Podcasts

Two Chinese APT groups coordinated cyberattacks against ASEAN-affiliated entities to coincide with the ASEAN-Australia Special Summit in March 2024, while leaked documents from Chinese contractor iSoon revealed that the Tianfu Cup hacking contest feeds zero-day exploits directly to China’s Ministry of Public Security.

Stories Covered

Mustang Panda and Earth Krahang Target ASEAN Nations with DLL-Sideloading Malware Packages

Palo Alto Networks Unit 42 documented coordinated campaigns by two China-linked APT groups against entities affiliated with the Association of Southeast Asian Nations (ASEAN). Mustang Panda — also tracked as Stately Taurus, Camaro Dragon, and Earth Preta — created two malware packages timed to the ASEAN-Australia Special Summit (March 4–6, 2024), targeting entities in Myanmar, the Philippines, Japan, and Singapore via phishing emails. The first package, TalkingPointsForChina.zip, contained a renamed legitimate executable: TalkingPointsForChina.exe was actually a signed copy of KeyScrambler.exe, an anti-keylogging tool developed by QFX Software. Threat actors exploit signed legitimate binaries for the trust factor — an executable signed by a known software company bypasses casual inspection and some endpoint defenses. Executing it sideloaded a malicious DLL (KeyScrambler.ie.dll), which decrypted shellcode assessed as PlugX malware and established persistence via an auto-run registry entry. The second package, note_pso.scr (a screensaver executable), targeted an entity in Myanmar — with “PSO” likely referencing Personal Staff Officer, a rank in the Myanmar military. This package downloaded a renamed copy of EA Core Server (signed by Electronic Arts) as WindowsUpdate.exe, paired with a malicious sideloaded eacore.dll that replaced the legitimate supporting library. Both packages exploit the same technique: a signed, trusted executable loads a malicious DLL through sideloading, which then pulls additional payloads into memory.

DLL sideloading works by placing a malicious DLL in the same directory as a legitimate executable that loads supporting libraries by name rather than by verified path. When the signed program launches, it loads the attacker’s DLL instead of the real one, executing the malicious code under the cover of a trusted process. This approach reduces detection friction: the parent process is signed, the file on disk looks legitimate at a glance, and the actual payload often runs only in memory. Phishing remains the preferred delivery mechanism because it eliminates the need to burn a zero-day against patched infrastructure — a single click from a targeted user provides the entry point. The timing of malware package creation (March 4–5) precisely overlapping the summit dates suggests deliberate operational planning around geopolitically significant events where ASEAN government personnel would be exchanging relevant documents.

A second unnamed Chinese APT cluster (attributed by infrastructure overlap to attacks originating in Cambodia) was also observed targeting ASEAN-affiliated entities. This group, tracked as Earth Krahang and active since early 2022, specializes in using compromised government infrastructure as an attack platform — proxying attack traffic through government servers, hosting malicious payloads, and sending spear-phishing emails from legitimately compromised government email accounts. Once inside a network, Earth Krahang builds VPN servers on compromised public-facing hosts to tunnel into private networks and conducts brute-force attacks on email credentials for exfiltration. Attribution to the same national-state actor was made via shared C2 infrastructure: when malware from two different campaigns reaches out to the same command-and-control servers, that overlap ties the operations together regardless of the targeting differences.

iSoon Leak Exposes China’s Cyber-Contractor Ecosystem and Tianfu Cup as Zero-Day Pipeline

Documents leaked on GitHub from Chinese contractor iSoon (also known as Anxun) provided rare public visibility into how China structures and outsources its state cyber operations. The documents showed that iSoon sells a portfolio of offensive tools — including the ShadowPad RAT and Winnti (also called Treadstone) — to multiple Chinese government entities. The model mirrors a commercial software supply chain: the government does not build or maintain these tools in-house but purchases capabilities from private firms that specialize in developing and maintaining them. The contractors operate like digital private military companies — some had been implicated in prior campaigns including the 2019 Poison Carp operation against Tibetan groups and a 2022 breach of Com 100. What the documents also revealed is that some of these firms conduct attacks independently without explicit government instruction, hoping that a successful operation will attract a paying government customer. This creates an uncontrolled layer in the offensive ecosystem: contractors acting on their own initiative may inadvertently burn ongoing government APT operations by triggering detections at targets already silently compromised by a different group.

The most structurally significant detail in the leaked documents concerns the Tianfu Cup, China’s state-run equivalent of Pwn2Own. Where Pwn2Own is a commercial hacking contest where researchers submit exploits to vendors who pay bounties and patch the vulnerabilities, the Tianfu Cup feeds in the opposite direction: when submissions include full exploit chains, China’s Ministry of Public Security receives the proof-of-concept code and disseminates it to private firms for further development and deployment. The contest functions as a pipeline that converts competitive hacking research into government-stockpiled zero-days rather than vendor patches. By contrast, Pwn2Own 2024 paid $200,000 for a Tesla hack, $130,000 for a VMware Workstation guest-to-host escape, and $60,000 each for Chrome and Safari exploits — all of which go to vendors for remediation. The structural difference is consequential: one system converts discovered vulnerabilities into patches; the other converts them into weapons. The iSoon leak makes clear that China’s offensive cyber capacity is not purely internal — it is an ecosystem of contractors, mercenaries, and competition-fed exploit pipelines operating in parallel with and sometimes independently from state APT groups.

Listen to the Episode

Change Healthcare reportedly paid Black Cat (ALPHV) a $22 million ransom in early March 2024 — and the ransomware group promptly exit-scammed its own affiliates, seized the full payment, posted a fake FBI seizure notice, and put its source code up for sale, leaving 4 terabytes of stolen patient and insurance data still in criminal hands.

Stories Covered

Black Cat Exit-Scams Its Own Affiliates After $22M Change Healthcare Ransom Payment

Change Healthcare, a technology subsidiary of UnitedHealth Group that processes prescription drug transactions for hospitals and pharmacies nationwide, was hit by Black Cat (ALPHV) ransomware on February 23, 2024. The attack took down the systems that pharmacies use to verify insurance eligibility and process claims, meaning patients at the pharmacy counter either could not fill prescriptions or were forced to pay full out-of-pocket costs for medications their insurance would normally cover. The disruption cascaded through the healthcare supply chain for weeks. On or around March 1st, a Bitcoin address security researchers had already mapped to Black Cat received a single transaction of approximately $22 million — consistent with a ransom payment. On March 3rd, a Black Cat affiliate posted on the Russian-language ransomware forum RAMP claiming to be the individual who had provided Black Cat with initial access to Change Healthcare’s network. The affiliate’s complaint: Black Cat had received the $22 million, frozen the affiliate’s account, and refused to pay out the commission that was owed.

Black Cat operates as a ransomware-as-a-service collective. Affiliates — independent operators who find and breach targets — earn commissions ranging from 60 to 90 percent of any ransom paid. The core Black Cat administrators provide the ransomware infrastructure, encryption tooling, negotiation support, and leak site; affiliates bring the intrusions. In this case, the affiliate claimed they were owed a multi-million-dollar cut of the $22M payment and received nothing. The affiliate warned on RAMP that they still possessed four terabytes of data stolen from Change Healthcare’s network, including records tied to Medicare, CVS Caremark, HealthNet, and MetLife. They explicitly threatened to leak the data independently if Black Cat didn’t pay and warned other ransomware operators to stop working with ALPHV. The stolen data pool covering major insurance networks and pharmacy partners represents substantial personal health information, insurance records, and financial data at scale.

Following the affiliate complaint, Black Cat’s leak site went dark and the group posted what appeared to be an FBI seizure banner — the same type of notice that appeared when law enforcement seized Black Cat’s infrastructure in December 2023. Security researchers, including Fabian Wosar of Emsisoft, quickly identified the notice as a copy-paste job from the earlier real seizure, not an authentic law enforcement action. The FBI did not confirm any new action against Black Cat. Simultaneously, Black Cat announced it was selling its ransomware source code for $5 million. Wosar stated publicly that Black Cat was exit-scamming its affiliates — a deliberate final move to extract maximum cash before shutting down the brand. By withholding commissions from multiple affiliates at once and disappearing with the accumulated ransoms, the Black Cat administrators essentially robbed the people they had relied on to run their criminal enterprise. The December 2023 FBI operation had already compromised Black Cat’s infrastructure; the group rebuilt and continued operating, but its position as the dominant ransomware actor after LockBit 3.0’s takedown apparently made it a priority target, and the administrators appear to have decided to cash out before law enforcement closed in again.

Several dynamics worth noting. Paying the ransom did not end Change Healthcare’s exposure — it funded the criminal enterprise while leaving the stolen data in the hands of a disgruntled affiliate who was never paid and had every incentive to leak or re-extort. This outcome recurs: ransomware payment does not guarantee data deletion, because the operators and affiliates are not bound by the same agreement and have competing financial interests. The affiliate structure that makes ransomware-as-a-service scalable also makes it unstable — when the administrators steal the ransom from the people who executed the attack, those affiliates still have the data and the access logs and no reason for loyalty. The takeaway for organizations is that payment creates a second exposure problem rather than ending the first one. Separately, analysts noted a possible additional explanation: that Russian government pressure may have directed Black Cat’s administrators to pivot capabilities toward Ukraine-related operations and wind down the commercial ransomware operation, though the source code sale and affiliate exit scam pattern is more consistent with a financial grab than a state-directed shutdown.

Listen to the Episode

Black Cat (ALPHV) ransomware struck Change Healthcare — the largest prescription payment processor in the US — in late February 2024, disrupting prescription drug access at more than 70,000 pharmacies nationwide and claiming to have stolen 6 terabytes of data including records tied to TRICARE, Medicare, CVS Caremark, and other major insurance and healthcare networks.

Stories Covered

Black Cat Ransomware Hits Change Healthcare, Knocking Out Prescription Processing Nationwide

Change Healthcare, a technology subsidiary of UnitedHealth Group, is the backend infrastructure that pharmacies use to transmit insurance claims and verify patient coverage before dispensing prescriptions. When a patient goes to a pharmacy, the system communicates with their insurer to confirm eligibility, calculate copays and coinsurance, and authorize the transaction — a process most people never see because it happens in seconds. On approximately February 20, 2024, Black Cat (ALPHV) ransomware operators gained access to Change Healthcare’s systems and took them offline. The disruption cascaded immediately: CVS, Walgreens, and pharmacy chains across the country reported they could not transmit insurance claims, leaving patients either unable to fill prescriptions or forced to pay full out-of-pocket costs that can run into hundreds or thousands of dollars for medications their insurance would normally cover. The American Pharmacists Association reported significant backlogs of prescriptions at pharmacies nationwide. Optum, the UnitedHealth subsidiary that owns Change Healthcare, acknowledged the outage and said it was working to restore systems. Mandiant — Google’s cybersecurity incident response division — was engaged to handle the investigation.

Black Cat publicly claimed responsibility on its dark web leak site, directly contradicting UnitedHealth Group’s early SEC filing that attributed the breach to a suspected nation-state actor. Security analysts pushed back on that characterization immediately — ALPHV is a financially motivated ransomware-as-a-service operation with no known nation-state affiliation. The group claimed to have exfiltrated more than six terabytes of data from Change Healthcare’s production network, describing it as highly selective data covering all Change Health clients with sensitive data being processed by the company. The claimed stolen dataset included source code for Change Healthcare solutions, records tied to the US military’s TRICARE healthcare program, Medicare, CVS Caremark, health insurance providers, and personal identifying information for patients across the network. Change Healthcare processes payments for over 70,000 pharmacies and is used by more than 1.6 million physicians, 8,000 hospitals, and other care facilities. The scale of the potential data exposure — across military personnel, Medicare beneficiaries, and commercial insurance customers — represents a significant long-tail risk for phishing and identity fraud well beyond the immediate service disruption.

The attack came after Black Cat’s December 2023 takedown by FBI-led international law enforcement, which seized the group’s infrastructure and hundreds of decryption keys. The group rebuilt, increased affiliate commissions to as high as 90 percent, and explicitly removed prior restrictions against targeting hospitals and healthcare providers — language that had been in place partly to avoid attracting law enforcement attention to critical infrastructure attacks. The FBI, CISA, and the Department of Health and Human Services issued a joint advisory warning that Black Cat affiliates had been primarily targeting US healthcare organizations since mid-December 2023. The advisory noted that healthcare is a particularly attractive target: large volumes of sensitive data, significant revenue, and widely documented use of outdated infrastructure — some hospital systems still run equipment on Windows XP-era operating systems. FBI tracking placed Black Cat behind over 60 breaches in its first four months of operation and estimated the gang collected at least $300 million in ransoms from more than 1,000 victims through September 2023. The US government had separately announced rewards of up to $10 million for information leading to the identification or location of Black Cat leadership. The Change Healthcare attack signaled that the December takedown had not meaningfully degraded Black Cat’s operational capacity — it had accelerated their targeting of exactly the sector most likely to cause public harm.

Listen to the Episode

Operation Kronos — a joint operation by the UK National Crime Agency, FBI, Europol, and partners across more than ten countries — dismantled LockBit ransomware’s infrastructure in February 2024, seizing 34 servers and more than 200 cryptocurrency accounts and arresting members in Ukraine and Poland, targeting a group that controlled roughly 25% of the global ransomware market.

Stories Covered

Operation Kronos Seizes LockBit’s Infrastructure and Turns Its Own Website Against It

LockBit was not simply one of the larger ransomware groups — it held an estimated 25% of the ransomware market, a share so dominant that no other group came close in the double digits. The US alone documented more than 1,700 victim organizations spanning financial services, food production, schools, transportation, and government. Analysts described it as the Walmart of ransomware: politically neutral, operationally disciplined, and run like a business optimizing for maximum return. LockBit pioneered the ransomware-as-a-service model at scale — affiliates would gain initial access to target networks, deploy LockBit’s tooling to encrypt data and exfiltrate it, and split the ransom with LockBit operators. The gang had accumulated enough operational history that it openly operated a dark web leak site displaying countdown timers next to victim names: when the clock hit zero, stolen data would be published unless the ransom was paid. The site was updated nearly daily.

On February 19, 2024, authorities from the UK NCA, FBI, US Department of Justice, Europol, and agencies in France, Japan, Switzerland, Canada, Australia, Sweden, the Netherlands, Finland, and Germany announced they had disrupted LockBit’s core infrastructure under Operation Kronos. Law enforcement seized servers running in the Netherlands, Germany, Finland, France, Switzerland, Australia, the US, and the UK — 34 servers total across the affiliate and operator network. More than 200 cryptocurrency accounts linked to the gang were frozen. The FBI also obtained decryption keys and made them available to LockBit victims to recover encrypted data without paying a ransom. Two Russian nationals were charged with deploying LockBit ransomware tools against companies worldwide. The most tactically pointed move: law enforcement took control of LockBit’s own dark web website and used it against the group — replacing the gang’s victim gallery with a message reading, “We have source code, details of the victims you have attacked, the amount of money extorted, the data stolen, chats, and much, much more.” The site then displayed countdown timers — LockBit’s own signature tactic — pointing to a scheduled disclosure of the gang’s internal data rather than victim data.

LockBit’s operators posted on an encrypted messaging app claiming their PHP-based servers had been targeted but that backup servers without PHP remained unaffected. Security researchers from VX Underground shared screenshots confirming the affiliate control panel had been replaced by the law enforcement message. The FBI did not immediately confirm or deny the backup server claim. LockBit had been discovered in 2020 when its malware first appeared on Russian-language cybercrime forums; despite this, the group publicly claimed to be apolitical and located in the Netherlands, motivated purely by financial return. By September 2023, the group had collected at least $300 million in ransoms from more than 1,000 victims. Operation Kronos represented a rare multi-continent coordinated action of sufficient scale to match what LockBit had built — a point that itself illustrates how significant the threat had become before law enforcement moved.

Father-Son Duo Arrested in Ukraine, Warsaw Member Identified in Poland

On February 21, 2024, Ukrainian police announced the arrest of a father and son in Ternopil, western Ukraine, both of whom were identified as LockBit affiliates. The pair had carried out attacks targeting government institutions and corporations in France. Mobile phones and computer equipment used in the attacks were seized. Their arrest came as part of Operation Kronos and was carried out with assistance from a French cyber police unit — France had been a driving force behind the operation after opening its own LockBit investigation in 2020. By the time of the takedown, France had recorded more than 200 LockBit victims within its borders, including hospitals, municipal governments, and businesses. In January 2022, LockBit had publicly claimed on its leak site to have breached French entities — a provocation that accelerated French law enforcement’s push for coordinated international action. In Poland, a 38-year-old Warsaw man was identified and arrested as a LockBit gang member, also with assistance from French cyber police units.

The arrests illustrated how Operation Kronos extended beyond seizing infrastructure to actively targeting the affiliate layer — the operators who did the actual intrusions and ransomware deployments on behalf of LockBit’s core. This matters because ransomware-as-a-service operations are distributed by design: taking down central infrastructure degrades capability, but affiliates with their own access and tooling can rebuild or migrate to a competing platform. The seizure of 200+ cryptocurrency accounts across the network complicated the financial picture for any surviving affiliates. The broader question left open was whether the core LockBit developers — the people who built and maintained the encryption tooling — were among those arrested or whether only affiliates and lower-level members had been taken. If the technical core survived, a rebuild was possible. If not, other ransomware groups — Black Cat being the next largest — would absorb displaced affiliates and market share, though likely with increased caution given the heat Operation Kronos demonstrated law enforcement could bring.

Listen to the Episode

Microsoft and OpenAI jointly disclosed that five nation-state APT groups from Russia, China, Iran, and North Korea had been actively using large language models for offensive cyber operations — from scripting and phishing content to satellite protocol research and CVE analysis — before OpenAI shut down all their accounts.

Stories Covered

Russia, China, Iran, and North Korea APTs Caught Using OpenAI for Cyber Operations

A joint blog post from Microsoft and OpenAI documented five major threat actor clusters — all aligned with nation-state sponsors — using OpenAI’s large language models to enhance offensive cyber operations. After identifying the accounts, OpenAI terminated all of them. The disclosure is notable not because the techniques involved were novel, but because it confirms that nation-state actors are integrating commercial AI into their existing workflows the same way legitimate organizations are: as a productivity accelerator. Microsoft explicitly noted that none of the observed LLM abuse had produced particularly novel or unique attack techniques — these actors were not using AI to discover new attack categories, but to do existing work faster and at better scale.

Forest Blizzard, the GRU-affiliated Russian military unit also known as Fancy Bear and linked to hacks of the Democratic National Committee and Ukrainian military targets, was using LLMs for basic scripting tasks, file manipulation, data selection, and multi-processing, as well as intelligence gathering on satellite communication protocols and radar imaging technologies — capabilities directly relevant to the ongoing war in Ukraine. Two Chinese APT groups were also identified. Charcoal Typhoon (also tracked as APT40 and Aquatic Panda) used LLMs for both pre-compromise and post-compromise tasks: gathering information about specific technologies and vulnerabilities, generating and refining scripts, producing social engineering content in multiple translated languages, and querying for guidance on achieving deeper system access after initial compromise. Salmon Typhoon used OpenAI primarily as an intelligence tool — sourcing publicly available information on high-profile individuals, intelligence agencies, and geopolitical matters — while also attempting, largely without success, to get help writing malicious code and researching stealth tactics. OpenAI’s content policies have progressively restricted responses to requests for explicit malware assistance, so Salmon Typhoon’s attempts to use it that way hit those guardrails repeatedly.

Iran’s Crimson Sandstorm (also known as Imperial Kitten and Tortoiseshell) was using LLMs to develop phishing email content — drafting messages impersonating an international development agency and a feminist advocacy group — as well as generating code for web scraping and task automation, and using ChatGPT as a translation tool to craft convincing lure content in multiple languages. North Korea’s Emerald Sleet (also tracked as Kimsuky) was using LLMs for basic scripting, phishing content generation, and researching publicly available information about CVEs, nuclear weapons experts, think tanks, and government organizations working on defense and nonproliferation. Like the others, Emerald Sleet was using AI as a faster, more interactive search engine for targeting research rather than as a code generation engine for novel attack tooling.

The pattern across all five groups is consistent: LLMs being used as productivity tools that accelerate existing tradecraft rather than enabling entirely new attack categories. An experienced threat actor who would spend three days researching satellite communication protocols can now do it in hours. A group that would take weeks to translate phishing lures across five languages can do it in an afternoon. A developer translating malware from C++ to Golang — a language with historically lower antivirus detection rates because fewer samples exist — can use an LLM to accelerate that translation without needing deep expertise in the target language. None of this is science fiction; all of it represents meaningful operational improvement for groups that already have the underlying capability. The more plausible near-term concern is malware that incorporates on-device AI processing — leveraging the tensor processing units and dedicated AI cores now shipping in consumer hardware from Apple, Google, and others — to enable adaptive behavior that evades signature detection. That capability does not exist in deployed malware today, but the hardware prerequisites are proliferating rapidly.

Listen to the Episode

Two stories this episode: a cyberattack on Fulton County, Georgia knocked out power, courts, tax processing, and phone services for the entire county government, while a critical Jenkins vulnerability (CVE-2024-23897) left 45,000 internet-exposed instances open to arbitrary file read and potential remote code execution after proof-of-concept exploit code went public.

Stories Covered

Cyberattack on Fulton County, Georgia Takes Down Courts, Tax Systems, and Phone Service

Fulton County, Georgia — home to Atlanta and one of the most populous counties in the southeastern United States — suffered a cyberattack in late January 2024 that knocked out county government infrastructure across multiple critical functions. Court filings, tax processing, the court system website, and county phone and internet service all went offline. Power outages compounded the disruption. County commissioner Rob Pitts stated that preliminary investigation did not indicate any transfer of sensitive citizen or employee data, but acknowledged the breach had caused significant operational disruption with no firm timeline for restoration. The incident was still developing at air time and no threat actor had been identified. The impact illustrated the cascading effect of a single breach on a government entity that provides interconnected services: when court systems, communications infrastructure, and tax processing all run through shared network infrastructure, a single point of compromise can halt the entire operation simultaneously.

Local and county governments are among the most chronically under-resourced targets in the threat landscape. The attack surface is large — court systems, utilities, emergency services, tax administration, and permit processing all require network connectivity and increasingly run on internet-facing infrastructure — while the cybersecurity budget and staffing at most county governments is a fraction of what comparably scaled private organizations maintain. The result is that a county government is simultaneously a high-value target (access to citizen records, legal proceedings, financial data) and a soft target (older systems, deferred patching, limited incident response capability). When a nation-state or sophisticated ransomware operation targets county infrastructure, it is effectively pitting the resources of an entire government or criminal enterprise against an entity whose IT department may consist of a handful of people. The Fulton County attack follows a broader pattern of critical infrastructure intrusions: water treatment plants, power infrastructure, pipeline operators, and government systems have all seen targeted intrusions in recent years. The consistent thread is that internet connectivity has been extended to infrastructure that was not designed with internet-scale threat models in mind, without proportionate investment in the defenses that connectivity requires.

Jenkins CVE-2024-23897: 45,000 Unpatched Servers Exposed to File Read and Potential RCE

Jenkins — the widely used open-source CI/CD automation platform — disclosed CVE-2024-23897 on January 24, 2024, a critical arbitrary file read vulnerability in the Jenkins built-in command line interface (CLI). The flaw allows an unauthenticated or low-privileged attacker to read arbitrary files from the Jenkins server filesystem, including credential files, secrets, and signing keys that the Jenkins process has access to. Depending on configuration, the vulnerability can be chained into remote code execution: if an attacker can also upload a file to the server (through any available mechanism) and then trigger execution via the read path, they can achieve RCE. The Jenkins security team released a patched version on the same day as disclosure and advised that organizations unable to patch immediately should disable the Jenkins CLI as a workaround.

By January 29th — five days after the patch release — the nonprofit threat monitoring organization Shadow Server reported approximately 45,000 internet-exposed Jenkins instances still running the unpatched version, with nearly 12,000 of those located in the United States. China had a comparable number of exposed systems. Proof-of-concept exploit code had already been published publicly, meaning any attacker with basic capability could target the 45,000 unpatched systems without needing to independently develop an exploit. Jenkins is used heavily in software development pipelines across enterprise, government, and startup environments — a compromised Jenkins server typically has access to source code repositories, build artifacts, deployment credentials, cloud provider keys, and production signing certificates. An arbitrary file read on a Jenkins instance is therefore not just a server compromise; it is a potential stepping stone into the entire software supply chain that Jenkins serves. Patch immediately, or disable the CLI as an interim measure until patching is possible.

Listen to the Episode