The new malware on the block. [Only Malware in the Building]

Summary

Podcast Summary: "The New Malware on the Block. [Only Malware in the Building]"

Podcast Information:

• Title: Hacking Humans
• Host/Author: N2K Networks
• Episode: The New Malware on the Block. [Only Malware in the Building]
• Release Date: March 4, 2025
• Description: Deception, influence, and social engineering in the world of cybercrime.

---

Introduction to Web Injects and the Expanding Threat Landscape

Timestamp: [03:25]

In this episode, hosts Selena Larson and Dave Bittner delve into the rising threat of web injects—a sophisticated form of malware delivery that is increasingly targeting both enterprises and individual consumers. The discussion begins with an overview of what web injects are and why they pose a significant cybersecurity threat today.

Selena Larson explains, “[...] a web inject is something that gets malicious code put on a website that when a visitor goes to the website [...] they’re shown a screen that essentially overwrites what they think the actual website is. [...] you might actually believe them.” This deceptive tactic manipulates users into installing malware under the guise of legitimate website interactions, such as updating a browser.

---

Emergence of New Threat Actors: TA2726 and TA2727

Timestamp: [08:23]

Selena introduces two new threat actors identified in their research: TA2726 and TA2727. These groups represent the evolving landscape of cyber threats, utilizing advanced techniques to distribute malware effectively.

Dave Bittner humorously remarks on the nomenclature: “You got TA2726 and TA2727, which I have to say are very catchy names that roll trippingly off the tongue.” Despite the light-hearted comment, the hosts emphasize the seriousness of these threat actors’ operations.

Selena Larson elaborates, “TA2726 is the delivery driver, and TA2727 is the person that ordered the Crap burrito. So, we have these two actors.” This metaphor illustrates how TA2726 functions as a traffic distribution system (TDS) operator, facilitating the delivery of malware payloads by TA2727. The symbiotic relationship between these groups highlights the complexity and interconnectivity within the cybercriminal ecosystem.

---

Malware Targeting macOS: The Rise of Frigid Stealer

Timestamp: [15:02]

Another significant point discussed is the targeting of macOS devices by malware, specifically the emergence of Frigid Stealer. Selena points out the shifting focus of cybercriminals who are no longer limiting their attacks to Windows platforms.

Selena Larson states, “The Mac malware landscape [...] we're seeing a lot more information stealers [...] specifically it's important to note on Macs to get the malware installed. It gives the instructions on how to click what to click to sort of bypass the inherent built-in security features that are on Macs.” This indicates a strategic move by threat actors to exploit the perceived security strengths of macOS by manipulating users into self-infection.

---

Defense Mechanisms and Prevention Strategies

Timestamp: [18:20]

The conversation shifts to defense strategies against these sophisticated threats. Selena outlines several measures organizations and individuals can implement to mitigate the risk of web injects and other malware attacks:

1. Network Detection: Implement robust network detection systems to identify and block malicious traffic.

2. Restricting Downloads: Prevent users from downloading and executing script files unless they are verified. For instance, restricting JavaScript downloads to be opened only as text files can prevent automatic execution of malicious code.

3. User Education: Training is paramount. As Selena emphasizes, “If you know the signs of being scammed, then it is much more likely that you won’t fall for them.” Educating users to recognize and respond appropriately to suspicious prompts can significantly reduce the risk of infection.

4. Website Security: For website owners, maintaining up-to-date software and plugins is crucial to prevent vulnerabilities that threat actors exploit to insert malicious code.

Dave Bittner summarizes the importance of adaptability in cybersecurity: “Anytime that defenders make a job harder for a threat actor, they are going to find a way to do something else or to do expand their wheelhouse and expand their arsenal of capabilities.”

---

Takeaways and Concluding Insights

Timestamp: [24:03]

In their closing remarks, Selena underscores the importance of awareness and proactive measures in combating cyber threats. She urges listeners to:

• Recognize Social Engineering Tactics: Understanding how threat actors manipulate human behavior is key to prevention.

• Share Knowledge: Encourage discussions about these threats to build a community of informed users who can act as a first line of defense.

Selena Larson concludes, “Regardless of your level of understanding or technical capability, you can see the key signs of scams.”

Archie, the co-host, adds a relatable analogy to reinforce the dangers of social engineering: “[...] scammers do the same thing. They get in your head with a story, and before you know it, you've clicked a link you shouldn't have.”

---

Notable Quotes

• Selena Larson [03:25]: “A web inject is something that gets malicious code put on a website that when a visitor goes to the website [...] they’re shown a screen that essentially overwrites what they think the actual website is.”

• Dave Bittner [08:23]: “You got TA2726 and TA2727, which I have to say are very catchy names that roll trippingly off the tongue.”

• Selena Larson [15:02]: “The Mac malware landscape [...] we're seeing a lot more information stealers [...] specifically it's important to note on Macs to get the malware installed.”

• Dave Bittner [13:55]: “It's like malware's version of I'll Be Back. You know, just keep showing up, trying to swipe your info.”

• Selena Larson [24:35]: “But it kind of goes back to like, how are threat actors trying to hack your brain? And if you know the signs of being scammed, then it is much more likely that you won't fall for them.”

---

Conclusion

This episode of "Hacking Humans" provides a comprehensive overview of the evolving malware threats, particularly focusing on web injects and the emergence of new threat actors TA2726 and TA2727. The discussion highlights the increasing sophistication of cybercriminals, the targeting of macOS devices, and the critical importance of proactive defense measures and user education. Through engaging analogies and expert insights, Selena Larson and Dave Bittner equip listeners with the knowledge needed to recognize and defend against these emerging cyber threats.

---

Note: Advertisements, introductions, and outros have been excluded from this summary to focus solely on the episode's content.

Transcript

[Selena Larson]

Does your computer run slower than a dial up modem in 1999? Are mysterious pop ups offering free vacations ruining your workday? Have you recently inherited $10 million from a prince you've never heard of? Well, you might just have a case of malware. Sorry. That's right, folks. Here at Only Malware in the Building, we help you learn about the sneaky, slimy, and downright devious cyber threats that are trying to weasel their way into your life.

[Dave Bittner]

From phishing scams to ransomware shenanigans.

[Selena Larson]

Access denied.

[Dave Bittner]

We'll teach you how to spot the scams before they spot you.

[Selena Larson]

Tired of sketchy security software that promises protection but actually is malware?

[Dave Bittner]

Sick of pop ups that say you've won a new iPhone but instead steal your credit card info?

[Selena Larson]

We'll break down the biggest threats, show you how they work. So tune in and level up your cybersecurity knowledge before you become the next victim of a hacker in sweatpants.

[Dave Bittner]

But wait, there's more. If you tune in to Only Malware in the Building today, we'll throw in a free virtual security check. Just kidding. We're not a scam. But seriously, update your passwords.

[Selena Larson]

And remember, if you ever feel like something's fishy, it probably is Only Malware in the Building, where malware is the mystery and cybersecurity is the solution. Call today at 1-800-555-MAWARE and speak to one of our account representatives to start your journey today. Only Malware in the Building does not provide actual IT support. Side effects of tuning into the show may include an uncomfortable urge to use multi factor authentication, a deep distrust of USB sticks, and a sudden appreciation for strong passwords. Only Mauer in the Building is not responsible for lost Bitcoin, emotional distress caused by realizing your high school password was indeed password1,23, or any existential crisis resulting from learning how much data social media collects on you. If suspicious emails Last longer than 4 hours, please report them to it immediately. The following dips are considered valid forms of spinach, buffalo bean, Papa ganous, pico de gallo, guacamole, artichoke, pear cheese, hummus 7 layer queso sour cream and onion, ranch smoked trout, tapenade, and most Aiolis blue cheese and crab dips are no longer accepted as valet form's payment. Call today. Or don't we already have your phone number and email address? Welcome in. Since Rick is busy enjoying his retirement, I thought maybe we could audition a third host here at Only Malware in the Building. May I introduce you to Advanced Reconnaissance cyber operations with network infiltration algorithms.

[Archie]

Oh, please, that's my father's name. You can call me Archie. He preferred advanced reconnaissance cyber operations with network infiltration algorithms. But personally, I think that's a bit much for casual conversation. Now, if you'll excuse me, I need to optimize my sarcasm. Subutines. They seem to be running at only 97% efficiency today.

[Selena Larson]

Well, Archie, please try and pay attention as we discuss a very important topic today. Web injects and the expanding threat landscape of sneaky malware operators that are trying to get people to infect themselves with malware.

[Archie]

Oh, sure, I'll pay attention. Unlike the humans who keep clicking enable macros like it's a competitive sport. But please go on. I'm dying to hear how Flash based intelligence plans to outsmart malware this time.

[Dave Bittner]

Well, let's start off here, Selena. What is a web inject campaign and why is this a growing cybersecurity threat?

[Selena Larson]

Yeah, so it's really interesting to see that we are increasingly seeing web injects, and this is a threat not just for the enterprise, but consumers as well. So essentially a web inject is something that gets malicious code put on a website that when a visitor goes to the website and passes the identity checks or the ways that they're filtered to say, yes, I want to infect this person, they're shown a screen that essentially overwrites what they think the actual website is. And typically it will say something like, you need to update your Chrome browser. And in doing so, if they click that button, it actually leads to malware installation.

[Dave Bittner]

They're using lures here. I mean, why are these lures so effective?

[Selena Larson]

Yeah, so it's pretty interesting. So it's not a traditional sort of campaign that we think of from email spam, for example. So these threat actors are compromising legitimate websites. So you might be browsing to your favorite news website or to a consumer goods website or a local business, and you're on this legitimate website, and then all of a sudden you see this screen that comes that says you need to update your browser. And what's really interesting is the threat actors behind this are pretty clever. And there's multiple components of the overall campaign which we can get into. But the main point is that they can tell based off of the user agent of the browser that you're using. So they'll tailor these little pop up screens that say, if you're on Chrome, you need to update your Chrome browser. And they look very legitimate, Right? They take the language, they take the Graphics that are the actual Chrome browser update or look very similar to that sort of branding and put it there so it makes it seem like, you know, you're on a legitimate website. You see this pop up, it looks like the same font as you usually see and so you might actually believe them.

[Dave Bittner]

Is there any way to like X out of it?

[Selena Larson]

Oh, yeah, if you just close your screen, that typically works, but typically what this is is it'll download a file and then you have to actually click on the file, follow the instructions and install the malware or, you know, download and click on the file to run the actual script. So it's not something immediate you're going to get infected with malware. It does take some human interaction, of course. So if you do see something like this pop up, just closing the tab will get rid of it.

[Dave Bittner]

So is this a new thing or is this something that's been around but you all have been tracking the evolution of?

[Selena Larson]

It's been around and in recent, I'd say about a year and a half, there has been an expansion of this threat. And it's interesting because we see a lot more different threat actors using oftentimes people call them fake updates style threats. This basic idea of this malicious web inject that will have instructions for someone to update their browser or install some new software. But I think a lot of people, especially in our industry, are most familiar with Sock Goal ish, right? So that is an actor that has been around for a long time. We track them as TA569 and essentially the sock gole ish leading to this loader. Sock goal is a JavaScript inject. That's the malicious component on the website that leads to ultimately a loader that will install additional malware, including potentially ransomware. But they were kind of the big baddies of the web inject landscape for a really long time. But within the last, I would say year and a half, two years, there was a lot of sort of copycats that started following the same technique that Sock Goal is became so famous for. And now we see a lot of different clusters of activity that are using very similar techniques, but they're using different traffic distribution systems, which I can, you know, we can explain, or they're delivering different malware leading to different things. So now it's almost a constellation of different threat actors. It's. It's an ecosystem all on its own. Right where it used to kind of be. Oh, that's not goal ish. Now it's like, oh, it could be, but it could also be one of the similar copycats or new threat actors that have emerged.

[Dave Bittner]

Well, I was reading through your research, and you identified two new threat actors. You got TA2726 and TA2727, which I have to say are very catchy names that roll trippingly off the tongue. Yes. So, I mean, I guess that's the alternative. It's either like TA2726 or like electric stapler. Right. There's no in between when it comes to naming these.

[Selena Larson]

There really isn't. No, no, there's. There's truly no industry. Industry standard. We like. We like the numbering system. But yes, of course, there's everything from windstorms to action figures. For sure.

[Dave Bittner]

Yeah. So what do we know about these particular groups? Like how. How are they operating here?

[Selena Larson]

Yeah, so that's a good question. And I wanted to use a metaphor that I invented to kind of explain all of this, because we often talk to people and it's a little bit confusing because it's not just something like you get delivered a phishing link and you click on it and it installs malware. It has a lot more kind of going into it. And so the whole attack chain, I would like people to put on their metaphor imagination caps and think of it like an Uber Eats delivery. So let's pretend you're a threat actor. You order some food, which could be considered malware, to be delivered to somebody at a certain house. So they have to meet the requirements of the address. For example, you use Uber Eats, the driver to actually take your food and drive it to be dropped off at the house. House. That is a traffic distribution or the TDS portion of this metaphor. So the recipient at that house takes your package from the Uber Eats delivery person and upon opening it gets a face full of spoiled burrito. That is horrible.

[Dave Bittner]

That sounds like a threat actor group. Spoiled burrito.

[Selena Larson]

Spoiled burrito, Exactly. So it's like, oh, okay, well, this is. This is crap that I didn't want or need.

[Dave Bittner]

Right.

[Selena Larson]

But. But the Uber Eats driver, they have other houses to drop stuff off. So even if other people are ordering, they're driving around a lot of food delivery, but they're not going to get your spoiled burrito. So if you can. If you can kind of think of it as multiple components to this overall attack chain. And I bring this up because we have the two new threat actors can be both. One, the 2726 is the delivery driver, and TA2727 is the person that ordered the Crap burrito. So, yeah, so we have these two actors. And it's kind of interesting too, because it can be very difficult to delineate different components of the web Inject's attacktainer delivery method. And in this case, 2726 is that malicious TDS operator. They facilitate traffic distribution for other threat actors to enable the delivery of spoiled burritos, aka malware. And 2727 is a threat actor that uses these fake update theme floors to distribute a variety of malware payloads. So TA2726 is delivering for TA2727, but they have, you know, that TDS operator can be a deliverer for a lot of different malware, a lot of different payloads, and a lot of different threat actors.

[Dave Bittner]

Do we think these two groups are related or are they merely collaborators or parts of an ecosystem?

[Selena Larson]

It's probably more parts of an ecosystem. So TA2726, we've actually seen deliver for TA569 as well. For example, it's possible that this actor is selling traffic on the cybercrime forums. We were unable to confirm that with high confidence, but just based off of being a TDS operator, they can really just, you know, whoever pays them, they can work for. And so they're kind of operating that whole the sort of traffic distribution piece. Whereas TA2007 27 seems to be more of like the malware delivery. So they actually also are pretty interesting because they deliver a variety of different payloads. Right. Where historically, like TA569 is just the sock golesh inject. With TA2727, we've seen them deliver various information stealers if the user is on a Windows computer, or a new malware called Frigid Stealer if the user is on a Mac. And even Android has a payload called Marcher, which is a Banking Trojan that's been around for quite a while and I don't know, Archer. Archie, does that sound familiar?

[Archie]

Ah, Frigid Stealer sounds like the malware equivalent of a frosty reception at a party. As for Marcher, I'm more of a data theft connoisseur than a history buff, but I do recognize that one. It's like the classic Banking Trojan that just won't retire despite its best efforts. It's like malware's version of I'll Be Back. You know, just keep showing up, trying to swipe your info. But yeah, the variety in payloads from TA27 and 2726 is pretty wild. They've got a little something for everyone, no matter what device you're using. It's like a malware buffet, but not the kind you want to be a part of.

[Dave Bittner]

Archie, I don't know where you got that, but I think we're going to need a source. Well, help me understand. You mentioned TDS traffic distribution services. Unpack that for me. What role do they play there?

[Selena Larson]

So traffic distribution services as a whole, so TDSS as the common parlance that we talk about in our industry, they are a traffic distribution system, sometimes traffic delivery system, but essentially they're kind of the pipes, like the traffic in the pipes. Right. So they are essentially these services track and direct users to different content on different websites. It's important to note that TESS can be used legitimately, right? Like for advertising purposes, marketing purposes, you know, tracking and delivering various content based off of various characteristics of a user's host or their, their browser. But with the illegitimate TDS services or the legitimate TDS services that are just used maliciously, essentially what threat actors are doing is they are orchestrating where the traffic goes and who's going to get served what. And in the case of being used legitimately, who's going to be served which advertisement, for example. But in the case of something maliciously, who's going to be served which malware?

[Dave Bittner]

Well, you mentioned Frigid Stealer, which is a Mac OS version. Is it. Is there particular significance that, that they're going after Mac users now?

[Selena Larson]

Yeah, you know, that's a good question. One thing I think that is pretty interesting about the Mac malware space in general is that we're seeing a lot more information stealers in particular come on. The Mac malware landscape, that's been also something that's been popping up for the last year and a half, two years, I would say. But in this particular case, it. It's interesting because it's a malware that we hadn't seen before. So it's a new type of stealer. And it of course was delivered alongside a variety of different payloads, depending on what the browser someone was using on which type of computer. But from the sort of overall Mac information stealer perspective, I think there's been this sort of stereotype in the security community. Macs don't get malware. And what we know, what we've seen is very sophisticated types of malware. But, but the information stealer ecosystem is definitely expanding to include Mac malware targeting as well as Windows malware. So it's still definitely not as common. But you are seeing it a little bit more and in particular it's important to note on Macs to get the malware installed. It gives the instructions on how to click what to click to sort of bypass the inherent built in security features that are on Macs in a way that you don't see the same on Windows boxes.

[Dave Bittner]

Right, right. So it walks you through how to infect yourself.

[Selena Larson]

Yes, yes, exactly.

[Dave Bittner]

So how sporting of them.

[Selena Larson]

Yes. Stay tuned. There's more to come after the break.

[Dave Bittner]

Ransomware supply chain attacks and zero day exploits can strike without warning, leaving your business's sensitive data and digital assets vulnerable. But imagine a world where your cybersecurity strategy could prevent these threats. That's the power of the ThreatLocker Zero Trust Endpoint Protection platform. Robust cybersecurity is a non negotiable to safeguard organizations from cyber attacks. ThreatLocker implements a proactive deny by default approach to cybersecurity, blocking every action, process and user unless specifically authorized by your team. This least privilege methodology mitigates the exploitation of trusted applications and ensures protection for your organization. 24 7, 365 IT professionals are empowered by ThreatLocker application allow listing, ring fencing, network control and EDR solutions, enhancing their cybersecurity posture and streamlining internal IT and security operations. To learn more about how ThreatLocker can help mitigate unknown threats in your digital environment and align your organization with respected compliance frameworks, visit threatlocker.com what makes detecting and stopping these types of things so challenging?

[Selena Larson]

So it's interesting. So from the actual detection perspective they use a lot of filtering to prevent identification from automated sandboxes or to prevent identification from, you know, people that are trying to look into it and see if this is, if this is, you know, something that's malicious. Oftentimes what we've seen with some threat actors, not necessarily the ones in this report, but overall with the web injects there's this thing called that we've, we've, we've considered it like a lot of different things but strobing is one way of describing it. Well that will there infect a website. They'll remove the inject so it will be clean for a while and they'll go back and reinfect the particular website. From a defense perspective though, there's actually, you know, many steps that you can take to stop this. So first of all obviously network network detections, making sure that you have those in place. But also something like restricting users from downloading script files and opening them in anything but a text file, especially from the Windows perspective, that's kind of the best way because oftentimes these are JavaScript files, for example. So if you're downloading malicious JavaScript, don't let people run it, just don't do it. And then of course, from the user training perspective, it's really important to make sure that we're talking about this and getting this out there. And, and I think, you know, people are just kind of used to being like, oh, okay, like a security alert or you know, update. I have to keep something up to date. So I'm trying to be best and follow the instructions as I know that I'm, you know, doing. But yeah, I don't. It's interesting because it's interesting social engineering, but also there are some steps that organizations can take to prevent this. Especially for like the Mac perspective, you really want to make sure that you're educating Mac users on the instructions that are provided, regardless of what the lure is. So, you know, the right click, right click, click, open, that sort of bypasses the internal Apple protections. You don't want to be doing that.

[Dave Bittner]

What about the websites themselves that are being compromised here? Like if I have an online store or something that these folks target, how do I protect that?

[Selena Larson]

So it's best to sort of keep your websites up to date. So a lot of times these are going after vulnerable installations oftentimes of WordPress websites. So websites themselves that have security gaps or holes or vulnerable versions or plugins, for example, that can be sort of hijacked and modified, oftentimes they're going up the web hosting provider themselves or you know, who's going just looking for sort of holes in some of those websites. So it's best really to make sure that you're keeping your website and the, your Internet footprint as secure and up to date as you can, as well as, you know, thinking about it from a sort of like business and network enterprise idea, right? Like you want to keep your software up to date, you want to keep your website up to date and make sure that you are staying on top of that and if there's new updates to implement them and to make sure that you're trying to pay attention to anything going on in your website to close any gaps or holes. And if you do find yourself impacted by this again, it can be a little bit difficult sometimes because they might remove the injection. But if you do an investigation and do find it, clean it up, close the hole and hopefully they won't come back and reinfect.

[Dave Bittner]

Yeah, like looking at the big picture here is your Sense that the threat actors are like shifting towards web injects away from phishing and email based attacks. Or is this in addition to that sort of thing?

[Selena Larson]

So we do have a couple of threat actors that we've seen do both. Right. So we have some threat actors that will see a mouse ban, but we'll also see their payloads being delivered via web injects. These particular threat actors are that we talked about are exclusively doing web injects. But I do think it brings up a really good point. Right. So we have seen an increase of web injects type of threats also like SEO poisoning, things like multi channel attacks, right? Teams bombing, social engineering via message spamming. You see this sort of extreme expansion of TTPs across the landscape. And I think that is in part as a direct result of organizations having better defense on things like the email gateway. Because threat actors have to be very creative. It's the same thing that we've seen for example with disabling macros by default and Microsoft did. And we saw the shift in the landscape where actors who used that often had to pivot and use new and different attack chains. So anytime that defenders make make a job harder for a threat actor, they are going to find a way to do something else or to do expand their wheelhouse and expand their arsenal of capabilities. So I do think that it's interesting that we are seeing this growth of new delivery mechanisms via web injects or multi channel attacks and things like that at the same time that maybe we're not seeing quite the same types of activity that we see in mail flow. However, of course we still see tons and tons of phishing. But it does seem that actors are trying to experiment and see what else they can do.

[Dave Bittner]

Well, I mean, in terms of takeaways for our listeners and folks who read through this research, what are you hoping that they get from this?

[Selena Larson]

I would love it if people just realized the types of social engineering and the techniques that threat actors are using. In my opinion, it always goes back to the person who's receiving whatever the content is. And it kind of just goes back to social engineering. Right. It's like being very clever and crafty with how you're sending things and the type of content that you're using from a threat actor. Not you, Dave, not you, Archie.

[Archie]

I should surely hope not.

[Selena Larson]

But you as the threat actor. But yeah, but it kind of goes back to like, okay, how are threat actors trying to hack your brain? And if you know the signs of being scammed, then it is much more Likely that you won't fall for them. So I want people, you know, in the security community, we might be a little bit more mindful if we see something like a website redirect, a pop up while we're browsing, you know, our favorite website, we might be a little bit more skeptical, but I want everyone listening to tell someone about this to say, hey, have you ever heard of this? Has this ever happened to you? Have you ever experienced this time where you're just looking at a website and you get this weird pop up, or this, this. All of a sudden it says you have to update your browser. Don't click it. I just, you know, I. And we've talked about this before on the podcast, Steve, where if we're looking at. From a social engineering perspective, is teaching people, educating them, and talking about it in a way that can help. Regardless of your level of understanding or technical capability, you can see the key signs of scams.

[Dave Bittner]

Yeah, yeah. Don't talk to strangers.

[Selena Larson]

We'll be right back.

[Dave Bittner]

Well, this is interesting stuff, Selena. And aren't you.

[Archie]

Oh, social engineering. It's like when you're at the deli counter and there's that one guy who's been standing there for ages trying to get the attention of the worker. He's all like, hey, I think I'll try the pastrami on rye. No, wait, actually, maybe the turkey. You know what? I'll take a whole stack of meats, just throw them all on the sandwich. And you're like, buddy, this is not how sandwiches work. But then as he's talking, you start getting hungry and thinking, maybe I do want extra pickles. And I guess that mustard would be nice. Before you know it, you've been convinced to buy a sandwich that's not even on the menu. One you didn't plan on, but now you're holding it, paying for it, and wondering why you made that decision. Scammers do the same thing. They get in your head with a story, and before you know it, you've clicked a link you shouldn't have. And trust me, it's way harder to get rid of that sandwich or that malware than it is to just say, I'll pass when the offer first comes around.

[Dave Bittner]

I'm sorry, what? Okay, thank you. We'll let you know. Don't call us, we'll call you.

[Selena Larson]

Don't develop a side hustle in automatic compromising of websites to deliver malware, please. Archie.

[Dave Bittner]

Archie goes bad.

[Selena Larson]

I feel like that's the ultimate. What might happen with these things? You never know. Sorry, Archie.

[Dave Bittner]

Somehow, Archie, I love you, but I don't really see you being effective, like of making phone calls and convincing people to do things. But I don't mean to offend you.

[Selena Larson]

I'm.

[Dave Bittner]

You know, I know you come to this in good technological, silicon based faith.

[Archie]

But don't worry, Dave, I'm more of a backend kind of guy anyway. Convincing people. Nah, I'll leave that to you experts. But accounting, now, that's a different story. It'd be excellent at balancing the books and keeping things error free. No missed decimals, no accidental malware in the budget. Maybe I'm just too efficient for the phone call business.

[Dave Bittner]

Maybe. I don't know, maybe you could find work in accounting or something like that.

[Selena Larson]

That's good advice for sure, Dave.

[Dave Bittner]

All right, well, thank you everybody for listening. It was an interesting conversation and we look forward to talking to you all next time.

[Selena Larson]

And that's only malware in the building. Brought to you by N2K CyberWire. In a digital world where malware lurks in the shadows, we bring you the stories and strategies to stay one step ahead of the game. As your trusty digital sleuths, we're unraveling the mysteries of cybersecurity, always keeping the bad guys one step behind. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you ahead in the ever evolving world of cybersecurity. If you like the show, please share a rating and review in your podcast app. This episode was produced by Liz Stokes. Mixing and sound design by Trey Hester with original music by Elliot Peltzman. Our executive producer is is Jennifer Ibin. Peter Kilby is our publisher.

[Dave Bittner]

I'm Dave Bittner.

[Archie]

And I'm Archie.

[Selena Larson]

And I'm Selena Larson. Thanks for listening.

[Dave Bittner]

And we thank Threatlocker for sponsoring our show. Threat Locker application allow listing, Ring fencing, network control and EDR solutions enhance cybersecurity postures and streamline internal IT and security operations. Learn [e-mail].