58)

And that'll be in Redmond again at campus. Amazing. It's absolutely worth it. If you're listening, search up Zero Day Quest, Microsoft, go get involved and check that out. And finally there is New Hat Asia in Big Dalaru coming up. How do you feel about that? When is that?

C (13:17)

I'M very excited. So we, we have three, three hello Hat events around the world now. It started in Redmond, we've had an event in Israel for several years, and then recently we started one in India and it's been such a big success that we're expanding to attract the broader region and it's called Duluth Deja.

A (13:38)

Fantastic. So those are some things for the audience to go check out right now. Get on your computer and look up Zero Day Quest, Microsoft and Blue Hat Asia coming up soon. Tom, I have one final question for you. What is something that you would love to see more of from the research community this year?

C (13:56)

I think there's still a big opportunity to do more AI research. I think there's a lot of folks with a lot of talent around application security and that's a great mindset. What we'd like to do is see more people pivot to think about the AI problem. The researchers that work in the AppSoc space have a great mindset. If they apply that same mindset to AI, I think it'll unlock a lot of different things. Some of the things that we're doing is we're providing additional training. We have videos out, we have information about that. It's a different type of problem and so you just have to think about it a little bit differently. But the core competencies are really the same thing.

A (14:36)

One of the things that I think is so cool about AI bug hunting is that you could do a lot of it in natural language. So the bar to entry really is anybody can do it. That's right. And I want to put a particular call out to my social engineers out there, because combining your social engineering experience with natural language capabilities, getting into AI systems, you can hit bugs that you maybe not. You maybe could not have hit otherwise.

E (15:03)

That's right.

A (15:04)

Without a social engineering background.

C (15:06)

That's right. And you don't have to get sweaty like you would social engineering.

A (15:10)

A real person, you don't need a clipboard or anything like that, just a computer or little typey, typey fingers.

C (15:15)

And if you fail, you just try again. It's not like social engineering in the real world where you get shut down.

A (15:20)

Absolutely. You can keep trying. I love it. Tom Gallagher, thank you so much for joining us. That was vice President of Engineering from the Microsoft Security Response Center, Tom Gallagher. I'm Sarah De Grippo, Director of Threat Intelligence Strategy at Microsoft, coming to you live from black hat to 2025. Thanks for joining me, Tom.

C (15:36)

Thanks, Sarah. It was great.

A (15:37)

Welcoming to the stage. My close friends that I Have known for a very long time. Eric Olsen, principal security researcher and Eric, senior security researcher. I've heard that you guys like crime, True or false?

C (16:02)

True.

F (16:03)

Not committing crime, but crime.

E (16:05)

Yes.

A (16:06)

Gotta make that distinction. Don't want to commit the crimes, want to research the crimes.

E (16:11)

Exactly.

A (16:11)

Yeah. Okay, so let's talk about ransomware. Ransomware is one of my most favorite things to research and never do because it really had falled over like the past 10 years to become this thing that used to be an individual situation where like a computer would get printed to. Now they're shutting down entire organizations operationally. So help me understand. I'll start with you. Like, help me understand what you're seeing on the ransomware ecosystem.

D (16:47)

Yeah, I think what we've been seeing lately is that when they come in, they seem to know where they want to go a lot faster than they used to. So whether that's going straight towards nice servers or targeting the backups and trying to inflict the damage fast and early.

E (17:00)

Because they have a better chance of.

D (17:02)

Getting the ransom payment rather than just encrypting a few workstations, which doesn't really motivate the company to want to pay. And I think another thing that's really been brought up is the they seem to have the accounts when they come in, they don't need to do a lot of privilege escalation. I don't know if that's the right rise of ransomware brokers and access brokers. Giving them credentials. The initial access is usually really fast. And then we'll see them do things such as building the tick attacks or trying to drop other persistence mechanisms to keep us from kind of stamping them out. But the speed, I think is the real thing. That's changed the last two, three years for us.

A (17:38)

That's really interesting when we talk about speed. For years, the DBIR for Verizon would have have stats on dwell time, which is essentially the time from when a threat actor gets access to a network, how long it takes before they actually do the inputs to intake with the lady who shut down the organization. And year after year, dwell time would get shorter and shorter. And I remember dwell Times of 10 days, dwell times of seven days. And as those got shorter, I think we're seeing dwell times now in hours.

D (18:10)

Yeah, we. I worked a case a few weeks ago and it was about 30 to 40 minutes from when they came in. When we had the first VPN log time stamp to when they started hitting the backgrounds was around 40 minutes. So it's very quick now.

A (18:24)

Are you seeing the same kinds of things with the ransomware that you're looking at?

F (18:28)

Yeah, it's been interesting. So we see abuse of common exploits. So good example is Citrix Bleed cu, which is more recent. So you'll see them jump from some exploit like that and then once they get in the network, set up shop, click the tool attendees and in a lot of instances these folks know the tools better than the customers. So they're like, hey, we can. You're using a software deployment mechanism.

E (18:51)

Guess what?

F (18:52)

We have people who are experts in this and they're able to just get.

E (18:54)

In, get it deployed and get out.

A (18:57)

I think that's something that we've seen too in especially when it comes to social engineering. Threat actors really do seem to know the organizations, the people, the business processes in a lot of cases better than the employees themselves. They're able to really understand, hey, if we rans up this organization or this company, will we get a pay, will we get paid? Do they have the money, do they have the capability and how exactly would we get that access? And I think that it's really, it's a shift over the past decade. Decade of kind of a spray and pray ransomeware like locky was in 2015 to now. It's really targeted, it's really specific and intentional. Do you have any insight into how these ransomware actors are choosing their targets?

F (19:48)

It varies. It really varies. It could be open source intelligence and they're just going to be scans of unsubscisse. I mean it's RDQ exposed, some other remote access protocol exposed. It could be through some social engineering credential theft. We've seen like a forum gets compromised, there's some abuses for something like let's say codes and that person gets, you know, honked down the limiting Adobe executable and it's actually not as the first stage of own access into the organization.

A (20:21)

And something that I think is interesting now too about the way ransomware operates is we're seeing a lot of, you know the phrase we used to use was double extortion, but I think now we're saying we'll see extortion. How are we seeing that playing out with not just encryption for pay, decryption for pay, but additional extortion techniques of the same organization at the time?

D (20:45)

Yes, I think there's the data that comes component of them actually exfilling proprietary data before doing the encryption. So they have kind of two options, right? Like we'll release your data to the public and you're going to sit there with everything encrypted. So I think it's mostly what I've seen recently is the extortion of their proprietary native.

A (21:05)

I think looking forward in terms of ransomware, I think something that really is on the horizon is the use of AI and you might say like, well, where do you put AI in the attack chain essentially for a ransomware event? And I think what we're going to see is usefulness of vintage data breaches, ransomware actors going, pulling down old data breach archives, putting them through an LLM or an SLM locally and saying, hey, help me figure out their weaknesses. Help help me figure out based on these data breaches where I could potentially do a ransomware event on this particular organization. Or you know, look through this and see if there's extortion tactics that maybe we can use. Maybe if you get an email dunk, look for email conversations that talk about mergers and acquisitions or maybe a supervisor being inappropriate with one of their employees and we could use that part of kind of extortion. So it's get a really epic accelerate these threat actors ability to understand the businesses like we were talking about before, they're going to be a lot quicker in that.

D (22:16)

Going back to your earlier question too of how they get in sometimes I think, and you've probably seen this too also, if the company's using a third party MSB and they compromise that sometimes the way they pick their targets is whatever employee they compromised in that third party, that's who they go after. The employee has access to these four companies to do normal administration work, they go after them. I think we've seen a lot of those seemingly seem like they start from the managed service provider and then go into a company. So I think there's going with it. I think there's a kind of a bright spot in it though. We have seen a lot of customers getting smart to having their backups disconnected from their main network. We worked at it recently where they hit the A6I servers, they were going to pivot to their backup so they just cut the line right away. They seemingly were able to save themselves. So as we see like the ransomware at the dwell time get faster, I think the customers responses are actually getting pretty, pretty fast as well.

A (23:15)

Yeah, and a good point on the.

F (23:16)

Use of AI is now quality all of this information at your fingertips so you can go back and say, okay, hey, this company was impacted by this previous vulnerability of some software and now a new version comes around so they.

E (23:29)

Can go back and play back that.

F (23:31)

You know, repeat that playbook and say, okay, hey, the customer is vulnerable this time. What's the chance they're now also vulnerable with this new version?

A (23:38)

And that I think breaks up that important conversation around software supply chain or provider supply chain, where your vendors of providers are just as much of a target as you are, if not more. Because ultimately those vendors, whether they sell you software, they sell you services, you use their platforms. If threat actors know that those service providers and software sellers are vulnerable, it's a lot easier to compromise a hosting platform or like you said, an MSSP and then go downstream to all of those customers that make excellent targets for these threat hackers, especially to ransomware.

D (24:13)

Yeah, and I think from the customer side too, they don't really know how the script he's managed on the other side. They may do everything right on their side, but they're kind of leaving that vulnerability out there in some way.

A (24:25)

Yeah, I think that cuts back to like one of the least fun and cool parts of security, which is like vendor audits, like making sure your vendors are doing the boring parts of security and that you have, you know, as a P3 of visibility into those vendors and understand their approach, security, what they think is important, how they do the things they do. I want to talk a little bit about the business of ransomware. We always say ransomware is an ecosystem. You're not fighting a single threat after group, you're fighting an entire organized ecosystem. What have you seen in terms of the organization of these ransomware threat actor groups, how they operate?

D (25:08)

Don't know if I have a specific answer on that. I think the access group broker side though, is maybe where I've seen that evolve a little bit. Because before it was always kind of an exploit at like an edge device or compromised credentials of, you know, you can be a social engineering or something. But now it's. We're seeing cases where none of that really seemingly happens in the logs. They just kind of log in with an account. So it's, did they buy those credentials from an access broker somewhere else with the permissions that they need and just log in and do what they had to do?

C (25:35)

So the.

F (25:36)

Yeah, also you have disagreements between different ransomware groups and they break the leg, form their own ransomware group and maybe take that as a moment to, you know, introduce some changes of their law in the way that products that they want to use, have used and then hit it that way.

A (25:51)

If there's definitely an element of kind of cutthroat, no honor among thieves would have Hunts a lot of these rans workers. And the way that most of us know that is we read the slide the or various other leaks that have come out of these groups where we can really see the inner workings of, hey, this guy's getting paid more than I was getting paid. I want a raise. Or, you know, we're doing it this way. I don't think that's the most effective. Let's make a change here. As Big said, no, I don't like that school. We're gonna. We're gonna splinter or we're gonna shut it down.

F (26:22)

They're not getting a big enough cut.

A (26:24)

They're not getting a big enough cut. I've also seen instances where, like, it'll be, you know, one person working for multiple ransomware groups at a time because they just sort of know what to do and they take on as many jobs as they can. What do customers need to know in terms of ransomware? You say double, and then customers need to get handled for greed.

D (26:45)

I think would be having a plan to disconnect critical systems backups stored in a manner that's not connected to your normal production environment. So you're not totally Greek yielded. And if you it'll get a hold of it in time. And then another thing I always want when we're on instant response gigs is the VPN and the firewall logs, especially for any kind of historical compromise. Not having those logged anywhere really limits how they got in and where they came from and to really track if there's any other processor. So I think disconnected backups and having proper logging, I think is so for.

A (27:21)

All of you listening, you're going to need to do proper logging and backups. Things like network segmentation and making sure that your heat can and fireball laws are accessible. So we are really talking the language of like 2002. Yeah. That people haven't taken care of us.

F (27:38)

Have recommendations also equally important, you know, realizing where your sensitive data is at. Because the ransomware folks, they definitely know. And when we start when they send you an email and they're like, hey.

E (27:51)

Look at all this data.

F (27:51)

I said, and, you know, maybe the customer is like, hey, little cat and mouse, I'll send me a proof of life. I don't believe you tell me you took my data and they send you a text file. Like, hey, look, here's all the data I took. And now you're that company going, all.

E (28:04)

Right, I see this data.

F (28:05)

I don't recognize this.

E (28:06)

Where did it come from? Inside my network.

F (28:08)

And then they can't find it.

A (28:09)

So you can't verify whether or not this redactor really has what they say.

F (28:12)

They have, or even proving that the data was exfil because maybe that segment was not logged or audited and there was no, no evidence.

A (28:21)

So there really is just such a big element, I think, of social engineering aspect for ransomware. Whether it's, you know, the initial entry leverages text messages or calling, whatever threats, or if it's at the, you know, encryption stage where they say, oh, we really do have this data. And then the organization has to decide whether or not they believe that's true.

E (28:43)

Yeah.

A (28:44)

All right, we are going to wrap up now. I want to see thank my two guests, Eric Oldman, principal security researcher and Eric Lawler, senior security researcher at Microsoft. I am Sheridan, criminal director for Intelligence Strategy. Thank you for joining me at Black Hat 2025. Hello and welcome to the Microsoft booth at Black Hat. Wow. Okay. We're going to talk about credential phishing and social engineering, two of my most favorite topics. And with me, I have fantastic guests from Microsoft. Travis Schack, principal security researcher, and my good friend Eric Olson, also principal security researcher. I am Sarah de Graveau, director of threat intelligence strategy at Microsoft. And let's get into it. Travis, I'm going to start with you. What exactly is social engineering, but definitely should be.

G (29:41)

Can you hear me? So social engineering is just a tactic that threat actors use to get you to do something, to provide something. Lots of different techniques involved in that. We'll probably talk a lot about the phishing as far as the email side with the phishing and some other techniques.

A (30:04)

So, Eric, I'll ask you, what examples of social engineering have you seen that threat hackers actually sent out there into the world?

E (30:15)

Well, so social engineering, actually probably a really good one, is everyone who's got a text message that says, hey, you have a tool due, click this link. Or UPS says, oh, don't forget your package, click this link. And I know everyone's got that.

A (30:30)

So you should click the link. Right.

E (30:33)

If you're a researcher, maybe. But no, definitely not click the link.

A (30:38)

Only if it's for research purposes.

E (30:40)

Yeah, exactly.

A (30:42)

And so people get those all the time. I think a lot of people listening are probably pretty smart and just deleting the message or ignore it. What happens if you click on the toll link? What is it varies?

E (30:54)

Could be something that's like, hey, put in your email address and password and you're like, oh, well, I use the same password for everything. Naturally. So let me Just put in my password. And now they got your password. And they could either, you know, go to some credential broker or you know, that threat actor was hoping that you would put in your password and then now they have it.

A (31:13)

So what kind of scale are we looking at when we talk about things like social engineering for credential theft? Like how many of these messages are getting sent, how many people are clicking on them? Is this actually profitable?

E (31:28)

Very much so profitable and probably way too many to count. I know I have family members who send me emails all the time. They're like, Eric, is this spam? I'm like, yes, it is a phishing email. Please tell me that you did not click the link, you didn't provide your password or any of the other info that it asked for. And I think one of the things that's changed is that with the use of AI, so previously, you know, you get an email and you're like, oh, this is unrealistic because either the English isn't correct or the grammar doesn't match up with something that would be said in person. So now through the use of AI and like using deep fakes, you're like, all right, this is kind of believable if you're not looking for other indicators like hey, it came from a random email address. That's not the company that said they sent it.

A (32:16)

Right. And I think that people don't understand them for the most part. Things like Credential Phish are really the beginning of an attack. So Travis, walk me through, like once the threat actor has your username and password, let's say you did fall for it, you put it in the landing page. What happens after that?

G (32:37)

Yeah, so typically they want to use that information once they capture it. And if you don't have multi factor authentication on that account, they're going to gain access to whatever systems where you use those credentials. So whether it's work related, personal related, banking, they're going to try everywhere, social media, they're going to try everything to try to get users credentials to gain some kind of access.

A (33:06)

So I guess that leads me to my next question, Eric. How do we prevent this stuff? Stuff like what's the way to stop it?

E (33:15)

Well, you know, I was reading something earlier that was talking about, about corporate training and you get, you know, we get it too. And it'll be a video like hey, click on this thing or watch this video about something. And you know, for the most part a lot of folks probably just tune it out because they're like, hey, I have 40 hours of training I have to do. It's videos and I think it'd be much better served for some kind of like micro learning, like a simulation where you're like, hey, you click on this area of the email that looks suspicious. So I know that you know if you get an email at the company that you'll be a good, a good cybersecurity person because everybody can do a little bit of security and be like, hey, this is no good. And then report it and okay. Nope, not clicking it.

A (33:57)

So what else, Travis, can we do in terms of prevention? How do we stop this stuff?

G (34:02)

Yeah. Besides the user education. But then you're still going to have some failures there. Then you got to rely on some of the technology side of the house. That's where multifactor authentication is going to help. Adding in that second layer of authentication tools like Defender for Office 365 is going to help with that. So really the multi factor authentication is probably one of the biggest protections that we can have.

E (34:29)

Yeah, because. And you know, for phishing and actually social engineering too, it's not necessarily starting with breaking the system, it's breaking trust of the person who's on the other side. And then you have to hope that all the other security controls and tools and things that you have at your disposal are what, you know, stops the next step.

A (34:47)

Yeah, I think too, like you mentioned, AI and I've been thinking a lot about this. I think that a lot of the AI tools that we have available to us today really are these large language models, generative text. They can create images and they can create text. And I think we are seeing threat actors leverage AI tools to create really good social engineering org. But something I think about too is all of those data breaches that have happened over the last several years, those are out there available for threat actors to take and it would be really easy, I feel, for a threat actor to download a bunch of BREIS data, whether it's emails or credentials or corporate ip, and then run those through an LLM and say to the LLM, if I was going to try to trick someone from this company, how could I do that? What is something that people in this company are concerned about that would cause this to click? I don't know that we've seen that yet, but it makes sense to me that threat actors are thinking about leveraging AI as that kind of tooling.

E (35:51)

Yeah, definitely speeds up the breaking trust bit.

A (35:54)

Right. It makes things go faster. And I think it does. I think AI really something that is important to think about when you're rebranding. It is the A can very easily stand for acceleration. Just making things a lot faster that we used to do manually. Or even when you did it with code, you could do it even faster today than you can with writing most scripts. Because what do you see? Think about bodies of text, which is what LLMs specifically are really great at, handling the amount of different types of usernames and passwords and data that's out there. Writing a regular expression for that to like grep through a giant database of text is really hard. Like that regular expression is probably impossible to create. So with an LLM, you've now got that natural language interface and you could say, hey, go through this and find me anything that would be interesting if I was a hacker. Basically.

E (36:48)

Yeah, yeah.

A (36:51)

So help me understand. We talk about social engineering in terms of emotion, emergency and habit. Any examples of social engineering that you thought were really clever to do?

E (37:04)

Really good use of like audio or deepfakes is actually audio deep fakes listening to. I don't remember what it was. There was something in the news, a politician in the US and they deep faked his voice and then used his voice to call other politicians. And I mean, unless I guess, you talk to the person every day, you could easily be tricked. They're breaking your trust and you're like, okay, this sounds believable. Or at least they have enough context about what they want that it sounds believable. And you're like, okay, you lower your shield down and you know, just allow, you know, allow the conversation to continue.

A (37:38)

Yeah, Travis, what have you seen?

G (37:42)

I'd have to say what Eric said. You're starting to see the phishing becoming more successful because they are getting better at calling. Right. We see a lot of help desks being targeted and typically used to be able to like decipher, like, is this person really real or not? But now with the voice generation stuff and with the AI coming in, helping with the grammar mistakes and making that more believable, but it's. You just do that.

E (38:10)

And I think AI has definitely helped you be more relatable because you're like, hey, well, I know that you like this specific thing, so you don't start the conversation with what you want. You start the conversation with something to build trust first and kind of get that person to lower their barrier. And then you come in for your ask.

A (38:26)

Absolutely. I think, you know, we see multi chain relationships tips with social engineering. We see things like just a single email sent out a really Good example that I talk about a lot is, you know, it's on sort of email letterhead like with a thick file and graphics and everything that says we're in a law firm. And it says, hey, I'm from this LLP law firm. If your spouse has contracted me to prepare your divorce papers, go ahead and click here to view our first draft of your divorce papers. And I think, Billy, anybody married, single, happy, unhappy? There are so many reasons for people to click on things like that.

E (39:04)

Yeah, absolutely. Prey on their fear.

A (39:06)

Yeah. Curiosity.

E (39:08)

Yeah.

G (39:09)

Lack of jobs right now. Right. I was a former Sizz my. The last company where I was a ciso, our HR VP got impersonating and we're basically offering jobs to people and then scamming them out of money through Google sites. And it was really hard to stop that front of because they thought that it was actually from our organization. So today you see a lot of, like a lot of my friends are saying, hey, I just got this recruiter, they just sent me something about a job. You think this is real? So you're going to use the current times, whatever's going on. And so you really have to be aware of what's happening right now and how threat actors can you leverage that.

E (39:51)

Yeah. And even something like, hey, take a look at this job description and it's in a word doc or a PDF and the person on the other side has malicious intent. And you know, you're looking for a job so of course you're going to have, you're going to have an interest on opening up the email and looking at the attachment.

A (40:08)

I also think too there's, you know, threat actors have been able to really be smart about who they're targeting in terms of looking at data that's available, either open source data or data that's out of reach. Say, oh, like this group of high value individuals all have the following thing in common. I could kind of write a similar or send that out to all of them and see what comes back to me. I know of an example where one of those big email platforms, one of those marketing platforms, an account on one of those was compromised and the threat actor said, great, I've got access to all these people. It was a newsletter about wine of the month, it was a wine review newsletter. And the threat actor said, you know, great, I have access to this, I can send from it. I'm going to look through these individuals and see who's maybe a high net worth, who has high access that I want to maybe compromise them. So I can get further access. And the threat actor sent out a wine newsletter that said, click here for a free bottle of wine.

E (41:07)

Hopefully they sent the wine.

A (41:09)

You got hacked. Bait and switch. But it makes sense, right? If you know even a little bit about your target, you can social engineer them so much more effectively. And, you know, there's everything across the spectrum of threat actors. You do deep, deep research on their targets. They understand them. They tailor perfect, perfect social engineering and floors directly at that individual. And then there's those massive campaigns of spray a prey where the threat actors like, I'm just going to send this to everybody and just hope for the best.

E (41:42)

Yeah.

A (41:43)

So I think social engineering is something we can never overlook. And I'll kind of leave everyone with this. If you're looking at an email and it's telling you to do something immediately, that is probably social engineering. Anytime that an email says you must act now, hurry, going fast, all those kinds of things, generally you should be a little suspicious.

E (42:07)

Yeah, definitely.

A (42:09)

All right. I want to thank Travis Shack and Eric Olson, both principal security researchers at Microsoft, for joining me. Sharon Negrippo, director of threat intelligence strategy here at Black Hat 2025, to talk about social engineering and physics. Thank you both.

E (42:24)

Thanks for having us.

G (42:25)

Thank you.

B (42:30)

This week on the Microsoft Threat Intelligence Podcast, join us live at Black Hat, where you'll hear about bug bounty programs, ransomware, and all kinds of incident response tactics. Be sure to listen in and follow us@msthreatintelpodcast.com or wherever you get your favorite podcasts.