Marcus Hutchins

Me explaining to AI dudes that cybersecurity ≠ vulnerability management and that the majority of cyberattacks involve exactly zero vulnerabilities

I live walking distance from the banana stand and very disappointed to learn that there's no banana stand or any money in it 🥲

So, this oversized baby isn't you?

When I think of highly effective autonomous attacks, I don't think of anything from the AI era. I think of Emotet. I'd argue it was the pinnacle of sophistication for at-scale financially-motivated malware operations. The malware lands on a corporate endpoint, immediately exfiltrates the victim's SMTP (email) credentials, as well as their email inbox. Their inbox gets sent to the threat actor's backend processing pipeline, which scrapes the victim's inbox for email threads where the last reply was by someone other than the victim. The pipeline then crafts a reply to the email thread containing a backdoored Microsoft Office document, which is usually presented as an invoice or something time-sensitive that the target is likely to open. The emails were then farmed out to the infected systems, and sent using legitimate stolen SMTP credentials. The use of legit credentials + corporate systems as spam bots bypassed SPF / DKIM, and IP based spam blocklists, ensuring the email was highly likely to land in the target's inbox, not get blocked or sent to spam. The recipient receives an email from a party they know, trust, have had previous communications with, and is in reply to an existing email exchange between the target and victim. Basically email worm meets extremely effective spearphishing at scale. They say you don't gotta hand it to them, but you kinda do. The engineering that went into this botnet's infrastructure was incredible. The pipeline had a polymorphic engine that would rewrite the malware's code every time antivirus vendors tried to add detections for it. It put plenty of state-sponsored malware operations to shame. The malware was so effective that 8 different countries banded together to stop it. They hacked into the command-and-control infrastructure, then used the malware's self-update command to push out code that removed the malware from the system and then deletes itself. It set precedent for governments being able to, in extreme circumstances, mass-hack victim systems and deploy code designed to disinfect said systems. Previously, there was only law enforcement precedent for triggering the malware's built in remove command, displaying warning messages, or simply just seizing / hijacking the control infrastructure. The botnet had been running for about 12 years when it was taken out in 2021. They just don't make malware like they used to. Everything from the post AI-era is borderline slop and I'm bored out of my mind analyzing it. The below image is what the Microsoft Office documents the target received would look like. Clicking the "Enable Content" button runs the malware.

Quite the community you have. Looks like everyone left yo ass to hold their bags.

I know people tend to just like/retweet and move on, but can I please get some more comments. The average IQ down here is like 3 rn. Bud got triggered because I used the term "we" in a post and he couldn't figure out who "we" is (it's my company, easily discoverable via Google).

Compromise developers via contagious interview -> if they maintain any public developer tooling, backdoor it -> compromise even more developers -> rinse and repeat youtu.be/EMldOiiG1Ko

Sup?

lol, two for one special. ✅ the hackers got into the network via phishing ✅ the company’s internal AI tooling helped the hackers accomplish their goal

Would you look at that. Binance was hacked via phishing (Contagious Interview), not zero-day exploits written by abliterated AI models. Exactly as I predicted. I may shitpost a lot, but I do actually know some things about some stuff.