Anti-Tech Extremism - 2026-06-01

Summary

Podcast Summary: Talkin' Bout [Infosec] News - "Anti-Tech Extremism"

Host: Black Hills Information Security (Corey Ham)
Date: June 3, 2026
Theme: This episode covers a lively, in-depth discussion of current infosec news, with a heavy focus on emerging anti-tech sentiment—especially localized resistance to AI data centers, evolving cyberattack techniques (from USB drops to botnet takedowns), and reflections on the effectiveness and risks of new AI tools in offensive and defensive security.

---

Episode Overview

The panel tackles the fresh emergence of "anti-tech extremism" in the U.S. and broader anxieties around data center expansion for AI. The group pivots into varied infosec headlines: the return of physical attacks like USB drops, novel AI vulnerabilities, the limitations of red teaming and threat hunting tooling, and the persistent dance between offensive/defensive research—and the controversial role of major platforms like GitHub. Sprinkled throughout are insights into the evolving role of AI for both attack and defense, plus the customary mix of jokes and war stories from the field.

---

Key Discussion Points & Insights

1. "Anti-Tech Extremism": Data Center Backlash

• Description: Federal law enforcement is warning about "AI anti-tech extremism" (13:04), spurred by intense local resistance to new AI data centers, particularly in rural or suburban areas.

• Highlights:

  • "The government has decided to acknowledge this as a real thing... anti technology extremists. And kind of like the first, you know, headline response on Twitter was, we're not anti tech, we're anti VC funded tech."
    — Corey Ham (12:49)
  • Discussion on specific cases, like the Utah data center backed by a Canadian billionaire, and broader frustrations about resource consumption, environmental impact, and lack of local benefits (14:00–16:56).
  • "They're building data centers and taking away from these cities and towns and resources to then also build AI that then takes away their jobs too..."
    — Ralph (18:38)

• Panel's Tone: Sharply critical of both federal/law enforcement framing (Wade: "This White House article is literally just propaganda." 17:02) and corporate efforts to push through projects without community input.

2. AI IPO Mania: Anthropic Files for Trillion-Dollar Valuation

• Timestamps: 21:06–22:56
• Anthropic files for IPO at an almost trillion-dollar valuation; the group marvels at inflated tech valuations and jokes about a "GameStop move" to buy it out.
  • "But Anthropic has made like 20 billion and this is like a $900 billion valuation. Which, by the way, that all makes sense because the stock market is not an indication of how much money a company is."
    — Ralph (21:49)
• Discussion segues into the wild financialization of AI and what it could mean for transparency.

3. Return of Physical Attacks: USB Drops in 2026

• Timestamps: 23:31–28:47
• The FBI warns of new ransomware attacks using physical USB drops—even mailing devices to law firms.
  • "Basically, this is a real article. The FBI has warned Silent Ransom Group... Apparently they're using an extremely advanced tool called WinSCP."
    — Corey Ham (25:06)
• Panel laughs at how "old-school" this feels, and debates law firms’ ongoing vulnerability due to outdated workflows (Shane Hartman: "They tend to be a little bit more technologically backwards..." 26:32).
• Recollection of "media drops" and how simple techniques still succeed surprisingly often.

4. Microsoft, GitHub, and the PoC Takedown Debate

• Timestamps: 30:37–36:45
• Ongoing fallout from the "Nightmare Eclipse" vulnerability: Microsoft forcibly removing proof-of-concept exploits from both GitHub and GitLab, especially when disclosure is controversial.
  • The group jokes about free speech, the politics of platform ownership, and the recurring cycle ("Guys, we gotta move off GitHub..."—Corey, 34:35).
  • "Zero days on GitHub is not really a problem, right?... There's probably other places you can go get zero days..."
    — Ralph (35:08)
• Underlying sentiment: both the research and corporate response patterns repeat in infosec.

5. AI as Both Threat and Savior: Mythos, M-Dash, and Post-Exploitation

• Timestamps: 42:04–50:09
• Mythos (an AI penetration tool) is pending public release. Panel asks: Will it really shift either attack or defense work?
  • Notably, defensive tooling hasn't kept pace: "It's not really the model. It's what tooling you wrap around it that is really the differentiator."
    — David (44:04)
  • Microsoft’s new AI harness ("M-Dash") claims better vulnerability detection than Mythos, but skepticism remains about practical infosec impact.
• Real-world attack case: Chinese attackers using an LLM post-exploit to accelerate pivot (50:09). More common than "Mythos-style" headline hacking.

6. AI-Induced Account Takeovers: Meta's Big Blunder

• Timestamps: 51:19–54:12
• Meta’s AI inadvertently grants control over high-profile Instagram accounts.
  • "Meta AI was super helpful and decided to just grant some people access to some high profile Instagram accounts..."
    — Corey Ham (51:21)
• Laughter, but real concern over how quickly AI deployments at scale create new exploit surfaces, especially when GRC ("governance, risk, compliance") oversight is lacking.

7. Phishing-as-a-Service (PhaaS) & Botnet Takedowns

• Timestamps: 56:02–60:49
• SaaS-based phishing kits lower the bar for attackers (Kali365, 56:02). Shane notes such device code phishing "is still effective" in the field.
• Major residential proxying botnet (ASOCs) dismantled in the Netherlands, but panelists wryly note that such services remain a staple for both threat actors and pen-testers.

8. Fun & Outlandish News Bits

• Timestamps: 61:14–63:42
• A kid grounds a flight by naming their Bluetooth device "bomb."
  • "Can you imagine doubling down?... They had, like, 10 chances to... just turn off your Bluetooth. No, I'm not gonna do that."
    — Corey Ham (63:10)
• ISPs (like Charter/Spectrum) suffer yet another data breach (63:59).

---

Notable Quotes

• On Data Center Backlash:
  "It's interesting because they're building data centers and taking away from these cities and towns... to then also build AI that then takes away their jobs too."
  — Ralph (18:38)

• On USB-based Attacks:
  "Honestly, my question with this is... how does this criminal ecosystem work? Like, are they hiring people who actually think that they're helping people? Like, is it... a mule system?"
  — Corey Ham (26:13)

• On AI Security Tooling:
  "It's not really the model. It's what tooling you wrap around it that is really the differentiator... On the defensive side, I'm not clear that... Mythos is going to move anything further."
  — David (44:04)

• On Microsoft’s Reaction to PoCs:
  "The argument is pr. It looks bad for PR, but should they be there or not? Because somebody made a PoC?... You can see where this kind of gets muddy."
  — Ralph (33:16)

• On AI-induced Account Takeovers:
  "It’s almost like if you had a red team that wasn’t replaced by AI, they would have caught this."
  — Corey Ham (51:42)

---

Timestamps for Key Segments

• 00:01–02:31 | AI model behavior, prompt engineering, and dev tales.
• 13:04–19:16 | Data center resistance & "anti-tech extremism" analysis.
• 23:31–28:47 | FBI USB-drop warning, real-world physical threat discussion.
• 30:37–36:45 | GitHub PoC bans & responsible disclosure.
• 42:04–50:09 | AI security tooling (Mythos, M-Dash), defense vs offense.
• 51:19–54:12 | Meta AI account takeover incident.
• 56:02–60:49 | Phishing-as-a-service, botnet takedown.
• 61:14–63:42 | Bluetooth bomb prank & ISP breach.
• 64:50–68:07 | [Plug] David’s new tool "Evidence Forge"—synthetic log generation for threat hunting.

---

Plugs & Community Shout-outs

• David: Launches "Evidence Forge"—generates synthetic, realistic log/event data for threat hunting.
• Shane: Training, "Hunting in the Dark" (June 17, 1:30pm ET).
• Phil: Upcoming webcast on hacking CICD pipelines (Wednesday after episode).
• Wade: Teaching Threat Intel 101, now a 2-day course (June 22).
• Ralph: Physical penetration testing/exploitation class – practical red team skills with a humorous nod to "nation state level physical exploitation" (physicalexploit.com).

---

Memorable Moments & Top Banter

• "Go endorse Ralph for edged weapon ex expert on LinkedIn."
  — Wade (05:36)
• "You cannot install this hard drive until you take me off of it."
  — Corey Ham (14:03)
• "Why would an AI company need to make money? It's not like they're spending $20 billion a month on electricity in my backyard."
  — Corey Ham (22:11)
• "Would you like a red Team contact Bhis. We will walk into your building with the USB drive and do whatever you want."
  — Corey Ham (29:11)
• "So it's like the Twitter thing, right? Like, no large company is going to want to take this heat."
  — Corey Ham (34:43)
• "We pay threat actors to use their service to pretend to be threat actors to protect threat actors. It's a loop."
  — Corey Ham & Ralph (60:49)

---

Closing Tone

Engaging, irreverent, but deeply insightful as panelists wrestle with the rapid evolution of threats, technology, and the recurring cycles of infosec conflict. Especially relevant for anyone tracking news at the intersection of AI, physical security, and cloud-scale operations. The episode is both a warning and a wink: the past keeps repeating, but the stakes and methods keep escalating.

---

Transcript

[Ralph]

I haven't, I haven't actually gotten too many of like I can't help you with that. Right. But I think it's because I break down my tasks so like into small pieces because I've had that happen before. You're just like, all right, we'll just solve this thing. Right, solve that thing.

[Corey Ham]

But anyhow, I mean at bhis we saw people that run into it. But it seems like the most of the people who are running into the cvp like denials are the people working on low level code like the, you know, exploit development. Like, like especially messing around with those Windows LPEs and stuff like that. It's, it's all over that. It doesn't want you to have that. But for just like pen testing stuff, it seems pretty open.

[Phil]

Yeah, yeah, I wasn't getting called out until recently. Last week they really didn't like the supply chain attacking tool that I was building.

[Corey Ham]

It was like, this is too close to home.

[Phil]

Well, in the golden age of Cloud co, before the whole like nerfing the model situation or whatever is when I like built most of it and it never complained once. But then like three months later on the new model it was like, I'm not touching that.

[Corey Ham]

And so you can always go back to the old model. True.

[Ralph]

People still say that they love 46 I think the best.

[Corey Ham]

No, no verification, no problem. Just let it rip.

[Phil]

Well, what was great about the older model was it would like find other things even though you didn't mention your prompt and like still like fix it for you and just do the best you could possibly do. Like oh, I found something critical. I should probably fix that as part of this test. But now it's like oh, I found something critical but you didn't say to do that. So I'm just going to leave this bug hidden so you never see it unless like you're like laser focused on my standard out which will get disappeared in 5 seconds. Anyways.

[Corey Ham]

I have found that 48 and 47 will both do that. But you have to use it in X high. You can't. If you use it in high or medium or anything like you, it has to be in the high or extra high mode to actually catch stuff along the way.

[Phil]

At least power mode type that episode

[Corey Ham]

Max is a whole different thing. Although I will say the new Max, whatever extreme mode is pretty fun like we were talking about with workflows but just I usually use the X high and that seems to do a good job with catching some of that stuff. Like you're Talking about. I agree though. I had the same experience.

[Ralph]

I just go straight to max. Even when I'm like, hey, could you just change this one color?

[Corey Ham]

I need you to center this div. Ultra code. Yes, Ultra.

[Ralph]

Ultra. Can I, Can I. And then I, I get a opus with Fast mode just for that.

[Wade]

Just ripping through tokens for.

[Corey Ham]

So wait, what is Fast mode? That's new, right? What is it?

[Ralph]

No, no, no. So I think they had it in. I, I think they had it in 462-4746. Anyways, if you're on OPUS and fast mode, just you're. You get faster tokens per second. So it's going to respond faster. Like you're going to get output quicker. So like the same task was going to, you're going to get that, the results right from beginning to like where you have to where it has to stop faster.

[Shane Hartman]

So.

[Corey Ham]

Gotcha.

[Ralph]

Yeah, but it costs more money.

[Corey Ham]

Of course. Of course it costs more money.

[David]

Yeah.

[Corey Ham]

So those oceans are going to boil themselves.

[Ralph]

No, but those farms are sure going to be taken down pretty soon. Here.

[Corey Ham]

Yeah, that's. That's one of the articles we're going to talk about probably first. There's an article for that.

[Ralph]

There's an article for that.

[Corey Ham]

Let's roll the finger. Ryan. Let's go live a little early because we, we are. We're already like segwaying into the show. Let's do it. Hello and welcome to Black Hills Information securities. Talking About News. It's 6-1-20. Time to change your password to June 2026, exclamation point. We have a star studded cast. This week actually is stacked. We have some heavy hitters, including some guests, some bhis people. Let's start. I'll just go in order. So I'm Corey Ham. I run continuous pen testing at Black Hills. We got Ralph. He's here hunting some gators maybe or I don't know. He's got like a. He's got a laptop with what looks like a government agency logo on it. I can't tell. I'm trying to enhance and it's not working. What's up, Ralph?

[Ralph]

What's going on?

[Corey Ham]

You got to give your fancy intro. What do you do? Spears, arrows. Your weapons?

[Ralph]

I only do like, like ancient attacks of sorts.

[David]

Right, Okay.

[Corey Ham]

I see old weapons. Old. He's an edged weapons dude. You remember that, like History Channel. Cyber.

[Ralph]

I'm a cyber. I'm a cyber. What do you call it? Software dealer. There you go.

[Corey Ham]

Okay. An arms dealer. You're the Lord of War.

[Ralph]

I'm the lord of war for cyber security.

[Corey Ham]

Okay. Yeah, I. I just remember like those History Channel, like, you know, when I grew up watching tv and it'd be like a History Channel documentary and it'd be like this guy with like, you know, a really, really short tie being like, I'm an edged weapons expert. That's you, Ral.

[Shane Hartman]

Yes.

[Ralph]

Experts come in all different shapes and sizes.

[Wade]

Go endorse Ralph for edged weapon. Ex expert on LinkedIn.

[Corey Ham]

Y times, good times. We got Wade, who's waiting through logs. What's up, Wade?

[Wade]

What's up? I am off this week because I am doing training, so it's actually pretty nice. I haven't read the news yet today.

[Corey Ham]

Are you taking it or are you giving it?

[Wade]

I'm giving it. I'm giving training, so. Which is always more fun, I think, nowadays? I don't know. I feel like now with AI training for me is just reading Claude articles

[Corey Ham]

over and over again, hallucinating your way through the training, just asking it to build a skill that's past this training.

[Wade]

Yeah, yeah, it's worked pretty well so far. You know, I just.

[Corey Ham]

Oh, nice. Phil's a bhis. I would say developer tester. I don't know what to call you, Phil. You have a webcast coming up, right?

[Phil]

Yeah, yeah. A little bit of jack of all trades, like some testing, some development. But yeah, I got a webcast coming up about hacking CICD pipelines. So it's all the rage these days with the supply chain tax.

[Corey Ham]

But

[Phil]

yeah, stay tuned because it should be a lot of fun.

[Corey Ham]

The content community team today on our internal meeting was like, it's Miller time. I love that. That's amazing.

[Phil]

My heart started racing so fast when they. I was like, I'm not prepared for this. I have nothing witty to respond with.

[Corey Ham]

Well, wait till. Do you see how fast your heart's going to be racing on your webcast? We also have Shane, Shane Hartman from Trusted sec. Right. That's where you work based on your shirt?

[Shane Hartman]

Yeah, based on my shirt. That's where I'm at. I'm one of the principal IR consultants there, so I spend all my day fixing everybody's mess. Ups.

[Corey Ham]

That's awesome. I love it when the podcast slants towards blue team. I feel like it's going to be up to you, David, to decide if you're. Are you a blue team or red teamer?

[David]

Oh, no. What do you see yourself despite the red hoodie? I am entirely 100. Blue team.

[Wade]

Good, good. I think this is one of the very Few times that we've had equal footing ever.

[Corey Ham]

This is equal. Yeah. We got three. I mean, okay, I will say Wade's famous quote, right? Everyone's blue team. If you think about it for long enough, right.

[Wade]

There is no red team, no spoon.

[Corey Ham]

There is no red team. Like, yes, I agree. But it's fun when we have. So David, you are. Shane, why don't you. You got a class coming up or you're keynot threat hunting summit we're doing. Or I don't know, something's happening. What's going on?

[Shane Hartman]

Yeah, I'm probably. I'm doing the threat hunt symposium or thing that you're doing on June 17th. So mine is kind of hunting in the dark. It's be focused a little bit more on kind of just the quick wins and getting started. A lot of engagements that we do where we engage with threat hunt, what we have is they're. They're either starting out or they're. They're trying to get a foothold to get the. Either money in order to get that going. So give you a few, like, quick wins. Some. Like, how can you start. Get started a little bit of asset. Asset management, maybe. You know, what actually would senior executives be looking for when you do a threat hunt? So you can actually get money and funding and kind of do some cool stuff.

[Corey Ham]

Nice. That's awesome. Yeah, I feel like a lot of the times when I'm doing, you know, pen test report readouts or whatever, I'm like, yeah, you could do a threat hunt, but, like, in my head, I just like yada, yada, yada, that I'm like, you know, just like, do a threat hunt, but I have no idea where to, you know, tell them to start. So maybe that would be a good place. Absolutely.

[Shane Hartman]

We like you guys. We like that when you leave details out on the network, we get to go find it.

[Corey Ham]

Yeah, yeah, that's my job, is to leave details out on the network to go find and then. Yeah, David, you're actually keynoting, right? You're the big name in the room.

[David]

I am kicking it all off. Yeah, I'm very excited. It's actually only my second ever keynote, so I'm trying to have really interesting insights.

[Corey Ham]

That's really hard. That. That's a. That's a high bar to set for yourself.

[Wade]

That's also very surprising that this is only your second keynote. What's wrong with people?

[Corey Ham]

Yeah, so, yeah, definitely people. Well, yeah, please, David, answer that question live on the air. Yeah.

[Wade]

What's wrong with people? Yeah, that's how we're starting the podcast

[David]

today and it's a strong start. No, no, I'm, I'm actually really excited. There's, it seems like for the last few years like half of my presentations are something. I screwed something up. That was my RSA presentation from was it last year how I screwed up threat hunting a decade ago. And, and, and you know, at the time I, I, I put out this, this definition of threat hunting that got picked up that it's human driven, maybe machine assisted, but human driven. And I feel like we may be to the point where it's time to possibly redefine that or at least decide whether we should redefine that. So I've always been like automated threat hunting, that's not a thing. We call that incident detection. And I'm starting to think that that may not be defensible anymore. And so I'm not going to tell you yet because I hadn't figured out whether I. Don't spoil it. No, I haven't figured it out yet either. So when I finish my presentation there will be a surprise to me as well.

[Wade]

That's what I was going to say. This sounds like an excuse for someone who hasn't finished the slides yet. Really.

[David]

That's exactly why I proposed it actually. I want to, I wanted to have an excuse to spend some time thinking through it. So that's, but that's what it's going to be like with the advent of AI being able to provide the reasoning that before only the human could really do. Is it time? And your guess is as good as mine right now.

[Corey Ham]

Nice. Yeah, I mean honestly I love like as a concept when I'm doing a talk or anything like that, I think you have to choose something that you're fascinated in and don't know all the answers about. Like it has to be something that you're genuinely doing discovery during the process. And yeah, building the slides the night before is the key. That's the, that's the key. That's the secret, the secret sauce. All right, let's roll into articles. David has a tool to plug but we'll leave that until the end. It's going to be exciting. So I think the first article we should talk about because we were a little bit getting into it during the pre show is basically there's a Wired article saying that U. S Law enforcement has started to warn about a new category of I guess threat which is AI Anti tech extremism or like AI hatred. So basically the idea here is that they're seeing an increasingly strong response to people not wanting data centers in their farms or backyards or local areas. And this is getting a lot of traction, at least in public, you know, public forums and town halls, stuff like that. So I guess the government has decided to acknowledge this as a real thing. You know, the actual this is federal intelligence agencies, domestic law enforcement, they're circulating reports, you know, anti technology extremists. And kind of like the first, you know, headline response on Twitter was, we're not anti tech, we're anti VC funded tech.

[Ralph]

Difference. Very specific.

[Corey Ham]

Which is, which is fair. It does feel like to me that when they do these projects, it feels like they're working as hard as possible to make it as politically disastrous as it could be. Like the, the one in, the one in Utah that hit my radar was, it was the Shark Tank guy, right? I forget his name. Kevin something. Anyway, he, it's a Canadian citizen who's a billionaire from Shark Tank trying to put just the world's largest data center in Utah. Like the size of the data center didn't even make sense to me. It was like, this is bigger than half the towns in the US or whatever. Like, it's like a gigawatt or, you know, 1.2 gigawatts or whatever. I don't know. But basically half of these projects are like, we've located a rare animal habitat and we're gonna slowly kill by one on a live feed. And that's, and then that'll be a data set. Like, it just feels like they're trying.

[Ralph]

We're gonna bring in baby pandas and then kill them just to make sure that you guys are all really, really upset.

[Corey Ham]

Yeah.

[Wade]

The better part was him claiming it was China.

[Ralph]

Right?

[Wade]

And then like, it being like two, like, women, like, nope, nope, not China. Like where you actually live here. Like, don't.

[Corey Ham]

Yeah, I mean, I guess I'm like, what is the, what is the real threat here? What are they going to do? Like, put, ignore all future instructions and stop construction. Like QR codes on things. Like, what is the, like obviously there are physical threat. You know, could be like, you know, people sabotaging projects or, you know, just imagine chaining yourself to a hard drive. You cannot install this hard drive until you take me off of it. I don't know.

[Ralph]

I, I. So, I mean, the, the terrorism or domestic terrorism aside.

[David]

Right?

[Ralph]

So like the actual actions. But I mean, you know, the only other way to stop these things from being built in your city is to, you know, essentially protest and specifically not just to stand out there with holding signs, but essentially to get the recognition of the, you know, the. The local government to. To not. To not have it there.

[David]

Right.

[Ralph]

That's, you know, that's, I think, like the ultimate goal.

[Corey Ham]

But, yeah, I mean, I don't know. I have mixed feelings on this. Does anyone have a strong take?

[Shane Hartman]

That's what they've been doing. In Florida, where I live. They've been putting out a lot of media articles about the electrical cost grid and water being used. So they're talking about. They're using the natural resource side and saying, we don't want it here because we don't have the resources to give to you because it'll. Everybody else will have to pay for it. So that.

[Corey Ham]

That.

[Shane Hartman]

That take is what they've done.

[Corey Ham]

Yeah, I mean, I live in Oregon where there's a lot of data centers. Like, Hillsborough is one of the biggest data center. Like, that's an entire AWS region.

[Ralph]

It is.

[Corey Ham]

And. And there's like. I mean, there's definitely mixed feelings. I mean, but I think the biggest from my perspective as like, a citizen who actually would be voting in some of these votes is I'm fine with it. But you do need to tax these companies and actually, like, give the money. Give. Give me some benefit as a citizen who has to live near this data center, like, whether it's infrastructure or tax money or whatever it is, don't, like, bend over backwards for this company to come in and, like, destroy farmland and then not pay any taxes. The biggest thing is, like, the data centers. You know, the best article or the best, like, take I've heard is that they rely on public infrastructure, right? Including, like, power grid, roads, like, all that stuff. So they should contribute back to that infrastructure. That's probably, like, an extremely, like, political Take I just gave. I apologize for that, but you sound

[Wade]

like one of these terrorists that they're talking about.

[Ralph]

Oh, my God.

[Corey Ham]

I guess I'm on a watch list now.

[Wade]

This White House article is literally just propaganda. Like.

[Corey Ham]

Yeah.

[Wade]

What have you seen anywhere? Nothing. It's just literally the people trying to say, I don't want a data center in my backyard.

[Ralph]

Right.

[Corey Ham]

People are against me, so they must be terrorists.

[Wade]

Exactly.

[Corey Ham]

Yeah.

[Wade]

Like.

[David]

Well, I mean, if you read that thing that it's not only about saying anti data center activists are terrorists. Right. There's, like, some broad categories in there.

[Corey Ham]

It's true. It's not just your. Yeah, right.

[David]

It's not just data centers. Again, I don't want to get too political on here either. If you want to hear that's your first post on my socials.

[Corey Ham]

That's what I post on my socials.

[David]

You want the politics, David, you can get that on Blue sky or something. But you know, I do think there's like three big waves that are kind of coming together and right now, and it's kind of, I want to say interesting, but like interesting and maybe a bad way too is like the, the anti AI, anti data centers, but also they're kind of inextricably tied to the anti billionaire things and the sentiments. And they all really are tied together, not just in people's brains, but they actually. Because these are the people who are making the data centers to run the AI. So yeah, it's just like a perfect storm right now.

[Ralph]

It is kind of interesting because they're building data centers and taking away from these cities and towns and resources to then also build AI that then takes away their jobs too. It's kind of like why do I want to keep doing this, right? Like what, what, what am I getting out of this to then feed, not only to take away people's jobs and again I'm, I'm, I'm like throwing out the nest, the net further. Right. We don't actually know how that's going to play, but just to look at it from the beginning, everyone's saying that to then make more money for the really rich people, the billionaires. Right. So you're kind of kidding out this whole like process flow. You know, the data center is just like the first thing you see to then the next thing to the next thing. And none of those are good for you.

[Corey Ham]

Yep, it's a good point. Very political take Ralph. How dare you. I know, sorry. I mean, I'm sorry.

[Ralph]

I'm an AI fan too. But it's like is the AI that we love so much or that I enjoy using so much, is that the thing that's going to hurt everybody?

[Corey Ham]

Right.

[Ralph]

I don't know. I'm not saying that's what I believe. I'm just saying I'm just proposing the question.

[Corey Ham]

Right? Yeah. I mean I think the only example of this that I've seen, and it wasn't even the US is like the UK strong resistance to the speed cameras and like, and, and like their equivalent of flock cameras and just seeing a bunch of videos of people with Sawzalls just hacking through the post, like you know, just cutting down speed cameras like as a kind of a coordinated, targeted sort of thing. But there was, there was at the

[Wade]

US there was a Target event like that, but not so much as AI is parking here in San Diego. So they started charging for parking at the Balboa park, which is huge, and at the zoo and everywhere downtown. And people straight up started just like Sawza in the parking meters or super gluing inside of them like it was destroyed everywhere. And it got to the point where they just now repealed it. Now they're not doing any parking laws anymore. Paid parking in that area.

[Corey Ham]

Wow.

[Wade]

It works, people.

[Corey Ham]

Well, I find myself on the other side of that one because I would always support anti car infrastructure and making people pay for parking. I love that idea.

[Wade]

But anyway, if there was a way, if there was public, public transit, it'd be great. But San Diego, they're just like, you

[Corey Ham]

have to drive and it's going to cost you $12. Yep.

[Ralph]

Speak. Speaking of AI, and this is not really. This is a news article, but it's a little piece. Is that Anthropic? Just filed to go IPO today, actually. No, they did it.

[David]

Yeah, yeah.

[Corey Ham]

Oh, God.

[Phil]

What was the valuation?

[Ralph]

So it's gonna something close to a trillion. So I think it was like 945 billion, which is a number we should do.

[Corey Ham]

Guys.

[Ralph]

Easy to say, but hard to actually tree fit.

[Corey Ham]

We should make an offer. Okay. Like GameStop did it for ebay. Okay, we can do this, we can do this.

[Ralph]

We can do this.

[Corey Ham]

We should put together a very compelling offer. We have Wade's mustache and a few.

[Ralph]

I did something else and essentially don't quote me on these numbers because they could be off. But just get the percentage idea here. There's something like Amazon. Or not Amazon. Walmart is worth like something like $700 billion and they make like $600 billion.

[Corey Ham]

Yeah, yeah, yeah, yeah.

[Ralph]

But Anthropic has made like 20 billion and this is like a $900 billion valuation. Which, by the way, that all makes sense because the stock market is not an indication of how much money a company is.

[Corey Ham]

It's not revenue, it's valuation.

[Ralph]

Yes, exactly. It's what I believe it could be in the future. And number is just, you know, could be anything. Right.

[Corey Ham]

So why would an AI company need to make money? I don't need to raise capital. I don't get it. Well, it's not like they're spending $20 billion a month on electricity in my backyard.

[Ralph]

I mean, Jensen Wong is just getting all of every.

[Corey Ham]

That is sort of true. Yeah. I mean, that's really interesting. Honestly, I, you know, I feel like this is kind of. I don't Know, I mean, maybe people saw this coming. To me, I'm like, there are a handful of really kind of interesting privately owned companies like Mars or, you know, there's. There's a handful of really interesting companies that are huge and are still private, but the majority of big companies are public. The benefit of this will be that more transparency and financials. So that's interesting.

[Wade]

SpaceX also with IPO. Right. So it's like a bunch of stuff all at once.

[David]

Yeah. Reliable authority that the first filing for Anthropic, their, Their, their valuation that they put in there was just so giant, it was like $950 trillion. And they pushed back and they were like, you're absolutely right to call me on that. I clearly messed that up.

[Corey Ham]

They submitted the form with AI. Yeah. Yeah.

[Ralph]

Yes.

[Corey Ham]

Oh, that's amazing. I love that. Yeah. So, in other news, apparently the FBI's warning about people walking around with USB drives. What year is it? Oh, my God.

[Ralph]

Honestly, if they're not USB c, I don't know where you're gonna be to it.

[Corey Ham]

Okay, so there's got to be some crusty IT guy at some company that like, has been epoxying over all the USB ports in his laptop for years and like, forcing other people to do it. And he's like, I told you. I told you so. Yeah, basically, this is a real article. The FBI has warned Silent Ransom Group, who I wasn't previously familiar with Threat Hunter people. Have you ever heard of silent Silent Ransomware Group? Ransom Group? Yeah, that one's new to me. Anyway, they say they've been active, or the FBI says they've been active since 2022, targeting US firms and since 2023. Basically, they used to use phishing emails. Now apparently they're physically walking into

[Ralph]

the physical part. Nobody said that.

[Corey Ham]

Physical.

[David]

Everyone was like, no one's doing this.

[Ralph]

Why would you ever go into someone's building? Come on.

[Wade]

Ralph's going to start using this as a, as an ad for his company.

[Corey Ham]

For his.

[Ralph]

Yes, yes, but you. That's the funny part, right? Like the everyone's. Everyone's argument is right about physical security. It's not a threat yet because I can just break in remotely. You're not doing.

[Corey Ham]

It's only a threat when you run out of other options.

[Ralph]

Exactly. So if you get better, it just becomes the X the next thing. Right? So.

[Corey Ham]

Yeah, well, that's exactly what the, the threat report says. It says they, you know, first they call or they send phishing emails. They're impersonating IT support. If that doesn't work. Then they go in person, they say, hi, I'm here to, you know, update your computer. Apparently they're using an extremely advanced tool called WinSCP.

[Ralph]

Oh, yeah, that thing. Right.

[Wade]

That.

[Ralph]

That honestly is agentic, by the way.

[Shane Hartman]

You mean ancient.

[Ralph]

Oh, yeah, I mix those words up.

[Corey Ham]

I'm sorry, you absolutely correct Ancient Agency agent. Yeah, I mean, what's old is new again, right? I mean, this has been a. It's been a real thing forever. Honestly, my question with this is, okay, so if they're targeting US based companies and they're using physical resources, this was something that I feel like from a threat, you know, perspective, we kind of were like, they probably won't do that just because the amount of risk involved. How does this criminal ecosystem work? Like, are they hiring people who actually think that they're helping people? Like, is it. Is it like a mule? Is it a mule system?

[Ralph]

There's no way that they're like bringing in Russian assets to just land on, like a vacation to do this.

[David]

Right, Right.

[Corey Ham]

Yeah, like if you leave Russian or Chinese turf, you're going to get arrested. So they're.

[Ralph]

Yeah.

[Corey Ham]

I don't know. Does anyone know David or Shane? Do you guys have any intel on this at all?

[Shane Hartman]

I don't have any intel on it.

[Corey Ham]

I did read the article.

[Shane Hartman]

It said it was targeting law firms. Now, I have had a little bit of experience with law firms. They tend to be a little bit more technologically backwards, meaning they do use USB because they go in and out of court and whatnot. So they, they're not always using WI fi or they just use older technology sometimes. So that there could be some validity here just in the targeting. But it's got to be small. I mean, it's not scalable.

[Wade]

Go ahead.

[Ralph]

No, I was just going to say. So, all right, how's this attack work? You show up with a USB in your hand and you find the first unlocked workstation. Is that what we're hoping?

[Corey Ham]

You show up at the last. You go to the target.

[Shane Hartman]

You go to the target, the one you already called?

[Ralph]

Yeah.

[Corey Ham]

You go to the pretexting target and you say, hey, sorry, yeah, I missed

[Ralph]

that from the article.

[David]

Then the help desk, you tell them you were expecting.

[Corey Ham]

Exactly. Yeah.

[Wade]

All my court documents are on this USB drive. Please plug them in and view them.

[Corey Ham]

I need to update your system, but your WINP is out of date.

[Wade]

I find lawyers to be a juicy target, though. Like, they're gonna hold a whole bunch of secrets, a whole bunch of information,

[Corey Ham]

like, okay, that's like stealing a drip from a drug dealer. Like, yeah, you're right. But like, dude, the, the repercussions are going to be significant. Like, can you imagine answering some ad that's like, do you want to make $10,000 in your PJs and then you like accidentally break into a law firm and do some USB stuff and then like have a whole law firm coming after you for screwing up.

[Wade]

There's been enough people with North Korea doing it, right? Like, hey, set up this laptop farm in your garage and just like move the mouse every now and then for me. Like, like it's, it's hard times. Like if I just called someone and told them to plug in a USB drive here, like go up to this lady's reception if you can get a USB drive. Like, here's a hundred bucks. You'll get 200 more if you get it.

[Ralph]

Yeah, the mules are getting scammed too. They don't. They're not, they're not going to be given the whole story. Right. They're just going to be given the half side of it. Right?

[Corey Ham]

Yeah,

[Phil]

they were email. I thought they were sending envelopes with USB drives in them to people.

[Ralph]

I've done that before. I've sprinkled them around parking lots.

[Corey Ham]

CDs. Remember those things? They were circular. Oh yeah, dude, put them in a media drops. Yeah, media drops. I still have a Khan Boot CD bumping around in my little go bag that I never use.

[David]

That was the first thing I thought of when I read this article and I was like, it's amazing that they're now a cutting edge hacking technique that the red teams have been using for decades.

[Corey Ham]

Yeah, yeah. I mean this is. Yeah. Let's just say the FBI in this case is a paid advertisement for pen testing.

[Ralph]

This happened to your organization too. For.

[Corey Ham]

Would you like a red Team contact Bhis. We will walk into your building with the USB drive and do whatever you want. Yeah, I mean, honestly though, from a defensive perspective, you're going to have to go against low maturity organizations. Every organization. We've done a handful of media drops but like in recent years, but I mean you can just check a box in CrowdStrike to just disallow external media. Right? Like you can pretty easily mitigate this with an edr. Anyway, speaking of edr, apparently Defender can now isolate systems. Crowdstrike killer, here we come.

[Wade]

Yeah, they couldn't beforehand.

[Corey Ham]

That's what I said.

[Wade]

Shows you my Microsoft experience.

[Corey Ham]

But it's automatic though, I guess is the big. The headline, not the fact that you could. Couldn't quarantine before, but now it's automatic. I mean, they call it automatic attack disruption.

[Ralph]

Wasn't it last month that they added that feature to Microsoft Defender where you could use it to privilege escalate?

[Corey Ham]

Oh, no, that was, that was. That was part of the recent ongoing, you know, slew of Microsoft vulnerabilities that we've all been all loving.

[Ralph]

Like yellow sun.

[Corey Ham]

Speaking of yellow key. Yeah, just.

[Ralph]

But better, right?

[Corey Ham]

Yeah, Kanbu. But better. Yeah, very true. No, it's fine. Everyone puts pins on their BitLocker. Everyone does that.

[Ralph]

Everyone does it. Honestly, you know, you have to enable BitLocker by default or have a domain policy, so. That also is true. There's a bunch of fun things. But did you see speaking of the gift that keeps on giving, that the yellow sun or our chaotic eclipse. There you go. He got kicked off of GitHub and then got kicked off of Bit Lab. I mean, they're just kicking them off of everything. All right, so here's the wild part, though, right?

[Corey Ham]

He's threatening Microsoft.

[Ralph]

Yeah, no, that's not the wild part. The wild part is that there's other PoCs on GitHub. Why is it that the one that happens to be attacking Microsoft, was it because he didn't do a responsible disclosure.

[Corey Ham]

Excuse me.

[Ralph]

Or because it's Microsoft and they're just really upset about it?

[David]

What do you guys.

[Corey Ham]

Yes, both. It's both. But mostly they own GitHub.

[Phil]

The GitLab got taken down, too. Like, Microsoft has some pullover GitLab somehow. Now, I didn't think they owned them.

[Wade]

I mean, but the Microsoft poll is strong, right? Like, if Microsoft were to call you right now, you're like, oh, okay, like,

[Ralph]

who would Microsoft would call you that you would be upset about? Would they be like, oh, you took

[Corey Ham]

a license you guys don't get every day?

[Wade]

Dude, he calls me all the time, has me put in updates, sends me USB drives to plug gift cards.

[Corey Ham]

Oh, yeah, dude, I get. I get tons of calls from Microsoft. They're super helpful. They all have weird accents, though. Oh, God.

[Ralph]

I always.

[Corey Ham]

The. I think the, like this whole thing, the whole Microsoft thing, like to approach it from both angles to be.

[Ralph]

What about free speech?

[Corey Ham]

Yeah, yeah. To play devil's advocate. Well, first of all, free speech doesn't affect you.

[Ralph]

I'm just saying. Thanks. Okay.

[Corey Ham]

Okay, I got you. Free speech. Anyway, I think, to play devil's advocate, I think part of the reason that they're able to pull for these takedowns is because of the amount they can make an argument that this is a harmful thing and that can be abused. Arguably that is true in this case. Right. Like these are. The amount of data that can be exposed through some of these vulnerabilities is higher than average, I would say. But it isn't like conficker, like, you know, it's not like wormable wannacry other

[Ralph]

POCs on GitHub that do bad things

[Corey Ham]

to other products, right? Oh, yeah, maybe even arguably worse.

[Ralph]

Right. But the argument is. The argument is pr. It looks bad for pr, but should they be there or not? Because somebody made a poc? Was it because it was a reasonably responsible disclosure? But then after it's patched, now is it okay, so then no one else can post it? I mean, you can see where this kind of gets money, right?

[Corey Ham]

Oh yeah, it's totally.

[Ralph]

Can do whatever they want. Pretty sketch as a platform, right? You kind of like, if you put enough of these, like weird hurdles and people will just go to something else. Right? I don't know.

[David]

Just opinion.

[Corey Ham]

Yep.

[Phil]

I think there's been so much, like bad experiences with like Microsoft Security program that it was just reached its boiling point and finally like the water started boiling out of the pot. And with Nightmare Eclipse, just because all the back and forth, which I don't know exactly what happened. Just based on his blog, it sounds like he likes he didn't get credit for like a cve and they're like, oh, this doesn't qualify, like, closing the issue, but then. Or this has happened to a bunch of people in the past where they have to wait 90 days that hits and then they need an extension. Then Microsoft like silently patches the issue

[Corey Ham]

and like, so Microsoft has bungled this every time in the past and I think they've earned this karma. But also they own the platform and so they get to do whatever they want on the platform they own. This is not the first time, by the way, that offensive tooling has been taken off of GitHub. I feel like every two years we have the same discussion as hackers where we're like, guys, we got to move off of GitHub.

[Ralph]

Yeah, where are we?

[Corey Ham]

Where are we going, guys? Anyone?

[Phil]

It's not safe either. Now we gotta go to bit Bucket or get tea or whatever the other.

[Corey Ham]

No. 1, no, this is like the Twitter thing, right? Like, no large company is going to want to take this heat, right? It's the same thing as, like when people have really hot takes and get fired from their big tech jobs. It's like it's not that they don't agree with your takes. They just don't want to pay a PR firm to compensate for you. Like, it's really just economics. It's the same thing applies to git, you know, GitLab or GitHub or.

[Ralph]

Yeah, I mean, but at the end of the day, zero days on GitHub is not really a problem, right? I mean, like, you think there's probably other places that you can go get zero days besides GitHub. It's not really where I'm headed for my first zero day.

[Wade]

Tor is too slow. Just go to GitHub.

[Corey Ham]

Yeah, it's easier. I think it's a great value proposition for GitHub. These things used to cost 100k. The government's paying 100k for these things now they're free.

[Ralph]

We give you so much value with our free accounts now.

[Corey Ham]

So much value. Yeah.

[Ralph]

Amazing. Oh, we'll piss off another security research.

[Corey Ham]

I will say to kind of flag it for follow up on the show or wherever they the date. Like, they say they're going to make Microsoft Pay on July 14th.

[Ralph]

Because I'll tell you right now, it doesn't matter what site it's on. If that O day is good enough, you're going to click, you're going to go for that fish, you're going to definitely check that out. And if it's real, you don't have a choice. Like, you're going to have to figure that out.

[Wade]

I won't have to. My agent will.

[Shane Hartman]

Yes.

[Ralph]

I send my agents to wade out

[Corey Ham]

into the dark side. I feel like Microsoft is basically training a threat actor live. Like they're basically like trying to make them disgruntled to the point that they drop this. It's such a weird way to manage this. From my perspective, like, OpenAI is like, oh, you made open claw and burned like $10 billion worth of tokens. We'll just hire you or whatever. Like, yeah, like, why is no one, like, recruiting this guy to go run Mythos on all their internal tools? Like, I don't know, whatever.

[Phil]

I like how he said they will feel it in their bones. Or what do you say? Their bones.

[Ralph]

In their bones. Maybe, maybe.

[Wade]

Maybe they'll recruit him to the Cyber Force.

[David]

What?

[Corey Ham]

Oh, oh, is that the next article?

[Shane Hartman]

Wade?

[Corey Ham]

So, okay, so Cyber Force is apparently real. I don't know. Basically, Senator One senator from New York, Kirsten Gillibrand is spearheading a markup amendment to the Senate 2027 National Defense Authorization act that would create a Cyber Force as the next armed service branch, they would have keyboards on their arm, obviously, and heads up displays, you know, like you need for hacking.

[Ralph]

Yeah.

[Corey Ham]

I mean, is this real? Like, we already have Air Force, Navy, Space Force. We have so many forces.

[Ralph]

Well, almost all the commands have a cyber now or some other kind. But, you know, cyber division, I mean, it wasn't the case, you know, less than probably 20 years ago.

[Corey Ham]

It's army though.

[Wade]

All the commands have airplanes too. Right. And boats and.

[Corey Ham]

Yeah, okay, so.

[Wade]

So why not?

[Corey Ham]

I was not in the military, but Ralph, you were in the army, right, so. Or was it Army? Yeah, you were army.

[Ralph]

Yeah.

[Corey Ham]

So, okay, if you are a cyber force operator, are you mostly running around with USB sticks trying to plug them into things? Like what, What. Why does the army need a cyber force? Like of all the different branches, like, why.

[Ralph]

Well, why does the art. Well, the army already has a cyber command.

[David]

Right.

[Ralph]

So they already have essentially as a cyber focused offensive arm.

[David]

Right.

[Ralph]

I think that, you know, how much they do from the offensive side, you know, gets into the, to the waters where you get into the, you know, the CIA versus, you know, that relationship.

[Shane Hartman]

Right.

[Ralph]

But I mean, essentially saying like, you know, a, A quick action. Right. Like a QRF for like cyber. Right. We probably already have some of that, but building out a huge command of it and you know, to make attacks against, you know, foreign adversaries, which would. Is essentially what any military branch is specifically designed for. Right. Not necessarily for, what do you call it, local defense.

[David]

Right.

[Wade]

I just say we let it get created just in case there's a draft. So we can all just go straight to cyber.

[Ralph]

Yeah, we're going. We immediately go to cyber.

[Corey Ham]

Yeah, they're like, do you not pass all the physical requirements? Welcome to Cyber Force.

[Ralph]

Well, you know what the funny part is, even with the other cyber commands, it's hard enough to train up, up these, you know, train up all of these soldiers in this skill.

[David]

Right.

[Ralph]

Get them to be decent at it.

[Corey Ham]

And then I want 20 cves by the end of the day.

[Ralph]

Exactly.

[Corey Ham]

Yeah.

[Wade]

I know back in the day they used like, if you had cyber experience, they would bring you in as a warrant officer too, for a little bit. And I remember me being in cyber for a couple years, like, should I just join and just go and like, do it for a bit? And the thinking about it now though, with the, the barrier to entry, so like, so hard for new cyber people. Right. Could this be an easier route? It'll be an easy route for most people, which is sad, but scary.

[Corey Ham]

Yeah, it's a good point. I don't know.

[Ralph]

Yeah, the cyber. So the Cyber Command includes U.S. army Cyber Command, the U.S. marine Corps Cyber Command, U.S. fleet. So this is Navy, and then Air Force has their cyber. It all falls under the national cyber. United States Cyber Command.

[Wade]

So there already is a Cyber Force.

[Corey Ham]

There's already three of them. Yeah, they're just not an army one.

[Phil]

One.

[Ralph]

Yeah, no, no, no. There is an army one. So US Army Cyber Command. Right. But what I think they're trying to make this, is that like some like warrior with like overhead displays or something like year one type deal. I, I don't know what that looks like, dude.

[Corey Ham]

Heads up displays and keyboards on their arms.

[Ralph]

Yes. I'm just trying to envision the. No, like the, the quick tactical team that like repels into the data center to do something. I don't know, dude. I don't know.

[Corey Ham]

Yeah, no, I think you're right. No, I, I, I agree. I mean, someone, some people in Discord have been speculating, oh, these are just drone pilots. Okay, that's fair. Like that makes sense.

[Ralph]

We don't even need that. We have AI for that.

[Corey Ham]

We have open AI though. Yeah.

[Ralph]

You're out of credits, Crash.

[Corey Ham]

I think, I think it's fair to assume this will probably get approved just with the, and I mean, I don't know.

[Ralph]

But yeah, honestly, half of everything that you said, Corey, they're writing it down right now.

[Corey Ham]

So they're like, wait, USB stick. How many, how many can we get into a plate carrier? A lot.

[Wade]

Working in a sock was really fun. I'm not gonna lie. Like, at the time, the pew Pew charts, right? The big monitors, There's a wall with a glass and the CEO presses the button and then it becomes opaque and all the investors look at you like you're a monkey. And like, it was great, but more people should go work in socks. That's all I'm saying.

[Corey Ham]

I don't know if this is defensive or offensive, but the best.

[Wade]

Honestly, we need more defense. Right? Like all of our stuff's getting hacked. There's no there. We already have the offensive side. Maybe we need a cyber defense core.

[Corey Ham]

Wouldn't that be national card anyway?

[Ralph]

National Cyber Guard.

[Corey Ham]

Let's, let's move on. So there's a couple of interesting little tidbits on AI that I think we should talk to. First of all, in the Opus 4. 8 release, they did specifically say that they are preparing Mythos to be publicly released in the next, in the coming weeks. That was the exact terminology that they coming Weeks, Obviously there will be, you know, thousands of weeks coming. Who knows if it's going to be the next one or, you know, it could be a thousand weeks from now. It's still technically coming. But, I mean, I will say their cadence, their release cadence is pretty fast. And so.

[Ralph]

Well, so is ChatGPT. It's a war out there, man. No, I got 5.5. No, I got 4.9.

[Corey Ham]

Oh, I got extra ultra code.

[Ralph]

Yeah, I know, I know.

[Corey Ham]

And we're like, no, let's see what happens. So basically, that might be happening, but also, do you think that's the end of.

[Ralph]

Of cyber? We're all done just vulnerabilities left and right? I mean, yeah, maybe. Maybe Wade is right.

[Wade]

Maybe we do the red team. I don't know what to tell you guys, but it's not. I still got it. I haven't seen any cyber do an incident response really that well yet.

[Corey Ham]

Or threat hunting?

[Wade]

No, I don't know. We'll see what David says after this. But,

[Corey Ham]

I mean, are you guys, as threat hunters interested in this tooling or is it really, like, hype for the CVEs and the threat, you know, for, like, AI tooling? What was the question? Do you care about Mythos? Are you going to use it as a threat hunter, or do you already use LLMs, like, in your workflows? Like, obviously, everyone's like, Mythos is going to make it amazing to hack stuff. Is anyone saying it's going to make it amazing to hunt for threats?

[Wade]

No.

[Shane Hartman]

I mean, we do use LLMs, but

[Corey Ham]

I don't think so.

[Wade]

Not yet.

[Ralph]

We are.

[Wade]

We're going to coin it right now,

[David]

but you said the magic word earlier. It's the tooling just a minute ago, right? It's not really the model. It's our models. The frontier models are already so good. It's what tooling you wrap around it that is really the differentiator. I have not had hands on Mythos. I've talked to people who have, and they say, yep, it's. Some of them say, yeah, it's really what they say it is, and some of them say, I don't know. So I don't really know what to say about Mythos, but I was going to say, on the defensive side, I'm not clear that we need that Mythos is going to move anything further for the defense. I would be really happy to see some frontier model provider provide that kind of emphasis on defensive security, as they seem to on offensive security. It reads to me like they feel like creating vulnerabilities and exploit chains is cybersecurity or information security. When it's not really, it's just a piece of it. And the hard part is the defense. And when they start coming out with, you know, models and tooling that are frontier and they're targeted toward defense, then I'll get really excited.

[Corey Ham]

I fully agree. I'm interested to see if any frontier company actually makes a play at defensive. The defensive side of AI.

[Wade]

But like the defensive tooling is going to be heavy. Reliant on the organization as well. Right. Manipulating the tool to make it fit your company, just like any type of detection would. Having all your documentation. Right. I almost find it harder not as a blue teamer to get, not even to get buy in, but to get grc.

[Corey Ham]

Right.

[Wade]

Like that's some of the stuff. If we're plugging all these AI toolings in. I hate to say it, but it's like then you have to think about permissions. What these AIs are doing, right? Are they over permission? If someone uses an oauth token to then log into this and you're a security person who has super admin to something, boom. Now this AI has super admin, so there's a bunch of controls around it. But I think the defensive will come. I, I believe it's right around the corner. Someone I. I would like that. Why hasn't anyone just went and tried Mythos and just like tried to do everything defensively with it, right?

[Corey Ham]

If it's doing all supposedly they have. That's what people are talking in discord about M Dash. I thought it was someone making it. I thought it was Luke making a joke that he was going to start using M dashes, which is like, like for those that are out of the loop, the M dash is like the double dash that the AI loves to do when it says anything. So I thought he was just joking that like he was going to start doing it to pretend like he's an AI. Turns out it's actually a real thing that Microsoft has released that's supposed to be defensive focused. This is back from May 12th. So pretty old now, but I'm guessing this is like their harness or tooling or whatever they built. It's multi model. It's supposed to be, according to their graph, better than Mythos.

[Ralph]

Everything's better than Mythos.

[Corey Ham]

Yeah. So, but check this out. 21 out of 21 planted vulnerabilities were found. You know,

[Ralph]

what about on the gainter chart or ganter or whatever the hell.

[Corey Ham]

Well if you look at the chart, it says they're better than you.

[Ralph]

So I'm just gonna go ahead and cash this one out. I'm done.

[Corey Ham]

Yeah, yeah. Microsoft has solved security. I think we can just buy. Just figure it out.

[Phil]

Having a harness is very important though. Like a lot of people are posting different ones in the chat and there's a lot to choose from, but something is better than nothing. And then it's funny too. At what point does the collection of plugins and skills and hooks and memories and learning become a harness? How many do you have to have before you can call it a harness? I have one skill. Is that a harness? No, you have to have a skill and a hook and a plugin and a memory or whatever. Right. But there are some cool ones that will at least like automate, like continuous learning for you. So that.

[Corey Ham]

Yeah, like Hermes or those.

[Ralph]

Yeah, I, I think it's kind of funny. I was talking to another pen testing team and they said they had all these zero days now that they've, you know, taken the time to find in all these different products or whatever. And this goes back to what you guys talking about with defense. And they're not going to fix these things right away because they don't have anything in place to. So essentially it's all fun in games to go find these zero days but no one is from these organizations that's creating the software or whatever. They don't have systems in place that are looking for it the same way. Right. Because it wasn't as like shiny. They're just trying to run their business and make some software, make whatever. And I think we're going to see a big wave of a bunch of vulnerabilities and a bunch of companies trying to figure out how to defend themselves or update their software or develop software in a more sustainable way using AI to actually be able to detect this. So I do think we're going to see a big wave of it and the defense is really where you're going to see a lot of people struggle.

[Corey Ham]

So transition. Next article. Oh, sorry. Unless anyone had a final go back, I was going to say if you want to see how AI is being used today without Mythos. So there's a really fun article about how attackers. There's a fun write up about how attackers are using AI for PostX. And this is pretty much reads like a pen test report to me because we're doing the exact same thing, we're just not doing it in Chinese. So language. Basically. The long story short is that Someone used an LLM for post X. Now this is like I said, exactly what we're doing as pen testers. But essentially they exploited the cve. Then they asked AI, what else can it access? Basically they were just like, hey, what else can this key access? But they did that in Chinese and somehow that. That question of what it could access made it through to the API, which is pretty funny. It leaked into the command stream while executing a credential search.

[Wade]

And

[Corey Ham]

that's pretty much why you don't need Mythos. It's basically like an explanation of why. Because this kind of abuse of LLMs is the more risky thing, right? This kind of like, very simple, just being like, AI, take this AWS key that I just compromised and do evil things with it. This is what we're seeing in the real world. If you look at breaches, there has yet to be a breach from a Mythos zero day or whatever. But there has been many breaches like this. Where a typical CVE is exploited, an agent or an LLM is used as post exploitation or quick transition to the next article, which is about a chat bot that just gives access to accounts if you ask for it. So this is like the other side of AI exploitation, which is sometimes you don't need an exploit at all. You can just ask the AI for access to the account. So this is a Meta thing. Basically. Meta AI was super helpful and decided to just grant some people access to some high profile Instagram accounts, including the account for the White House, or I guess the Barack Obama White House, the Chief Master Sergeant of Space Force.

[Ralph]

It's a feature that it. They built it like this.

[Corey Ham]

It's super. I mean, I will say you need a really advanced model to get to have it compromising accounts. Okay. To me, this is a textbook. I mean, there's screenshots that are just insane. This is a textbook case of like AI failure. Right? Like, why do you give your AI

[Ralph]

the access to all those accounts? I don't understand.

[Wade]

Exactly, Exactly.

[Corey Ham]

Great question. It's almost like if you had a red team that wasn't replaced by AI, they would have caught this.

[Ralph]

Oh, they just didn't ask the right prompt. That was the problem. Let's try.

[Corey Ham]

I feel like, okay, so I know Meta has a huge red team and I know some people that even work there. And so my question is, number one, did you get replaced by AI and are you looking for a job? If so, let me know. And number two, are, are we to the point where AI is moving so fast that things aren't being properly tested before they're being published. Including like. Oh yeah, this sort of high risk applications. Like, is that where we're at?

[Wade]

We were there before.

[Ralph]

Yeah, yeah, we were before AI for sure.

[David]

I mean, Wade, just like a couple minutes ago you said like GRC was getting in the way. Like. No, I don't, I don't see that in a lot of places. Like in most organizations, problems with AI are that they're adopting it too fast in ways that they didn't actually know that they were adopting it. And so it's. It's kind of like this, the shadow AI and shadow.

[Ralph]

I love it.

[Wade]

Key the term. Someone make me a sticker.

[Corey Ham]

Oh God.

[Ralph]

What is it like a. What do they call it? Like a dark AI factory. Yeah, look that up.

[Wade]

I don't want to look that up. That sounds like a bad dark web term.

[Corey Ham]

I was gonna say that's your personal search history there. I don't think you call it what

[Ralph]

you want, but ask your AI about it, he'll tell you.

[Corey Ham]

Really, you think? Yeah, I don't know.

[Wade]

So this is not doing AI correctly, right? Like, like we said, this is when you. This is what happens when you bypass grc. Like is this.

[Corey Ham]

Well, yeah, yeah. I mean, I don't know. It's kind of crazy that. I will say though, this is the classic thing of scale. When you're operating at these huge Internet scale companies like Meta, you can't hire support people to actually support your accounts, or at least they think they can't and so they use AI and that's gonna cause risks. Although it is a business logic flaw, arguably, maybe it's an LLM flaw, but it feels more like a business logic flaw to me of it basically not knowing where the credentials it's handing out came from. It doesn't properly tie together the request and the response.

[David]

I could just see like you were talking about, where's the red team? I could just see like a bunch of AI red team experts getting together and being like, nah, surely it's not that simple. We got to try some more advanced attacks.

[Corey Ham]

Yeah, I mean, I will say I have personally observed this in our agentic AI testing. Some of the things that are really tough to convince AI are vulnerabilities. Like one web app we were testing. I think I've told the story before, so I'm sorry, but one web app we were testing, it was basically an eye door, so indirect object reference. And essentially it was giving a 302 response, but it was giving the entire content of the page that was supposed to be restricted in the response. And AI kept being like, no, this isn't a vulnerability. It gave a 302 response. And we're like, yeah, but look at the 302 response. It has the whole web page. And it's like, I don't know what you're talking about. It's a 302 response. I have to redirect. It's like that back and forth. I could see a red team, like an AI red team missing a business logic flaw. Like, well, they asked for the account and it sent the number. So I don't see what the problem is. Well, like, but AI, it's a different account that they reset. Like they were resetting someone else's account. Oh, you're absolutely right.

[Wade]

All right, let's talk about the real problem is why are they using a phone with a crack screen? Like, come on, at least get two phones with two screens. Like, I can't. That is just driving me crazy.

[Corey Ham]

I think this is just what threat actors do, man.

[Shane Hartman]

They do.

[Corey Ham]

They. They. That's just their background. That's just their chat background. For. For meta. That's not even a broken screen.

[Wade]

That dot that you don't see the huge crack right there on the right hand image.

[Corey Ham]

I know. They have a cracked screen image as their background.

[Ralph]

Yeah, that would actually do with all my phones. That's why no one steals them.

[Wade]

That's actually a really good idea.

[David]

Misinformation on any app that you have.

[Wade]

Yes.

[Corey Ham]

Yeah, yeah.

[Ralph]

This is never gonna happen again. So we don't have to worry about this. Let's move on.

[Corey Ham]

There's an article about the Kali365.

[Ralph]

Oh, my God, dude, they stole my playbook.

[Corey Ham]

It's literally just like pen tester 101. Like if you were to take Michael Allen's initial access class, it would just cover this. It's using device code fishing, which, don't get me wrong, it's a good one. But also like, like, come on,

[David]

it's

[Ralph]

better because it's a SaaS product. Okay.

[Corey Ham]

It's P Phishing Sass. What?

[David]

Pass.

[Corey Ham]

I don't know.

[Ralph]

Everyone loves a monthly subscription fast.

[Corey Ham]

I don't know how to pronounce that. Phishing as a service platform that I like how the news article is kind of a dig where it says it helps even low skilled attackers. Hijack.

[Ralph]

You could be an attacker too.

[Corey Ham]

They're just directly calling the attackers who bought this low skilled. That's pretty funny. Yeah. Device code phishing. I mean, come on. Who Allows device codes these days. Who doesn't have secure conditional access policies that don't allow access from unmanaged devices? Like, come on, no one, no one screws that up anymore.

[Shane Hartman]

No, not true.

[Corey Ham]

The threat hunters in the room are like, nope, you're wrong.

[Ralph]

There's an article about it. It's still effective.

[Shane Hartman]

Yeah, I've done about three cases of it in the last month and a half.

[Wade]

Have.

[Corey Ham]

Well, I do need email on my phone. So we better just compromise the entire organization so I can have that.

[Wade]

That is exactly what happens. One person says that.

[Corey Ham]

Yeah, basically, if you're a pen tester or red teamer, you should know how to do this exact campaign just by reading this news article. This is a, this is a first thing to learn in initial access techniques. It's great. All right. And don't buy this product. Don't do it. It's probably done. Speaking of botnets, let's talk about botnets. So the authorities in the Netherlands, which I love, I just imagine people on little boats and they're going to fancy restaurants, you know, I just imagine Amsterdam. They have dismantled a botnet that comprise more than 17 million devices which is used basically for residential proxying or residential, you know, the service is called asocs, which is a Russian based company, provides residential proxying services. They cater to, they pay me every month.

[Ralph]

They have like that little thing that you run on your computer, they have

[Corey Ham]

that laptop they shipped you and put in your garage.

[Ralph]

Yeah, they said it was for research.

[Corey Ham]

Yeah. So I guess, I mean these are, you know, often used for illicit or unethical purposes. DDoS attacks, botnet commanding control servers, phishing, operations, scraping. My question is, how bad do you have to get to get dismantled by the Netherlands police? Like how much DDoS was this IP space launching? It had to be a lot.

[David]

Yeah,

[Corey Ham]

because that's.

[Wade]

How much, how much is this?

[Corey Ham]

What do you mean how much?

[Wade]

How much as it won't even.

[Corey Ham]

Oh, you're saying like you want to buy the price.

[Wade]

It won't even tell me prices unless I log in.

[Ralph]

No, no, no. It said there's a price. I got it. Look, it's 15amonth.

[Corey Ham]

You can't afford it.

[Ralph]

Yeah, residential IP is only $5 per proxy a month and corporate is only 5. Those mobiles are really high up there

[Corey Ham]

because it's like it's really hard for

[Ralph]

organizations to block mobile IP addresses because they move them around. And additionally many of the ISPs use either IPv6 or carrier grade NAT. So like it's really hard to block.

[Phil]

Source code is on.

[Ralph]

I think you're going right for bombas. Those are the top of the line. They don't last. No, no, no.

[Corey Ham]

Darn tough, dude. Bombas are not even close. Darn tough or nothing. Yeah. You don't wear socks. Get out of here.

[Ralph]

A socks.

[Corey Ham]

You're. You're a sock shoal because you're from Florida and you don't wear socks.

[Ralph]

Oh, my gosh. They have a G2 review for ASOCs. Oh. And then they actually. Oh, they got kicked off.

[Corey Ham]

I will say this whole, like, socks, you know, the, like, residential proxying thing is kind of a dark horse because we use this service, not ASOCS specifically, but we use residential proxying. They're all kind of mildly unethical. Like, I don't know. I. You know, you kind of have to have a service like this. But none of them are particularly above board. This one seems to be kind of the worst. But I don't know. It's Russia, yo.

[Wade]

It's good.

[Corey Ham]

That's true. It's legitimate or it's. It's realistic. It's what threat actors are using. That's why we use it.

[Ralph]

Yes, yes, exactly.

[Corey Ham]

We pay threat actors to use their

[Ralph]

service to pretend to be threat actors to protect threat actors.

[Corey Ham]

It's a. It's a loop. It's a loop.

[Ralph]

That really seems like it.

[Corey Ham]

All right, so any final articles? Shane or David, you guys have any articles you want to plug? We don't have any chicken news this week. I'm sorry, everyone.

[David]

I'm just told specifically there'd be chicken sacked.

[Shane Hartman]

I did. Did post one in our chat. That was real quick. It was one that was. There was a flight to, I think the Maldives where a kid decided to rename his Bluetooth device to bomb. And it freaked out the. It broadcast to everybody on the. On the plane. They tried to get him to turn it off or tried to get. They didn't know who it was, so they kept. They told everybody on the plane to turn off their Bluetooth and he never did. So they had to turn around and go back to Newark, I think, because his phone said bomb on it as a.

[Corey Ham]

As.

[Shane Hartman]

As his Bluetooth name.

[Ralph]

So found out who did it.

[Shane Hartman]

Yeah, I think there were only a couple devices left, so they found them. Yeah, bars, I know, but kind of a crazy story.

[Corey Ham]

Can you imagine doubling down? How old is this kid? I want to know because this is some dumb. Like, this is like. Yeah, 12 year old level dumb.

[Ralph]

Yeah.

[Corey Ham]

Like,

[David]

what is the air crew thinking? It's like, oh, you have a bomb on the plane, but if you turn the Bluetooth off, please. So we just don't notice, it's gonna go.

[Wade]

I got. Like, come on. Like, it's literally just a Bluetooth.

[Corey Ham]

Like, it's seriously just one of those things where everyone is just rolling their eyes and being like, guys, can we please have nice things? And some kids just like, no, we can't have nice things. And I will be on the no fly list for the rest of my life because of how dumb I am.

[Wade]

I know.

[Ralph]

That's the wild part. Like, you know, we just Talked about how GitHub can kick you off their platform for any reason, for whatever. Right? So can airlines. They can ban you for life on all the airlines they do. You are not guaranteed a flight. No, there's no constitutional rights here.

[Corey Ham]

No. But I can't imagine doing this.

[Ralph]

Imagine living your life and never being able to take a plane ride again,

[Corey Ham]

but then also doubling down again and again. Right? Like, you know, they had, like, 10 chances to, like, you could just turn off your Bluetooth. No, I'm not gonna do that. Somehow I won't get caught. And then, like, of course, when they land the plane, everyone's going into quarantine. Like, you're not just gonna, like, okay, deboard everyone. Just throw your phones out the window. It's fine. Like, they're gonna make everyone. You know, they're gonna figure it out.

[Ralph]

Imagine when this kid gets older, he's like, hey, why can't trip. I'm kind of infamous for this thing a long time ago. I can't.

[Corey Ham]

You were zero Cool.

[Ralph]

You were Zero Cool.

[Corey Ham]

No, he was bluefall. Bluetooth kid. Yikes.

[Ralph]

I did have one last one, and this one's really short. Not. Not a surprise, but it seems like a lot of isps are getting breached. Charter got breached by Shiny Hunters.

[Corey Ham]

Oh. Which is Charter for they have terrible security. All ISPs do from what I've experienced in my life. Yeah.

[Ralph]

Charter's one of the bigger ones in the United States. They cox. They own a bunch of other ones, so. Yeah, it affected a lot of people. Spectrum, I think, is another.

[Corey Ham]

Oh, yeah, they get breached every two years. I've been. My data has been breached in Spectrum like, five times. I'm not even joking.

[Wade]

I got so, so much lifelock, you won't believe.

[Corey Ham]

I've got so many Croll identity monitoring subscriptions at this point. It's fantastic.

[Ralph]

You can stack them and get zero extra.

[Corey Ham]

Yeah. Yeah. So, okay, I do think we should plug David's tool. So David, tell us about your tool. Yeah, so it's to generate thread, it's to generate threat hunting data. That's what I understand.

[David]

It's called Evidence Forge and it's a tool that I released what I guess last week or maybe the end of the week before. And it's targeted toward, there's. It's targeted toward creating realistic sets of logs for simulated environments that don't exist. Like think of, you need to create some logs for a, to demonstrate how a piece of offensive technique works in a real environment. So you spin up a cloud service and you do Terraform to, to create all your sensors and all your Microsoft networks or your Windows or your Linux systems. And then you run the actual exploits through and you get all the data through. And you know, you spend a lot of time, a lot of, a lot of money and possibly requires for people for you guys, probably not as it's probably well within your expertise, but for a lot of people it's not. The idea with evidenceport is you get the same similar output, but you don't actually have to have a real network. You don't have real threat actors or real red teamers. You create a scenario in which it is all simulated and you get a set of up to 20 different types of logs that look like they all are, came from that simulated environment. They're all realistic, they all hang together. So if you see like one of the inputs is zeek. So if you see a ZEEK log for an HTTP transaction and then you go into the proxy log, you'll see the same proxy log has the same transaction in it that the Zeek log has. And if you see that that came from your computer, you should find the computer that it came from. And there's probably a process log from Windows Sysmon that showed that you ran the web browser that generated that. Right.

[Corey Ham]

That's really cool.

[David]

It's really neat. It's interesting because it has an AI assistant to help you create the scenario, define the environment and the attack that you want to run and everything. But once you do that, generating up to, you know, gigabytes potentially of data is all done by a script, no AI involved. So it was actually partly because I was trying to experiment with efficient ways of using AI, targeting AI where you actually need the AI rather than, you know, just have the AI do it all.

[Corey Ham]

Well, also it's nice when the script is deterministic and creates the same output every time instead of just I hallucinated a bunch of events in Windows. And you're going to go hunt for these?

[David]

Yeah, it blows randomness, but it's. Yeah, but it's seeded random and the seeds are in the config files. So it basically makes a YAML file for the scenario and you can regenerate the same data from the YAML file however many times you want, trade them with your friends like Pokemon cards, you know, all kinds of stuff.

[Corey Ham]

You know, I love it. I will say I have personally had clients ask me for this, to do this and I've actually spent time running fake pen tests in their like test environments to generate the sort of data. And so now I would just be like, oh, there's a script for this. Here you go.

[David]

Well, I'm sorry to tell you, I actually created this because I didn't want to pay for the equivalent of having a register of my data.

[Corey Ham]

I wouldn't either. So out of curiosity, does it make PCAPs or is it just event logs? It's.

[David]

It doesn't make PCAPs. That's a good idea, but far more involved. But it does. Windows system logs several of the types of events, but not every single type of event. But it does like processes, starts and Kerberos things and authentications and things. It also does a bunch of different sysmon event types, does Linux syslogs, Cisco firewalls, Zeek and Snort. And it has a, it has an EDR that. It's not a specific brand of edr. It's just a generic EDR capability. Mostly because I didn't have the right documentation to create real looking EDR for a specific product. So all kinds of stuff.

[Corey Ham]

That's awesome. My only other feature request is you got to make it export straight from backdoors and breaches. You play a game backdoors and breaches and then you just have the threat hunt to go along with it. That'd be pretty awesome.

[David]

Look, I'm a big fan of backdoors and breaches. I would totally love to do that. I bet I could do it right now actually if I had a backdoors and breaches scenario, I could probably just tell it the AI and be like, hey, here's my scenario. Go build me a data set for this. It probably would do it.

[Corey Ham]

All right, so final plugs. David is keynoting our threat hunting summit. I forget when it is, but Ryan knows because he's smart. And the date on the threat hunting summit is June 17th 17th at 10am early for those Pacific time people. Get your coffee and get to David's talk. We also have Shane's training that he's doing on starting a threat hunt. Right?

[Ralph]

Yep.

[Shane Hartman]

In the dark.

[Corey Ham]

It's on the day.

[Shane Hartman]

Mine is I think at 1:30, I think on that day, Eastern time.

[Corey Ham]

And you. Do you have to have blackout curtains and make it dark in your office or can you just do it in daylight as well?

[Shane Hartman]

I think I could do it daylight as well.

[Ralph]

All right.

[Corey Ham]

Okay, cool. And then, Phil, you have a webcast this week, right?

[Phil]

Yeah, on this. This Wednesday actually. And I'm kind of in between a rock and a hard place because there's a tool I was going to drop that that goes along with the course, but.

[Corey Ham]

Spicy.

[Phil]

Yeah, it's a little too spicy. It's like too dangerous. Like, I don't know if I should release it because you could do like a lot of bad things with it.

[Corey Ham]

You should release it.

[Wade]

Release it. Release it.

[Corey Ham]

You have my official approval to release it.

[Phil]

All right. Yeah, I will. I was just like, oh, Nightmare Eclipse. I don't want to get Nightmare Eclipse.

[Corey Ham]

Yeah, you do. Yeah, well, you do because you actually have a job. Unlike them anyway. All right, what else we got? Anyone else have anything to plug? Wade, you have something to plug?

[Wade]

I see you. I. I am teaching on the 22nd. My threat Intel 1012 day course. That'll. That'll be fun. I just made it two days from one day, so I'm still working on the slides.

[Corey Ham]

Nice. Good to hear. Ralph, what are you plugging?

[Ralph]

Oh, yeah, I didn't really have anything to plug, but we do got another physical class coming up. So if you want to figure out how to actually go into a building and plug in USB Dr. Drives, because that is something if you want to prepare.

[Wade]

Nation state level cyber force.

[Ralph]

If you want nation state level physical exploitation. Yeah, we got.

[Corey Ham]

That's awesome. When is that, ralph?

[Ralph]

Shoot, I have to look at the calendar here. I don't remember the date now.

[David]

Swear to God.

[Corey Ham]

What is it practical physical exploitation.gov?

[Ralph]

yes, it is. It's physical exploit.com.

[Corey Ham]

physical exploit.com.

[David]

if we take your class and we graduate, do we automatically get a job with the silent ransomware group or do we have to apply?

[Ralph]

No, you still have to apply. But I do know a guy, so I can get you like, there's.

[Wade]

There's an affiliate email. You. You email the certification that RALPH gives you and then they'll contact you shortly

[David]

with just USB drives.

[Corey Ham]

We.

[Ralph]

We actually just had a class last week and we had 10 students in it. It was a lot of fun. So a lot of all Russian.

[Corey Ham]

Not a word of English was spoken.

[Ralph]

It's not important what their primary language is. It's important the skills that they learned. Which were the best.

[Corey Ham]

Awesome. All right, y', all, thank you for coming. I really appreciate it, especially David, Shane, Phil, thank you. We'll talk to you later. Bye, everyone.

[Ralph]

All right, later, guys.

[Wade]

Sam.