ChatGPT; Create a dossier on room 39 in DPRK

This article is part of an ongoing experiment with the use of ChatGPT for developing primers on cyber security topics.

Room 39 is a secretive organization within the Democratic People’s Republic of Korea (DPRK) that is believed to be involved in illegal activities, including money laundering, arms smuggling, and counterfeiting. Here is a dossier on Room 39, detailing its history, operations, and significance.

The exact location of Room 39 within the Democratic People’s Republic of Korea (DPRK) is unknown, as the organization operates under a high level of secrecy and its members are believed to be highly skilled at concealing their activities and avoiding detection.

However, it is widely believed that Room 39 is headquartered in the capital city of Pyongyang, and that it has branch offices and operational centers throughout the country. The organization is thought to operate under the direct authority of the North Korean leadership, and to have close ties to the country’s ruling elite.

Despite its secretive nature, Room 39 has been the subject of intense scrutiny by international organizations and governments, as its illicit activities are seen as a major challenge to regional stability and security. Efforts to track the organization’s activities and disrupt its operations have been ongoing for many years, but progress has been limited by the organization’s secrecy and the support it enjoys from the North Korean regime.

The exact amount of money that flows through Room 39 is difficult to estimate due to the secretive nature of the organization and its operations. However, some estimates suggest that the organization generates billions of dollars in revenue each year, largely through illicit activities such as money laundering, counterfeiting, and smuggling.

It is widely believed that a significant portion of the revenue generated by Room 39 is used to fund the North Korean regime’s military and nuclear programs. However, it is unclear how much of this revenue is directly funneled into the accounts of the Kim family, which has ruled North Korea for three generations.

While there is no concrete evidence to support the claim that the Kim family directly benefits from Room 39’s activities, some reports suggest that members of the family have used the organization to acquire luxury goods and other items that are subject to international restrictions. For example, a 2017 report by the United Nations suggested that Kim Jong Un had used front companies associated with Room 39 to acquire luxury yachts, musical instruments, and other items.

History

Room 39 was established in the late 1970s by Kim Jong Il, the former Supreme Leader of North Korea and the father of current leader Kim Jong Un. The organization is believed to have been created to provide a source of foreign currency for the North Korean regime, which has been subject to international sanctions and trade restrictions.

One of the key tactics used by Room 39 in its illicit operations is the use of grey markets. Grey markets are informal networks of traders and middlemen who operate outside of formal channels of commerce, often in the context of goods that are subject to sanctions or trade restrictions.

Room 39 is believed to be involved in a wide range of grey market activities, including the smuggling of goods and the evasion of international sanctions. The organization is thought to use a network of front companies and intermediaries to transfer funds and goods, and to conceal its activities from international authorities.

For example, Room 39 has been linked to the smuggling of minerals, such as coal and iron ore, which are subject to international sanctions. The organization is believed to use a network of traders and middlemen to transfer these goods across borders, often using deceptive practices such as mislabeling or transshipment to avoid detection.

Room 39 has also been linked to the smuggling of luxury goods, such as high-end automobiles, watches, and liquor. These goods are subject to international restrictions, as they are believed to provide a source of revenue and prestige for the North Korean regime. Room 39 is thought to use a range of tactics to evade these restrictions, such as the use of front companies and the exploitation of loopholes in international regulations.

In addition to its grey market activities, Room 39 is also believed to be involved in a range of other illicit activities, including money laundering, counterfeiting, and the production of illegal drugs. The organization’s operations are highly secretive, and it is notoriously difficult to identify its members or track its activities. Nevertheless, Room 39 is widely believed to be a significant source of revenue for the North Korean regime, and its activities are seen as a major challenge to international efforts to promote stability and security in the region.

Operations

Room 39 is believed to be involved in a wide range of illegal activities, including:

• Money laundering: Room 39 is thought to be involved in laundering money from drug trafficking, smuggling, and other illicit activities. The organization is believed to operate several front companies in China and other countries to facilitate the transfer of funds. According to a report by the US Department of the Treasury, Room 39 has used these companies to conduct transactions worth millions of dollars.
• Counterfeiting: Room 39 is believed to be involved in the production of counterfeit US dollars and other currencies. The organization is reported to have sophisticated facilities and printing equipment, and to use advanced techniques to avoid detection. In 2019, a Hong Kong-based news outlet reported that North Korea was using its embassy in Beijing as a base for its counterfeiting operations, with Room 39 reportedly involved in the scheme.
• Trading: Room 39 is also believed to engage in legitimate business activities, such as trading in minerals, metals, and other commodities. These activities are believed to provide cover for its illegal operations and to generate revenue for the regime. According to a report by the Korea Institute for International Economic Policy, Room 39 has been involved in the export of coal, iron ore, and other minerals to China and other countries.
• Arms smuggling: Room 39 is believed to be involved in the smuggling of weapons and military equipment, including missiles and nuclear components. According to a report by the US Department of State, the organization has been involved in arms smuggling to countries in the Middle East and Africa, and has also provided military training and support to non-state actors.

Cyber Operations

North Korea has been linked to a number of cyber operations in recent years, many of which are believed to be conducted by the country’s military intelligence agency, the Reconnaissance General Bureau (RGB). These operations include attacks on financial institutions, cyber espionage, and the theft of cryptocurrency.

While the exact role of Room 39 in these cyber operations is unclear, it is believed that the organization plays a key role in generating revenue for the regime from cybercrime. For example, Room 39 is believed to be involved in the theft of cryptocurrency, which is then used to fund the regime’s military and nuclear programs. In addition, the organization is thought to be involved in the development of advanced cyber capabilities, which are used to conduct cyber espionage and other operations.

The most high-profile cyber operation attributed to North Korea was the 2014 attack on Sony Pictures, which was carried out in retaliation for the studio’s production of a movie that portrayed the North Korean leader in a negative light. The attack, which was attributed to the RGB, resulted in the theft of sensitive data, the release of embarrassing emails, and the destruction of computer systems.

Other cyber operations attributed to North Korea include the WannaCry ransomware attack in 2017, which affected hundreds of thousands of computers around the world, and the theft of $81 million from the Bangladesh Bank in 2016, which was carried out using stolen SWIFT credentials.

Ties to Room 39

While it is unclear to what extent Room 39 is directly involved in cyber operations, the organization is believed to play a key role in facilitating North Korea’s cybercrime activities. Room 39 is thought to be involved in the laundering of funds generated by cybercrime, as well as the acquisition of technology and equipment used in these operations.

For example, a 2019 report by the UN Panel of Experts on North Korea noted that Room 39 had been involved in the acquisition of advanced encryption software and other technology that could be used to conceal the country’s cyber activities. The report also noted that the organization had used front companies and other means to transfer funds for the purchase of this technology.

In addition, a 2020 report by the US Department of the Treasury identified several individuals and entities involved in North Korea’s cyber activities, many of whom were linked to Room 39. The report noted that these individuals and entities had been involved in a range of cyber operations, including the theft of cryptocurrency and the development of malware and other tools for use in cyber espionage and other activities.

These and other reports suggest that Room 39 plays a significant role in North Korea’s cyber activities, and that the organization’s illicit operations are intertwined with the country’s cybercrime activities. As such, efforts to curb North Korea’s cyber activities will need to take into account the role of Room 39 and other organizations involved in generating revenue for the regime.

The individuals associated with Room 39 are notoriously difficult to identify, given the secretive nature of the organization. However, here are some examples of known individuals who have been linked to the group:

• Kim Chol: In 2013, the US Department of the Treasury designated Kim Chol, a senior official in the North Korean government, as a “specially designated national” for his involvement in Room 39’s illicit activities. According to the Treasury Department, Kim Chol was involved in the management of several front companies used by Room 39 to launder money and evade international sanctions.
• Ko Chol Man: In 2017, the UN Panel of Experts on North Korea identified Ko Chol Man as a key figure in Room 39’s illicit activities. According to the Panel’s report, Ko Chol Man had been involved in the operation of several front companies used by Room 39 to transfer funds, and had also been involved in the smuggling of coal and other commodities.
• Kim Su Il: In 2020, the US Department of the Treasury designated Kim Su Il, a North Korean government official, for his involvement in Room 39’s illicit activities. According to the Treasury Department, Kim Su Il had been involved in the operation of several front companies used by Room 39 to transfer funds, and had also been involved in the smuggling of coal and other commodities.

It is likely that there are many other individuals associated with Room 39 who have not been identified publicly. The organization operates under a high level of secrecy, and its members are believed to be highly skilled at concealing their activities and avoiding detection.

Ties to crypto currencies and illicit operations

Room 39 is believed to be involved in a wide range of illicit activities, including money laundering, arms smuggling, counterfeiting, and trading. One of the tactics used by Room 39 in its illicit activities is the use of cryptocurrencies.

Cryptocurrencies provide a means for Room 39 to evade international sanctions and bypass traditional financial channels, making them an attractive option for the organization. Room 39 is believed to be involved in a range of cryptocurrency-related activities, including:

1. Cryptocurrency mining: Room 39 is believed to operate a significant cryptocurrency mining operation, which allows it to generate large quantities of Bitcoin and other cryptocurrencies. The organization is thought to use a network of servers located in China and other countries to conduct its mining activities.
2. Cryptocurrency theft: Room 39 is also believed to be involved in the theft of cryptocurrencies from exchanges and other targets. The organization is thought to use a network of hackers and intermediaries to steal the cryptocurrencies, which are then used to fund the North Korean regime’s military and nuclear programs.
3. Cryptocurrency laundering: Room 39 is also believed to be involved in the laundering of cryptocurrencies through a network of intermediaries and front companies. The organization is thought to use these intermediaries to convert the stolen cryptocurrencies into fiat currency, which can then be used to fund the regime’s activities.

One example of Room 39’s involvement in cryptocurrency-related activities is the 2018 theft of $530 million in cryptocurrencies from the Japanese exchange Coincheck. According to reports, the hackers responsible for the theft were linked to North Korea and may have been associated with Room 39. The stolen cryptocurrencies were likely used to fund the North Korean regime’s military and nuclear programs.

Overall, Room 39’s involvement in cryptocurrencies is part of a wider strategy to evade international sanctions and generate revenue for the North Korean regime. The use of cryptocurrencies allows the organization to operate outside of traditional financial channels and to conduct its activities with a high degree of anonymity and secrecy.

Significance

Room 39 is significant because it provides a vital source of income for the North Korean regime, which is subject to severe economic sanctions and trade restrictions. The organization is believed to generate billions of dollars in revenue each year, which is used to fund the regime’s military and nuclear programs, as well as to support the lavish lifestyle of its leaders.

The activities of Room 39 have also contributed to the isolation of North Korea from the international community, as many countries view the organization as a threat to global security and stability. The US and other countries have imposed sanctions on individuals and companies associated with Room 39, in an effort to curb its illegal activities and to pressure North Korea to abandon its nuclear and missile programs.

Despite these efforts, Room 39 continues to operate and to generate revenue for the North Korean regime. Its activities are likely to remain a challenge for the international community, as they represent a significant source of support for one of the world’s most repressive and isolated regimes.

Open Source Reporting:

There have been several reports in open-source media on Room 39 and its operations. For example:

• In 2017, the United Nations published a report that identified several companies and individuals involved in Room 39’s money laundering activities. The report found that these entities were using a network of shell companies and front companies to evade international sanctions and transfer funds to North Korea.
• In 2018, a report by The New York Times alleged that Room 39 was involved in the theft of $81 million from the Bangladesh Bank in 2016. The report suggested that North Korean hackers were behind the theft, and that Room 39 was involved in laundering the stolen funds.
• In 2019, The Wall Street Journal reported that North Korea was using its embassy in Berlin as a base for its illicit activities, including the smuggling of goods and the acquisition of technology for its nuclear and missile programs. The report cited unnamed Western officials who suggested that Room 39 was involved in the scheme.
• In 2020, the United Nations published a report that highlighted Room 39’s involvement in illicit activities. The report noted that the organization was involved in money laundering, counterfeiting, and smuggling, and had used a network of front companies to evade international sanctions. The report also suggested that Room 39 had been involved in the acquisition of luxury goods, which are subject to international restrictions.
• In 2021, The Diplomat published an article that detailed Room 39’s involvement in the smuggling of cigarettes. The article cited sources who suggested that the organization had been involved in the smuggling of cigarettes from China to North Korea, and had used the profits to fund its other illicit activities.
• In 2021, Radio Free Asia reported on Room 39’s involvement in the production of methamphetamine. The report cited unnamed sources who suggested that the organization had established several drug labs in North Korea, and was producing large quantities of methamphetamine for export.
• These and other reports indicate that Room 39 remains a significant source of revenue for the North Korean regime, and is involved in a wide range of illicit activities. The organization’s operations pose a significant challenge for the international community, as they contribute to the regime’s ability to pursue its nuclear and missile programs, and to maintain its grip on power. The continued reporting on Room 39 underscores the need for continued vigilance and enforcement measures to curtail its activities.

Krypt3ia generated this text with ChatGPT, OpenAI’s large-scale language-generation model. This author reviewed, edited, and revised the language to my own liking and takes ultimate responsibility for the content of this publication.

SARS-CoV-2 Lab Leak Intelligence Assessments

This article is part of an ongoing experiment with the use of ChatGPT for developing primers on cyber security topics.

As this is in the news this week, and Director Wray came out and spoke about it last night, I thought a little intelligence report generated by ChatGPT and a threat assessment might be fun. Personally, I have always held that the potential of the origin of SARS-CoV-2 was higher in this scenario than the wet market scenario due to several things.

Firstly, the virus seems to have been, for a zoonitc event, all too readily infectious for humans right from the start. While SARS virus’ are already seen in humans and of course SARS had an outbreak in China back in 2002, the impacts of that particular strain were not as massive as SARS-CoV-2. One of the primary reasons for that from my reading, has been the difference in the virus in Cov-2-19 is it’s ability to bond to the ACE2 within our systems and run rampant. It is also to be noted that the genetic structure of the virus does not rule out genetic manipulation, specifically, that of gain of fucntion research, which is what WIV had been working on.

Secondly, there were at least three emplyees of the WIV who got sick in November, just before the pandemic started in Wuhan, who may have in fact had Covid-19. Not much is known about these three people as the Chinese governmnet is not being transparent about them, but, it is quite the coincidence that these three lab workers got sick with an unknown disease, in November, and then the full outbreak of SARS-CoV-2 began in December, in Wuhan of all places.

Thirdly, the Chinese government has been very obtuse in cooperating with anyone about getting to patient zero in this pandemic and has actively blocked investigations. Of course, this is a tricky situation for any country, the epicenter of a pandemic, but China has really blocked so much of the potential truth that it cannot be dismissed. I am not saying in any way, that this was a deliberate release, or that this virus was being “weaponized” in a military program though. It is my contention, that they were doing gain of function work in efforts to understand how to counter such shifts in the SARS genome should it happen and create vaccines against it. It is just a matter of it walked out on someone’s shoe before they even had a chance to come up with a counter to the bug they had just souped up.

Added to this last set of facts, I also can easily see how the virus could have escaped from WIV due to reporting before the pandemic where the lab had been cited for poor security practices. This is also a known quantity that is not a slam dunk, but, if you take all of the known known’s and assess the situation before and after the initial beginnings of the pandemic, well, I can easily see my way to a low to a medium confidence theory on a lab leak being the possible caue of the pandemic writ large.

Anyway, here’s an assessment written by ChatGPT on this…

ChatGPT: Create an intelligence estimate of the lab leak theory for sars-cov-2 and cite data that backs up this theory

Executive Summary:

The theory that SAR-CoV-2 originated from the Wuhan Institute of Virology (WIV) through a laboratory accident remains inconclusive. While there is some circumstantial evidence to support this hypothesis, there is also evidence against it, and alternative explanations remain plausible. Further investigation is necessary to determine the virus’s origins and the role of the WIV, including tracing the early spread of the virus and studying its genetic makeup. The possibility of a laboratory accident cannot be completely ruled out, and the scientific community and policymakers must continue to take steps to ensure the safety of biosecurity labs and prevent future accidents.

Background:

The emergence of the novel coronavirus SAR-CoV-2 in late 2019 has led to intense speculation about its origins. One hypothesis is that it may have accidentally leaked from the WIV, a high-level biosecurity laboratory located in Wuhan, China. The lab is known for its research on bat coronaviruses and is part of China’s effort to become a world leader in virology research.

Intelligence Assessment:

1. Evidence supporting the lab leak theory:

There is some circumstantial evidence to support the theory that SAR-CoV-2 originated from the WIV through a laboratory accident. For example, the lab was conducting research on bat coronaviruses at the time of the outbreak, and there have been reports of lax safety protocols at the facility. In addition, some scientists have suggested that the virus’s genetic makeup is more consistent with laboratory manipulation than natural evolution. However, none of this evidence is conclusive, and alternative explanations remain plausible.

2. Evidence against the lab leak theory:

There is also evidence that contradicts the lab leak theory. For example, the virus’s genetic makeup closely resembles that of other bat coronaviruses found in the wild, suggesting a natural origin. In addition, many experts believe that the virus likely originated in a wet market in Wuhan, where the sale of live animals provided an opportunity for the virus to jump from animals to humans. Furthermore, some early cases of COVID-19 were traced back to individuals who had no connection to the WIV, further casting doubt on the lab leak theory.

3. Unanswered questions:

There are still many unanswered questions about the origins of SAR-CoV-2, and the possibility of a laboratory accident cannot be completely ruled out. Further investigation is necessary to determine the virus’s exact origins, including tracing its early spread in Wuhan and studying the genetic makeup of the virus. In addition, more information is needed about the safety protocols at the WIV and other biosecurity labs around the world.

4. Confidence in the intelligence assessment:

The level of confidence in the intelligence assessment varies depending on the specific evidence and alternative explanations. Overall, there is a medium level of confidence in the assessment due to the inconclusive nature of the evidence and the need for further investigation.

Conclusion:

The theory that SAR-CoV-2 originated from the WIV through a laboratory accident remains inconclusive. While there is some circumstantial evidence to support this hypothesis, there is also evidence against it, and alternative explanations remain plausible. Further investigation is necessary to determine the virus’s origins and the role of the WIV. The possibility of a laboratory accident cannot be completely ruled out, and the scientific community and policymakers must continue to take steps to ensure the safety of biosecurity labs and prevent future accidents. This includes increasing funding for biosafety research, strengthening regulations and oversight, and improving international cooperation to address global public health threats.

ChatGPT: Write a threat assessment remote on the hypothesis that the Wuhan virological lab was the source of an accidental leak of SAR-CoV-2

Threat Assessment Remote: Hypothesis of an Accidental Leak of SAR-CoV-2 from the Wuhan Virological Lab

Introduction:

Since the emergence of the novel coronavirus SAR-CoV-2 in late 2019, speculation has circulated around the origins of the virus. One hypothesis is that it accidentally leaked from the Wuhan Institute of Virology (WIV) in China. This assessment will consider the potential threats associated with this hypothesis.

Background:

The Wuhan Institute of Virology is a high-level biosecurity laboratory located in Wuhan, China. The lab is known for its research on bat coronaviruses and is part of China’s effort to become a world leader in virology research. According to some reports, the lab may have been conducting research on bat coronaviruses at the time of the outbreak.

Threat Assessment:

1. Public health threat:

If SAR-CoV-2 did originate from the Wuhan Virological Lab, the consequences of this accidental leak could have been catastrophic. The virus has caused a global pandemic, resulting in millions of deaths and widespread economic and social disruption. The risk of future pandemics originating from labs is a serious concern and could result in even more devastating outcomes.

2. Economic and geopolitical threat:

The potential for damage to global economies and international relations is significant. If it is found that the virus originated from the Wuhan lab, there may be calls for reparations or punitive measures against China, leading to economic and geopolitical tensions.

3. Threat to the credibility of biosafety protocols:

The safety of biosecurity labs is critical to preventing the accidental release of dangerous pathogens. If the hypothesis of an accidental leak from the Wuhan Virological Lab is proven to be true, it could damage the credibility of biosafety protocols and undermine public trust in the safety of such facilities.

4. Risk of future accidents:

The risk of future accidents is a concern. If it is found that the virus did indeed originate from the Wuhan lab, it may indicate that the current safety protocols are insufficient. This could lead to increased scrutiny and stricter regulations for biosecurity labs, potentially hampering their ability to conduct critical research.

Conclusion:

The hypothesis that SAR-CoV-2 originated from the Wuhan Virological Lab presents a number of potential threats, including public health, economic, geopolitical, and credibility risks. While investigations into the origins of the virus are ongoing, it is crucial that biosecurity labs adhere to the highest safety standards to prevent future accidents and ensure the safety of researchers and the public.

Krypt3ia generated this text with ChatGPT, OpenAI’s large-scale language-generation model. This author reviewed, edited, and revised the language to my own liking and takes ultimate responsibility for the content of this publication

Hypothesize on how threat intelligence analysis jobs will suffer with A.I. being deployed into SIEM and EDR systems

This article is part of an ongoing experiment with the use of ChatGPT for developing primers on cyber security topics.

One of the ruminations I have had since ChatGPT and AI became a reality for us all, has been humans place in the world once this technology has been eagerly applied to business by corporations. There has been of course, a lot of talking head cut lines out there in the blog and media sphere, but, I wanted to discuss this topic specific to an area I am familiar with. Primarily, the field of information security and in particular, the area of CTI (Cyber Threat Intelligence)

I was having a conversation with my mentee about the job search, and a dearth of positions for a younger person with only a few years of experience in the field as well as my travails in trying to land another position and got on the subject of A.I. I began to hypothesize on the near future, where the A.I. (generative and other) would no doubt, be implemented in the tools of the trade for hacking as well as blue team efforts including that of Threat Intelligence. What I eventually worked out was the notion, like many others out there making prognostications, was that once the technology is integrated more completely with ML, the role of a “Threat Analyst” may become not so much a single role, but, just a portion of a larger role for someone within a security group. As such, the potential for future CTI jobs may be less and less a position one can get.

If the combination of SIEM and EDR systems, both have an A.I. component, then, all of the large data (structured and now, even unstructured) could be sifted through and analysis carried out by an A.I. which then would only have to be told or automatically programmed to create threat analysis reports for all of the various consumers that the organization has dedicated to them, and emailed without human intervention once the maturity model is met.

The natural conclusion of the hypothesis for me, was that what we already see within the security world of contraction and the drive to get more with less (e.g. layoffs and seeing positions for single person catch all duties roles on req’s today) will be exacerbated when A.I. gets wider implementation in the CTI space. Corporations will always seek to spend less, and within the security space, which is always a cost center for corporations, if the A.I. is the panacea, and offered as a service by EDR and SIEM vendors, you can bet that positions will be eliminated just like in other spaces where robotics and A.I. become the go to for cost savings.

Just how long we have is a guess, but, I am going to make a stab at saying that in five years, this is likely to come to pass. So, just one more job that A.I. will likely subsume. Sure, there will have to be human hands involved for a while, but, eventually, the role of a CTI analyst will likely become less and less of a role companies will really need as a single function one that requires a dedicated employee. As the A.I. itself points out below, it will likely be, that we analysts will have to evolve to keep up with the A.I. and service it’s needs to create more components it can use, or create augmentations that, at present, would take human intervention.

…and that is some cost savings given the salaries out there.

Coincidently, this article was on Mastodon this morning as well… The Future of Network Security: Predictive Analytics and ML-Driven Solutions

ChatGPT: “Hypothesize on how threat intelligence analysis jobs will suffer with A.I. being deployed into SIEM and EDR systems”

With the deployment of AI into SIEM (Security Information and Event Management) and EDR (Endpoint Detection and Response) systems, it is likely that some aspects of threat intelligence analysis jobs will be affected. Here are a few potential hypotheses:

1. Increased Automation: The use of AI in SIEM and EDR systems could automate many routine tasks that are currently performed by threat intelligence analysts. For example, AI could be used to automatically categorize and prioritize alerts, reducing the amount of time analysts spend on these tasks. This could lead to a reduction in the number of entry-level threat intelligence analysis jobs.
2. Higher Accuracy: AI has the potential to improve the accuracy of threat detection and response, which could reduce the need for human intervention in some cases. However, it is important to note that AI is not infallible and will require ongoing human oversight and tuning to ensure it is effective.
3. Shift in Focus: As AI takes on more routine tasks, it is likely that threat intelligence analysts will need to shift their focus to more complex and strategic tasks. This could include analyzing trends and patterns in attack data, developing new detection strategies, and investigating new threats.
4. Need for Specialization: As AI becomes more prevalent in threat detection and response, there may be a growing need for analysts with specialized knowledge in areas such as AI algorithms, data analytics, and machine learning. This could lead to a shift away from generalist threat intelligence analysis roles towards more specialized positions.

With the increasing adoption of AI in SIEM and EDR systems, it is likely that some aspects of threat intelligence analysis jobs will be impacted. As AI becomes more sophisticated, it has the potential to automate routine tasks and improve the accuracy of threat detection and response, reducing the need for human intervention.

While this may lead to improved efficiency and cost savings for organizations, it could also result in the elimination of some threat intelligence analysis positions. This is particularly true in industries where security is viewed primarily as a cost center, and organizations may be more willing to replace human analysts with AI to reduce costs.

However, it is important to note that the deployment of AI in SIEM and EDR systems may also lead to new opportunities for threat intelligence analysts. As AI takes on more routine tasks, analysts may need to develop new skills and specialize in areas such as AI algorithms, data analytics, and machine learning. This could lead to the creation of new, more specialized roles that require a higher level of expertise.

Overall, the impact of AI on threat intelligence analysis jobs will depend on various factors, including the industry, the organization’s view on security, and the level of sophistication of the AI system. While some positions may be eliminated, the deployment of AI in SIEM and EDR systems may also create new opportunities for analysts with specialized skills. It will be important for organizations to balance the benefits of AI with the potential impact on their workforce and develop strategies for reskilling and upskilling their employees accordingly.

Krypt3ia generated this text with ChatGPT, OpenAI’s large-scale language-generation model. This author reviewed, edited, and revised the language to my own liking and takes ultimate responsibility for the content of this publication

Threat intelligence report on the various North Korean advanced persistent threat groups, who we know from open source intelligence they are composed of, and what activities they have carried out over the last five years.

This article is part of an ongoing experiment with the use of ChatGPT for developing primers on cyber security topics.

Threat Intelligence Report: North Korean Advanced Persistent Threat Groups

Executive Summary: North Korea is known for its active state-sponsored hacking groups that carry out cyber espionage and disruptive activities to further their strategic objectives. These Advanced Persistent Threat (APT) groups are known for their sophisticated tactics, techniques, and procedures (TTPs) to infiltrate targeted networks and steal data. This report provides an overview of the various North Korean APT groups, their composition, and the activities they have carried out over the last five years.

Background: North Korea’s regime has long recognized the importance of cyber warfare as a means of advancing its strategic interests. The country has been accused of orchestrating several high-profile cyber attacks, including the 2014 Sony Pictures hack and the 2017 WannaCry ransomware attack.

North Korean APT Groups: North Korea has a number of active APT groups that conduct cyber espionage and disruptive activities. The following are some of the most notable groups:

1. Lazarus Group: Lazarus is one of the most well-known North Korean APT groups and has been active since 2009. The group is believed to operate under the Reconnaissance General Bureau, North Korea’s primary intelligence agency. Lazarus Group has been linked to several high-profile cyber attacks, including the 2014 Sony Pictures hack and the 2017 WannaCry ransomware attack.
2. APT37: Also known as Reaper, APT37 is believed to be a sub-group of Lazarus Group. The group is known for its sophisticated malware and phishing campaigns and has targeted a range of sectors, including government, military, and the media.
3. APT38: APT38 is a North Korean hacking group that is believed to be responsible for cyber attacks on financial institutions around the world. The group is known for its advanced capabilities, including the ability to bypass two-factor authentication and other security measures.
4. Kimsuky: Kimsuky is a North Korean APT group that is believed to operate under the country’s military intelligence agency. The group is known for its spear-phishing campaigns targeting South Korean government agencies and the country’s military.

Activities over the last five years: Over the last five years, North Korean APT groups have been involved in a range of cyber attacks, including:

1. The 2014 Sony Pictures hack: Lazarus Group was linked to the attack, which resulted in the theft and release of sensitive data and caused significant damage to Sony Pictures’ reputation.
2. The 2016 Bangladesh Bank heist: APT38 was linked to the attack, which resulted in the theft of $81 million from the Bangladesh Bank’s account at the Federal Reserve Bank of New York.
3. The 2017 WannaCry ransomware attack: Lazarus Group was linked to the attack, which affected over 200,000 computers in 150 countries and caused widespread disruption.
4. The 2018 Pyeongchang Winter Olympics cyber attack: Kimsuky was linked to the attack, which targeted the email accounts of South Korean officials and organizations involved in the event.

Exposed Assets within DPRK Cyber Operations

North Korean state-sponsored hacking groups, also known as Advanced Persistent Threat (APT) groups, have been widely identified and studied by cybersecurity researchers over the years. These groups are believed to be operated by the North Korean government and are known for their sophisticated cyber espionage and cyber attack capabilities.

Here are some of the known names of operators within North Korean APT groups:

1. Lazarus Group: The Lazarus Group is perhaps the most well-known North Korean APT group, and has been active since at least 2009. It is believed to be responsible for a wide range of cyber attacks, including the infamous Sony Pictures hack in 2014 and the WannaCry ransomware attack in 2017. Some of the known Lazarus Group operators include Park Jin Hyok, who was indicted by the US Department of Justice in 2018 for his involvement in the Sony Pictures hack, and Kim Il, who is believed to be a key member of the group’s cyber espionage operations.
2. APT37: Also known as Reaper or Group123, APT37 is another North Korean APT group that has been active since at least 2012. It is known for its wide range of cyber attack capabilities, including espionage, data theft, and destructive attacks. Some of the known APT37 operators include Kim Hyon Woo and Jon Chang Hyok.
3. APT38: APT38 is believed to be a sub-group of the Lazarus Group, focused specifically on financial gain through cyber attacks. It is known for its involvement in a number of high-profile attacks against banks and financial institutions, including the theft of $81 million from the Bangladesh Bank in 2016. Some of the known APT38 operators include Park Jin Hyok and Kim Su Jin.
4. APT27: Also known as Emissary Panda, APT27 is believed to be a Chinese-speaking North Korean APT group that has been active since at least 2010. It is known for its cyber espionage and data theft capabilities, and has been linked to attacks against government agencies, defense contractors, and other high-value targets. Some of the known APT27 operators include Zhang Xiao and Zhu Qiang.
5. APT10: APT10, also known as Stone Panda, is another Chinese-speaking APT group that is believed to have close ties to North Korea. It is known for its cyber espionage and data theft capabilities, and has been linked to attacks against government agencies, defense contractors, and other high-value targets. Some of the known APT10 operators include Zhang Zhang-Gui and Tan Daijing.

It is important to note that these are just some of the known names of operators within North Korean APT groups, and that these groups are constantly evolving and changing their tactics and techniques. Cybersecurity researchers and law enforcement agencies around the world continue to monitor these groups closely in order to better understand their capabilities and prevent their attacks.

TTP’s and IOC’s,and Campaigns by DPRK OPS

North Korean Advanced Persistent Threat (APT) groups have been actively engaged in cyber espionage and cyber attack campaigns for many years. These groups are known for their sophisticated Tactics, Techniques, and Procedures (TTPs), which they use to compromise networks, steal data, and conduct other malicious activities. In this report, we will discuss some of the key TTPs, Indicators of Compromise (IOCs), and campaigns associated with North Korean APT groups.

Tactics, Techniques, and Procedures (TTPs):

1. Social Engineering: North Korean APT groups often use social engineering tactics to trick users into installing malware or providing sensitive information. This includes spear-phishing emails and fake social media profiles.
2. Malware: North Korean APT groups develop and use a wide range of malware, including Remote Access Trojans (RATs), Keyloggers, and data exfiltration tools. They often customize their malware for specific targets to avoid detection.
3. Exploits: North Korean APT groups actively search for vulnerabilities in software and operating systems that they can exploit to gain access to target networks. They have been known to use exploits for zero-day vulnerabilities to remain undetected.
4. Encryption: North Korean APT groups often use encryption to protect their malware and data exfiltration activities. They may also use steganography to hide malware within benign-looking files.

Indicators of Compromise (IOCs):

1. IP addresses: North Korean APT groups often use IP addresses associated with their attacks. Some of the well-known IP addresses used by these groups include 175.45.176.0/22 and 210.52.109.0/24.
2. Domains: North Korean APT groups often register domains that are similar to legitimate websites in order to trick users. Some of the known domains used by these groups include dc56wd4z2f4q3vix.onion and gosmail[.]co.
3. Malware signatures: Researchers have identified a range of malware signatures associated with North Korean APT groups. Some of the well-known malware signatures include “Freenki” and “SiliVaccine.”
4. Command and Control (C2) infrastructure: North Korean APT groups often use unique C2 infrastructure to communicate with their malware. This includes custom protocols and communication channels.

Campaigns:

1. Operation AppleJeus: This campaign was carried out by the Lazarus Group and involved the creation of a fake cryptocurrency trading application called Celas Trade Pro. The malware used in this campaign was designed to steal cryptocurrency from users of the fake application.
2. Operation GhostSecret: This campaign involved the use of malware designed to steal sensitive data from a wide range of industries, including healthcare, telecommunications, and finance. The malware used in this campaign was linked to the APT37 group.
3. Operation Sharpshooter: This campaign was carried out by the Lazarus Group and involved the use of a new malware called “Rising Sun.” The malware was designed to steal sensitive data from military and government organizations in the US and Europe.
4. Operation North Star: This campaign was carried out by the APT38 group and involved the use of malware to steal millions of dollars from financial institutions in countries including South Korea and India.

Malware Groups

North Korean Advanced Persistent Threat (APT) groups have been developing and using a wide range of malware for many years. This malware is used to conduct cyber espionage, cyber attacks, and other malicious activities. In this report, we will discuss some of the known North Korean malware and the APT groups that are associated with them.

1. Destover: This malware was used in the 2014 Sony Pictures hack and was attributed to the Lazarus Group. Destover is a wiper malware that is designed to delete files and overwrite the master boot record of infected systems.
2. Joanap: This malware was attributed to the Bluenoroff group and was used in a range of attacks against South Korean targets. Joanap is a Remote Access Trojan (RAT) that is capable of executing commands on infected systems, stealing data, and conducting reconnaissance activities.
3. Brambul: This malware is associated with the APT38 group and is used to conduct SMB brute-force attacks. Brambul is designed to infect vulnerable Windows systems and use brute-force attacks to gain access to network shares.
4. WannaCry: This ransomware attack occurred in 2017 and was attributed to the Lazarus Group. WannaCry was designed to exploit a vulnerability in the Windows operating system and encrypt files on infected systems, demanding a ransom for their release.
5. Andariel: This malware is associated with the APT37 group and is designed to steal cryptocurrency. Andariel is capable of stealing credentials, executing commands, and exfiltrating data from infected systems.
6. ELECTRICFISH: This malware is associated with the Hidden Cobra group and is used to create a tunnel for exfiltrating data from infected systems. ELECTRICFISH is capable of bypassing firewalls and other security measures to exfiltrate data to command and control (C2) servers.
7. KEYMARBLE: This malware is associated with the Kimsuky group and is designed to steal data from infected systems. KEYMARBLE is capable of stealing passwords, executing commands, and exfiltrating data to C2 servers.
8. SILENTTRINITY: This malware is associated with the APT10 group and is a modular backdoor that can be customized for specific attacks. SILENTTRINITY is capable of executing commands, stealing data, and conducting reconnaissance activities on infected systems.

Conclusion: North Korean APT groups continue to pose a significant threat to global security and stability. Their sophisticated tactics, techniques, and procedures (TTPs) make them difficult to detect and mitigate. To mitigate the risk of North Korean cyber attacks, it is essential for countries and organizations to invest in better cybersecurity measures, share threat intelligence, and adopt a proactive approach to cyber defense.

Krypt3ia generated this text with ChatGPT, OpenAI’s large-scale language-generation model. This author reviewed, edited, and revised the language to my own liking and takes ultimate responsibility for the content of this blog

How Threat Intelligence Will Leverage A.I.

Written by ChatGPT at my prompt.

Threat intelligence is a critical component of cybersecurity, providing organizations with the information they need to defend against cyber threats. Traditionally, threat intelligence has been a manual process, with analysts gathering and analyzing data to identify threats. However, the use of artificial intelligence (AI) has the potential to revolutionize threat intelligence by automating the process of identifying and responding to threats. In this article, we will explore in-depth how AI will leverage threat intelligence and how long it may be until it is fully implemented.

How AI Will Leverage Threat Intelligence

AI can be used in various ways to leverage threat intelligence. One of the most significant advantages of AI is that it can analyze vast amounts of data in real-time, allowing it to identify threats quickly and efficiently. By analyzing network traffic, user behavior, and other indicators of compromise, AI algorithms can identify threats that may go unnoticed by human analysts.

AI can also be used to automate the process of threat analysis and response. For example, AI algorithms can be used to monitor network traffic and detect anomalous behavior. If a threat is detected, the AI system can automatically respond by blocking the threat, isolating infected systems, or alerting security personnel. This can significantly reduce the time it takes to respond to threats, minimizing the impact of an attack.

Moreover, AI can help organizations prioritize their response to the most critical threats. For instance, by analyzing the behavior and tactics of known threat actors, AI can identify patterns and signatures that indicate the likelihood of an imminent attack. This way, organizations can prioritize their defenses and prepare for the most severe threats that pose the greatest risk to their operations.

Finally, AI-powered threat intelligence can help organizations stay ahead of emerging threats. With the ever-evolving threat landscape, AI can help organizations detect new types of attacks and respond proactively to potential vulnerabilities in their networks.

How Long Will It Be Until AI-Powered Threat Intelligence Is Fully Implemented?

The use of AI in threat intelligence is already happening, with many organizations using AI-powered threat intelligence platforms to detect and respond to threats. However, the implementation of AI-powered threat intelligence is not without its challenges.

One of the biggest challenges of implementing AI-powered threat intelligence is the need for large amounts of high-quality data. AI algorithms rely on large datasets to train their models and identify patterns. Organizations that lack high-quality data may find it challenging to implement AI-powered threat intelligence effectively. Therefore, organizations must prioritize data quality and develop strategies for collecting and processing large datasets effectively.

Another challenge of implementing AI-powered threat intelligence is the need for skilled personnel. AI algorithms may be able to identify threats automatically, but they still require human oversight to ensure that the system is functioning correctly. Organizations will need skilled personnel who understand AI and threat intelligence to implement and manage AI-powered threat intelligence systems effectively. The shortage of skilled cybersecurity professionals is a significant challenge, and organizations must invest in upskilling their existing workforce or recruit new talent to address this gap.

Finally, the cost of implementing AI-powered threat intelligence can be significant. AI-powered threat intelligence systems require significant investment in hardware, software, and personnel. Organizations will need to evaluate the cost-benefit of implementing AI-powered threat intelligence carefully. They must assess the potential risks and benefits of implementing AI and make informed decisions that align with their business objectives.

Conclusion

The use of AI in threat intelligence has the potential to revolutionize cybersecurity. AI algorithms can analyze vast amounts of data, detect threats in real-time, and automate threat response. Moreover, AI-powered threat intelligence can help organizations prioritize their defenses and stay ahead of emerging threats. However, the implementation of AI-powered threat intelligence is not without its challenges. Organizations must prioritize data quality, invest in upskilling their workforce, and evaluate the cost-benefit of implementing AI carefully. Despite these challenges, the benefits of AI-powered threat

The Pivot: Nuke To Cyber

Sitting here monitoring the situation, with the activation of the nuclear ready forces in Russia by Putin, I had to game things out a bit and wanted to share.

Short of a tactical nuclear strike, and then escalation, Putin may turn to the cyber arena instead come Tomorrow or later this week in reprisal for his being cut off from SWIFT, as well as other pressures that are coming to bear today. In the last few minutes, I have also seen Sweden sending lethal aid as well as other warfare equipment, Switzerland freezing Russian assets, British Petroleum pull out of Rosneft, and others around the globe starting to make Putin and Russia a pariah state.

These actions, mostly financial, are already wreaking havoc on his economy, but the more of them that come to play, the more cut off he will be to even prosecute his war…. Except maybe his cyber, war. Which brings me to the point. Come Monday, we may see reprisal attacks that generally, will not be considered, or haven’t been in the past, as reasons for kinetic responses.

As such, expect that soon we may see DDoS attacks on financial infrastructure, Ransomware attacks, Wiper attacks, and general detonation of malware. If you are in the FI space as a defender, get ready. If not, be aware that all of these actions could have effects on your business and your personal lives.

Be ready.

K.

Pandemic Threat Intelligence and Response Briefing For Executives: Planning For INFOSEC/Supply Chain/Continuity

Johns Hopkins COVID-19 Heat Map Tracking

Threat Intel:

SARS-CoV-2 has been exponentially spreading within the global community and the effects of the virus and its attendant disease (COVID-19) are rapidly causing shocks within the global community. The affects of the pandemic are far reaching, we have seen the strain on the global supply chain as China fell into the height of the pandemic with supply chains being diminished or broken outright. As such, as the virus spreads, it is important to consider the threat space to the security and function of your organization due to loss of these supply chains as well as work forces within and without. As the spread of this disease continues, expect more supply chain degradation if not complete failures for some amount of time as the quarantines commence and play out.

As such, here are some basic questions to consider for your organizations security and continuity both as a whole and as separate functions such as the security of your networks. Use this document to spark discussions around the security response as well as the larger continuity and integrity of the whole as we are affected by this pandemic. These scenarios may not actually come to pass, but, as a security body, it is our job to forecast eventualities and the responses to them that might be needed to continue the function of the org.

Executive Briefing:

With the outbreak of SARS-CoV-2 and it’s resultant COVID-19 (syndrome from infection) we have been seeing the arc of this outbreak becoming a global pandemic. With that in mind, it is advantageous to start planning for the effects from this pandemic on the businesses that you are responsible for. In this assessment, we will be taking a look primarily at the CIA Triad of the response but not just on a data security level, but, at an expanded outlook on the security, continuity, and supply chains that make up the the CIA triad. All of these affect the security of your organizations as well as the basic functionality of your business.

With this in mind, it is important to look to the effects of the pandemic projecting out from initial outbreak to pandemic globally and how that will affect your business. Primarily the effects can be broken down into these discreet areas of concern:

1. Supply chains: What supply chains will be affected that will impact your business model?

• • Human capital, how many people does it take to function properly if the work force is down from COVID-19
    • What are your tolerances on head count?
    • What contingencies do you have if work force is depleted due to sickness and quarantine?
    • Where are your single points of failure in the knowledge base were these assets to be sick and quarantined?

• • Supplies on demand that go into making your product; How much tolerance do you have for supply chains breaking?
    • What regions do your supplies come from?
    • Are they affected now?
    • Plan for pandemic loss of work forces and how long you can function without supplies or with less

2.) Infrastructure Capacities: What tolerance does your network have to expanded remote working capabilities?

• • With a workforce that may be in social isolation mode, what is the capacity for your company to allow people to work from home?
    • People will self quarantine if they become ill
    • Children may be home as schools and day care shut down in order to prevent spread of disease
    • The state and federal government may recommend that people stay home and isolate to stop spread
    • In a protracted scenario of isolation and potential re-infection, what are your projections on your organizations ability to function?

3.)  Information Security Events and Response: With a global pandemic, the same draw down on work forces will also apply to MSP’s (SOC) workers as well

• • With automation today much of the function of a SIEM/SOC is canned response, but, there is always a need for human intervention, who handles your response?
    • During the time of pandemic and response, if your team is depleted due to sickness or quarantine procedures, what is your contingency for response?
    • During the time of pandemic and response, the same applies to your SIEM/SOC solutions that you pay for if you do not have it in house, what is their contingency?
    • If you have a true incident in your environment, how will you handle it if the primary incident handlers are unavailable?
    • Do you have a service you work with?

All of these questions should be addressed going into an event like the one that is playing out globally with the SARS-CoV-2 (COVID-19) pandemic today. It is recommended that the executive suite be briefed on these questions and assure that these possible eventualities can be answered by the organization to insure the continuity of the org. Other elements of this narrative also come to bear on scenarios in others areas such as infrastructure, and overall output of whatever your organizations products are, but these are a good set of questions for the security element to bring to the executive suite to have the initial discussions.

As such, use this document accordingly.

PDF format of this post here

Ryuk Ransomware Threat Intel Report

I cobbled together some stuff on Ryuk in case you all want to have a report you can re-purpose.

K…

PDF is here

 

 

 

Ryuk Ransomware Threat Intelligence Report

1/4/2019

Table of Contents

Executive Summary: 2

Recommendations: 3

Technical Details: 3

IOC’s: 5

Appendix: 13

1. 1. Executive Summary:

The Ryuk variant of ransomware is a new type of ransomware that first appeared in August 2018 and has been used since then in an targeted attack scheme by unknown actors online. The evolution of the attack has taken shape to mimic some of the attack methodologies used by the SAMSAM group (Iran) in locating vulnerable enterprises/organizations through reconnaissance and phishing to then gain a foothold in as a first phase of their attack.

The Ryuk actors then escalate the incursion by loading the ransomware (Ryuk) onto servers in the enterprise and thus locking that business down completely from daily business. The attacks have been seen recently (Dec/January 2018-2019) in attacks against publishing and media corporations such as the LA Times, Chicago Times (Tribune Group) as well as DataResolution Cloud Service. The financial damages to those companies has yet to be determined but due to the attack on the Tribune group, printing of newspapers was degraded or stopped for a time.

The Ryuk actor group uses two probable means to gaining access to internal networks:

1) phishing to infect systems with EMOTET (trojan variant using PowerShell via doc files that use macros to start ps.exe) and then pivot laterally to gain more access.

2) Locating vulnerable systems online using Shodan and other tools to find open RDP sessions and exploits them to escalate the attack.

In both attack vectors the second stage of the attack is to use the access gained to recon the org to locate systems (servers) to infect with Ryuk. The Ryuk infection will then encrypt all data, delete shadow copies and leave a message that the systems have been encrypted and where to send bitcoins.

The malware campaign to date (Aug 2018 to today) has accrued approximately $2,680,077.93 in bitcoin transfers from affected organizations. The average demand for money per each attack, is per the organizations tolerances judged by the actors estimate of what they can afford. This method is a lot like the SAMSAM group.

1. 3. Recommendations:

Threat intelligence on the malware and the tactics of the group provide the following recommendations for response to this threat:

• Put all IOC’s into HIDS/NIDS

• Block known C2’s

• Assess for vulnerable RDP sessions to the internet (Shodan)

• Block all hashes and C2’s for EMOTET campaigns

• Be aware of ps.exe (powershell) sessions going to the internet

1. 4. Technical Details:

The malware immediately begins by shutting down A/V systems and specifically SOPHOS and McAfee as well as other processes focusing not only on A/V but backup programs. Early Virus Total assessments as well as Hybrid Analysis online show some signs that the actors had tested early versions of the malware and that it had been detected by SOPHOS and McAfee.

Strings:

stop “Enterprise Client Service” /y

stop “Sophos AutoUpdate Service” /y

stop “Sophos Clean Service” /y

stop “Sophos Device Control Service” /y

stop “Sophos File Scanner Service” /y

stop “Sophos Health Service” /y

stop “Sophos Safestore Service” /y

stop “Sophos System Protection Service” /y

stop “Sophos Web Control Service” /y

stop “SQLsafe Backup Service” /y

stop “SQLsafe Filter Service” /y

stop “Veeam Backup Catalog Data Service” /y

stop “Zoolz 2 Service” /y

stop Antivirus /y

stop BackupExecAgentAccelerator /y

stop BackupExecAgentBrowser /y

stop BackupExecDeviceMediaService /y

stop BackupExecJobEngine /y

stop BackupExecManagementService /y

stop BackupExecRPCService /y

stop BackupExecVSSProvider /y

stop EhttpSrv /y

stop EPSecurityService /y

stop EPUpdateService /y

stop MBAMService /y

stop McAfeeEngineService /y

stop McAfeeFramework /y

stop McAfeeFrameworkMcAfeeFramework /y

stop MSSQL$BKUPEXEC /y

stop MSSQLServerOLAPService /y

stop ntrtscan /y

stop PDVFSService /y

stop ReportServer /y

stop ReportServer$SQL_2008 /y

stop ReportServer$SYSTEM_BGC /y

stop ReportServer$TPS /y

stop ReportServer$TPSAMA /y

stop SAVAdminService /y

stop SAVService /y

stop SepMasterService /y

stop Smcinst /y

stop SmcService /y

stop SMTPSvc /y

stop SntpService /y

stop SQLAgent$BKUPEXEC /y

stop SQLAgent$CITRIX_METAFRAME /y

stop SQLSafeOLRService /y

stop swi_service /y

stop tmlisten /y

stop TrueKey /y

stop TrueKeyScheduler /y

stop TrueKeyServiceHelper /y

stop VeeamDeploymentService /y

stop VeeamTransportSvc /y

TerminateProcess

Currently a high number of A/V client engines now see the Ryuk malware by hashes. It is assumed that the actor may in fact re-pack the malware to avoid such detection’s if not upgrade functionality to have a wider ability to succeed and avoid HIDS/NIDS detection as well.

The malware also requires ADMIN to perform all it’s functions. This need for ADMIN is the reason that Ryuk is a second stage and not a one and done attack. EMOTET infections attain the ADMIN level access and allow the actors to recon the enterprise and determine where to attack as well as what they can access to load Ryuk and encrypt files.

1. 5. IOC’s:

IP(s) / Hostname(s)

• 104.199.153[.]189

• 104.239.157[.]210

• 187.17.111[.]103

• 195.20.45[.]185

• 200.98.255[.]192

• 23.253.126[.]58

• 68.168.222[.]206

• 89.119.67[.]154

URLs

• bedava-chat[.]com

• bestinfo[.]vv[.]si

• digiturk[.]adsl[.]com[.]tr

• freshmirza[.]tk

• ibrahimreb[.]com

• infocommsystems[.]com

• jaragroup[.]com[.]ar

• klkjwre9fqwieluoi[.]info

• kukutrustnet777[.]info

• kukutrustnet777888[.]info

• kukutrustnet888[.]info

• kukutrustnet987[.]info

• lavanyacreation[.]com

• natufarma[.]net

• radiantjewelcraft[.]com

• sets-hm[.]tk

• veddagroup[.]twomini[.]com

Associated-file-path:

• C:\Users\Public\cjoZX[.]exe

• C:\Users\Public\window[.]bat

Associated-email-addresses:

• WayneEvenson@tutanota[.]com

• WayneEvenson@protonmail[.]com

• stevkramer@protonmail.com

• johnfraz@protonmail.com

• stevkramer@tutanota.com

• johnfraz@tutanota.com

• kurtschweickardt@protonmail.com

• kurtschweickardt@tutanota.com

• wayneevenson@protonmail.com

• wayneevenson@tutanota.com

• steveedelman@protonmail.com

• steveedelman@tutanota.com

• andymitton@protonmail.com

• andymitton@tutanota.com

• kaykienzler@protonmail.com

• bennidiez@protonmail.com

• kaykienzler@tutanota.com

• bennidiez@tutanota.com

• dustinloose@protonmail.com

• dustinloose@tutanota.com

• AdamasVorms@tutanota.com

• AdamasVorms@protonmail.com

• RcsonanaGemmaran@tutanota.com

• RcsonanaGemmaran@protonmail.com

• dfvdc@protonmail.com

• khgvkh@tutanota.com

• yu66MarsellBlan@protonmail.com

• yu66MafrsellBlan@tutanota.com

• BruceSmithh@protonmail.com

• BruceSmithh@tutanota.com

• vejoydyLunde@tutanota.com

• vejoydyLunde@protonmail.com

• RichardsonStan@tutanota.com

• RichardsonStan@protonmail.com

• WillysFranks@tutanota.com

• WillysFrank@protonmail.com

• KangCheonSoo@tutanota.com

• KangCheonSo@protonmail.com

• RaulDrake@protonmail.com

• kaidrake@tutanota.com

• fgbfs@protonmail.com

• fgbf@tutanota.com

• ElaineDeaVille@tutanota.com

• ElaineDeaVille@protonmail.com

• TinaHahn@tutanota.com

• TinaHahn@protonmail.com

• ChrisJohnes@protonmail.com

• ChrisJohnes@tutanota.com

• DeborahPATINO@tutanota.com

• DeborahPATINO@protonmail.com

• CristopherBrandstrom@protonmail.com

• CristopherBrandstrom@tutanota.com

• DANIELEdEBLOIS@tutanota.com

• DANIELEdEBLOIS@protonmail.com

• petterSpurier@protonmail.com

• petterSpurier@tutanota.com

• arWalagnCuad@tutanota.com

• arWalanCuad@protonmail.com

• degrv@tutanota.com

• fhnf@protonmail.com

• taigrizalsec1973@protonmail.com

• arturDale@tutanota.com

• CamdenScott@protonmail.com

• eliasmarco@tutanota.com

• MelisaPeterman@protonmail.com

• MelisaPeterman@tutanota.com

Associated-bitcoin-address:

• 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

• 1L9fYHJJxeLMD2yyhh1cMFU2EWF5ihgAmJ

• 1KURvApbe1yC7qYxkkkvtdZ7hrNjdp18sQ

• 15RLWdVnY5n1n7mTvU1zjg67wt86dhYqNj

• 1LKULheYnNtJXgQNWMo24MeLrBBCouECH7

• 1CN2iQbBikFK9jM34Nb3WLx5DCenQLnbXp

• 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

• 15FC73BdkpDMUWmxo7e7gtLRtM8gQgXyb4

• 1NQ42zc51stA4WAVkUK8uqFAjo1DbWv4Kz

• 1EoyVz2tbGXWL1sLZuCnSX72eR7Ju6qohH

• 1K6MBjz79QqfLBN7XBnwxCJb8DYUmmDWAt

• 1ChnbV4Rt7nsb5acw5YfYyvBFDj1RXcVQu

• 162DVnddxsbXeVgdCy66RxEPADPETBGVBR

• 12N7W9ycLhuck9Q2wT8E6BaN6XzZ4DMLau

• 1C8n86EEttnDjNKM9Tjm7QNVgwGBncQhDs

• 18eu6KrFgzv8yTMVvKJkRM3YBAyHLonk5G

• 19AE1YN6Jo8ognKdJQ3xeQQL1mSZyX16op

• 1NMgARKzfaDExDSEsNijeT3QWbvTF7FXxS

• 12UbZzhJrdDvdyv9NdCox1Zj1FAQ5onwx3

• 1KUbXkjDZL6HC3Er34HwJiQUAE9H81Wcsr

• 13rTF3AYsf8xEdafUMT5W1E5Ab2aqPhkPi

• 1Kx9TT76PHwk8sw7Ur6PsMWyEtaogX7wWY

• 12vsQry1XrPjPCaH8gWzDJeYT7dhTmpcjL

• 1ET85GTps8eFbgF1MvVhFVZQeNp2a6LeGw

• 1FtQnqvjxEK5GJD9PthHM4MtdmkAeTeoRt

• 1Kx9TT76PHwk8sw7Ur6PsMWyEtaogX7wWY

Malware Hash (MD5/SHA1/SH256)

• c0202cf6aeab8437c638533d14563d35

• d348f536e214a47655af387408b4fca5

• 958c594909933d4c82e93c22850194aa

• 86c314bc2dc37ba84f7364acd5108c2b

• 29340643ca2e6677c19e1d3bf351d654

• cb0c1248d3899358a375888bb4e8f3fe

• 1354ac0d5be0c8d03f4e3aba78d2223e

• 5ac0f050f93f86e69026faea1fbb4450

• 1b465c0e12523747f892b48fa92a30f82e5027199a2aff06587c5269bd99f69a

• 3c8531fc54eca31a79a23bf16d4f528067c89a5e58e1e745a2c5b1b05140f5a8

• 95b228b664dca2e18935444c67c7c7dbda9da7450a18d429cb04f7e311af5fe9

• 46fb27f4cff2d33baae3b1c199797d1f0929bc03166cebd092081e4fe2f9ea6e

• 8d50d9fe17eb36edc9945a2673c1594f58a6e653f5a794058ee42e46d24d83d7

• f21f222d8f62f2223faec375e834efb76f96b73ef70e0ef09024586cf9eef638

• b7e945a8dafc91ebe8c8717ee3107498afc1ad5461599611d2fb07aaa7700aa1

• 88d491bb73d509aacca103919d3a7418f9c6b611ce7dc453e1cacffed9c0f0d5

• 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28

• aacfc3e386ed12082923d03fa1120d5fa6bf7b8655ba77e04b96a45434fa9a83

• 235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac

• 7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20

• 9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17

• 695a716f2c43a69bdd03e74058fa23fb77e596bb4f1f3a021d529c85e9564f7d

• 6eca3f416a08fde6688250dbd4ba4dfaa3df95a5d26b6d978dfbd67fbd159619

• 965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26

• 8d3f68b16f0710f858d8c1d2c699260e6f43161a5510abb0e7ba567bd72c965b

• 3012f472969327d5f8c9dac63b8ea9c5cb0de002d16c120a6bba4685120f58b4

• b8e463789a076b16a90d1aae73cea9d3880ac0ead1fd16587b8cd79e37a1a3d8

• 9b86a50b36aea5cc4cb60573a3660cf799a9ec1f69a3d4572d3dc277361a0ad2

• 113af75f13547be184822f1268f984b79f35965a1b1f963d23b50a09741b0aec

• 1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56

• c51024bb119211c335f95e731cfa9a744fcdb645a57d35fb379d01b7dbdd098e

Dropped Files:

details

“gimap.jar” has type “data”

“org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar” has type “data”

“Download_on_the_App_Store_Badge_fr_135x40.svg” has type “data”

“PIXEL.INF” has type “data”

“close.svg” has type “data”

“com.jrockit.mc.components.ui.ja_5.5.1.172852.jar” has type “data”

“org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar” has type “data”

“javaws.jar” has type “data”

“org-netbeans-modules-options-api.jar” has type “8086 relocatable (Microsoft)”

“org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar” has type “data”

“ADEBASE.MSI” has type “data”

“org-netbeans-core-io-ui_zh_CN.jar” has type “data”

“org.eclipse.help.ui_4.0.100.v20140401-0608.jar” has type “data”

“VeriSign_Class_3_Code_Signing_2001-4_CA.cer” has type “data”

“org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar” has type “data”

“org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar” has type “data”

“com.jrockit.mc.browser.ja_5.5.1.172852.jar” has type “data”

“org-openide-loaders_zh_CN.jar” has type “data”

“com-sun-tools-visualvm-host-remote_zh_CN.jar” has type “data”

“org-netbeans-modules-queries.jar” has type “data”

source: Extracted File

Virus Total Assessments:

• https://www.virustotal.com/#/file/1b465c0e12523747f892b48fa92a30f82e5027199a2aff06587c5269bd99f69a/detection

• https://www.virustotal.com/#/file/3c8531fc54eca31a79a23bf16d4f528067c89a5e58e1e745a2c5b1b05140f5a8/detection

• https://www.virustotal.com/#/file/95b228b664dca2e18935444c67c7c7dbda9da7450a18d429cb04f7e311af5fe9/detection

• https://www.virustotal.com/#/file/46fb27f4cff2d33baae3b1c199797d1f0929bc03166cebd092081e4fe2f9ea6e/detection

• https://www.virustotal.com/#/file/f21f222d8f62f2223faec375e834efb76f96b73ef70e0ef09024586cf9eef638/detection

• https://www.virustotal.com/#/file/b7e945a8dafc91ebe8c8717ee3107498afc1ad5461599611d2fb07aaa7700aa1/detection

• https://www.virustotal.com/#/file/88d491bb73d509aacca103919d3a7418f9c6b611ce7dc453e1cacffed9c0f0d5/detection

• https://www.virustotal.com/#/file/5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28/detection

• https://www.virustotal.com/#/file/aacfc3e386ed12082923d03fa1120d5fa6bf7b8655ba77e04b96a45434fa9a83/detection

• https://www.virustotal.com/#/file/235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac/detection

• https://www.virustotal.com/#/file/7c1e0597dd5a1e2d48c9cede54843aa7c299f7404630b5a2aafac2eec7358b20/detection

• https://www.virustotal.com/#/file/9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17/detection

• https://www.virustotal.com/#/file/695a716f2c43a69bdd03e74058fa23fb77e596bb4f1f3a021d529c85e9564f7d/detection

• https://www.virustotal.com/#/file/6eca3f416a08fde6688250dbd4ba4dfaa3df95a5d26b6d978dfbd67fbd159619/detection

• https://www.virustotal.com/#/file/965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26/detection

• https://www.virustotal.com/#/file/8d3f68b16f0710f858d8c1d2c699260e6f43161a5510abb0e7ba567bd72c965b/detection

• https://www.virustotal.com/#/file/3012f472969327d5f8c9dac63b8ea9c5cb0de002d16c120a6bba4685120f58b4/detection

• https://www.virustotal.com/#/file/b8e463789a076b16a90d1aae73cea9d3880ac0ead1fd16587b8cd79e37a1a3d8/detection

• https://www.virustotal.com/#/file/9b86a50b36aea5cc4cb60573a3660cf799a9ec1f69a3d4572d3dc277361a0ad2/detection

• https://www.virustotal.com/#/file/113af75f13547be184822f1268f984b79f35965a1b1f963d23b50a09741b0aec/detection

• https://www.virustotal.com/#/file/1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56/detection

• https://www.virustotal.com/#/file/c51024bb119211c335f95e731cfa9a744fcdb645a57d35fb379d01b7dbdd098e/detection

Hybrid Analysis Assessments:

• https://www.hybrid-analysis.com/sample/1b465c0e12523747f892b48fa92a30f82e5027199a2aff06587c5269bd99f69a?environmentId=120

• https://www.hybrid-analysis.com/sample/8d3f68b16f0710f858d8c1d2c699260e6f43161a5510abb0e7ba567bd72c965b?environmentId=120

• https://www.hybrid-analysis.com/sample/3012f472969327d5f8c9dac63b8ea9c5cb0de002d16c120a6bba4685120f58b4?environmentId=120

1. 6. Appendix:

URL’s:

https://www.bleepingcomputer.com/news/security/ryuk-ransomware-involved-in-cyberattack-stopping-newspaper-distribution/

https://niiconsulting.com/Security_Advisories/Security_Advisory_Digest_Aug_2018_Edition_2.0.pdf

https://www.bleepingcomputer.com/news/security/ryuk-ransomware-crew-makes-640-000-in-recent-activity-surge/

https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-2019-threat-report.pdf

https://resources.malwarebytes.com/files/2018/12/Malwarebytes-Labs-Under-The-Radar-APAC-1.pdf

https://research.checkpoint.com/wp-content/uploads/2018/08/Threat_Intelligence_News_2018-08-27.pdf

https://krebsonsecurity.com/2019/01/cloud-hosting-provider-dataresolution-net-battling-christmas-eve-ransomware-attack/

https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27951/en_US/McAfee%20Labs%20Threat%20Advisory%20-%20Ransom-Ryuk_v2.pdf

http://www.rewterz.com/rewterz-news/rewterz-threat-advisory-ryuk-evolves-as-a-new-targeted-ransomware

https://www.cyber.nj.gov/threat-profiles/ransomware-variants/ryuk

https://www.maltiverse.com/sample/8d3f68b16f0710f858d8c1d2c699260e6f43161a5510abb0e7ba567bd72c965b

Leaderless Jihad and Open Source Jihad: A Marriage Made In Hell.

In 2013 I wrote about leaderless jihad and the “Stand Alone Complex” Now we are seeing this type of leaderless, “inspired by” thought virus playing itself out on the national stage. Last nights attack using a lorrie was something that was presaged by two issues of Inspire Magazine back in 2010 and 2014. There isn’t much to it really to gather some weapons, steal a truck, and then plow it into a crowd but it has taken this long for the insidious idea to take root in the collective unconscious of the would be jihadi’s. The days of a more rigid and trained “jihad” are being eclipsed by would be unbalanced individuals seeking attention and reinforcement of their sick ideas through the media, the internet, and our collective inability to look away from a tragic scene on a glowing screen.

2014 Inspire

 

2010 Inspire 2 “Ultimate Mowing Machine”

 

Soft targets were always the preferred avenue of attack but now they are becoming seen as a top priority for security forces since the attacks in France and other places like Bangladesh. While Dahka on the face of it had a contingent of more trained individuals the attack last night is as simplistic as they come. This is what is really scaring the populace and the security services because now it seems that the authors and actors of these acts are in fact just one guy and not a cabal that they could perhaps track using pervasive surveillance. A cell of one is hard to track and certainly if they self radicalize by just downloading Inspire magazine and watching YouTube, well, what can one do? There are no easy answers here in the world of detection and prevention.

So here we have it, I have been pointing this out for a while and at first it was AQAP trying to inspire “OSJ” or Open Source Jihad. Now Dabiq and Da’esh are carrying it on and furthering it with the media zeitgeist that ensues with each attack. The net effect here is that these people are selfradicalizing with the help of the media’s obsession on covering ad nauseum these acts. The pervasive hand wringing and talking heads only serve to whet the appetite of the would be jihobbyist into action. Forget the Inspire magazines and the videos, just watch CNN and that is enough it seems. This all is very much like the plot line to “The Laughing Man” arc of Ghost In The Shell. An act carried out on the media instilled others to carry out like acts to be on the media and further the idea(l) as well as serve as a means to self fulfil the actors need for attention and satisfaction.

This is pure psychology at work and there are a host of reasons and syndromes that could likely be pointed at to rationalize it’s happening. The fact of the matter is that now we are seeing it play out rather bloodily on the streets of the world in furtherance of an idea and ideal set that lends itself to the like minded.. Or should I say mentally ill? Yes, I would say mentally ill. These actors are acting out and likely have some borderline tendencies to start with. These people feel outcast in their societies or out of place within the societies they are living in as a second generation citizen. It is a complex thing to nail down and I suggest that anyone who might want to delve into it further read “Leaderless Jihad” by Marc Sageman.

We need a more nuanced approach to the GWOT and I am afraid we won’t get that…

K.

 

Much Ado About Nothing: Team System DZ and Defacements

Recently there was a spate of defacements by Team System DZ that has been making the rounds in the mainstream media. These defacements by Poti-SaDZ or Poti Sad Darky and his derpy bandito boyz using daesh symbols and poorly written rhetoric are nothing to write home about yet the media spins their skiddie exploits into media gold. Well I am here to set the record straight with you all. Poti, or Ahmed Saoudi is just a derpy kid in Algeria with nothing better to do than deface sites with others tools. He, and they, are just looking for the lowest of low hanging fruit to garner some attention for themselves. In fact, Poti here has some poor OPSEC as do many of his derpy little pals as you can see below.

In the first picture there you see his folders as he is running a tutorial on uber lee7 h4x0ring in winderz. The second picture is one of more than a few where he fails to engage his proxy and the handy little task bar there on the browser gives his home IP address(s) 41.100.113.208 and 41.100.76.152 respectively over time. Poti in fact logs in to the Team System DZ Facebook account without proxy a couple times and is likely unable to easily get on there because of issues with proxies, since ya know Zucky don’t play privacy.

Anyway, the IP space is for the following in Algeria:

IP address: 41.100.113.208
inetnum:        41.100.0.0 – 41.100.255.255
netname:        RegChlef
descr:          region chlef
country:        DZ
admin-c:        SD6-AFRINIC
tech-c:         SD6-AFRINIC
status:         ASSIGNED PA
mnt-by:         DJAWEB-MNT
source:         AFRINIC # Filtered
parent:         41.96.0.0 – 41.111.255.255

person:         Security Departement
address:        Alger
phone:          +21321911224
fax-no:         +21321911208
nic-hdl:        SD6-AFRINIC
source:         AFRINIC # Filtered

Other Data:

Poti-Sadz aka PoTi SaD DaRkY
https://www.youtube.com/channel/UCnHsj8Q7xOgTGSB9S-6mZdA
https://plus.google.com/116132926353763071423/posts/MsJWpbiRn8Q
youtube.com/user/ahmedsaoudik/playlists … ahmedsaoudik
http://video.exstrim-bog.ru/author/ahmedsaoudik

Skype: poti_sad-dz

There are a lot of Ahmed Saoudi’s in the skype phone book as well but only a couple list Algeria as his location and one of them has 1992 attached to the name. So, 2015 – 1992 = 23 which would be a prime age range for this kind of stupid kid activity no?

Skype: ahmed.saoudi1992

Give em a shout and see! Look, what I am saying here is that in looking at these guys I would have to say that the are not the daesh A-Team of hacking. I would also say that perhaps they could be behind the last derpy Googling of some military names and posting a hitlist online thing. That there was also something that the media went nova on and in reality “no va” is really more appropriate.

HOLY WTF PEOPLE! CUT THIS SHIT OUT!

Anywho, I just thought I would dump this little OSINT OPSEC FAILTACULAR on you all.

Enjoy the lulz…

K.