A Petabyte of Data Stolen and Nobody Noticed

Summary

Hacker And The Fed, Episode 124: "A Petabyte of Data Stolen and Nobody Noticed" Date: March 19, 2026 Hosts: Chris Tarbell (former FBI Special Agent) and Hector Monsegur ("Sabu", former blackhat hacker turned security pro)

———————————————————————— Episode Overview ————————————————————————
This episode dives deep into a series of recent, high-profile cybersecurity incidents, exploring how massive data thefts can go undetected, how AI platforms are being breached due to weak security practices, and how threat actors are leveraging new and old techniques to wreak havoc on organizations worldwide. Chris and Hector blend technical breakdowns with firsthand insights, practical lessons, and their trademark banter, making this an essential listen for cybersecurity professionals, leaders, or anyone concerned about digital threats.

———————————————————————— Key Topics and Insights ————————————————————————

1. How a Petabyte of Data Went Unnoticed: Telus Digital Breach

   • Story Recap (08:11): Canadian BPO giant Telus Digital confirmed "unauthorized access" after the extortion group Shiny Hunters claimed theft of almost one petabyte (1000 TB) of sensitive data. Data allegedly included PII, financial info, FBI background checks, call records, source code, agent performance ratings, and more.
   • Hector’s Analysis on Exfiltration (09:21): Hector emphasizes how such volume could only be lost over months due to a total failure in security monitoring—likely the blame lies with organizational leadership, not individual security staffers.
     • "You just don’t pull a petabyte out of data off a system within 24 hours. Not really a thing." [10:06, Hector]
   • Cost & Infrastructure Realities (13:05): Discusses data transfer costs and how even with negotiated rates, the bandwidth spike (between $5,000–$90,000) would have set off alarms from providers and internal teams.
     • Quote: "There would have been a sudden jump not only in the bandwidth, but in bandwidth cost… There’s some sort of threshold somewhere alerting somebody... You may want to investigate that." [14:02, Hector]
   • Skepticism on the Numbers (15:13):
     • “If the 1 petabyte number is correct…most of that is probably metrics and logs and shit.” [19:18, Hector]
   • Attack Vector (17:45): Attackers allegedly used compromised Google Cloud Platform credentials, pivoting from an earlier breach.
   • Takeaway: Public headlines often inflate the size of breaches; real damage is in sensitive data, not massive log files.

2. AI Platform Breach: McKinsey’s “Lily” Hacked by Codewall

   • Incident Summary (21:37): Security researchers gained internal access to McKinsey & Company’s AI platform, “Lily,” exposing chat logs, files, user accounts, and AI assistant configurations through prompt injection and unauthenticated API endpoints.
   • Technical Breakdown (24:59):
     • “They were able to leverage a prompt injection to gain not only read access, but write access into their production databases within just two hours.” [24:59, Hector]
   • Severity & Responsibility (25:54): Hector criticizes McKinsey’s implementation of AI and laments that organizations rarely reward researchers who disclose these flaws.
     • “This right here is the perfect example of a terrible implementation of AI into your organization.” [25:01, Hector]
   • Attack Chain (26:43-29:43):
     • 200+ API endpoints, 22 left unauthenticated, enabling SQL injection and IDOR (insecure direct object references).
     • “A SQL injection in 2026. So much SQL injection out there, so many SQL injections.” [27:03, Chris]
   • Pen Test and Vendor Advice (35:00):
     • Companies must scope security tests well, share architecture details, and demand thorough API endpoint testing—including attempts to chain vulnerabilities for real-world exploit simulation.
     • “You have to find a vendor that provides that capability, that are esteemed in their space and have red teamers… Not every company offers that.” [39:04, Hector]

3. SEO Poisoning and VPN Credential Theft: Storm 2561 Campaign

   • Overview (41:12): Storm 2561 used SEO poisoning to push fake VPN software high in search results, distributing trojanized installers that steal user credentials even while faking legitimate downloads.
   • Dangerous Ad Buying Loophole (43:27): Chris recalls how scammers abuse big ad networks (e.g., Google Ads) for distribution—sometimes with the ad platform profiting doubly from both good and bad actors.
     • “They get paid by the bad company and paid by the redirect. So why would they want to stop it? What's their financial motivation to stop this?” [43:55, Chris]
   • Corporate Risk (44:24): Even with basic IT policies, users often seek new VPN installs outside official channels, risking corporate access—especially if onboarding or remote work is poorly managed.
   • Effectiveness of MFA and Automation (46:08-47:17):
     • MFA helps but may not stop real-time interception; attackers increasingly use Telegram bots to automate credential harvesting and OTP relay.
     • “It's all automated now, bro. Not all of it, but some of it is. And these kids are doing… it's pretty insane.” [47:53, Hector]
   • Actionable Tip: Organizations must strictly control software distribution and educate users not to download key software from search engines or unofficial sites.

4. Destructive Hacktivism: Stryker Medical Device Supply Chain Attack

   • Incident Details (51:06): Iran-linked group Hacktivist Hondala breached Stryker Corporation, allegedly exfiltrating 50 TB of data and remotely wiping servers, devices, and phones via Microsoft Intune.
   • Ethical Tensions (52:01): Hector reflects on targeting limits, noting even hacktivists should have boundaries when healthcare supply chains are at risk.
     • “Once I would have learned it was a medical company...I would have just moved on with my life.” [52:41, Hector]
   • Motivation & Supply Chain Risk (53:18): Attack was in retaliation for US actions; even if not disabling active medical equipment, corporate disruption undermines healthcare delivery.
   • Attack Timeline (54:06):
     • Start: Credentials compromised, leading to Azure/Entra admin access and privilege escalation.
     • End: Mass device wipe via Microsoft Intune, possibly due to lack of (or non-use of) available guardrails.
   • Critical Quote:
     • “They could have deployed the guardrails that were offered by Microsoft to prevent exactly this... This was not the first company that's ever been wiped before through Intune. But it won’t be the last.” [55:01, Hector]
   • Business Continuity Lessons:
     • Major incident wiped out executives’ communications and decision-making tools. Every org must plan for a total device loss scenario—ensuring backup communications and clearly defined disaster protocols.
     • “If all your executives, all your teams, are offline at the same time, how do you communicate at that point? That’s a hell of a takeaway.” [58:26, Hector]

———————————————————————— Notable Quotes & Moments ————————————————————————

• On the disbelief of unnoticed massive exfiltration:
  • “How does someone move a petabyte of data out of your network and you don’t notice it?” [00:00, Chris]
• On the economics of cloud bandwidth:
  • “Traffic equals money. If you have egress came from Google Cloud... the bandwidth bill alone should be $50,000–$90,000.” [12:04, Hector]
• On API security failures:
  • “You have to bring in a vendor to help you validate, stress-test, threat model your architecture... You have to be very mindful of your vendor and how you choose them.” [39:04, Hector]
• On legacy tactics and new automation:
  • “We didn’t have none of that cool shit back in the days... I had to walk in the snow to get a password.” [48:04, Hector]
• On corporate disaster readiness:
  • “If you're a 56,000-person company... and your key employees lose access to all that stuff, how are we making decisions?” [57:32, Chris]

———————————————————————— Timestamps for Important Segments ————————————————————————

• 08:11 — Telus Digital breach: 1 PB of data allegedly stolen
• 09:21 — Hector’s breakdown of negligent oversight and how such exfiltration goes undetected
• 13:05 — Discussion of cloud bandwidth economics and cost anomalies
• 19:18 — On probable overstatement of breach data
• 21:37 — McKinsey’s Lily AI platform exposed by Codewall via prompt injection and API bugs
• 24:59 — Speed and ease of full production database compromise
• 26:43–29:43 — Chained attack vector (API > SQLi > IDOR) enables mass exfiltration
• 35:00–39:04 — Advice for companies on properly scoping pen tests and vendor selection
• 41:12 — Storm 2561’s SEO poisoning fake VPN campaign
• 43:27 — How ad networks profit from both scams and legitimate clicks
• 46:08 — Limitations of MFA against modern credential theft
• 51:06 — Stryker hack: destructive wipe via Microsoft Intune, supply chain threat
• 58:26 — The challenge of business continuity when leadership is digitally disabled

———————————————————————— Bottom Line Lessons ————————————————————————

• Data exfiltration at massive scale signals not just technical failure but organizational mismanagement. Watch network and cloud billing for early warnings!
• Even prestigious firms and innovators (e.g., McKinsey) fall prey to basic security gaps like unauthenticated APIs and SQL injection. Vendor diligence and rigorous pen testing procedures are critical.
• Old tactics like SEO poisoning and malvertising remain dangerously relevant—especially as automation enables attackers to defeat even current user protections.
• Destructive supply-chain attacks, especially on healthcare-adjacent organizations, create organizational and societal risk far beyond immediate IT damage.
• Every company must plan for disaster scenarios where core digital communications, authentication, and access are lost—a quick tabletop exercise may reveal major gaps.
• Finally: “Developers are not security people. They’re fucking terrible at security for the most part. No offense.” [32:45, Hector]

For more, including advice on API and incident response, tune in or see the show blog.

—End of Summary—

Transcript

[A]

How does someone move a petabyte of data out of your network and you don't notice it?

[B]

Hector Monseager was responsible for some of

[A]

the most notorious hacks ever committed.

[B]

Special Agent Chris Tarbell and FBI informants

[A]

participated in some of the world's most

[B]

infamous hacks that caused up to $50 million in damages. A life in the shadows Cyber attacks on the.

[A]

Welcome to Hacker and The Fed, episode 124. For the free shows, I'm Chris Tarbell, former FBI special agent working my entire career in cyber security. And I'm joined, as always, by Hexor Montegor. Hello, Hector.

[B]

Hi, how you doing?

[A]

Hector's a friend, podcast co host. He's also a former black hacker who once faced 125 years in prison for his many years of hacking under the codename Sabu. Our stories declined in June of 2011 when I arrested him and then convinced him work with me at the FBI. Hector's now a red Teamer, researcher, cybersecurity xer, and co founder of SafeHill. Applause, applause, applause, applause, applause. Hello, friend.

[B]

Hi. How are you?

[A]

Good. We had a hell of a live show this week. Want to thank the great hacker in the Fed listeners that joined us on our live show last week. We had a really good time.

[B]

Yeah, it was a great conversation. We were there about an hour and a half. We had some really good questions, a lot of back and forth. You know, I gotta say, like, I. I enjoyed it.

[A]

Yeah, it was fun. So we'll have to plan another one. Hopefully. Guys, send us some, some dates or if you like, a different time, or whenever you like it. If you guys want, like, on a Saturday night or if we get a big enough crowd, we're happy to move it to a different date and have a good time. We might move it to a different platform. We might have it on LinkedIn or on YouTube. We haven't decided that whatever you guys, you know, think works out best for the. For the audience. However, we can get the most people there so we can have a good, spirited conversation. Because to be honest, Hector and I love talking to the audience more than talking to each other.

[B]

Yeah, no, listen, I appreciate it. I like talking to the audience. I like to hear what they gotta say and, you know, the responses. You know, last, last week when we recorded that session, the live session, you know, I get passionate, brother. You ask a question, you alley oop it up to me and I'm like, bang, bang, bang, bang, bang. I started throwing out a whole bunch of things, points, and the crowd is like, yeah, Hell yeah, brother.

[A]

You know, I also like it when they say you're full of.

[B]

Yeah, well, no way I'm full of. Come on.

[A]

Oh, that's just me.

[B]

That's just you. They're nice.

[A]

They're nice.

[B]

They're nice to me. I'm glad.

[A]

To your face. To your face on the Internet. Not so nice.

[B]

Yeah, that's fine. I'm cool with that. I don't mind.

[A]

So we just did the Patreon. Thanks, you guys, for sub subscribing to the Patreon, supporting the show. Also, hit us up at hacker and the fed.com for our merch. Trying to move some merch to support the show a little bit. Gave out some merch at the live show, so that seemed to go over well. So for those that were on the live show, we should be getting that out here this week. Appreciate you guys joining and wear your hacker in the fed shirts and sweatshirts and hoodies and all that and do the show proud. We appreciate it. So anything fun going on at Seafood this week? I know that you and I are traveling this week. We're. We're. As this came out, we probably are on stage as we speak. As. As this is coming out Thursday morning, so.

[B]

Yeah, I'm excited. I can't wait to see you. I know. We're gonna hang out, grab some dinner or something.

[A]

We'll probably not be allowed in a restaurant last time because your skin color. We're down in the south again.

[B]

Well, I'm glad you had to see it. All right. It's not. It's not. It's not fiction. It does happen, you know. But yeah, even if it happens, we go back to the hotel room and just take our clothes off and order some food just like we did last time. Like, it's okay.

[A]

That's a normal thing for us.

[B]

Oh, yeah, yeah, yeah. But. But no, everything's cool, brother. Listen, first off, the merch is dope. Shout out to you and the team for putting the merch together. I love it. Second off, you know, I'm doing fine. Safe. It was beautiful. A lot of really good progress with the team and development research, massive Q1 spirit. And we're about to wrap it up. Like, we're literally towards the end. And Q2 is like an even bigger sprint for us. But what I'm going to say is for anybody that's out there that needs some sort of a pen test, they want to get involved in ctem, feel free to ring us up, check us out, because we'll Be doing really cool demos soon, actually showing off all the new capabilities. So, yeah, that's kind of where I'm at.

[A]

Yeah. Guys, hit up Safe. Tell them you heard about them on Hacker in the Fed, and I'm sure they'll give you a hell of a deal. Oh, yeah, give the friends and family discount for Hacker. Hacker in the fed.

[B]

Oh, yeah, 100%. Well, you know, we've had people reach out. I know from the audience.

[A]

I know a lot, a lot. A lot of the Hacker and Fed listeners reach out for you guys. I think it's fantastic.

[B]

Oh, yeah, you know, it's. It's been a really cool experience to see that kind of. That level of support. And I appreciate you guys. But also the cool thing is this is something I tell everybody, regardless if you come from the show or not. You know, once you're part of our ecosystem, we're going to give you all the capabilities we could offer. You know, we're going to give you all the access to information if you have. For example, last week we had a. We had a customer that they had a really weird email situation. They thought that their CFO was compromised. Right. Without going to too many details, but what ends up happening is, is that the email looked legitimate. It came from the proper IPs, it came from the proper email client. The email headers all match. The dkim and SPF and all that. It all matched. So there's either one or two things happening. The person's computer was actually compromised and the adversary was sending out emails from. From their actual email client, which is a possibility.

[A]

Sure.

[B]

I've done that. Or the employee went rogue. Right. I mean, it's just a rogue employee. Now, the thing is, there was a third option everybody considered that I haven't seen in a very, very long time, Chris. And that is when you use a certain mail client, like Thunderbird or Outlook, whatever, Right. Like a physical client, quote, unquote. If you have terrible Internet and you send out email during that terrible Internet session, those emails get queued. And so what happens is the email doesn't go out immediately. It might go out much later, especially once you have, like a better Internet situation. Sure. So what ends up happening with that person and that company, that customer, is that their CFO was traveling. They sent out a whole bunch of emails one month, and when they finally got home, all the emails got sent out because they were queued up in their client, you see. So there's. There's like a. 30. 30 days or five weeks worth of emails that Were delayed with, wait.

[A]

The person was traveling and didn't realize for 30 days emails hadn't gone out. Like, like this is the CEO of a company. And didn't think, oh shit, I didn't get a reply. If I don't get a reply by from yesterday, I'd be like, what the is going on?

[B]

That's the problem with executives, brother. You know, they, they, they're thinking that delivered, we're good. Yeah, that's one problem. That's one problem. But that's exactly it. The, the, the emails were queued in the mail client and he never verified or validated it. Just moved on with their lives.

[A]

Wow.

[B]

When they finally got home after travel, the email sent out and it looked like a fishing campaign. Yeah, because it was like old transactions like hey, send out X amount of dollars to this person. Like wait, hold on a second, we already did that two months ago. The hell are you talking about? Right? See it's good to talk about these little events because like it, it's provides you some perspective. Yeah.

[A]

It wouldn't cross my mind that, that somebody didn't look back on an email that was sent 30 days ago. No follow up.

[B]

Exactly.

[A]

All right, you running into some stories. We got a lot of stories today.

[B]

There's a lot of stories. Some of them are good, some of them are scary.

[A]

Oh, they're all scary. Everyone, everyone says they're scary. So no good time. Telus Digital confirms breach after hacker claims one petabyte of data theft so Canadian BPO giant Telus Digital, which is a business processing process outsourcing arm of Telos Corp. Which provides customer support and AI services, they have confirmed an unauthorized access to a limited number of systems after an extortion group Shiny Hunters claim to have stolen nearly one petabyte. That's for those that don't do the math. That's 1,000 terabytes of data over a multi month intrusion. Stolen data allegedly includes customer pii, financial information, FBI background checks, salesforce data, source code, detailed call records and metadata, voice recording agent performance ratings, AI powered support tools, fraud detection databases and content moderated moderation data. Hector, how does someone move a petabyte of data out of your network and you don't notice it?

[B]

Yeah, very simple when you have a negligence team all the way to the top. So I'm not going to blame a random security guy at Telus that wasn't given access to the tools to kind of deal with something like this. This is a product goes all the way to the top, obviously going all the Way to the top. No validation, no verification. The systems worked. Are we even tracking egress traffic? The answer is no. Because a petabyte of data, assuming that that's a legitimate, you know, claim. Right. Or can be backed, would imply that the adversary was stealing and exfiltrating information out of that network, out of that environment, you know, over a period of time. You just don't pull petabyte out of data off a system within 24 hours. Not really a thing. That's not right. So this went. This. This happened over a period of time and nobody noticed? You tell me that security team didn't notice. You tell me the network team didn't notice. Is a network team even monitoring ingress or egress traffic? And then, of course, you have a Canadian company sitting on FBI background check information, sitting on metadata and all sorts of. Yeah, that's a problem.

[A]

Yeah. I'm trying to think, as you brought it up, like, what is the only way that you could possibly do a petted byte quickly? And the only way I can come up with is if, like, physical access to, like, a RAID 1 server, a server where the data is written on two different drives for redundancy. And you go into there and you pull the drives and walk out with it, and then you throw in another drive and rebuild it. And the customer's like, oh, what happened to my server? Oh, a drive failed and we had to replace it. So we swapped it out, put in a new one, and it rebuilt the. Rebuilt the system.

[B]

Yeah.

[A]

I mean, otherwise there's no way you're moving it across fiber or copper without someone noticing.

[B]

Well, here's. Yes, somebody somewhere should have noticed that. So here's the problem, Right? Here's one thing that you have to think about. So as somebody that worked in data centers before, I could tell you that traffic equals money. You can't. You know. Yeah. You go to YouTube, you go to watch a video, the video is 400 megabytes long or a gigabyte long, you don't really see it. Right. You're paying for YouTube Premium or you're getting an advertisement. If you're not, you're not seeing what the back end costs for this.

[A]

Yeah.

[B]

So assuming that Telus had their own data center with their own racks and own servers, and I'm gonna go through some scenarios, Chris, you don't mind? Because I wanna break this down from different perspectives.

[A]

Absolutely.

[B]

So let's say they have a data center. They have their own rack, they have their own, you know, they. They were able to Kind of negotiate a decent budget or even a price, like per gigabyte or per gigabit for traffic. Per terabyte per traffic. So we do some basic math here, right? And like cloud provider calls, assuming that they were. The egress came from like a AWS environment.

[A]

Actually, I think it was Google Cloud.

[B]

Okay, we'll get to that. Yeah, we'll get to that. I want to give different numbers because I, when I worked in the data center space. It's fucking expensive. It's not cheap. So if it was like Google Cloud, at the very least, Google Cloud is charging depending like 0.5 to 0.9 cents, depending on the customer, depending on the contract, depending on, you know, whatever deal they've negotiated. Because, you know, as you become a massive customer in Google Cloud or aws, they eventually start negotiating prices with you. Right?

[A]

Sure.

[B]

So one, assuming the best case scenario for today, tell us, then their bandwidth bill alone should be anywhere between 50 to $90,000. That's one.

[A]

Well, for this breach or for.

[B]

In overall, just, just the traffic. Just the traffic by itself, the egress

[A]

should have seen a 50 to $90,000 anomaly.

[B]

Exactly. Right? So now let's say that they have bulk pricing, okay? Bulk pricing. Now, with bulk pricing, when I worked at, you know, freaking, I'm not gonna mention the company name. If you really like the customer and you can make a bulk price on bandwidth you're giving them, you're able to do like a terabyte or terabit, let's see, it's about a penny to 2 per GP, right? So at this rate, it would have been something between 10 to $20,000, right? Assuming that it would be like a large tier one isp, like let's say, let's say they were able to rent a rack at, AT and T and get a really good deal at the very least is $5,000 in traffic. Now here's the crazy part, Chris, here's the fucking crazy part, if you don't mind, right? Regardless of how or what kind of deal they had, right, There would have been a sudden jump not only in the bandwidth, but in a bandwidth cost. And for any of you guys out there, if you have aws, Google Cloud, whatever, Alibaba, right, Cloud, the moment you start, there's like a, there's like a quick boom, right? A jump from a thousand to eight thousand in a short period of time, you're going to get some sort of alert. There's some sort of threshold somewhere alerting somebody that, hey, by the way, you just blew through $5,000 worth of bandwidth. You may want to investigate that. So what this tells me, and I want to call bullshit on this story, if you don't mind bullshit on the numbers. Right?

[A]

Call it.

[B]

All right, so in Worst case scenario, 90,000. Best case scenario, 5,000. Right. Five to 90,000 range based off of bandwidth calls. You would have gotten alert from your cloud provider or your data center provider or your bandwidth provider. You would have got an alert from your networking team, firewall team, somebody, I hope. Now let's assume all of that fails, Chris. Let's assume that nobody paid attention to alerts. Nobody cared about the firewalls, nobody looked at egress traffic. Here's the problem. You're the adversary. You're probably a fucking kid. 18 year old kid, right? Chris, do you have the infrastructure to store 1 petabyte of content somewhere? That's an honest question. I don't personally. Well, I'll give you an honest answer from a former adversary. Out of all the systems I've fucking ever compromised in my life, I never ran into a random server with a petabyte of empty data free space that I could use for an exfiltration. I found some really cool stuff I found. I've hacked into superclusters before. Yeah, but this would have required that the adversary had that infrastructure to store the information.

[A]

I will say these guys have been around for a minute. So. And they've had some successful ransomware attacks. Yeah, and they were asking for $65 million. So I mean, maybe that would help cover their, their infrastructure costs.

[B]

That is true. And they do have money from previous extortion campaigns. Yeah, no, so, I mean, listen, all valid points. You know, I wouldn't say that I completely call BS on the full story.

[A]

Yeah.

[B]

But this is. A lot of things had to happen in order for this to be successful.

[A]

You think they're doing this just for headlines?

[B]

I don't know. I'm sure they got something. I wouldn't be surprised if they got, you know, 100 terabytes. Yeah, but once you, once you pass a certain number, you have to have infrastructure. You have to be able to handle costs. Because remember, the cost goes both ways. It's not just tell us paying 5 to 90,000 based off of bandwidth traffic, then you have the destination that's paying for traffic too. Right. So this, this was, this was a big money operation. If it was successful and they did exfiltrate all that information, that company's fucked. Like they're done.

[A]

They're saying the attack vector was Credential based accessed using Google cloud platform credentials and compromised tokens that was discovered in data exfiltrated during the earlier sales. Sales loft drift breach. So.

[B]

Which makes sense.

[A]

Yeah, yeah, yeah, it makes sense. So you know the credential, you know, discovery and then they pivot to access the large scale cloud struck storage. I, I get you, I, I look thinking about it, you know, moving what's really the, the point of moving a petabyte and then when you're going to move it, what the hell are you going to do with. Makes good sense to me of you know, from your perspective of why this could all be bullshit.

[B]

Yeah. And maybe it's not all bullshit, but I think a lot of it is bullshit.

[A]

Right?

[B]

Here's what I think. If I'm the adversary and I break into this organization, I'm not just gonna take everything, but it's just me. I'm speaking for myself, right? My own opinion. Guess what I'm looking at those FBI background checks. I'm grabbing those, right? That's the first thing that's out of there. The second thing is like sales data because that they're gonna pay me for that, right? What else, what else am I looking for? I'm looking for things that I can actually leverage against the company. But I promise you, if the 1 petabyte number is correct and is all valid, then most of that is probably metrics and logs and shit. You know what I mean? You know that, right?

[A]

Yeah, I hear you. It's a, it's a lot, there's a lot of background data and there's bumping up the information just to get to that one petabyte number.

[B]

That's exactly right. So they probably rounded it off. Oh yeah. It's a parabyte of data that we went through in reality probably took a terabyte worth of shit.

[A]

And then when they start doing that stupid math when you start times in it by a thousand instead of 1024 really it gets out of hand.

[B]

Yeah, that's right, that's right.

[A]

And they try to sell you a terabyte drive when it's really only 936 gigabytes. That's right. Lion bastards.

[B]

Lying bastards. But obviously an exfiltration took place because otherwise the talents group, this company, whatever they're called, sure. They would have not even confirmed this because they're, they're a Canadian company. They don't, they don't have to abide by. Unless they. Are they publicly traded here? I don't know, I haven't checked.

[A]

I Don't know. Yeah, I mean, yeah, something happened and it was a multi month, you know, strategic intrusion. So they had access for a long period of time.

[B]

Yeah, but.

[A]

But you're right, moving a petabyte might just be a headline, headline grabber. But we'll see, we'll keep people updated on it. Interesting story how we hacked McKinsey's AI platform. So a security research firm, Code walls, autonomous offensive AI agent, discovered an exploited vulnerability in McKinsey and Company's internal AI platform, Lily, which was used by 43,000 employees for strategy, client research, document analysis and AI assisted workflows. And gained full read write access to the production database within two hours. Starting from just the domain name. Access included 4.6 million plain text chat messages, 728,000 files, which are PDFs, Excels, PowerPoints, Word documents with client files, 57,000 user accounts, 384,000 AI assistants and 94,000 workspaces, system prompts and model configurations, and 3.86 rag document chunks. Do you know what RAG document chunks are?

[B]

Yeah, what is it? Yeah, so that's actually really cool. Right? So RAG is something that we're leveraging. It's called Retrieval Augmented Generation.

[A]

Okay.

[B]

And it's kind of like, conceptually, it's like a framework that allows you to improve large language model accuracy. It's actually really dope. We're using that safe fill. And so what it does is it retrieves, let's say, data, or you bring a whole bunch of data into it, like with data enrichment, and then you kind of hyper focus that large language model or whatever model you're using to leverage it as kind of like a database. Right. So now the AI model is no longer guessing what the answer might be or trying to contextualize it. It knows to look in this RAG database or RAG vector database to kind of get the answers right. It's actually huge.

[A]

Oh, all right. Well, a lot of shit stolen or accessible. All publicly exposed API documentation revealed that they had 200 plus endpoints and 22 unauthorized unauthenticated endpoints exploited for the initial access. Same shit. Different. Different story.

[B]

Same, different story. This one is worse, in my opinion. This was worse.

[A]

Tell me why.

[B]

Okay, so for those of you that don't know, McKinley and company, they've been around for quite some time. Very old company. They're involved in all sorts of research, intellectual property. The fact that their organization immediately moved into AI because, you know, AI is still, quote, unquote fresh. It's still new. Right. 43,000 employees here's the. Here's where it gets crazy. 384,000 AI assistants. That's what four was. That. Was that four per employee or something like that?

[A]

Much worse than that.

[B]

Yeah, right. Yeah, we. We're in a weird place when you look at an organization like this where they're sitting on massive amounts of documents, contracts, reports, patent information, emails, all of

[A]

which nearly nine per employee.

[B]

Nine agents per employee. Chris. They really drank the fucking Kool Aid. They really went up beyond the fucking scope. And so 46.5 million chat records or messages, okay. I had to process whenever. When I first read the story. I read Cold War's blog post. By the way, guys, go show Cold Wall love. I don't know who these guys are. I haven't met them personally. Show them love. Go read the blog post yourself. It's Codewall AI. Go to the blog. Now, here's where it gets crazy, Chris. As far as I could tell from, like, the methodology, they were able to leverage a prompt injection in McKinley's own system to be able to gain access, not only read access, but write access into their production databases within just two hours.

[A]

That's nuts.

[B]

That is nuts. This right here is the perfect example of a terrible implementation of AI into your organization. You know, shout out to McKinley for trying to be ahead of the curve, but obviously their implementation was bad. Now, the fact that Cold will publish this blog post, right? Then you can say, well, you publish it for marketing, blah, blah, blah. You know what this tells me? This tells me that they reported to McKinley and McKinley was like, all right, cool, thank you. And boom, they moved on with their lives. Because if McKinley was smart, McKinsey. Sorry, if McKinsey was smart and they're like, damn, you guys found. You basically got access to our entire. Like our. Honey, like, you got access to our crown jewels. Let's work together. Can I hire you guys? Can we be like, can we be our vendor and can you stress test our security? This blog post wouldn't fucking exist. Let's keep it real.

[A]

Let me ask you that. I don't. I don't like that. That sort of comes along the lines of ambulance chasing.

[B]

I get that. I understand that, but I'm not going to that.

[A]

I'm not.

[B]

I'm not saying.

[A]

I hear you. I hear you. I agree with you.

[B]

What McKinsey should have been, what they should. What should have come out their fucking mouths was, thank you. You just saved us billions of dollars. Hey, you want to work together? Can I hire you?

[A]

Right? Yeah. This isn't like an employee clicked on a link or some shit like that that made them vote on. Well, they just set their shit up wrong.

[B]

Yeah, yeah.

[A]

And then didn't test. Apparently they didn't test it at all. Or if they did, if they did have a third party test in their shit, that, that fired.

[B]

Well, yeah, that's. That's a crazy one. Guess what though? This is a tip of the iceberg, okay?

[A]

Why is that?

[B]

Because this organization, they're not the only ones that did this bad implementation. They're not the only ones that went this route.

[A]

Do you think they're listening to us right now? And they're gonna, they're gonna.

[B]

Yeah, they're probably gonna whack me in a few minutes. Yeah. After this goes live, I get waxed.

[A]

They're gonna start stress testing their shit. I mean, they need to. I mean, look at this exposure, brother.

[B]

46.5 million chat messages. If you are a, a company that's involved in like you're. We're part of organizations that's doing espionage work, bro. You cut everything here.

[A]

Well, the problem is it's not their fucking data. Like, it's not McKinsey. I mean, it's their clients. They're passing all their, all their client in there to be analyzed.

[B]

Yeah, well, this is definitely a supply chain attack. You're right, because a lot of this is client stuff that's being. Going back and forth and being analyzed. Yeah, this is, this is pretty insane. So I want to go into a little bit of the technical details because the article is actually really good. So. So in terms of attack vectors, this is what audience like really wants. Get to nitty gritty. Here's what they found. They did identify some publicly like accessible API documentation, APA documentation, which is fine. That's normal. There are about 200 endpoints for API, but about 22, which probably should have required authentication, allowed unauthenticated access to those endpoints. That's terrible. Right? Because that was literally the entry point for these guys. Finding the next set of issues, the next step, which was a SQL injection. Yeah, a SQL injection in 2026. So much SQL injection out there, so many SQL injections. Chris, you're not talking about patterns, right? Yeah, look at patterns. So the identified API endpoints 22, which were required authentication that allowed them to kind of engage without authentication. They identified endpoints or endpoints that would allow us to do a SQL injection. Then they chained that with another vector called an idor. I love eye doors, insecure direct object references. Then they started to access user data. No CVEs, no zero days classic error based or blind SQL leveraging or SQL injections reflected through, you know, database error messages, bro. Like that is that simple. A little bit of recon, a little bit of SQL injecting, a little bit of chaining of different things and then we're able to get access to the backend systems. I mean, is that, it's that straightforward? Great blog post. I love this. This right here was dope. You know what I like? You know what I like more? I like that these guys were legitimate researchers and it's. It reported it. I'm glad it wasn't a situation where it was like an adversary, that founders exploited it and then just destroyed that whole market.

[A]

I mean, they could have, you don't know, prior to this. This could have been found by somebody else and just didn't get out there.

[B]

Yeah, here's, here's my take on that, if you don't mind, right? Most adversaries now are lazy. They're using bots to find these paths. But this is an attack chain, Chris. Most adversaries are not doing attack chains, right? They're looking for a quick hit and run a quick drive by a quick. Oh, is that, is that zero they still use functional here? Yeah, yeah, it works. They're looking for a misconfiguration is very obvious. The credential exposure, that's what most of the adversaries are leveraging. Something like this requires you to sit down and think, okay, so what are

[A]

you doing once they're identifying the 22 unauthenticated endpoints? So there's your API abuse. How are you then moving over to the blind SQL injection?

[B]

Oh, it's a great one. I'm glad you asked this question. It's the fun part because now you sit there like an asshole and you start sending requests over API and changing things little by little, right? Yeah, you start, you start doing different things. So for the audience here, you want to, you want to play on the API, I got you one. It's a JSON endpoint. It only accepts JSON, but if you've been around long enough as a developer or researcher, you will know that some of the JSON libraries also accept xml. What if I send an XML payload instead of a JSON? Oh, it just crashed. Interesting. What's the error message? You know, we do not accept xml. Okay, let's move on. Let's change the HTTP method instead of a post. Can we do a put it worked. Can we do a delete A delete that didn't work. What about a modify. What if we just start blasting different perimeters? That's exactly how they found this.

[A]

And so how does not your endpoint protection not pick up on these different attempts on things?

[B]

There's no endpoint protection for this.

[A]

There's nothing.

[B]

There's a handful of companies that offer API security, wrapping and interception. I know one, I know one company that, that does something like this, but they have no customers because they'll say these, these. Because these companies, like, we don't need an API security gateway thing. We know what the hell we're doing and this happens. This happens.

[A]

Do you recommend it? I mean, do you recommend that, that service or.

[B]

No. Here's what I think. Here's my personal opinion. My opinion is yes, if you're leveraging APIs like this and you're not leveraging a WAF in front of an API. A web application firewall.

[A]

Yeah.

[B]

And by the way, that's not guaranteed to do anything. Right. WAFs are mostly static. I think Cloudflare now is using AI for their WAF, the web application firewall. But developers are not security guys, you know that.

[A]

What?

[B]

Yeah, developers, not security people. They're, they're fucking terrible at security for the most part. No offense to the developers out there, but this is laziness. This is negligence.

[A]

This is not two different things. Two different things. Laziness and negligence are two different things.

[B]

They're both. In this case, it's both.

[A]

Is it?

[B]

Yeah, absolutely. Because.

[A]

Maliciously negligent.

[B]

No, I want to say malicious. I don't think, I don't think they. I don't think that this company set out to fuck themselves.

[A]

No, not the company, but, but the developers.

[B]

I don't think the developers did that either. I don't think the developers went out and say, you know what? We're going to do this in a horrible way that's insecure and it's going to cost me my job and it's a cost my employer billions of dollars of brand reputation. No, I don't think so. I don't think it's malicious. If it was malicious, these guys cold wall, they would have found a back door that would have allowed them to circumvent all controls. Right. That's not what they discovered here. They discovered a series of issues that allow them to engage a SQL injection and then get access to Right access to the database. There's your negligence. Negligence Gaining right access to the data through a SQL injection. There's your negligence. Because the developer Sort of created different users for different roles with different permissions. Right, that's 1, 2. The laziness. Did you validate these API endpoints, accept or deny unauthenticated requests? There's no testing there. So if you're going to be in that position where you're going to expose publicly this massive data set through API, you have to bring in a vendor to help you validates stress tests, threat model your architecture to identify these gaps. I promise you, little, little cheap plug here, promise you safer would have found this or any other company that does the kind of work that we do, they would have found that. That's the reality. This is, this is basic one on one. This, there's nothing sophisticated here. You know what is sophisticated? The chaining. The chaining is what changes the game and I always tell you that.

[A]

So if someone call, if someone's listening to this and they, you know, they are running something similar to this or they have some APIs out there and all that, what exactly do they have to ask SafeHill in order for Safe Hill to find this? Like this isn't just a standard, you know, pen test, or does it, would this fall under a standard pen test?

[B]

That's a great question. I'm glad you asked that question. Right, so if you have a similar setup or want to deploy a similar setup and you want to bring a vendor with a Safe Hill or somebody else, here's what you need to ask for.

[A]

Safe Hill. People should be looking for Safe Hill.

[B]

Yeah, it's really good for safety. But you know me, I try to be cool.

[A]

Right?

[B]

So be cool. So here's would be cool. Here's what you do. You go to the prospective vendor, you say, hey listen, here's what we're doing, here's what I need. I would love a threat model of our architecture and I'll send you whatever you need to do that, whether it's stride or whatever, whatever threat model framework you want to use. That's 1, 2. I want a penetration test of our web application, but I need you to beat down our API endpoints and here's our swagger or OpenAI specifications. I'm going to set a crown jewels. Can you get right access to our database from our API? Right. You start to put these rules in place, you start to put like a rules of engagement and it'll be handled in a very safe way. And all of a sudden, all of a sudden, you know, you're, you're finding these issues through your vendor and you're fixing and remediating these issues to your vendor.

[A]

Is your vendor going to come back and say you have 22 unauthenticated endpoints?

[B]

That's a great question. No, no, no, no. Definitely not. I wouldn't. And I'm going to say I'm going to be very realistic with you. Right. The vendor may not even come up with 22 shout out to Coldwall. He did a very extensive job. But we don't know if Coldwall had full coverage. It could have been 82 API endpoints that are unauthenticated. And maybe your vendor comes up with 82 or maybe your vendor comes up with 5 that they found. But guess what? Even one is gonna give you enough information to now review your source code and then find the pattern that allowed this to happen.

[A]

I guess my next question would be, would they also find those SQL injection vulnerabilities or does it not even matter as long as they lock down the API?

[B]

Ooh, see that? I like the way you're thinking because now you're talking about a kill chain. Yeah, right. What's the kill chain? If an adversary breaks into our network using these four different issues, right? Unauthenticated API, SQL Injection and blah blah, blah, whatever. Right. Well, if I, if I make sure my APIs are authenticated and they're properly validating sessions, that kills the chain. It doesn't fix everything, but it kills the chain. It stops the attack. So at that point, Cold war would have just hit a wall, quite literally. Right? Now if it's like a full pen test and your vendor comes back with a whole bunch of different findings, a SQL injector, for example, the first thing you do is you're going to. First thing your quick win is authenticate everything.

[A]

All right?

[B]

Now if somehow the adversary gets past that, guess what? It's going to take time for that. Now that gives you time to deal with the other deep seated issues, the SQL injections and everything else, right?

[A]

Yeah. But my direct question is, is a non safe Hill company going to find those SQL injections? Is that part of a standard test or do you have to, does the client define it? They have to out there and say go beyond, you know, just the API issues, look for the other look, other things. What I'm getting at is I think there's a lot of companies out there that have implemented these things. They may be, oh, I'm scared. I don't think they know how to properly scope what they need with a vendor.

[B]

Yeah, that's a big problem. Right? Scoping is an issue. Now let me Go get back to your question. Before that, let me go to scoping. Right, so before that, you have to give that vendor, let's say seafood. You give the vendor as much information as you can about the architecture and your infrastructure so that they can understand context. It could contextualize your environment. And then they could do all these different tests and kind of follow different paths and then try to change findings together. That's one. But not every company has those specialties. You have to find a vendor that does that stuff, right? You know, so you have to look for vendors that provide that capability, that are esteemed in their space and they have red teamers and so on that could really think outside the box. Not every company offers that. So you have to be very mindful of your vendor and how you choose them. You'll do your research, right? Get some different quotes, talk to the security teams. It's definitely possible, right, during the sales process. But beyond that, the next thing is scoping. If you go to a vendor, say, yeah, we have 10,000 API endpoints, here's a swagger file. I need this done by next week. Guess what? Here's a reality. They might miss 80% of the file findings. They might miss 90% of the findings or 95% of the findings. You know, this time scope that people is this hard time stop that people add to engagements. It's not helping you. This is why Gartner came out with the CTEM framework, to make things like this more continuous and literally the tenant number one tenant as part of the CTUM framework, the continuous Threat Exposure Management framework is what it's coping. You have to understand your assets. And when you work with a vendor, you have to give them those assets. You got to give them context, just like AI. Chris, we talked about AI a little while ago, right? AI doesn't know what the hell you're saying. It's tokenizing your messages. But if you help it with like a rag vector database, now you're contextualizing and they're able to provide you the local language model. Now they're able to provide you more directed answers. Make sense?

[A]

Yeah, absolutely. All right, so storm 2561 uses SEO poisoning to distribute fake VPN clients for for credential theft. So cyber criminal threat actor storm 2561 runs an ongoing credential theft campaign using SEO poisoning to rank spoof domains, high end search results for enterprise VPN software queries. The victims Download the malicious zips from the attacker sites or GitHub containing a trojanized MSI installer that deploys fake VPN clients and, and then captures VPN signing credentials via phony GUI GUI prompts and then harvest stored configuration data and exfiltrate to a C2 while redirecting legitimate downloads to avoid suspicion. Man, we're seeing a lot in the VPN space recently. We covered it on the live show that we did last week about a company that was using VPNs or they owned all the different. One company owned all the different VPNs including your back VPNs. And we cut, you know, it was Cape Technologies that they owned all the big VPNs companies, all the top ones. And then they, so they, they also owned the bad webs, the websites that ranked VPNs and they ranked their owns. And as we're going through this this week alone on a very, very well known podcast, I heard a, a the, the hosts of the podcast read a commercial for Cyber Ghost, which was one of their VPNs in that very story. So they're still out there advertising on a podcast that came out this week which again, thank you guys for supporting hacker and the Fed through our merch and through our Patreon so we don't have to have, you know, pass along these, you know, advertisements that we don't really believe in just to keep the show alive. So again, that's where you, when you buy a hacker in the Fed shirt or you a Patreon subscriber, that's what you're keeping off damn show these advertisements. But anyways, SEO poisoning for to, to stake to steal VPN clients, brother.

[B]

You know, one of the people that I know for a fact has worked on this before. You know, you've dealt with this before. We've talked about malvertisement campaigns. This is literally the same thing.

[A]

Yeah.

[B]

And you know, one of the, one of the points I always bring up that you told me it blew my mind is that the, these companies that sell ads, they're, they're cool with it because they're getting paid regardless. It works.

[A]

The case I worked Google was getting paid twice.

[B]

Look at that.

[A]

Because of the redirects. They get paid by the bad company and paid by the redirect. So why would they want to stop it? What's their, what's their financial motivation to stop this?

[B]

None. Yeah, at that point it would be an ethical thing, but yeah, there's no ethics in business for companies that big.

[A]

You know, it gets lost. You know, people get ethics, people get somewhere along the way people get bonuses and there's matrix Job performances, all based on income. So.

[B]

Yeah, well, going back to this, this is interesting because this was highly targeted, hyper focused on VPN software. They were targeting corporate employees, corporate employees that weren't techie or tech savvy enough to go to, you know, ivanti.com or fortinet.com or cisco.com and download the official VPN clients. Slight laziness there, you know what I mean?

[A]

Dude, most of the companies I've worked at, they own, they let. There's only one place you're allowed to download new software, if you're even allowed to install some sort of executable or some sort of new software on your, on your device. If you did it, you can only download it from an internal page. Like I can't imagine most companies are allowing employees to go out, I guess, well, I guess if they're putting VPNs maybe they're putting on their personally owned device and they're saying you need this VPN to, to log into our system.

[B]

Or it's an employee that's negligent and they're freaking out because they, they, you know, bought a new laptop and copy doesn't know about it yet and they need to hop on. Last minute zoom meeting they forgot about and bada bing, bada boom, they go on Google, they type in, hey, I need vp, I'll post vpn. They get an advertisement, they click on the advertisement link, it looks like the correct URL VPN, you know, fortinet.com they download the malicious package, they're infected and now guess what, the corporation is now compromised. You know, is the story as old as you know, you know, social engineering is one of the oldest, you know, vectors of attacking human.

[A]

Is there something as simple as MFA on your VPN logins? Would that, would that stop this?

[B]

It's a great question. I'm glad you asked that question. So now in 2026, a lot of the modern, if not all of the modern VPN providers or tools offer you mfa, right? Or they have some really cool policies, I know, like, like Zscaler has like the zero trust VPN stuff that you have to prove your identity and you have to go through the whole process, but once you're in, you're in, right? The truth of the matter is, is that yes, but if the victim has downloaded this malicious package into the computer, then the attacker is still going to be able to intercept the MFA code as they're typing it into the client. Same shit, you know what I mean?

[A]

So I mean, if they acted within A certain. The activation of the, the token. Right. Then they could still use it. Yeah, they'd have to be pretty much live monitoring it in order to get the, the access. They're not. They're not. Okay, so it's just slow. Would slow them down if they're just collecting and reselling the logins.

[B]

Yeah, if they're just collecting and selling logins like the normal info stealer, then yeah. But that's not what these kids got. But let me tell you, these kids got like automated telegram bots. As soon as credentials come in and there's like an attempt to do an authentication, it'll show them the code for the otp, the one time pad or whatever and boom, they're inside your network. It's all automated now, bro. Not all of it, but some of it is. And these kids are doing really the ones that are more sophisticated. I've seen some of their telegram channels with some of the stuff they're doing. It's pretty insane.

[A]

You sound a little jealous.

[B]

We didn't have none of that cool back in the days. Exactly.

[A]

You're talking about, man. But back when I had to hack, I walked uphill both ways in the snow.

[B]

Yeah, that's exactly how I feel. I had to walk in the snow to get a password.

[A]

Old man hacker over here. Uncle's got a gray beard and pissed off that the kids have cool toys that he didn't get to use.

[B]

Yeah, well, listen, it's, it's different. So yeah, if you are a director of it, if you are IT support, whatever, whatever the hell you are, you have to make sure that your employees are not googling your corporate VPN software. You know, like give them a direct link. How about that? Put up a wiki page or something. Do something.

[A]

Seems pretty simple on how to do it. Yeah, I don't, I can't remember the last time I googled something. I don't trust Google, I don't trust SEO, I don't trust any of that shit. You know, I'm going straight to places to be honest with you. And I'll tell you this. Like, like, let's say like in the, like the vitamin supplement world and all that. I don't trust Amazon anymore. I. You know, there's so many fake supplements being sold on Amazon. Yeah. Like when I get my creatine or something like that. I buy that shit directly from the company. Now it might be cheaper and free shipping going through Amazon. There's so much fraud in that world in through Amazon. So. So Amazon speak to Me is becoming

[B]

like Google you, you. So you won't even go to like a GNC store? Like you just go straight to the manufacturer. Is that what it is?

[A]

I mean I would, I would go to a gnc. I don't go to a lot of brick and mortar stores. I mean, I wish I did, but it's just not. It's so much easier to have shit delivered to the house exactly what I want, not have to. I go to Stories now and they don't have it. I went the other day to get an oil filter for my, my daughter's truck and they just, they just didn't have them. They didn't have the. I mean it's not an odd. It's like pH5, it's a fram filter number five. They.

[B]

You should.

[A]

Very simple oil filter. You should have it. And so do I want to stop at three stores to get it or do I don't want to just jump on Amazon or wherever and just have it, it's at the house the next day.

[B]

But even in like the 2000s when I was really big into building cars, I had that same problem. I just stopped going to autozone. I stopped going to like, you know. And so at least here in New York is different because here in New York there's a ton of brick mortar stores I think still existing. And there was a spot called. Damn, what the hell was the name of it? Eagles. I would go to Eagles, bro, and I'm like, yeah, I need a 1989 head gasket for my Civic. I got an 89 Civic HX or CS or whatever the.

[A]

There's a place called Eagles in New York City.

[B]

It was called Eagles. Yeah, man. Eagles.

[A]

Not a damn Giants are fan is ever gonna go there. Why the hell, Why'd you name something Eagles in New York City?

[B]

Yeah, you know, it is what it is, bro. But they always had like the most obscure random things like. Yeah, and it was good prices too. But now, bro, I just go to like, you know that one site I showed you, that one site's a jamming to get all that cool stuff. We still gotta wait. I wish. You know what? I'm gonna start supporting brick and mortar stores because these freaking online websites are fucking. You know, they're fugazi, bro.

[A]

Fugazi. They're just all fugazi.

[B]

They're all fugazi.

[A]

So. Iranian linked hacktivist group Hondala claimed responsibility for a destructive cyber attack on the Stryker Corporation, which is a US based global medical technology giant with approximately 56,000 employees. That supplier of surgical imaging equipment. Defibrillator. Defibrillators, hospital beds and medical gear for the US Military. The attack involved gaining admin access, the defacing internal logins and admin pages with their branding and stealing approximately 50 terabytes of data and deploying wiper like destructive actions to reset servers, laptops, phones and network connected devices. So big attack and like Aramco reports of them wiping devices.

[B]

It's a tough one because, and I'm speaking as a former activist, right. Even back then I had some sort of ethical conundrum or boundary or limit. You know, you may not like the company for whatever reason, but in my case, once I would, once I would have learned it was a medical company that, that you know, their supply chain risk to like, you know, hospitals and, and you know, they're providing supports and services to clinics that take care of people. Right. I would have just broke the out of it. I would have just moved on my life.

[A]

Yeah. Now, now on the other side, I'm not saying I support what happened or anything like this, but, but from the other point of view, they're saying this is a retaliation, retaliation for the US attack that resulted in a girl school in Iran killing hundreds of young children. And so they're going after a company that they had a connection to US military medical devices. And again, you know, they're saying that they wiped corporate things, corporate devices, you know, corporate phones and all that. They didn't. I, I don't see anywhere where they're saying they attacked actual medical devices.

[B]

Well, yeah, I'm not saying that either. The reality is that this company is part of the supply chain regardless.

[A]

Sure.

[B]

So if this company is offline, they're not able to support them. I provide any support to any hospitals, clinics, health organizations because they're going to be offline at that point. They're, they're back to pen and paper. You know, once they're wiped out, assuming, assuming that, you know, they don't have resilience in place. If they have resilience in place, they're going to be back online just like Saudi Aramco was back online in a week. Right. We're not really seeing that right now. We're not hearing that right now. You know, so I'm not sure where they stand as an organization. But here's the reality. The attackers got in with regards to what their motives are. They got access to credentials. Okay.

[A]

Credential compromise again.

[B]

Credential compromise. They logged into Azure or Microsoft Entra. Right. They were able to Obtain admin credentials or privileges. They downloaded what they downloaded. They exfiltrated what they exfiltrated. They poked around and prodded and they're like, yeah, cool, we're good now. And then they logged into the Intune. Intune admin console for Microsoft, and they issued a mass remote wipe or factory reset commands. Now here's the crazy part. Yes, Microsoft allows you to do that, but Microsoft also gives you guardrails to avoid this. Right? So, Stryker, as much as they are the victim here, I don't like to kick the victims. And when they're down, they could have deployed the guardrails that were offered by Microsoft to prevent exactly this. This was the first company that's never been wiped before through Intune.

[A]

But wait, don't be the last. Don't those guardrails cost more money?

[B]

Ah, I think you, you may have solved the fucking case here, Microsoft. You know what? I'm not gonna get into that. That's a whole rant section today.

[A]

You asked me, if you asked me, I would think it would cost more money to have the remote wiping capabilities. It should cost more to do what they did. It shouldn't cost more to have guardrails against what they did.

[B]

Yeah, yeah.

[A]

But again, probably that's why I'm a bad marketing guy. Yeah, I make more money by allowing this shit to happen so I can give my wife allegedly drugs to not have STDs.

[B]

But there you go. That. That is the most vaguest reference back

[A]

to a certain files that you're in.

[B]

No, no, no, listen, I'm not. I'm not communicating in there. That's why I mentioned my name in there. That's something. That's two different.

[A]

It's not even your name. They mentioned a pseudo name you had.

[B]

Well, that's exactly right. That's Exactly. You're right 100%, but yeah. So the attackers, they got in, they got access to intune, they moved forward. It worked very quickly. They set a command to remote wipe device and it executes automatically. There's no extra prompts. There's no. You don't have to sit there and get a phone call from Microsoft confirming that you requested his wipe. It just did. And it works. And so what are we talking about here? We're talking about credential thefts. We're talking about setting up guardrails. We're talking about policies not validating. It's obvious that MFA got circumvented. Right, because otherwise they would have been able to log in if there was no mfa. Or there was mfa, you know, MFA on admin. I have no idea. But that's us. That's.

[A]

Talk about Fugazi.

[B]

Well, that's us. Assuming that they just logged in with admin credentials, what's possible is that they found some random employees credentials, a developer that had a little bit of privileges, and then from there they were able to escalate privileges to admin, which is totally possible in Microsoft's ecosystem. That's the whole thing. In that ecosystem, lateral movement is a big thing. So get rid of the virus, folks.

[A]

So I will say, I mean there are lessons to be learned on this. So because from this, you know, the, the, you got to think about it. If you have a company, this was a major incident and then they're key decision makers. They all lost their phones, their contacts, their communications, access to company systems. So what are we doing? If we're a 56,000person company and we have offices in 79 different countries and our, our key employees that make decisions lose access to all that stuff, how are we making decisions?

[B]

That's right. That's a good point. We always tell people that, hey, before incident even happens, make sure you have the right numbers in your phone to call the right people. In this case doesn't matter because your phone was wiped. And even if you had a secondary phone, who are you going to call when all of your executives, all your teams are offline at the same time? How do you communicate at that point? That's, that's, that's a hell of a takeaway. You know what I mean?

[A]

Yeah, I guess. You have to have a plan for this. You have to have a plan for you lose all of these, you know, like point to point, some sort of backup, you know, mesh network communication.

[B]

Yeah.

[A]

So, all right, friend, we went long this episode, but a lot of stories to cover, a lot of things happening out there. That means I'm not going to let you rant today. I don't want you to get in a bad mood. I want you to be, stay in this good mood. Guys, send us your questions. Questions at hacker in the fed.com we love hearing from you. We love hearing what you got going on. We had a lot of good interactions this week between the live show and the emails we got from you guys. Support Hacker in the Fed on Patreon, keeping dumbass commercials like you different VPNs that we don't really believe in. Off the show, five star review, wherever you download and subscribe, help us out on Hacker and the fed.com, buy your merch, buy your T shirts, buy your sweatshirts, support the show. Not only does it help support, you know, pay for the things that we need to keep the show free, but also gets the advertising out there. When you walk around your, your mall with your, your shirt on, people say it's a cool shirt. I'm gonna wear that. We're a couple cool guys.

[B]

That is true.

[A]

Share us on social media. Put our out there, get the people listening. Tell your friends, tell your co workers, tell your lovers. Hacker in the Fed where two schmucks talk about cyber security. All right, friend, I look forward to seeing you. We'll grab some food and chit chat and have a good time.

[B]

Oh yeah, I'm looking forward to my friend. We'll talk. All right.

[A]

Love and respect. Cheers.

[B]

Much love. Cheers.