Loading summary
Transcript26 lines
- [00:03]
A
You know, so we see. I focus a lot on sort of the Russian language marketplaces and the English language ones. But there's obviously this, it's a global problem. A lot of players around the world, they tend to gravitate towards different platforms. So for example, the Russian and English ones sort of like the classic bulletin boards and now Telegram increasingly, whereas Latin American ones will use other social media platforms to communicate. It's a dedicated website, but the hacktivist of space as well. Right, you mentioned that as well. Telegram's very popular, sort of an English language world, Russian language world, and also South Asia, whereas Twitter is really popular in Latin America.
- [00:50]
B
Welcome to another episode of Mannion's Defenders Advantage podcast. I am your host, Luke McNamara. I have the privilege today being joined by two of our guests, one who's returning, Jose Nazario, senior principal within Google Threat Intelligence Group. And Brandon, I think this is your first time on the podcast. Brandon Wood, product manager for Google Threat Intel. Great to have both of you here on this Friday.
- [01:15]
C
Yeah, likewise. Really honored to be here.
- [01:18]
B
So we're going to talk about some new capabilities that are rolling out within Google Threat Intelligence and then also talk about some of the use cases, some of the reasoning as to why some of the problems that we're trying to address in rolling these capabilities out. Maybe. Brandon, we'll start with you. What is this new set of features that is going to be available as of the time of this podcast going live in gti and what was sort of the market need that we saw that we wanted to address with these?
- [01:47]
C
Yeah, that's a great question, Luke. And you know, I've been focused on this problem for the last decade. And before I got to Google, I came with you guys as part of the Mandiant acquisition. I focused on tools that were largely related to creating Dark web monitors and trying to create alerts for customers based on conversations about them on the dark web. And what we saw comparing our tooling with most of the competitive landscape is that we all kind of handle this problem the same way. We create monitors largely based on regex, maybe have some machine learning classification, and then as a threat actor says something on the underground, we create an alert for it. Unfortunately, with this approach over the last decade, it creates a ton of noise for Threat intel teams and SOC teams. Right. And we see the adversary be very mindful of on being aware of the tools that we use to do this type of collection in the underground. And what's new with the capability that we've brought is that we actually Use Gemini to process everything that we see from the underground and personalize the intelligence that we've seen. And being able to do this at Google with Gemini, we've been able to get the system up to overwhelming performance. You know, we process every single one of the posts we collect from the dark web, tens of millions of events a day. We process every single one of those posts using Gemini. And then rather than using key terms and having the customer have to load all this context into the system like you do with existing monitors, we actually again use Gemini to go out and create a profile of the customer to get them started and create personalized intelligence for them. And again, using Gemini to make each of the alerts very relevant for them. So, you know, we're using Gemini on the front end at ingestion, really focused in on the, you know, the threats that really matter to organizations. We're using Gemini again to do the matching and then Gemini again to do the personalization. So, you know, I think the big thing for us and this team is leading with an AI capability that really takes what's been a really hard and pernicious problem for threat intelligence teams and flipping the false positive problem with these tools on its head to just be a very clean source of signal and really get after the adversary and changes we're seeing in the threat landscape.
- [04:23]
B
I think you mentioned this somewhat when you referred to it as sort of a clean source of signal. But one of the existing challenges with a lot of these other brand monitoring capabilities, organizations looking for mentions of their organization's name, keywords around executives, et cetera, in the underground, is that they can be very, very noisy. That seems to be one of the big things that we're trying to reduce. But also where there's maybe not explicit brand mentions, be able to take some of the larger context and say this might be something we need to look at. So maybe some of those are a few things. But can you dive a little bit more into like how this differs from some of these other capabilities out there when it comes to dark web monitoring or brand monitoring?
- [05:06]
C
Yeah, that's great question, Luke. And there's two parts of the problem that I think are distinctive with this system. The first part is, you know, we see the adversary be purposely very vague. You know, when we're looking at initial access broker posts, right? You know, they'll typically, instead of saying Coca Cola, they'll say, you know, large soda manufacturing company. That's not the blue one, right? Us as humans, when we read that, we're like, oh, they're talking about Coca Cola, they're not talking about Pepsi. We get it. We understand that part of the problem. And what we found in Gemini, Gemini understands that cleanly and understands it across dozens of different languages. And so as long as we're providing context to who the customer is, which is being delivered through another part of the system, we're able to actually put Gemini in a position to understand what the threat actor is saying and then determine if it's relevant to the customer or not. I'd say the other piece there and it really speaks to that key term regex part of the problem. And you know, we'll pick on our friends over at Apple, but most of your existing tools out there, even the existing tool that, that we've had for a long time, can't tell the difference between Apple the fruit and Apple the company, right. And so when a threat actor is talking about Apples, well, the threat intel analyst, the SOC team's getting alerts about, you know, both the company, somebody's name with Apple in it and the, the fruit as well. So, you know, we really think that is like the, the core thing that makes this different. And I think for us at, at Google, right, Like, you know, and I do a lot of vibe coding now. I'm not a product manager by trade, I was a philosophy major before that. I'm not an engineer. But if I was to leave, if Jose and I were leaving the company today to go vibe code, but startup focus on this part of the problem. I think the biggest challenge isn't building like what we built. It's actually comes down to the cost of operating these models at this scale. Right. We're processing tens of millions of dark web posts a day and doing a ton of agentic tasks in order to really get the signal down to the things that matter. And so it's really nice again to be here at Google having really crawled through glass on this problem for a long time and really be able to, you know, flex that kind of strength on a problem that hopefully benefits a lot of organizations out there that are struggling with this problem.
- [07:32]
B
What are some of the things, some of the other things that you see that makes kind of Google tackling this problem a bit unique in terms of the capabilities that we can bring to bear. Obviously there's Gemini, but of course also on like the researcher side, monitoring, tracking, forum posts, getting in these underground communities which can range in terms of like the types of platforms are on some of those being more closed off, invite only systems to others being more open, telegram Channels, things of that nature, different languages. So we have a lot of experience, I guess, on the human side getting into the weeds of this problem. But then also there's the technology component capabilities of Gemini. We can also throw at it. So maybe dive a little more into the sort of the unique stuff that you think we're kind of marrying up and bringing together here.
- [08:19]
C
Yeah, yeah, of course, Google tackling the AI problem is a big part. But yeah, what you're getting into is as, as we've been building out these systems and the things that we learned. Right, is that it really comes down to expertise, of understanding the problem that you're really trying to solve at the end of the day. And in this problem, it's all about understanding the adversary and the threat landscape that you're involved in. And so the GTIG organization and a lot of my former friends from Mandiant spent most of the past year really focused on doing classification, labeling and toning, being able to test cangem. And I actually understand these different nuances of, you know, Moscow spoken Russian versus other, you know, dialects of Russian. Can it actually, like, perform in these different ways? And you need really, really high expertise in order to understand if the system can actually do what it can do and then, you know, being able to leverage that expertise again to reimagine what this could be like going forward. Right. And so, you know, there's a lot of approaches that, you know, frankly, we couldn't get prioritized in engineering because it was just too expensive, it took too much time. And, you know, the bandwidth requirement on the research organization to, you know, get the prior system to do what we would want to do would be too expensive. But now we could have GTIG immediately plugged into the system in a really direct and ephemeral way where, you know, they're seeing the same threats that our customers are seeing. And we're able to, you know, guide research energy towards the threat landscape that our customers are seeing now and be able to dive deeper into, you know, adversaries that may be giving some of our customers a really hard time. And that connects back into all the other intelligence investments that we've been making at Google for a long time when it comes to our visibility, when it comes from our deep partnership on the mandiant consulting side and incident response when it comes to, you know, managing Personas on the underground for over 15 years. Right. This is really, you know, the, I think, the, the biggest, you know, technology shift that we've had since we, we came into Google and Allows us to really bring multiple parts of the research organization and different parts of Google together. And my job on the PM team and Jose's job of, you know, being the, the key expert involved in building the system is, you know, how do we put GTIC in the best position in order to get the most leverage on the adversary and the threat landscape? And what does AI need to do in order to unblock a lot of things that need to get done at
- [10:57]
B
the end of the day, Jose, let's bring you into this and maybe get a little bit further into the specific problems we can potentially address with this. So obviously for a lot of things like forum posts, tools being sold in the underground, data being sold in the underground, very, very relevant to a lot of the financially motivated cybercrime that we see, but not exclusively. We'll sometimes see initial access brokers being leveraged by state sponsored actors. Obviously you have the larger hacktivist problem which can occur on some of these platforms and stuff. So as you're thinking about some of the areas of the threat landscape that we can utilize these capabilities to help address, what are some of the things that kind of jump out at you also maybe just get into the openness of actors in the underground and what we typically see there.
- [11:46]
A
Great question. So I've been looking at hacktivism now for almost a couple of decades at this point. Sort of the intersection of geopolitics and cybercrime and cyber activity. But recently been, you know, in the dark web since coming to Mandiant and then Google. Yeah, you see a maturation of the marketplace. So we see, we know, we see people talking about I'm selling access or I'm selling data. And that's a fraction of what is really going on. Partly because where the real juicy stuff is sort of, it's kind of hard to get into. You don't openly advertise that, but you're also seeing some people who are just trying to sort of gain some credibility until they make some assertions as well. I have this, I have that. And so the system does a pretty good job of codifying the knowledge and expertise that we've brought and built over the years, over the 10, 15 years, I think of Mandiant expertise as Brandon talked about, to be able to describe the scenarios, obviously gather the data, but also then describe and teach Gemini how to sort of sort these things out when somebody says these things. Because we chose sort of the most ambiguous sort of spaces here as well. Right. So Brennan mentioned maybe you sort of describe the company without Naming it, maybe they intentionally misspell it so that those substring matches don't filter it or don't find it or sometimes even use an incorrect abbreviation. And Gemini is really good at sort of picking that out. Again, our experts in training the system, building the system up, leveraging, you know, quite a long history of manual classifications to train and evaluate, but then also teach it from the expertise and sort of get that feedback internally. It really helps to pick out again the sort of those. The stony things. And sometimes you'll look at a finding and you're like, I'm not so sure. And then, wait a minute. Oh, oh, it found something pretty juicy. This is pretty cool. Which is just exciting to watch it work like that. And so it really cuts down and sort of distills a bunch of stuff into very powerful kinds of narratives. And then, of course, we can then task other parts of the system to go and fetch some more data for us or what have you to inform, for example, about a threat actor. One of my common workflows has been, hey, this looks interesting. Is this person for real? Let's see what people say about them. What else have they done? So we can go and look, and you can see. Then you start finding some interesting trends. So maybe there's a prolific access broker who's hitting everything around the world with maybe one or two sort of types of access. And what you suddenly pick out is like, oh, wait a minute, maybe they have a tool or a weapon or something like that to be able to get in an exploit or some method that they figured out stolen passwords, cached stolen passwords for a vendor. And now you can sort of spot that trend pretty quickly. And again, it can pick some of these things out. Or you can sort of course ask, what do this person's peers say about them? And you can find out, oh, they've been in these disputes over the past few months with people about maybe what they said was sort of gold wound up being tinfoil or something like that. There's a fantastic paper some years ago about people, nobody sells gold for the price of silver. I think it was in the fishing space. But it's a very classic metaphor. And so people will sort of call that out, don't do business with this person, because they're a liar. So you can rapidly sort of get through all this kind of stuff very quickly. And Gemini is pretty good at spotting this. But coming back to sort of the things it's been really, like I said, really, really good at doing is again, dissecting and sort of spotting the stuff. You put a ton of stuff through it and it can sort of spot some interesting things for you really quickly.
- [15:19]
B
Yeah, I think we maybe noted this in our report last year. One of the reports last year around AI threat actors, threat actors, leveraging AI and specifically some of these jailbroken or illicit models that are being offered for sale in the underground. And I think something that maybe not everyone is aware of, but when we're talking about these underground marketplaces, like any marketplace, there are places where you can leave reviews on the sellers, on the capabilities of what they're offering. And so there's interesting data and insights there to potentially being gleaned as to the capabilities of certain tools or is this person reliable, etc. Maybe one thing that would also be interesting to dive into a little bit is can you share some of your insight into some of the variances across different communities. So you know, you have more like Russian speaking Eastern European cybercrime communities, you have ones that have English being utilized. You have, you know, like in Brazil, the Portuguese speaking cybercrime community and the platforms they may be on will differ. Brandon mentioned earlier, like being able to kind of spot language differences or dialect differences, obviously, you know, bringing some of the capabilities of like Google Translate to bear to this problem. But even like the differences between like the hacktivist spaces and how they'll sort of congregate, where they'll congregate and interact versus cybercrime communities, you talk a little bit about just sort of those general
- [16:46]
A
variances, the differences that I've seen and I would probably defer to some of my colleagues and hopefully representing them accurately and their expertise accurately, you know, so we see I focus a lot on sort of the Russian language marketplaces and the English language ones. But there's obviously this, it's a global problem. A lot of players around the world, they tend to gravitate towards different platforms. So for example, the Russian and English ones sort of like the classic bulletin boards and now Telegram increasingly, whereas Latin American ones will use other social media platforms to communicate and some dedicated websites, but the hacktivist space as well. Right, you mentioned that as well. Telegram is very popular sort of in English language world, Russian language world and also South Asia, whereas Twitter is really popular in Latin America to be able. But one common theme a lot, there's a couple common themes in all of it. Obviously they're trying to make a living, so they're trying to make a buck, they're trying to get things out there. And secondly they're trying to prove credibility, to sort of keep that toehold, that foothold in sort of the marketplace. And some of these guys really just want recognition, just want to be told, hey, what you did was pretty cool and pretty special. And so they're boasting, in many cases, they're human beings at the end of the day. And so watching them do these things and interact, and we were sort of relying upon them making some of these comments. And this is where Brandon was talking about some of our colleagues who can bring that human element in and sort of build those relationships up with some of them to discover more about them and their operations and sort of understand who they might work with. That gives us a much more complete picture, because, again, it is just a fraction of what we see. What we see is really just a fraction of sort of the whole thing. Because maybe I entice you with a few different sales that I'm okay with being openly shared, but if you and I establish rapport now, I come to you in the future more privately, hey, I got this thing. Let me offer to you before anybody else gets access to it for maybe a little bit more money, but now you get some inside access. Some of our people have, like I said, found some of those relationships, but also things like, hey, check this out. I got this thing over here, or I just came back from vacation. Look at my pictures. All sorts of human sort of needs sort of going on right there. Again, just that need of validation. Need to sort of prove that they're capable, et cetera. That's sort of a common theme. Even though they sort of communicate in sort of different ways, even though they other times in different places in different ways, using different sort of nuanced language at times, Gemini is really smart at sort of mapping it all in sort of the same kind of things in the same way that if you had to try to translate all of it, just to distill it, you would lose a lot of nuances. The way that the system, that the engineers sort of built the system, the designers and the scientists built the system, it does a really good job of mapping it all into sort of like defining, hey, this is what we're looking for. You can sort of pick out from different languages different nuances when they're talking about some of these things. And again, teaching it and training it has been really powerful.
- [19:45]
C
Yeah. And something. Sorry, Luke. Something to add to there. Like, you know, Jose, a lot of what you're revealing is how important it is for defenders to know who they're up against. Right. And obviously that's really important for us. And, you know, Mandiant Land and G Take. Right. You know, because even in the existing or previous paradigm of technology, right. Even if you got detection, Right. And even if it was specific to your organization, someone is talking about selling access to your organization. Well, what does your security team even do about that? Right. You don't have context on who it is. You don't know what type of access they have often. And so your threat hunter is just, you know, select all looking for anything and everything. This is, again, just to really celebrate the partnership between GTIG and AI here, is that there's a lot in this, you know, massive amount of data that we have. I mean, it's, you know, it's the data we've been collecting for a long time, but we've also entered a trusted partnership to accumulate even more data and gain even more broader visibility than we've ever had to really get this beautiful insight to what's happening in the underground. And so what we're able to do between AI and GTIC here is that, hey, we're able to understand a lot more on the stories of these handles and the Personas behind them and potential groups that they're a part of, and understand how they're changing and adapting over time. Right. So if we're seeing something from Sultan, who we know is a prolific initial access broker, happens to also be the author of Vidar, Infosteel and Malware. We know from his past communications that he likes to go after WordPress plugins and he likes to do Google Mail advertising to get his foothold. And so we're able to, you know, process these alerts and have this deep insight of the underground and be able to use tools like Gemini to make that discreet and actionable for the user. You're now, you know, starting your journey when you're getting this alert off in a full sprint on being able to, you know, understand what are some of the leads you need to go chase and make it more actionable. And again, it's just the power of using AI in the right ways and, and what GTA brings to. To the table.
- [22:02]
B
Yeah, I think that's incredibly, you know, obviously helpful to add that further context beyond just my name is being mentioned in the underground and my organization's name is being mentioned. What do I go then do about that? Where does that investigation start? So being able to provide greater prioritization and context to the network defender, who's obviously looking for insights into threat activity beyond the perimeter, beyond the network itself, but giving them sort of more specific guidance on kind of where to begin that investigation, I can see being incredibly helpful.
- [22:34]
C
Yeah, absolutely. And this is, I sit in the SecOps organization and the Google Cloud security portfolio. And a big reason why these dark web intelligence capabilities haven't been more integrated into a SIEM tool or others before it is because of the false positive noise problem. You essentially want to take SOC analysts who already have a huge alert problem to begin with and suffer in false positives for on network detection, and you just want to make their lives a lot worse with even more false positives. Right. That's been the tough situation most teams have been into. Again, why we're so excited to really offer that clean source of signal is we're now able to integrate this into tools like SecOps and other third party sims out there and be able to have it come with that enrichment that I'm talking about and tying in ttps to really look and feel like a lot of the other styles of on network detection that they're used to. We're just expanding to the entire attack life cycle, going deeper into reconnaissance and some of the other stages and, and giving folks that external visibility that you're talking about for on network activity as well.
- [23:50]
B
I know both of you will know this from your years spent working in intelligence, but obviously you have the threat environment as it exists today, and then there will be changes that will occur and that will look different in a year's time, five years time, et cetera. You know, Jose, I know the last several years we've seen sort of this resurgence of global hacktivist activity, but it used to be very, very big earlier and it looked different.
- [24:13]
C
Right?
- [24:13]
B
And you go back to like the LulzSec and Anonymous days. Same thing with like the cybercrime space. Like we see this continuous churn between the different ransomware and other sort of associated extortive brands, right? We see ones that are very hot a particular year, there's law enforcement disruptions, takedowns, they come back, they rebrand, et cetera. So there's this constant churn that we know we're dealing with. Maybe we'll kind of wrap up here. But when you kind of think towards the future, both of the capabilities that we're building out to provide greater context to network defenders and being able to apply AI to that problem in a rapidly changing world, how do we sort of outpace the speed and scale that we're seeing? Threat actors themselves also leveraging AI also bring to the table.
- [24:58]
C
Now, look I think it comes down to having a system that can scale and adapt to that problem. Right. And trying to do it outside of the. The organization we're in is. Is really painful and challenging. Right. And a lot of the, again, technology approaches, we've tried to understand this problem. I mean, because when you look at the underground, you're mainly talking about a vibrant economy that you're trying to understand and understand it continuously. And you need a system that can scale to understand the economy and gracefully track it change over time. Right. Because we want to put more pressure on the adversary. We want them to change faster, but we also need to be able to pace that change with them and put our defenders in the best position to be able to do something about it. So we feel we've learned a lot over the last decade about the underground, about the adversary, and about how you solve this problem and how you don't solve this problem. And we've been able to take that insight and build it into a product that is really elegantly designed. You know, there's different parts of the system that we already know we're going to replace in a short amount of time, and models continue to improve as well. And we've built the system to, you know, be able to take the next model when it's. When it's ready to go and like, quickly swap things in and out. All of that is to pace and change with the adversary here. And, you know, the other thing that I mentioned that Jose mentioned before, is that the nature of initial access brokering will change over time. The nature of data leaks will change over time. And, and for us, like, being able to adapt our detection and do that, is a prompt update now by the best in the business and gtag. So we're really excited for that.
- [26:42]
A
The adversary, one of the things that Brandon touched upon a little bit ago, or maybe you did as well, in our AI research paper and papers now, I think we've done several of those reports. We're seeing an explosion of sort of tinkering and research in this space and sharing wins and losses and stuff like that. People are commiserating, but also people are, hey, I assembled here. So did I. But also, like, hey, check this out. I think I found a way around this thing. Very reminds of very much of sort of the early 2000s in cybersecurity, cyber hacking. Hey, new technology. Oops, by the end of the week, somebody's popped it kind of thing. And sort of getting the accolades for that similar kind of dynamic. We're seeing an erosion if you will, or a lowering of sort of some of the barriers to entry. You know, Brandon talked about the two of us vibe coding. Attackers are vibe coding. The good news is, if you look closely, a lot of their stuff falls apart really quickly, or doesn't even compile in some cases. But they're getting there. They're experimenting, they're getting there. And so the pace of things is going to be crucial for a long time. You know, it was very much focused on the defender, was bring, just bring me more data. Just bring me more data. And we'll sift through it. We'll sift through it. And with the application of the thoughtful application of technologies like Gemini and others to the problem, you can obviously ingest more data, but sort it and distill it, both by sort of history. What has this person done over time? Their network, what's happened there, but also pictured out. Okay, well, we've seen these kinds of things. They also author these tools. What do these tools look like? Let's bring that in. Other kinds of attacks we've seen maybe of this type, maybe attributed to them. What happened? Bring that in so that relevance quickly comes together much faster. You're augmented now so you can operate much faster to make a much, much faster decision, as Brandon noted earlier, start sprinting as opposed to sort of fumbling around in the dark trying to find the doorknob kind of thing. You can actually hit the ground running with some good leads to go tackle and communicate from intel to operations and all the way up and really make that difference.
- [28:52]
B
Well, again, I think hopefully this is a new set of capabilities that can even better empower the defenders in bringing this together. Even still, knowing at the same time that we're launching this, that the landscape is going to change, evolve. Jose, Brandon, great job here kind of explaining this and walking us through. We'll include a link in the show notes to, I think the blog that will be announcing this or if you're finding this podcast because it was embedded in the blog, you'll already found that sort of resource. But thank you both for your time today and walking through these new capabilities that are rolling out.
- [29:24]
C
Yeah, thank you for that, Luke. And yeah, we're excited that these capabilities are just the beginning of a really cool story that we want to tell and tell going forward and excited for folks to jump in and beat the crap out of it. We look forward to it.
- [29:39]
B
Excellent.
- [29:40]
A
Thanks, Luke.
- [29:40]
B
Thank you both.