A Nightmare of Vibeware - 2026-03-09

Summary

Talkin' Bout [Infosec] News – "A Nightmare of Vibeware" (March 9, 2026)

Episode Overview

This week, the crew from Black Hills Information Security—Corey, Troy, Wade, James, and John—gathers as a "skeleton crew" to break down the latest infosec news and trends. The key theme is how modern threat actors (especially APT groups) are leveraging AI, unconventional malware ("Vibeware"), and trusted services as attack vectors, alongside broader industry updates (layoffs, regulatory/legal battles) and emerging technology risks (6G, device privacy, Salesforce and LexisNexis breaches). Humor, pop culture tangents, and practical security insights keep the discussion lively and relevant.

---

Key Discussion Points & Insights

1. AI-Created Malware & "Vibeware" (APT36)

• [05:30] Vibeware is introduced—a term for AI-generated malware.
  • APT36 (aka Transparent Tribe), a Pakistani threat actor group, is reportedly deploying AI-coded malware written in niche languages (Nim, Crystal, Zig) and using unconventional command & control (C2) channels like Slack, Discord, Supabase, and Google Sheets.
  • Insight: Adversaries are "living off trusted services"—abusing the same cloud tools and comms channels businesses use, making detection difficult.
• Notable quotes:
  • [05:45] Corey: "Vibeware equals AI created malware."
  • [06:37] Troy: "Unconventional database as a service, I guess I would call it."
  • [07:23] Troy on attacking India: "It's an old...thing where they're not really friends…in this current geopolitical state."
• Detection & Response:
  • Watch for unusual patterns in service usage (e.g., non-Slack users suddenly using API/web activity).
  • James: "BitDefender had the nice little graph...1,000% increase [in samples] over six months." ([12:58])
  • Suggestion: Tools like VirusTotal may soon flag code as "AI-generated" or "Vibecoded."

2. Broader Cyber Threats & Geo-Politics

• Surge in Iran-attributed attacks on US targets ([16:31]).
• John shares a bank case study:
  • Nation states orchestrated DDoS attacks via hacktivist groups as a smokescreen for phishing ([17:24]).
  • Difficulty in attribution—hacktivism and nation-state actions blend.
  • [20:34] John: "If we want to boil it down to one simple thing, hold on to your butts. It's about to get real interesting."
• Social engineering remains a key attack vector, especially targeting urgent, emotional situations ([20:44]).

3. Major Industry News

• Oracle Layoffs: 30,000 cuts due to banks pulling financing for AI-focused datacenters ([14:41]).
  • Raises questions about the AI investment bubble.
• Microsoft E7 Licensing: More AI features, higher price ($99/user vs. $15).
  • Cynicism about AI bloat and "security by SKU."
  • [27:53] John jokes: "I can't wait for Microsoft to come out with a marketing campaign—this company got hacked...because they were only using E5."

4. Emerging Tech—6G and Privacy Risks

• 6G is shaping into a new security and surveillance battleground ([30:29]).
  • Western coalition vs. China's standard.
  • John: "Sounds like borderline magic...you can map rooms, read heart rate, temperature, even identify folks in the room." ([31:19])
  • Vendors salivate over new ways to monetize—e.g., pricing Netflix based on people in the room.
• WI-FI-based room mapping tech is already being open-sourced ([32:26]).
• Jokes about dystopian implications—ads, insurance, even pre-natal data sales ([33:36]).

5. Security Breaches & Exploits

• Salesforce API Exploitation:
  • "Shiny Hunters" exploiting the Salesloft ARA endpoint for data disclosure ([34:25]).
  • Recommendation: Lock down/or restrict this endpoint if using Salesforce.
• LexisNexis Breach:
  • Customer support portal analytics leaked (screen resolution, device type, real ticket data, emails).
  • Risks: Highly tailored phishing; links personal and corporate emails of targets ([45:01]-[47:50]).
  • John: "It's just a matter of time before we end up in another massive breach of very sensitive data being exposed..."

6. Disinformation Campaigns (Doppelgänger RN)

• Domains spun up to impersonate news outlets, spread fake news ([36:15]).
• The ease of creating WordPress-based fake media flagged as a mounting risk ("doppelgänger RN ecosystem").
• Best org defense: Block 'uncategorized' domains at the proxy.
  • John: "Do not let your users go to it. That's the easiest domain allow listing trick..." ([41:05]).
• Policy obstacles: Exec assistants want to access new restaurant/catering sites.
• Need for better OSINT and critical thinking among users ([42:23] Corey).

7. Legal & Privacy Battles: Geofence Warrants

• Google petitioning Supreme Court to strike down reverse-location warrants ([49:34]).
  • Geofence warrants currently allow law enforcement to get lists of all devices present in a place/time window.
  • Privacy implications: Ensnaring bystanders, risk to protestors.
  • Advice: Don’t bring personal phones to protest; use Faraday bags/pouches ([53:37]-[54:53]).
  • Jokes spark an idea for a "BHiS Faraday fanny pack."

---

Memorable Quotes & Moments

• On AI-Coded Malware:
  • [05:45] Corey: “Vibeware equals AI created malware.”
  • [07:27] Troy: “You can get really far with just kind of… beating around the bush. The AI can be tricked pretty easily.”
• On Threat Trends:
  • [13:48] James: “It’s going to be the one that’s got all the right comments and all the right places, right?”
• On Industry Gimmicks:
  • [27:53] John: “Can’t wait for Microsoft to come out with a marketing campaign: this company got hacked…because they were only using E5.”
• On Privacy and Surveillance:
  • [31:19] John: “6G…you can identify who's in the room, read their heart rate, look at their temperature. It is flipping insane.”
  • [51:42] Corey: “I was in awe at the level of access [homicide detectives] had…like, email geofencing was the big one.”
• On Defending Against Disinfo:
  • [41:05] John: “Go into your proxy and look for uncategorized. If you see uncategorized, block it.”
• On Organizational Resistance:
  • [41:48] Troy: “Stupidest reason people push back? Local restaurants. That’s the number one pushback I’ve gotten.”
• On Dystopian Futures:
  • [34:09] Troy: “This dystopia, we're turning left at Dystopia corner into privacy plans the entire life of your child.”
• On Protester Privacy:
  • [53:37] James: “So bring a burner phone to protests.”
  • [54:17] Corey: Brainstorms BHiS-branded Faraday fanny packs.

---

Timestamps for Important Segments

• [05:23] – Introduction of APT36 and "Vibeware"
• [09:42] – Living off trusted services: Next-gen malware C2 trends
• [12:58] – Malware sample volume explosion
• [14:41] – Oracle layoffs: AI datacenter funding freeze
• [25:00] – Microsoft E7 license: AI expansion and security skepticism
• [29:22] – Motorola x Graphene OS partnership
• [30:29] – 6G Tech: Security, privacy, and surveillance scenarios
• [34:25] – Salesforce Salesloft ARA exploit and recommendations
• [36:15] – Disinformation campaign infrastructure, defense strategies
• [45:01] – LexisNexis breach: Phishing and privacy implications
• [49:34] – Geofence warrants: Google’s legal clash and protester privacy strategies ([53:37])
• [56:12] – Upcoming webcasts and educational content

---

Closing & Resources

Webcasts & Training:

• [56:27] James: "Deeper dive into synthetic identity and deepfakes, with solutions you can implement immediately."
• [57:15-58:23] Wade: "Intro to YARA rules at the SOC Summit; breach hunting case study."
• Corey: Upcoming talk on threat intel/Red Team.

General Tone:
Candid, technical, humorous, and pragmatic. The team jokes about vendor BS, pop culture, the "dystopia corner," but repeatedly deliver practical advice for defenders and organizations facing a rapidly evolving threat landscape.

---

For Listeners:

• Review internal use of cloud/C2 platforms and flag abnormal service usage.
• Monitor for emerging phishing and disinformation risks—educate users!
• Regularly evaluate legal/regulatory changes, especially in privacy/fed warrants.
• Stay patched, expect creative use of AI—by both attackers and defenders.
• Question bloaty security licensing; advocate for sane log access.

Stay vigilant, and remember: "Hold on to your butts. It's about to get real interesting." ([20:34] John)

Transcript

[Corey]

The SOC is where pressure is real and impact matters. Join the Anti Siphon Training SOC Summit free live streamed March 25th. Then go deeper with Hands on Training March 26th through April 10th. Learn more at Anti Siphone training.com event SOC summit. Okay, so we were talking about medical before we went live. Have you. Do either of you? I. I am clearly on downtime, where I sit at a couch holding a baby all day. So I'm binge watching shows and I've caught up on the. I started watching the Pit and then caught all the way up. Right, right. And so if you haven't watched the Pit, huge spoilers. Tune off. Now go a little bit ahead. Go a little bit ahead for season two. Have you. Are you not caught up on season two?

[James]

Oh, I'm caught up. No, I'm okay.

[Corey]

So in the most recent season, the Pit, their computer systems shut down.

[James]

Oh, my God.

[Corey]

Not because of ransomware.

[John]

Right.

[Corey]

But because of two other hospitals got ransomware. A preemptive shutdown.

[James]

Preemptive shutdown. Yeah.

[Corey]

I was very upset that they spent all this money on medical experts and none on cyber.

[James]

Yeah, yeah, yeah.

[John]

Like, when.

[James]

When it was happening, you were grimacing probably as bad as I was, because I'm looking at my wife going, that's not how it works. That's not how it works.

[Corey]

Right. I immediately texted my buddy, who is the. The security operations manager at a local hospital, and I'm like, bro, every hospital in San Diego is hit with ransomware. Do you shut down? It's like, shut down now. I was just so surprised. But it honestly make. It makes for good drama and a reason why I think they should have just gave them ransomware, honestly.

[James]

I agree. It should have been. That would have been better. Because it's only the day. I mean, right? Well, I think this way they can now say, you know, four hours later, okay, we're all good.

[John]

We're.

[James]

We're secured. We're protected, you know, and then have someone click on an email. That'd be historic.

[Corey]

Something like. Or, like, have, like, have some, like, kid, like, you see walking in and plugging in a Raspberry PI into a. Into a terminal that. Some random Ethernet port. That would have been perfect. It would have been perfect.

[John]

All right.

[James]

Just hacks the WI fi.

[John]

Come on, you know?

[James]

Yeah.

[Corey]

Watch the Pit.

[Troy]

I haven't. I. I. The only thing I've heard about it is that, like, my friends were making fun of it last night for, like, really struggling to implement every current event into the show's plot lines.

[Corey]

Very Much. So. Yeah.

[Troy]

Ah, crap. How do we work in Iran into this? I don't know. Like, I. I get it. Like, you know, but I'm also like, come on, how far backwards are you gonna bend to make the current events work into the show? I don't know. It's like. I don't know. I haven't watched it myself. I have a couple friends who are medical. In the medical field, and they're fans of it. But, yeah, I mean, I'm.

[James]

I'm from the days of watching ER and watching little John Carter grow up. So there's a. And I watched him in the library. Noah Wiley and the Librarians and Leverage and loved him in that. So I'm kind of pot committed to watching the show. But, yeah, when they did, I watched him in.

[Corey]

In Fallen Skies. If anyone.

[James]

If you've never watched it, I remember that. Yeah, I never got into it, but I remember that.

[Corey]

Yeah, it was a little hard, but it was a. It was an actual sci fi that has a. Has a clear ending, which is unbelievable

[James]

nowadays, which is surprising.

[Corey]

Yeah, yeah.

[James]

But, yeah, I.

[Troy]

On. You know, we had a really good discussion before the show. It was great, but I actually didn't really get any time to read any of the articles, so. It'll be a fun week. It'll be a week full of hot potatoes. Wade, you ready?

[Corey]

I read a couple. I read a couple. I read, like, the first four of Spice. Spicy Hot Topics.

[Troy]

It's all good. We know.

[Corey]

Okay, let's go to the. We could spin up and we'll go to the first one and I'll talk about it. I can go. I can do it.

[James]

I was gonna say. So this is just gonna be like being on Jerry's show. You know, it's like the stories. We just go right on in.

[Corey]

That's exactly what it is, but just more fun.

[Troy]

Exactly what it is. Yeah. Yeah. Ryan, let's.

[John]

Foreign.

[Troy]

Hello and welcome to Blackdale's Information Securities. Talking about news. It's March 9, 2026. We're here with Wade. It's. It's a skeleton crew today. No, John, we're here with Wade. And we got James here. We're just gonna hang out, talk about news. Oh, a late entry. Still working on his webcam, but, yeah, let's get into it. We got articles about APT36. We've got Oracle layoffs. We've got 6G. Ooh, a new. A new kind of.

[James]

Oh, yeah.

[Troy]

A new kind of virus for my brain. Thank God. Let's see what else official news that graphene and Motorola are combining efforts. That's exciting. We kind of leaked that last week. Firefox has an AI kill switch. We've got new Microsoft licensing. Apparently they've upgraded now. There's something called an E7. Who knows what that is? But we're going to talk about that and yeah, I mean, well, let's get into it, I guess. What's this? Apt 36 also, how are we only at 36? I feel like we're going down.

[Corey]

Right, Right. Who is it? Who gives it apt. The numbers? I believe it's Mandy. That's a Mandy.

[Troy]

Yeah, yeah, yeah.

[Corey]

It's not a cool storm. And the color. So it's not Microsoft. So pretty much this is going off like current trends. Right. And introduces the real term of Vibeware, which is a new type of AI created malware.

[Troy]

Vibeware equals AI created malware.

[James]

I'll allow.

[Corey]

Yep. Right. I like it. Like, like it's. It's not too cringy. It's worth it. I could easily see that in a signature somewhere. So I'm going for it. I applaud the, the naming. So pretty much this Vibeware from a Pakistani threat actor group called. They're also known as Transparent Tribe, which I thought was much better than apt 36 if you.

[Troy]

Are they that transparent? Apparently based on this blog, they are transparent but they're.

[Corey]

They're Vibe wearing a couple some malware in super niche languages. Ones I have never heard of. To tell you the truth.

[Troy]

I've heard of Nim because of Charles. Oh, yep, yep. But I've never heard of Krill Crystal or Zig.

[Corey]

And then I always love to see some unconventional C2. So they're using Slack Discord. Supabase. I've never heard of that in Google Sheets is Supabase.

[Troy]

It says Firebase too. Which I'm assuming Supabase is like an open source version of Firebase maybe.

[Corey]

What's Firebase? I don't know what that is.

[Troy]

This is like a Google as a Service application.

[Corey]

Ah, okay.

[Troy]

I love seeing unconventional database as a service, I guess I would call it.

[Corey]

Yeah. So pretty much they're just Vibe coding this new. These new malwares, throwing them out quickly and just trying to bypass detections and get out there. The one thing is like us as us threat, US based individuals aren't going to see this because they're Pakistani. So they're targeting a little bit more of the Indian government or Indian. Right. Rather than the US but still interesting stuff. Have you as anyone tried. I haven't tried to actually do anything malicious with an AI, like at least create malware or C2 or anything like that.

[Troy]

Yeah, I mean, that's my whole job, man. Yeah, I will say. Okay, so basically, like, high level here, there's two themes I want to get into and I want to, like, say them out loud. So I remember number one is like, this is kind of a kinetic to, you know, like, we're going to talk about kinetic versus cyber attack, right? But this is kind of like, interesting that in this current geopolitical state that they're attacking India. Like, that's an old. That's an old battle, right? Or like an old thing where they're not really friends and they don't get along. It's an interesting thing to throw on to the geopolitical. You know, it's like, oh, World War three plus plus, I guess. But the other thing I want to talk about, you know, is using AI illegally or, you know, maliciously. You can get really far with just kind of not even jailbreaking, but just saying either you're authorized to do this or just kind of beating around the bush. Like, you're not gathering. You're not gathering targets with. You're not using targets for phishing, you're using targets for sales or whatever. You know what I mean? Like, the AI can be tricked pretty easily. Also, last week I was having IT draft up. I was having it help me with some campaigns for a Red Team client. And I was like, help me make a red team campaign, blah, blah, blah. And I was like, and by the way, I want you to do the recon and, you know, pick up assets they have and like, you know, basically do external pen testy stuff. And it was like, absolutely not. You are not authorized. And then I. I literally, I actually screenshotted the real sow, but it was just an image that was like, phis is allowed to test insert company here. And it was like, all right, you're fine. Like, you have a letter of authorization. So, like, if you could just put an image that you generate of, like, here's an authorized pen test or whatever.

[Corey]

I will say later.

[Troy]

All that being said, I'm sure this is setting off red flags. Like, we have a corporate anthropic subscription. They know it's Black Hills Information Security. I would imagine if I was just on a Gmail or whatever, they would be like, no, right, like, for.

[Corey]

For the corporate subscriptions. Do they take down some of the walls around malicious use? Like, I. I don't think so.

[Troy]

No, not my knowledge. I mean maybe for the US Government if you want to make a kill.

[Corey]

Well, not. Well, not anthropic, but. But open AI for sure.

[Troy]

Yeah, yeah, I guess we. That article isn't in the list. We should go find that or kind of in the list.

[Corey]

One other term in here that I wanted to use that I haven't seen a lot that's in this is living off. Living off of trusted services. So lots. Right. Which is if you go back to other LOL based stuff. So living off binaries, living off like local scripts and stuff like that, which is looking for trusted services that a particular company is going to be using and then trying to create malware custom for those. So you blend in. Hence the company's using Slack. Right. I'm not going to be able to really look for something that's creating outbound Slack collections because I'm going to be expecting it. Same with Google Sheets and that type of stuff in order to blend into the service a little bit more, which I like. I haven't deep dive researched that, which is something I want to now. Maybe that's my next AI project.

[Troy]

So yeah, it's. I mean this is the world we live in. I will say, like it. I don't think they share in the blog how they're developing these. Like it doesn't say that they're using Anthropic or they're using OpenAI. I'm guessing they're using a combo of Frontier models. And then also there's, you know, open source open parameter models like Deep SEQ and Quinn that we have like we have had to use those in certain cases here. Like one customer asked me for prompt injection. Like they asked me for a spreadsheet with prompt injection things in it that they were going to throw into their, you know, their desktop and see if it worked. And Anthropic was not a fan of making prompt injection payloads, but Deep Seek and Quen were a huge fan of it. So you know, like, basically for some things you do have to use open parameter unlocked or obliterated models or whatever. But for the most part I would guess this is probably, I mean if you think about the queries you could use to make something like this, it's like, oh, I, I need to, I need to have remote control over my computer and I want to make something written in crystal to do this AI is going to be like, okay, yeah, you know, I totally get what you're doing.

[James]

Yeah.

[Wade]

There's one, one thing that comes to mind about the living off the Whatever

[Troy]

network services, living off the trusted services.

[Wade]

Trusted services which is basically like all web, like fill in the blank. Right. Nothing. Nothing really new I would believe from the fact. Yeah, arguably cloud front using like Technet forums and all that other kind of things since like the big like since they can. Right. I would say from a detection perspective if like people are curious about that. But what does that look like? I mean it's kind of goes to like that whole like. Well, if a user's using PowerShell or they're, they're an IT employee using PowerShell, it doesn't look as suspicious as if like a welder or somebody that's like in manufacturing is using some kind of technology. So I mean it's one of the things that's probably people should be looking for or people that are threat hunting or trying to like wrap their heads around detectives is like why would this like user be using Slack and they're not using the Slack desktop app, they're using like a web API. Right. Trying to find, you know, anomalies in that service. You know, I don't think there's anything in this article that or any of that news that suggests that they were using any kind of like MCP connectors to Slack or anything like that.

[John]

Right.

[Wade]

It would, it would just be like kind of codified to go do the thing. That kind of thing. Anyways, that was just my thoughts on it.

[James]

Yeah, I think it's interesting how it might, you know, we're talking about all these new signatures or sorry samples that are coming in. Bit Defender had the nice little graph there, you know, 1,000% increase over six months. It's like, okay, so virus total or the next virus total that's going to start tracking all these vibewares will certainly be interesting to see what crops up. But I certainly expect if we've, we've already been getting this many already, it's going to double and triple over the next few years. And if it won't be India targeted, it'll be the rest of Europe and

[John]

then I have no doubt it'll be

[James]

here in the U.S. yes, that's a

[Troy]

good feature of our total.

[Wade]

Like just have a flag like hey, this code was Vibe coded or, or the confidence level of this code is basically like, you know, 98 or 97% vibe coded versus like.

[James]

Yeah, yeah, yeah, because it's going to be the one that's got all the right comments and all the right places. Right?

[Troy]

Yes, that's exactly what I was going to say. Like commented if it has Documentation. It was vibe coded. Nice. Yeah, I mean I think this is one to just look out for, you know. Like we all know these kinds of threats are on the rise, but it is cool that they coined two new terms in one blog post. I think that's a little achievement for them. Bitdefender coming in hot. So I guess we can talk about layoffs. Oracle apparently is slashing 30,000 jobs which I don't know what percentage of their workforce that is. Layoffs, FYI. Probably could tell me. Let me go look. Actually, it's not listed.

[Corey]

Good thing John showed up late. We would have been talking forever about.

[Troy]

John, you've been laid off from your job at Oracle. Sorry.

[John]

Yay. About time.

[Troy]

The article says it's because a banks are pulling out of financing data centers. Like is the bubble popping? Is that what this is?

[John]

Is this like they're f pulling out a financing data center specifically for AI is what I read on that article.

[Troy]

Yeah.

[John]

So that's pretty wild. I mean if you have an entire financial sector is like, oh, this is a bad, this is a bad bet. Right? And then that's going down to the point where they're not going to finance Oracle because they think it's a bad bet. That's, that's a lot of bad things in a row.

[Troy]

I can't believe they even have 30,000 employees to lay off at this point, but I guess they do.

[John]

I thought they had like 80,000. Let me check real quick.

[Troy]

That's so many people. I guess they have Oracle E business. Like I'm like thinking of what products they're even. I guess they probably are in a lot of like cloud and SaaS. Stuff that we don't know about or that we don't see as commonly.

[John]

62,000 people global and there is a lot passports and they do a lot of consulting too. So when I was working at dod we saw them all the time doing like build outs and network operation centers and all kinds of crazy things and yeah, you know the whole thing that no one got fired for hiring IBM. Well that's kind of true for Oracle as well. So it's just, just kind of crazy.

[Troy]

So somehow we lost James. Hopefully he comes back.

[John]

James replacement. I finally got my Internet working in this, in this.

[Troy]

You can't replace him. You're not even trying. He had, he had, he had a, he had a whole background. He had a wrecker hat. Where's your wrecker hat?

[John]

I don't have a record hat right now. You're right. I am, I'm a pale imitation of James.

[Troy]

All right, what else we got? I mean, I think since John's here, we might as well talk about the whole. Oh, hey James, welcome back. Since John's here, we might as well get some hot John takes on the whole geopolitical situation that's happening. The whole, the classic story of what is kinetic, what is not kinetic. I have some, I'll just say, I don't have an article to back it up, but I did get a couple of tips from a couple of sources I have that said that we're seeing hugely increased cyber attacks coming out of Iran against US Targets. I don't think, I mean, maybe there's a specific news article we can find about that. But you know, I think, I guess it's an interesting thing to talk about is like what is, you know, of course they're gonna, there's gonna be retribution for all the missile strikes and things, having some cyber targets like, I guess, John, what's your take on this? Is this going to increase? Is this a thing?

[John]

Okay, so there's a couple of things, right? I mean, if you're, you're looking at two distinct types of attacks, right? One is a nation state level attack and we're definitely seeing an increase in cyber attacks right now. I've read and, well, I've heard rumors that of some of the strikes of what we've been doing have been specifically targeting some of the people that are in charge of the cyber aspects of Iran, which wouldn't surprise me looking at the amount of ordinance that's been dropped on them over the past week or so. So that's interesting in and of itself. But whether or not that contributes to what is exactly going on as far as the cyber attack me is a little bit difficult to ascertain at this particular point. And the reason for that is it isn't just Iran, right? So there's a whole bunch of other groups around the world that are really unhappy with what Israel is doing. And look at this as a continuation of what's been happening in Gaza. And there's a political hacktivist element of this as well. So anytime you're doing any cyber operations, one of the best things that you can do is you can do your cyber operations either utilizing the kind of, you know, the hacktivism movement, utilizing it directly, which I'm going to come to here in a second, or trying to cloak yourself in the hacktivist movements as well. So that way whenever you're looking at defenders, they won't be able to Tell the difference between what's a nation state and. And what is hackers. So giving you an example of how this was, I was working with the bank a number of years ago in Germany, and what was going on in that particular bank at that time was very interesting because they saw a concerted movement as a hacktivist attack E. Dos against the infrastructure, the web infrastructure of the bank at that time. Now if you remember, what was it? Low orbit ion cannon. High orbit ion cannon. These really crap tools were really prevalent whenever hacktivists were trying to bring down different sites. Now what was actually going on is nation state or nation state level player was actively riling up the hacktivist movement, getting a whole bunch of people to do that level of DDoS attack against legitimate websites that were ran by that particular bank. While that was happening, the, the actual elite group was running phishing campaigns against their customers. So what they were doing is they were saying, hey, your password's going to be expired. You need to log in here immediately. You need to do all of these different things and you must click this link to get there. Which worked because the main website was down, so the customers were not able to get to the main website. And they felt the only way that they could change their passwords or set up their passwords to not expire was to click the link. But that entire operation was completely orchestrated by a nation state level adversary. So when you're looking at these different things, it's very, very difficult to tell the difference between what is true nation state attack, what is groups acting on behalf of nation states, and what is a mix of the two. So keep that in mind as we're moving forward. But if we want to boil it down to one simple thing, hold on to your butts. It's about to get real interesting, James, and I'd love to get your take on this as well.

[James]

Yeah, of course. You know when it's always coming down to the human and targeting them to click on a link or open

[Troy]

an

[James]

attachment, when you've got something this serious, when it's imposing on livelihood, their lives and everything else, people aren't rushing to verify or trust it. It's like, oh my gosh, this is information. This is information we need. And that we've been seeing it on both sides, whether for missile strikes or for prayer groups or whatever the function that they're trying to utilize is. So social engineering is going to play a major part in all of this. Going after the human, relying on the fear, relying on the urgency to get them to click those links to take action, gain access to devices and everything else. And as you said, John, this is, hold on to your butts. This is just the beginning. I have a feeling it's going to get worse. What I'm curious to see will be the outcome of, with regards to how nation states might be inside nations, other nations infrastructures, and whether they launch any type of attacks related to, you know, this, this potential or current cyber war, not only physically, but also electronically as well. So it'll be interesting to see what further stories come out of this, what things we continue to learn about it. But yeah, it's, it's fastly moving and

[John]

what you're talking about I think makes a lot of sense. And you know, you kind of reminded me of a quote, you know, the whole quote of what is the best time to plant a tree? Right? The best time to plant a tree was 25 years ago. Second best time. And when we're looking at preparation for nascent state adversaries, a lot of organizations are freaking out. They're like, oh my God, what are we going to do? The really good organizations have been thinking and planning about this for 10 years, right? You've got to have nation state level adversaries in your threat profile if you're trying to defend your network appropriately. And if you're just now saying, oh my God, what about Iran? Rest assured it's probably going to be painful if you get hit.

[James]

Yeah, yeah. I was chatting with an organization a couple weeks ago regarding their incident response, their tabletop exercises and how they did things. And we were talking, we were brainstorming on different topics and they were already on the ones with regards to Iran, the war, different wars happening all around the world. The impact could be on them. And so yeah, they're already planning and they've already been exercising. So it was good to see that some, there are organizations out there, they're doing it to your point.

[John]

So I'd like to get your take on this too, since you're definitely on the defender side.

[Corey]

Yeah, yeah. So I posted a thing about how Anonymous came out and made a statement for the first time in a while. But it was more about the Epstein files. Right. Which, oh, is the total squirrel, a little bit of a squirrel tactic on what was going on. But with that I kind of counterpoint, like when was the last big hacktivist group that we saw? Like there's a couple things with like the furry hunters that we saw, the furries that hacked the. Someone, there's a, there's not as much out. You're talking about. Yeah, yeah. Who are great. There's a couple other ones but it's kind of interesting that it's not even there anymore as much as it was. I guess it's not even as a wild west type of thing. But to come at it from more come at. From Iran hacking you though my key take like Iran is a big player. We know that. They don't seem as technically savvy, at least in my ttps that I've done. Like they're not out there creating like crazy new zero days to drop on you and to get in. They're looking for low hanging fruit to come in, break stuff and back out most likely. So make sure everything's patched. I would be the first thing I would say.

[Troy]

Well, so what you're saying basically is that all the hackers out there sold out and went corporate and became financially. They became financially motivated threat actors.

[John]

I don't think that that's necessarily it, Corey. I think lot of the hacktivists gave up, just decided to shit post on Reddit instead. That way you can get that exact same type of feeling with lower risk and more of an immediate dopamine hit.

[Corey]

John, is that why you did an AMA recently?

[John]

Yes, that is why.

[Troy]

John's like, I need to do some threat intel research. Let me do an ama.

[John]

Yeah.

[Troy]

So okay. So John, are you saying live here on the news that buying the new Microsoft E7 license will not protect me from nation state threats?

[John]

No, but they're soon to be released E8 and E9.

[Troy]

Okay. I was worried there for a second because I am. I mean, I guess we should talk about it. It is an article. I'm sure it's on people's minds. It'll be quick. Today Microsoft announced E9 or, sorry, what number are we on? E7, which I guess is just slapping more AI on more things is. That's my understanding of it, basically. Am I wrong? I don't know.

[John]

That's all. I read it. It looked like a lot like Microsoft is trying so hard to try to get AI to work for them. It's just, you know, everything, you know, this is my personal right. They keep moving the copilot button on my phone and on my browser to try to put it in the most conspicuous place that my mouse is going to go to try to trick me into doing that. They just want to be known as like an AI, AI leader with this stuff. And it's just like, oh my God, it, it's, it's Too much at this point. So what is.

[Troy]

They're trying to. The Microsoft is calling you right now, John. You should probably.

[John]

They are, right, so. But yeah, what are they selling this with like Frontier models or something like that?

[Troy]

Frontier Suite is what they're calling it. I don't really know what that means. Does that mean we get to just take other people's AI away from them and claim that it's ours? Is that how that works?

[John]

What is it? Their pricing is kind of interesting. They say general availability for age of 365 is $15 per user. And then it says the new 365 E7 is $99 per user. I don't, I don't know quite.

[Troy]

They're like, listen, we're not a supply chain risk. We swear. Just give us buttons to put in all your programs, including, you know, Word and Excel and Notepad. Everything has to have AI. I mean, I don't know. I will say people are going to buy it. I mean, I'm honestly curious. From my perspective, can it just send my emails for me automatically? What could go wrong?

[John]

That would be nice. That would be great.

[Corey]

It can if you have cloud code, scheduled tasks turn on.

[Troy]

So, okay, so arguably that, that's what they're trying to go after, right? That, that like that exact workflow is what they're trying to target.

[John]

I think, yeah, that's what they're trying to go after.

[Troy]

From a security perspective, I very much as a hacker very much hope that this somehow becomes the default, that my customers are automatically having eyes reading all the stuff that we send them. Because for phishing, I mean, the prompt injection harvesting is going to be really good. So I don't know, who knows how it's going to roll out.

[John]

One of the comments that we're getting are like, wait, this is real? I thought this was a joke. Like the whole conversation is like, wait, no, this isn't a joke. No, this is a thing. Yeah, it's, it's. Yeah, we're just going to keep it.

[Troy]

It really is a thing. Yeah.

[John]

I can't wait for Microsoft to come out with a marketing campaign. It's like this company got hacked and they were using Office365, but they deserved to get hacked because they were only using E5.

[Troy]

They didn't have enough ease, they didn't

[John]

have licensing and they got, they got what they paid for, boys and girls. So.

[Wade]

Well, it wasn't too long ago before when. What is it if you only had an E5 license? Remember when China basically got into potentially anybody's 365 tenant. And if you didn't have an E5 license, you couldn't even see it. You'd even have the, you couldn't see the logs.

[John]

And they were pressured to make those logs available, but they only made it available for that specific style of attack. So it's like, yeah, well, should not. There should be no effing tiers dealing with logs. Like you have to be at this level to get your logs. Logs. Logs are freedom.

[Troy]

Well, so reading between the lines, it does seem like this. There's basically two takes. One is that it's way worse that like if you get an E7 license, you're going to have way more prompt injection vectors and way more AI data leakage and way more like concerns. But it is also reading between the lines that there's going to be, you know, they say here there's advanced Defender. You know, I don't know. I don't know if that's like a new kind of defender that comes from E7. I don't know. It's not clear. But we'll see.

[John]

Yeah, it never is.

[Troy]

So a quick follow up article to last week is that officially Motorola is partnering with graphene OS to make phones. We talked about that, you know, briefly that it was kind of like potentially happening. It's definitely happening. They're, they're planned in 2027, so that's pretty exciting.

[John]

Authenticator. I don't know if you saw in the news, but Microsoft Authenticator specifically said that they would not work with graphene os. And their big concern was it was, it was not a secure platform and.

[Troy]

But is that true? If I have an E7 license, can I just vibe code my own Authenticator app?

[John]

That's, that's what we need.

[Troy]

Yeah, I don't, I mean that, I didn't see that. If we have an article for that, that would be interesting to talk about. But I mean I thought they were like gonna get rid of Authenticator altogether at some point.

[Corey]

Passkeys. Yeah, says the password manager person.

[Troy]

All right, so I guess we could talk about 6G. This isn't really a.

[John]

Here's that. By the way, here's the link for everybody for that thing I was talking about. Microsoft Authenticator.

[Wade]

Gotcha.

[John]

Thank you.

[Troy]

Yeah. So basically 6G is somehow also a geopolitical concern at the same time as just being the fastest cellular connection. So basically Western nations have launched a coalition to found or shape the security and you know, like implementation of 6G where China is going to make their Own version of it. I don't know exactly what theirs is called, but not 6G, maybe.

[Corey]

We've talked about this before, right? About, like, how we don't want China to create the standards. We want us to create the standards.

[Troy]

And then it's like, you know, I mean, it makes sense. You can't. If you're creating the standards, you can backdoor it for yourself, right?

[John]

Yeah. Then you have control.

[Troy]

Then you have control. If someone else makes a standard, you don't intuitively understand how it all works.

[John]

So I have a friend that works in some of the labs up in the Nordic countries, and they were talking about some of the things that you can do with 6G. And it sounds like borderline magic. Like 6G. You can read temperature in room 6G. Remember in Batman where they mapped entire rooms? You can do that with 6G. You can identify who's in the room, read their heart rate, you can look at their temperature. It is flipping insane, even down to the point being able to identify who is in the room. So, you know, a lot of the vendors that are talking with this lab that I have a friend that works at are like, wait a minute, Netflix is like. So we can totally do a pricing model for people watching movies based on the amount of people in the room that are watching movies they. They want. They're looking at this as like a future pricing kind of situation and specifically tuning advertisements to try to identify who is in that room. It is. It is absolutely wild.

[Troy]

And it sounds like your friends in that lab might be spies. That sounds.

[Wade]

There was something that this weekend I was reading. There was. There was some news this weekend I was reading that somebody open sourced the technology that basically does just that. You can utilize WI fi to basically map a room out.

[Corey]

Yeah.

[Wade]

And then essentially you can, like look through walls and stuff. You can see people, like, moving through the walls and. And such. Because it's just using the RS.

[Corey]

Someone sent it to me because I have a 6G capable.

[John]

Yeah.

[Troy]

I mean, it's pretty cool.

[Wade]

Like, nobody's in your house and you have WI fi.

[Troy]

Are you telling me that all the tinfoil hat people were right all along? And I shouldn't have said that we need WI fi.

[Corey]

They are now.

[John]

They were, you know, good thing that most of us are dead and dying or have gotten out of it completely and are like running farms out of nowhere. But, you know, this gets back to. There's so many cool things you can do with this technology. And literally most of the. Most of the big vendors are like, how can we do better advertisements and get more money? It's like, how much money do these companies think is left to extract from the population?

[Wade]

Because they just had a fever, John. And then all of a sudden, you start getting Tylenol and, like, Motrin advertisements and, you know, stuff like.

[John]

Yeah, congratulations. Katie's pregnant. What?

[James]

Huh?

[Troy]

No licensing required for your. Your E7 license doesn't apply to your unborn child.

[John]

Yeah, yeah.

[James]

And for an extra price, we'll tell you if it's a boy or a girl. Right.

[John]

Your corporation and health insurance company that you are now pregnant and you have been fired. Thank you.

[James]

Imagine how upsetting that would be when you discover the sex of your child through a few of your phone.

[Troy]

Oh, all right. This dystopia, we're turning left at Dystopia corner

[John]

into privacy plans the entire life of your child. It's like, this is. This is pre cog. This is everything that's coming down the line. It's like, that's the technology, though.

[Troy]

So this is an article that hit my radar. I linked it. Basically, Shiny Hunters is going after Salesforce again. This time they're going after this API endpoint, which we've had on our radar for a while. Like, basically, this is something we've been reporting for a long time, but now Shiny Hunters is exploiting it and trying to sell it back or to, you know, extort people using the data. But basically, there's the sales loft ARA endpoint that you can get information disclosure from. I would strongly recommend if you use Salesforce to make sure that this endpoint is locked down. There's some settings in the blog that cover how to do that, but I would recommend, if you use Salesforce at all, make sure you aren't vulnerable to this. Of course, we tested all of our customers. There was a handful. This happened back in 2024 when we did it.

[Corey]

But Salesforce just keeps on giving.

[Troy]

Yeah, the gift that keeps on giving.

[Corey]

I believe they have two different type. Two different log types.

[John]

What was the name of that tool that created such a huge. Was it Salesforce? It was Meat Pistol. Meat Pistol, Yeah.

[Troy]

You're talking about they. Well, so Salesforce employed the researcher who was going to release Meat Pistol, told him he couldn't do it. He quit his job and did it anyway. That's. I mean, we should have known then that we were screwed. From a security perspective, I am going

[John]

to say, though, could have been named a little better. If a bhis to somebody is like. So I'm planning on creating a Tool

[James]

called the Meat Cannon.

[John]

I'm going to be like, yeah, no, I.

[Troy]

What? Are you kidding me?

[John]

Bad ideas? No bad ideas. But, you know, let's. Let's think about this just a little bit.

[Troy]

All right.

[James]

That was years ago. Holy cow.

[Troy]

I thought you were cool, John. All right, fine. So. All right, so the next one. I don't know. Wade, have you had a chance to read this Domain Tools?

[Corey]

Oh, yes, yes, yes. I want. That was the other one I want to talk to today. So this is the disinformation campaign stuff is, like, one of my favorite things to watch and follow. Like, one of. One of my mentors, like, right when I was getting security, was really hot about this and gave me, like, the best way to talk about it. And it's military weaponry being used against the public every single day pretty much with this type of thing. So in this article from Domain Tools, and I believe they got it from the social. Yeah, social design agency, pretty much. They're tracking this news. This. What I. What's the proper term? Like organizational news site. They had to use a good term. It's called the doppelganger RN ecosystem. It's able to quickly create websites that are masquerading as very prominent news organizations. And in order to create fake news and control the media and control narratives.

[Troy]

Dude, the fact that it's called reliable recent news, she seems like a red flag.

[Corey]

And so they're able to spin up WordPress sites, news articles, all their scalability. There's everything. It feels like. Like, it feels like your normal IT tool that's able to ramp up very quickly type of deal.

[Troy]

Thanks for that segue to our sponsor, Squarespace.

[John]

Built on the fly to deliver malware. Check out. You know, we shouldn't say that because, like, these companies are going to be like, wait a minute, is there money?

[Troy]

Wait, hold on. Can we. Can we pay these people?

[Corey]

We have come up with great ideas on this, on this podcast before for money.

[John]

Did you ever go to any Paul Bixie's talks, Troy? You may have.

[Troy]

Didn't he.

[Corey]

Did he do Reno Wild West Hack and Press, Rena, where it was literally like a doomsday talk. And everyone in there, everyone at the end of the con was like, okay.

[John]

And now we look back on what he was talking about and we're like, oh, that was quite. It's. If you want to, like, just somebody who knows the guts inside out backwards, go look at Paul Vixey's talk from Way West Hacking Fest in Reno, Nevada, and it kind of talks about the Amount of information and all the money that's being made on the back end of DNS and how it's all evil.

[Corey]

And then John disappears.

[Troy]

Oh no, it looks like, looks like they got DNS, got to John.

[John]

I invoke Bixie and it kicked me off, I guess. So make it that, that, that tracks.

[Troy]

So, so this like, I guess Wade, like on these disinformation campaigns, like, yeah. I mean, is this search engine, like, how is there a fix for this other than just like only using reputable news sources? Like, or is this, I mean, is

[Corey]

it just operational Internet? I don't know.

[Troy]

Don't use the Internet.

[Corey]

Make this, make a second Internet. Like the Internet within the Internet of only trusted sources that you have to have a. I don't know, like then it's going to become big tracking. There's no way to fix this, right? Like at the end of the day, someone on Facebook is going to find this and repost it to millions of

[James]

people and they'll repost it 80,000 times. Yeah.

[John]

What I mean about this crap is inevitably when this happens, there's one of those like, like Web 3.0 jackasses that's like, well, we need to implement Web 3.0 and it's going to fix all of this. And it's like, you're not cool, no one wants to party with you. Leave, get out now. The technology is sound, right? It's the apps and all of the things that people use out of convenience that just, that's just dead. You know, we can't wipe the slate clean and do a fresh start. It's like the technology is south. It's just everybody gets hooked into these ecosystems and we just reuse them again and again and again.

[Wade]

I wonder if the popularity to this is really focused on countries that have really poor ability to get good news. So they're just trying to find. Because if you look at some of these tld, like top level domains, they're just like, they kind of look sketchy. And then the fact that you have new domains being registered, right? Like categorization, like proxy categorization is good. There are like services out there, like, like Cisco's umbrella and stuff like that does a really fair job at like, like, like categorization of domains. So it's like, do people just not utilize that anymore or is this really just.

[Corey]

They just don't care, right.

[Wade]

That don't use proxies.

[Corey]

Like the big thing here was like typos. They're looking for people who are mistyping news sources Or Googling something or trying to prove that they're right.

[Wade]

Irs, where we look at the link and we're like, shit, domain was registered like three days ago.

[Troy]

Like, really?

[Wade]

Like, like, it's like. I mean, if it's, if it's a very popular domain, like, the fact is that they're not, like, for these to be successful. They're just not using like, like good, solid, like, proxies and, and domain.

[Troy]

Okay, hold on. Are you saying you don't usually. You don't usually get your news from Artichoke cc?

[John]

Let's, let's pick at that. Troy. Yeah, I think that this is an easy fix for organizations, right? Go into your proxy and look for uncategorized. If you see uncategorized, block it. The reason why this works is so many organizations. This gets into something I teach. It's like a lot of organizations are still fundamentally hooked on deny listing. Identify all the bad domains. We'll put them on a list. We won't let people go there. But if you have something that's uncategorized, like a Cisco and fortnet Palo Alto have never seen this domain ever. Do not let your users go to it. Like, yeah, and that takes care of a lot of those domains. But that's the easiest domain allow listing trick that you can do is just go into uncategorized, deny.

[Troy]

Do you want to know the stupidest reason why people get pushback for that? Because of local restaurants. That's the number one pushback I've gotten.

[Corey]

Use Google Maps. All right? Use Google Maps. See it.

[Troy]

All right?

[Corey]

You don't need it.

[Troy]

But listen, it was a catering order. I'm an exec assistant. It was a catering order you specifically asked me to put together.

[John]

Right?

[Corey]

I mean, okay, he said the key word there. The key word, everyone was executive. That. That was what got it through everything.

[Troy]

So again, this is like, I'm not saying it's legitimate. I'm just telling you this is the. It's the trenches.

[John]

Marketing, ciso, cto, executive assistant. That's the decision hierarchy.

[Corey]

You get an email from them, that's done, you're good. It's open that firewall right up. Oh, one thing I, I see from this is like, it's goes back to the thing. The common sense isn't so common. Right? Yeah, I hate, so I hate to plug this. I recently did an interview on the 1Password podcast with Kolina Kaladi about OSINT and how people need to be better at OSINT in order to find this fake news and to Understand, like, hey, I can make one more Google search to figure out if this news is fake or not. And then utilizing AI for that as well. Right. To make it even easier for you to understand and go at it.

[John]

Well, and this is a plug. And it bothers me because they pay people for this and I do this for free. But I just want to take a moment. Plug. Low sodium V8. It's absolutely delicious.

[Corey]

John has been drinking low sodium V8 for like, as long as the podcast has existed. I'm surprised they haven't at them and Nord. Why aren't they sponsoring us yet?

[John]

That's all I'm asking. I just want. And that. That's it. I don't want any money. I don't want anything. I just want to acknowledge that I exist and that I've been supporting their cause. Other than that, the other company they see on YouTube all over the place is Ground News. I absolutely love Ground News's app, where if it has a news story, it shows you the full swag of, you know, left, right. Like there's multiple different sites and different views of this story. And it makes it really a lot easier to sit down and read the news and enjoy an ice cold, low sodium phase.

[Corey]

I've been trying to get Liquid Death to sponsor me for a while and they just don't return my emails ever.

[Troy]

Like once a month you got to ramp a jet ski over a mountain to get sponsored by them.

[James]

Right.

[Corey]

I feel like Liquid Death and Cyber security go hand in hand. Like, their marketing schema, like, would be perfect.

[Troy]

We already had Liquid Death. It's called Jolt Cola.

[James]

All right.

[John]

Liquid Death was just.

[Corey]

Yeah, it's just bubble water. Right. That's all it is.

[John]

Liquid Death. So that's good.

[James]

The Grind news.com is available if anybody wants to go snag that their version

[John]

of RRN Meat Pistol. And people are like, are they joking? Are they setting us up with another Jody situation?

[Troy]

Thank you, James, for just fishing us live on the air. I love it. Yeah. So, okay, does anyone else have. Does anyone. Before we keep walking through the list, anyone? James, John, Wade, Troy? Anyone have any articles they want to like that they want to specifically talk about?

[John]

And I'm doing. We already hit the one that I wanted to talk about.

[Corey]

The Lexus Nexus One is kind of an ongoing thing that we've been following for quite some time.

[Troy]

This is a lot of our customers.

[Corey]

Yeah, I think that. That as well. So pretty much LexisNexis, which is this huge global provider of analytical information to a Bunch of different organizations, law firms, mostly law firms. So I remembered this because they. There was an article about car data being cycled to them for insurance information. And yep, your car not being. You not being able to turn it off. And there was a huge thing about. There was one other one about it too, that this is like the third time we've talked about them. So now seeing that they got breached, I was like, we all knew it was coming. Now, now, now they know that I speed. So what else is going to happen?

[Troy]

So the interesting thing about this one that we've. And we've been reporting it for our customers and giving nice little summaries of what was leaked. It's nothing crazy. They're like, they claim no usernames and passwords were leaked. The threat actors claim that like, potentially passwords and API keys were leaked, at least for the customers we've looked at that were affected. It's interesting because you'll see the. Like in. So in the data that was leaked. One of the things, one of the pieces of data is an analytics tool that was running on their support portal. And so the data from that analytics tool is leaked and some of the information that's disclosed is the person who. They submitted a ticket as the screen resolution that they submitted that ticket as the device type, the IP address, the location. So like, it basically is like Uber phishing for the targets that are in the breach about like LexisNexis data. Because not only do I have your device type, your location, your screen resolution, I also have whatever tickets you opened, whatever support numbers they were related to. It's like, that's what we've been warning our customers about, is like you're about to see LexisNexis phishing campaigns for the next five years. Like, just expect it.

[James]

Yeah. Job titles and phone numbers and email addresses and all the other stuff, like real ticket numbers.

[Wade]

Yeah, yeah.

[James]

But with the jobs, they can be sending other bec phishing emails easily. So.

[Troy]

Yeah.

[Corey]

Is the screen resolution just to see if they're mobile or not? Like, is. Is that it? Right? Like, what.

[Troy]

Why do we need to know?

[Corey]

I'm on a, on a 580.

[Troy]

Like, it's, it's one of those things. I mean, it's like again, it's, it's ostensibly in the name of support. Right. The user was on a mobile or. Yeah, the user was on a desktop or whatever. But I think it's, you know, it's

[James]

about something else to build rapport and build a connection with the target ticket.

[Corey]

You Need a new monitor.

[Troy]

Yeah, so anyway, it's, you know, something

[James]

circling back with the K, the ticket you submitted on such and such from your phone. Hey, can you fill out this survey?

[Troy]

Click Exactly. Also, one of the other pieces, interesting things, is that we saw for some of our clients, users were submitting support requests from both their personal emails and their work emails. So now you have a piece.

[John]

What I said that was being sarcastic. That's not a problem at all.

[Troy]

Well, it gives you that piece of data to tie those two emails together and now you can go go after their personal email and fish that too. Like, you know, it's two phishing vectors and their Gmail or whatever, their personal email is out of purview of the corporate security. So they're not going to get phishing protections or EDR or any of that stuff. So I guess basically don't click any emails from LexisNexis for the first next five years and you'll be good.

[John]

Okay, great.

[Troy]

Super easy.

[John]

But this gets into, you know, getting into a more meta issue since we're all about depressing topics here. Whenever you're looking at like LexisNexis or TransUnion or any of these background investigation companies and data aggregators and data brokers, it's like this is an area that probably needs to be regulated. And, and I've talked about it many times, like whenever you're dealing with this much personally identifiable information, it needs to make a transition and be phi and be handled and be protected underneath HIPAA consideration. So whether we're talking LexisNexis or we're talking about TransUnion style data or other data brokers that are out there, or if we're dealing with ad data where Amazon and Google are creating these very detailed profiles about you as an individual, even though maybe not specifically your name, this crap should be protected and should be regulated at some level. And I'm, I don't, it's not going to happen anytime real soon. But you know, anytime you can talk to somebody associated with like, like, you know, Congress or the Senate and you can sit down and have a conversation with them, you should absolutely try to push this as an idea because these unregulated areas, like, it's just a matter of time before we end up in another massive breach of very sensitive data being exposed to the Internet as a whole.

[Troy]

So while we're in depressing dystopia corner, why don't we talk about this? Unfortunately, this article kind of implies that that argument's going to fall on deaf ears. But basically Google has requested or, you know, filed or whatever that the Supreme Court strike down geofencing warrants or geofence warrants. Obviously, we're not lawyers, this is not legal advice, but essentially there's a type of warrant called a geofence warrant that is essentially a reverse search warrant, where if you're thinking that shouldn't be something that can be reversed. Well, we all agree basically the police can demand technologies company Pinpoint point all mobile devices present in a specific geographical area during a specific time span. So Google is sick of providing these information to law enforcement, I guess, or they don't agree with the fact that they have to do it and they're trying to get around this so that they don't have to do it. So apparently in July 2025, they started storing all history data on device so they can't subpoena. So it can't be subpoenaed. But this case is actually a 2019 case. You know, this is classic Supreme Court. They're only seven years behind the times that basically a Virginia man pled guilty to a bank robbery and they got that information. They just literally were like, who was at this bank at this time? And Google had to give them all of that information and then they figured out who did it based on that. So I don't know. I mean, I guess currently this is legal, terrifyingly, hopefully. I mean, I. From privacy perspective, I really hope it gets, you know, knocked down by the Supreme Court. I. I don't have high hopes for this personally based on the current political climate, but maybe, I mean, privacy is always kind of a bipartisan thing, right? I mean, it kind of just depends on who's in the room at the time.

[Corey]

But I recently spoke with a murdered, like a homicide detective about their abilities to do this type of stuff, and I was in awe at the level of access they had to things that I did not know they. They could easily be granted access to.

[Troy]

Oh yeah, your ring cameras, your.

[Corey]

Yeah, like email geofencing. Right? Like, email is the big one. I didn't know that. They could just be like, hey, here's five people here. We need all their emails because they were. They're in this. They're like, up for this murder. Yeah, yeah. And it's like, okay, yeah, here's their entire inbox control. F murder. Here's the guy, he did it. He emailed his dad later.

[Troy]

Like, he emailed his dad, I just murdered someone. Oops.

[John]

Come help.

[Corey]

Come help clean.

[John]

All the time. Like, you know, it's like, there's so many people, like, things like crime, I wish to commit crimes, I should do crimes. And it's hard because, like, as a privacy advocate, you want this stuff private, but then you see how stupid criminals are, and you're like, you're not helping.

[Troy]

You're not. But okay, so this is two different things. There's one thing, which is who was at this building in this time. The other one is this person. I is a suspect in a case, subpoenaing their information.

[Corey]

I'm okay with that.

[Troy]

I'm okay with that. Like, if you're a current suspect and I have evidence or probable cause or whatever you want to call it, that's one thing. It's another thing to say. Say I went to the bank today. So now I'm in the legal file for a case where that bank got robbed later that day. Right?

[John]

And that's it. Right. That's. That's what's kind of going down. Right? So all of a sudden, if you're like, in a coffee shop in a building where, like, let's say a whole bunch of drug dealers are meeting, now all of a sudden, because of the geofence warning or warrant, they can basically say, I want to have access to all the people that were at this location. And then based on that information, then they can get the warrant and get access to all of your emails and everything associated with it. And we all know that where this ends with a lot of different societies. Right. Without speaking directly to the geopolitical climate that exists in the United States or globally today. Just hypotheticals is this gets to the point where if you have any type of demonstration or protest, they can literally just do full geolocation or geo warrants, and they can basically. Or geofence warrants, and now they have a list of all the people that were present, and they can use that for additional things moving forward work.

[James]

So bring a burner phone to protests

[John]

or just don't bring your phone.

[James]

Or don't bring your phone. Or bring a burner. Yeah.

[John]

But even then, James, like, you don't walk around.

[James]

Yeah.

[Wade]

Nobody else, like, you got.

[James]

I was gonna say that was the other thing.

[John]

Nobody else keeps the phone in a Faraday B.

[Corey]

Everywhere I go, I keep.

[John]

I keep it in my Faraday fanny. God damn it. We got it. Can someone send me and send an email to content community. Bhis needs to make Faraday fanny packs. I'm gonna do it right now. It'll be a, like, aligned fanny pack that you can put your phone in it's a Faraday fanny pack. We're gonna do this. Hold on.

[Corey]

We haven't had a call.

[James]

Bhis Faraday crossbody.

[John]

Gotta love it.

[Corey]

It used to be like a T shirt every week. I like this one.

[James]

Now I have a duffel bag and I have three. Three Faraday pouches. One for a laptop, one for a tablet, one for a phone. Phone. And a duffel bag. But I haven't been brave enough to take it to the airport because I don't want to deal with that crap if I go through security.

[Troy]

Yeah, that's a. That's a tricky one. But luckily you usually don't have to fly to protests.

[James]

Well, you never know some of these people. But yeah, yeah, true, true.

[Troy]

That's good.

[John]

Yeah, but think about it. If you're going to something, you just take off your watch, take off your phone, put it in your Faraday antipack, and you're protected against these.

[Troy]

I mean, yeah, listen, I will say like the, you know, just to make personal real quick. The ICE building in Portland is literally on my normal bike route that I take to get to like half of the city. And so I've like almost gotten tear gassed multiple times just riding my bike.

[Corey]

I have seen those videos.

[Troy]

I'm probably in some of these data dumps just because I was just some idiot riding his bike and being like, I'm getting gassed. Sorry, guys. Good luck. Sorry.

[John]

Like, okay, I am just going to call it like, Portland knows how to throw down a protest appropriately. It's the big, you know, like the people in the blow up suits and then absolute nudity because it's really.

[Troy]

Oh yeah.

[John]

News and be like, these protesters were dangerous and violent. They were naked and it was 15 degrees, I don't think so. Nude protest. Way to go, everybody.

[Troy]

So yeah, you just. No clothing, just a Faraday bag.

[John]

All you need. All you need. The only thing when I protest, all I wear is my Faraday. Like it's.

[Wade]

Yeah.

[James]

Naked. Yeah. Or you do.

[John]

So.

[Troy]

Oh, wow. So many good ideas are coming up. Gotcha. So well, before we, before we close out the show, James, you have an upcoming webcast. Do you want to tell us about it?

[John]

It.

[James]

Yeah, I'm gonna. I'm talking. I kind of diving in a little deeper to. Based off the deep fakes talk I did last year and I talked about synthetic identity. So I'm doing a deeper dive into it, looking at different organizations that were impacted. Impacted by it. Not just that, the one that I used to work for. And I'm going To give you a solution in the first 30 seconds on what you can do to protect your organization of the. Of that webinar on Wednesday. So come check it out.

[John]

Out.

[Corey]

Block Astral vpn. You're done. You did it. You're good.

[John]

Congratulations.

[James]

No, it's. There's no technology involved, believe it or not.

[Corey]

No, I. I love this so I will in. Oh well, I'll let Troy go first.

[Troy]

Troy, you also have an upcoming webcast at the sock summit.

[Wade]

I. I do. That's later have one. I have one on Thursday as well. That talking about a breach assessment that we did at the end of the year last year. I don't know if we have. If we have anything there.

[Corey]

There you go.

[Wade]

I know for the SOC summit I'm teaching my class as well as I'm. I'm giving a. A talk on Yara and just kind of introduction to the tool Yara. If you've probably familiar with Yara, you've seen, you know, an IOC list, a YARA rule. Maybe you want to kind of understand like how that works and you know, kind of getting started with that. So I'm going to give an introductory talk on that as well. But this Thursday I'm also going to be talking about. About this interesting case that we detected last year. Doing a. During a breach assessment is what we call it. But essentially it's like a threat hunt right. In an environment where we found the threat actor was. Was in the environment for over seven months and the campaign itself was probably over two years old by the time we we were involved and kind of detected it for this customer. So just kind of share. There's already been a blog post on it that we posted in December right before Christmas. But I'm going to be just talking through that and have a little Q A at the end of it.

[Troy]

Alrighty.

[Corey]

What I don't get my sock summit talk doesn't get. Get thrown up there too. I'm talking too. Gosh, I don't even remember what I'm. I don't even know what I'm talking about. I. I wrote out a wireframe. I'm gonna try to do a John and build it the day before.

[James]

Isn't that the way you do it anyway?

[John]

Right.

[Corey]

I don't know if I can do it the morning enough with two kids now. That's good.

[Troy]

Do you have a title? Do you have a title?

[Corey]

Let me look at my notion real quick.

[Wade]

That's the most important part, right? You start with the title and then

[John]

I. I've been letting content community just come up with my title talks for me and they were doing things like exactly how much lube and doggy treats are required to do incident response and it's like that's a really tough tough thing to write a talk to. By the way that ends a shout out to Josh Wright. Oh look.

[Corey]

Oh you're using my my bad headshot too. Oh wow.

[James]

Oh look at that headshot that that's

[Corey]

from when I

[Troy]

the suspect of a geofencing incident at a local java but

[James]

we can't find him because his phone's inside a fanny pack Faraday to to

[Corey]

go back onto James I will I have written interview question an interview scenario it's like a take home that revolves around catching writing an intel report for North Korean and threat actors. Right. For malicious work per month. The amount of people that can't do that is ridiculous. I'm like there's a million websites out there telling you how to do this. Just chat GPT it please.

[Troy]

All right. Any final notes before we close any

[James]

so I know and you asked at the beginning Corey and I appreciate it but folks have been asking about how the job hunting is going and I am trying to get a new job because essentially all I do all day is just crush cans. It's soda pressing so thank you very much.

[Corey]

You must be making so much money.

[Troy]

Gotta get those deposits back.

[James]

Well yeah, you tried to.

[John]

Yeah,

[Corey]

It.