The discourse surrounding ransomware takes center stage as we engage with investigative journalist Geoff White, whose extensive research delves into the notorious Conti Ransomware gang. This episode elucidates the profound implications of ransomware attacks, which have escalated beyond mere data encryption to encompass severe extortion tactics that threaten the integrity of personal and organizational data alike. White articulates the critical need for public awareness regarding the mechanisms and repercussions of ransomware, especially in light of recent high-profile attacks that have reverberated across various sectors in the United Kingdom.

Furthermore, we explore the intricate dynamics of cybercrime, including the intersection of state-sponsored hacking and organized crime, revealing how these elements coexist and influence one another. In shedding light on the inner workings of the Conti gang, we aim to equip our listeners with the knowledge necessary to navigate this complex and evolving threat landscape effectively. The exploration of ransomware, particularly through the lens of the Conti Ransomware gang, presents a multifaceted narrative that delves into the complexities of modern cybercrime. Investigative journalist Geoff White, known for his extensive work in exposing organized crime and technology intersections, articulates the profound implications of ransomware on both corporate and individual levels.

This episode sheds light on the alarming trend where ransomware has transitioned from mere data encryption to more sophisticated extortion tactics. The discussion is framed within the context of recent high-profile attacks on major UK entities, illustrating how these breaches have penetrated public awareness and sparked discourse on cybersecurity. White elucidates the significance of the unprecedented leak of 300,000 internal messages from the Conti gang, offering a rare insight into their operational mechanics and ethical considerations. This leak has unveiled not only their technical strategies but also the internal debates regarding the morality of targeting critical sectors such as healthcare. Such discussions prompt critical reflections on the broader ethical landscape of ransomware, as victims often grapple with the decision to pay ransoms to recover vital data, raising questions about the ramifications of empowering criminal enterprises.

The conversation further enriches the understanding of ransomware's intertwining with traditional organized crime, showcasing how the financial flows from ransomware operations can fuel various illicit activities. White and host Joe Carson emphasize the necessity of enhancing public awareness and education on these issues, advocating for proactive measures that would empower individuals and organizations alike to recognize and combat ransomware threats. As ransomware evolves, the episode serves as a crucial reminder of the collective responsibility to foster a more informed society, one that is equipped to navigate the increasingly complex landscape of cyber threats.

Takeaways:

• Geoff White elucidates the complexities of ransomware, particularly focusing on the notorious Conti gang, and its multifaceted impact on both businesses and individuals.
• The podcast reveals how ransomware attacks have evolved from mere data encryption to sophisticated extortion schemes that threaten to disclose sensitive information.
• Listeners gain insight into the significance of the Conti leaks, which provided unprecedented access to the inner workings of a leading ransomware organization.
• The narrative emphasizes the necessity for public awareness and education regarding ransomware, as its implications extend far beyond the realm of cybersecurity professionals.
• Geoff White discusses the intersection of financial crime and cybercrime, highlighting how ransomware profits are integrated into broader illicit financial networks.
• The episode underscores the importance of vigilance among employees and citizens alike in recognizing phishing attempts and other cyber threats that facilitate ransomware attacks.

Links referenced in this episode:

• https://www.bbc.co.uk/programmes/p0ntv7bv
• https://geoffwhite.tech/
• https://www.youtube.com/playlist?list=PLz_B0PFGIn4ccgXclIq9gdmf_nFNz-Og8

Hello, everyone.

Welcome back to another episode of the Security By Default podcast.

I'm the host of show Joe Carson and it's awesome to be here.

Always.

My favorite time of the week is where I get to talk to really cool, awesome people.

That really insightful, you know, brings me knowledge, brings me the curiosity and gets me excited about the passion I have for this industry.

So I'm really excited to bring you a guest who's been on the previous podcast, but now first time on this podcast.

So, Jeff White, welcome to the podcast.

If you can give the audience a little bit about yourself, background, your origin story, how do you got into the industry and where did you really, where did you get started off?

Here.

Sure, yeah.

Thanks.

So, yes, I'm Jeff White and I'm an author and investigative journalist.

And what I basically cover is organized crime and technology.

So ever organized crime and tech crossover, that tends to be where I hang out.

And how I got into that was I was a journalist for Channel 4 News for many years, the big UK news program covering technology.

And the issue we had basically was that technology stories, they were always a kind of nice to have funny story at the end of the program.

You know, particularly back in the day, it's video games and Apple product launches and that kind of thing.

It didn't seem very serious.

And as a result, we kept getting dropped from the end of the program because if something important happens, it goes in at the top of the program and you've got a limited amount of time, so whatever's at the bottom of the program gets dropped.

And I just got really annoyed with that.

And also I didn't get into journalism to cover product launches.

You know, I wanted to do hard news.

So I started doing more investigation.

And then that led me into the sort of cyber security, cyber crime kind of space.

And through that started looking not just at cybercrime, but tech crime, generally, financial crime.

Obviously there's a lot of technology involved in that.

Money laundering, of course, has become increasingly high tech.

So now what I cover is basically all of those types of, if you like, for crime.

Fantastic.

Excellent.

You know, what was kind of what, you know, you're working on some upcoming documentaries and stuff, which should be around the same time we launched this podcast.

Can you tell us a little bit about what have you been working on this last year or six months plus what's the exciting news that you have?

Yes, well, so it's always frustrated me a little bit that ransomware, although in the industry it's accepted as a huge phenomenon still with the general public, it's not been something general public have been hugely aware of.

That's obviously changed now, particularly in the UK with the attacks on Mark Spencers and Co op and Jaguar Land Rover.

We've had this remarkable moment where a cyber attack affected our country's gdp, which hasn't been looking particularly healthy for a few years now.

So we can do without that.

But it frustrated me.

There'd not been really a way for the general public to get into the issue of ransomware and to understand it and to understand how it works.

And so we were kicking that around to try and work out how we would deal with that.

At that point, we had this astonishing leak of information.

I mean, 300,000 messages from inside the gang got leaked for reasons we can go into.

And we did go into the.

The BBC podcast I've been working on.

And so I wanted to try and tackle the issue of ransomware, but also do it in a way that the public could understand and really got into the heart of this and actually really got our arms around the whole subject.

And this leak of data was.

Was really pivotal.

So podcasts have done for the BBC World Service.

It was called the Lazarus Heist because we were covering the Lazarus Group, which was a North Korean group.

It's now been renamed Cyberhack.

Not my favorite name, but there you go.

But it does allow us to cover way more than we used to.

So the Conti Gang and the Story of Ransomware is going to be our new series for that BBC Cyber Hack strand.

And that's going out in on 1st of June this year.

Fantastic.

That's actually really exciting.

I mean, I've kind of, of course, been covering it myself from a researcher perspective for a long time.

And I completely agree with you.

It's really kind of from the, you know, this typical person on the street, you know, or at home, the families in society, they kind of be somewhat.

Be a bit disconnected until it really hits home, until it affects them.

And I remember working on one case a couple of quite a couple of years ago now, maybe four years ago, where it was a small business, but it was a small business where it doesn't impact just the business, but the crossover between the business and their personal life was also impacted.

Yeah, all of the drives were the accounting and stock information was the Same drives where they stored their family photographs and their digital life and history.

And when they got impacted, the attackers were asking for tens of thousands of euros in order to decrypt it.

And that's something that you know, would really harmfully, you know, impact the business.

But also they had to make the decision because it was photographs and videos of grandparents that had, you know, no longer been around, and that's that connection to their past.

And it was a really tough decision.

That's where you also get into the question is, you know, a lot of researchers have always say in the past, don't pay the ransom because you're feeling, you know, crime, which I agree with.

But at the end of the day, you have to think about people's lives as well.

Yeah, yeah.

The decision.

So in that case, I took the effort in helping negotiate down to, you know, just a few hundred euros in order to be able to get that life, that digital life that they had lost back.

It's interesting.

So negotiation does work in a lot of cases, especially when you're using empathy.

But.

And even when we hear about the misinterpretation about how many people's paying actually ransomware itself, I think the Kunti leaks showed us that we'd underestimated a lot because, you know, the assumption was maybe a couple of hundred million.

And that was like, showing that it was actually, I think Conti was.

Was a cyber crime unicorn in many cases because of the amount of kind of money it went through, their kind of systems and ransom demands, possibly.

So, yeah, I mean, we know it's in the hundreds of millions.

The FBI assessment, the US government assessment is 158 million.

That's a vast understatement.

I mean, there are.

As you comb through the Conti leaks, you start to come across examples of companies that were not in the public domain.

And I've come across companies that still, it's not been reported that they were targeted by Conti would almost certainly have paid up.

And so you're looking in the hundreds of millions, and that's Bitcoin prices.

2022 Level.

Bitcoin's price since Donald Trump came into power has roughly doubled.

So, yeah, you might not give you an idea.

Yeah.

So tell me about what was your kind of interest?

You know, one of my favorite.

You know, I've.

Your books over the years have been amazing.

I really enjoyed the Lazarus heist was a fun read.

And then the last time we did the episode was when you were launching Rinsed, which for me was.

It was a big Realization when I went and read the book, because it really kind of where a lot of my skills focuses on the digital forensic side of things.

And you really kind of highlighted to me that there's this convergence between financial investigations and the digital investigations and how important they are together.

What was the findings when you're doing the research?

Did you start finding more that convergence overlap and how both financial investigators and digital investigators.

So what was, what was interesting was looking at, and this is one of my big bugbears, is that I feel we've got this unhealthy separation in our world between financial crime, fraud, money laundering and cyber.

When you meet those people, they come from different backgrounds, usually they inhabit different worlds.

The conferences are generally separate, the companies are generally separate, but often they're dealing with a lot of the same threat.

You know, if you're a cybercriminal and you steal a bunch of money, you have to launder it somehow.

You have to have some laundry facilities somewhere to, to wash that money.

You can't buy your Lamborghini still these days, mostly in bitcoin.

It just doesn't work.

You know, you've got to have, and also, you know, most Lamborghini dealerships, because Lamborghini doesn't want to be involved in, you know, criminal proceeds.

Lamborghini dealerships will sell Lamborghinis to people who can prove where their money came from.

You know, going along with a bag full of bitcoin is not really going to work.

So you need to have these kind of off ramps and on ramps for the money laundering.

Now, one of the things we don't go into in the BBC podcast, which is fascinating, is the work the National Crime Agency's done around what happens to the profits from ransomware.

There's an amazing operation called Operation Destabilize, which the National Crime Agency were originally going to call Operation Accumulatively.

But as I've just illustrated, I think they realized that was just too difficult a word.

Yeah, it could be a.

Could be a quick tongue twister, especially when you're trying to pronounce it.

Yeah.

So destabilized was a lot, a lot easier to say.

Certainly what they discovered was that ransomware profits were washing into what they say is a vast network of money movers around the world.

And those money movers connect ransomware gangs with street level drug dealing in the uk so the people who peddle heroin on our streets in the UK they also connect it with Russian government influence operations.

So the Russian government channeling money into the UK to fund Media, Kremlin Media here to fund spy rings in the uk.

Also sanctioned Russian individuals who want to buy property and pay their school fees.

In the UK there was this nexus of dodgy money and inevitably the ransomware gangs were part of that because they've got dodgy money that they want to get rid of.

There's this sort of underground banking system for people who for various reasons can't be honest about their money.

And ransomware and cybercrime absolutely feeds into that.

So if you're in the cyber space and you think, well, financial crime, fraud, money laundering, doesn't really affect me.

Absolutely it does.

The people who are hitting you and hacking you, they are taking the money they get and they are putting it into these networks.

Absolutely.

It always remind me that was the other thing is that when you do pay ransom demands is that you tend to be fueling, you know, it's an entire criminal ecosystem and as you're, you're pointing out is that it's probably easier for the criminals to exchange services between criminals because it's easier to kind of keep the money off the books.

Yeah.

And you know, when you're doing that, you know, you end up fueling other crimes.

Your software, illegal software, you end up creaming human trafficking, drug trafficking, you know, drug kind of criminals.

So it kind of gets into this whole entire ecosystem.

What's some of the interesting, you know, one of the things we look back, you know, as is the, you know, attribution of criminals still very much, you know, the likes of North Korea, you know, Russia, Iran.

Is it still the usual, you know, state actors and mercenaries?

Are you finding it is expanding beyond all of that?

It's interesting, yes.

We've still got, you know, state level activity.

And so frankly, the uk, the us, every country worth its salt has government hackers.

That is just the game.

It's the modern face of espionage.

That's what happens.

What makes North Korea such an interesting example, the reason I've covered it so much and keep covering it, is because it's, it's this interesting nexus between sort of state level power and criminal power.

You can look at what North Korea does to try and steal money to top up its coffers because of course North Korea is sanctioned it unable to get its hands on legit money a lot of the time.

So it's, it's hacking to steal money.

It's like, well, is that nation state hacking or is that cybercrime?

It's actually a hybrid of both.

That's why North Korea is such a fascinating example to look at.

But what's interesting is as our world starts to fracture, we're going to be in an increasing, increasingly fractured world.

And you can look at Russia as an example of this.

As states start to break away from traditional sort of linkages, their ability to move money around is going to become increasingly part of what the private sector does.

So, for example, you know, the Russian government wants to funnel money into the UK to fund pro Kremlin media.

It's stopped from doing that by sanctions.

The UK government will try and stop Russia from doing that.

So the Russian government, according to National Crime Agency, works with private individuals who are working on the criminal side, but also work on the government side to help funnel money around.

So what we're seeing is this blending of sort of state power with criminal rails on which all of this stuff can happen.

There's a great book, by the way, by a guy called Miles Johnson called Chasing Shadows, which is all about how Hezbollah in Lebanon worked with drug cartels in Colombia and how the two of those came together.

It's a really fascinating book.

And issues like that where you start to this blending of state stuff with criminal stuff.

I think that's going to become more prevalent in the future.

Absolutely.

The mercenary side of things where they're just basically, you know, people fire, you know, to do those activities, whether it be in skill or just people who's looking to, you know, give their space from their homes to, you know, computers that will operate and appear to be coming from those countries.

So, you know, a lot of that disinformation campaigns that we see quite commonly.

One of the things that kind of was interesting was, you know, one country, basically it was when the Russian government appeared to take down Conti.

How, how was.

Do you think that was more of a show entertainment type of thing, you know, on the front?

Or was it, you know, a proof of example to other criminals to get in line.

What was kind of, what was your thoughts around that scenario?

It's very, it's very, very interesting.

And I think people in the UK and outside Russia have this idea that Russia is this wild west where anything goes, you know, that there's no law enforcement, it's all co opt and so on.

That's not altogether true.

I mean, Russia has a criminal code.

They enforce it.

You know, there are police officers in Russia and actually, you know, in the uk, National Crime Agency, people in the FBI who've worked and Secret Service who've worked occasionally with Russian officers do find some commonality there that, you know, there are Russian Officers who want to do a good job and enforce the law.

And you do see this every now and again.

Amazingly, one of the stories we cover in the podcast is the incredible tale of the 25th Floor Film Company, which was a film company.

They made and distributed films.

We actually spoke to a guy who was writing a film for them.

The film was going to be called Botnet, and it was going to be about cybercrime.

So he went across to meet 25th floor and found them remarkably well informed about cybercrime.

And that's because certainly According to the FBI and various others we've spoken to, 25th floor was a front company for laundering money from Russian cybercrime.

So the Russian police came in, they raided the place, they shut the place down.

They didn't, it seems VICT the people behind this, but it was a slap on the wrist.

It was basically like, you can't do this.

And we've seen this in various, various times.

You know, there are arrests, there are raids.

It's difficult to get an absolute steer on why that stuff happens.

It could be that the Russians are enforcing the law.

It could be that someone within the gang hasn't paid off the right police officer or the right, you know, individual in the government.

It could be that a rival gang wants to put that gang out of business.

So they've managed to convince the law enforcement guys to go after them.

It's quite a lot of smoke and mirrors.

But we do know that these.

These things happen.

In fact, one of the key members of the Conti gang, I got told fairly recently was arrested by the Russian security services.

However, can't find any more details on that and any more information.

And so there's these tantalizing moments where something happens, but you're not quite sure why it happens.

What is the dynamic behind that in Russia?

Yeah.

Or what's the outcome?

Where does that individual end up, you know, is a part of, you know, do they become part of the offensive team eventually to pay off their service as well?

So bring it back into the citizen side of things?

Is that how important is it for them to be aware of ransomware and the evolution of ransomware as well?

Because it's no longer just about encrypting data.

It's become more of extortion.

Warriors become threatening to disclose sensitive information.

We've seen it in the Vastamo case in Finland, where it's a very different type of scenario where it was patient records from psychologists.

So how important should citizens be aware of ransomware and what things can they do in order to, you know, what sources can they get better informed about it?

Yeah, yeah, sure.

There's two sort of ways to look at this.

Number one is as just a member of society, citizens in society.

You know, the company that you worked with, gave data to, paid, used their services, could get hit by ransomware, and your information could be leaked out.

And one of the cases we go into in the podcast is the famous hit on Graff Diamonds, the big Juliet jewelry company.

In that case, details of very, very rich and wealthy clients of graph got leaked all over the Internet.

It's turned into a huge story.

There's people like David Beckham and Oprah and Donald Trump, people who shop at Graf got their details sort of smeared all over the Internet.

Now, obviously that's celebrities, but, you know, on a lower level, we are increasingly going to see if these ransomware gangs continue and continue to be successful.

More and more people's information smeared all over the Internet that can be used, obviously to target people with phishing emails, with fraud campaigns, with extortion and blackmail, if it's a particularly sensitive service.

So there's that level on which people have to understand it.

There's also the level that lots of people are company employees.

And when the hacking gangs go after companies, they're going to be sending phishing emails to lots of employees.

So as a citizen, you may get affected by this if your data's leaked.

But also as an employee of a company, which a lot of people are, you have a responsibility to up your game in terms of spotting these phishing emails, these phishing messages, you know, all of us can actually play a part in that and potentially stop the company that you work for being ground to a halt and potentially put out of business because somebody answered a dodgy email.

Absolutely.

I think it really comes down to is that the more data that gets leaked out there that is sensitive, that can be weaponized against us.

And then when you combine it with the acceleration and what AI has been able to do and a lot of GPT engines that can really use that to get it really personalized and really targeted, where it's no longer the generic one from, you know, Africa, the Prince, you know, which is just the same, that everyone gets used to, those messages become very personalized and also translated so well.

Yes.

That there's very little mistakes.

Yes.

It gets even more difficult even for professionals to spot than just citizens on the street.

Yeah, and, and also on the translation point, translated into different languages.

I mean, previously, you know, to send phishing emails, sending them in English made sense because you've got all of the us, which is hundreds of millions of people, you've got the uk, you've got other countries where English is the common language.

You know, targeting Estonia, for example, or Latvia would be more difficult because you've got to learn the local language, get your phishing email.

Right.

You know, translation engines can absolutely help with that.

And I worry that populations that have not been massively targeted with phishing before might see more phishing attempts come their way simply because the language ability is there now for the hackers that wasn't maybe there before.

Absolutely.

We've seen it in Estonia where, you know, the language is no longer a protection for this society and it's meant that the NCSE here in Estonia has had to, you know, send out new educational to the citizens to be that, you know, the ways of spotting fishing in the past is no longer valid today.

Looking for mistakes is just not enough because it's going to be even better than most people's grammar and in the language they speak today.

So sometimes, you know, it's better to look for mistakes because then it's more likely written by a human.

Phishing emails have become too good.

They're actually better than.

Yeah, yeah, absolutely.

So what, what sources.

Where can, you know, for, for people to, you know, I think it really comes down to, is that, you know, people need to be aware, they need to be educated.

This needs also, I think, not just, you know, starting the means that we are, you know, delivering and trying to get the population to prioritize this and, and become aware of the risks.

But also I, you know, find that it needs to also start in schools and to get into even the younger generation because we need them to be more.

Not just digital natives, but we need them be digital secure natives in many cases.

So what's your kind of recommendations?

How to get it even to the next younger generation, next talent that's coming through is the documentary follow any kind of focuses around children and youth who's going to replace us in the years to come?

I think it's an interesting one and obviously saying this is somebody who's well advanced in years now trying to work out what the kids are looking at and what they're interested by.

But, you know, I have done sessions in schools and what I find interesting is the one thing that will get kids attention is if you frame it and phrase it in a way that makes sense and is relevant to their world.

So, for example, you know, I've gone in as a journalist and I've talked about journalism and what I've started by is saying, well, what's the news story today in this school?

You know, if I was going to write a front page about your school, what would it be?

Which teacher's done something really stupid and embarrassing?

Who fell asleep in assembly and dropped off their chair?

Starting at their level and starting in their world.

And their point is absolutely the best way to do, because if you just go in with an adult perspective on it or an outsider perspective, it's just not going to resonate.

I don't know how you sort of translate that at scale, but I do think, and, you know, look, it's interesting, I had a conversation with somebody the other day who was saying that if you look at statistics around who falls for phishing emails and for fraud attempts and so on, we have this idea that it's all older people who, you know, crumbly and don't understand this.

Actually, young people, the statistics this person was quoting was saying, are more likely to fall for these kind of things.

And even if those statistics aren't right, you know, young people do fall for this phishing stuff.

But what's interesting is younger people have less money.

So in terms of the cost per failure, if you like, of people's ability, as you get older, you have more money, so you're more of a target.

But those younger people are getting caught.

They are falling for phishing emails and they are falling for scam campaigns and scam deals on Facebook.

It's just the losses for those people relative to the older people is less.

Although if you're in your 20s and you lose £1,000, that's going to be a lot of money to you.

It's arguably going to be as much of an impact as if you lose 100,000 when you're in your.

Your 70s or 80s.

So I think there's some interesting dynamics around that, around thinking about what the harm on those age groups is going to be.

And again, targeting that and not saying, well, you lost 100 quid on Facebook Marketplace, you know, what's the problem?

That's a big problem for somebody who's only got 100.

Yeah, absolutely.

It makes.

It makes sense.

The impact is very different for the younger generation than it is for older from a financial side of things.

So the question is, what is that real, true impact moving forward?

So tell me a little bit more about documentary, Kenneth.

What does it kind of move through.

What's the storytelling aspect of it?

Where do you start off?

And tell me a little bit about the navigation storytelling side.

So we start off at Conti's sort of first big hit, and it's a really interesting one because it's a hit on a local council.

Ed Carton, Cleveland BOA Council in the northeast of England.

It's a really small local council.

Classic ransomware campaign starts on a Friday night.

Somebody had answered a phishing email.

There's the 3:00am call for the IT security person.

And it literally was a 3:00am, you know, go in, pull out the plugs.

So we sort of start from there and we start to unpack what happened at Redcar Council.

It's a slightly awkward example to use because it takes place at this point where there was a flux between how the ransomware gangs were defining themselves and being defined.

So we'd had this emergence of a gang called Trickbot who had various members and did various things that grew out of sort of bank hacking kind of community, but then discovered ransomware, and the ransomware they were using was the Conti ransomware.

Eventually they became known as the Conti Gang.

But at the time the Redco attack happens, there's this interesting kind of flux point and inflection point.

And then you can just see they just double down on ransomware.

From then on.

The Conti Gang are just doing it and doing it and doing it.

And what's brilliant about the leaks and the reason these leaks of information are so useful and why I spent months going through thousands of these messages.

I'm 45,000 messages into the Conti leaks, and I'm still going, oh, my goodness.

The brilliant thing about that is you can see them talking in real time contemporaneously about the hacks that they're doing.

So one of the issues we hacks, we talk about in the podcast is the health service executive of Ireland, Republic of Ireland.

There's this really interesting debate that takes place in the Conti Gang around that time, but also at other times about attacking healthcare.

Do we attack healthcare?

Is that right?

And that's where you start to realize the Conti Gang is not a homogenous group.

There is leadership, but the leadership struggles to really plant its culture across the organization.

There are people in the Conti Gang who absolutely do not care.

They're like, let's hit as many hospitals as possible.

It's Covid.

They're going to pay up.

We can make millions.

And at the other end, there are people who are saying, no, that's not what we do.

We are trying to be businesslike and hitting healthcare is really not going to make that argument.

And also we're going to get heat from everybody if we attack hospitals.

So you see the visibility rises playing out in real time.

And that's something we go into in the podcast.

The other thing we is, of course, the man who's allegedly behind Conti, Vitaly Kovalev, who went by the name Stern.

We have, for reasons that you'll have to listen to the podcast to understand, discovered a trove of videos of Vitaly Kovalev on the Internet, waving, you know, hanging out with the family, going on holiday.

It's absolutely astonishing that the man who's basically gangster number one, he's one of the world's most wanted cyber criminals, is popping up on YouTube and TikTok in these videos.

It's absolutely astonishing.

Fantastic.

I'm really excited about watching and going through and learning.

For me, it's been a fascinating kind of evolution that ransomware's had over the years.

What has happened to Conti, you know, what is kind of.

Where do you find, you know, have they disbanded into smaller groups?

What kind of.

What had they evolved into?

So what's interesting is there's this point where Russia invades Ukraine.

Some people in the Conti gang backed the Russian Special Operation, as Vladimir Putin called it.

Some members of the gang were clearly in Ukraine or Ukraine supporting.

That's what led to this leak of inside data.

Somebody got so annoyed about this, they were like, f you, we are leaking this stuff on the Internet.

So that's where these leaks come out.

It's caused pandemonium in the Conte gang after that, the gang limps on for a while, and they do actually stage, which we cover in the podcast, an attack on the government of Costa Rica, which, although it was at the tail end of Conti, really shows the evolution.

They went from the beginning of our series attacking a small local council in the UK to taking down an entire country's government.

You know, they really, really put Costa Rica through the wringer for weeks after weeks after weeks, and it became an Internet pile on.

Other groups were getting involved as well.

Conti, after that, disintegrated the National Crime Agency, the FBI, have told us that the members went into other gangs and other groups.

We know obviously where the man accused of being behind it, Vitaly Kovalev, we know where he is.

We can track him on social media.

He's on holiday.

He's clearly, you know, enjoying a Good life.

A lot of the gang ended up in Dubai.

We know that from the leaks.

And my suspicion with that is that they are sitting now on a vast pile of dodgy cryptocurrency, hundreds of millions of dollars worth of crypto.

Where and how do you take that money and transform it into pounds, dollars and then Lamborghinis, apartments and yachts and so on.

There is still in Dubai.

Dubai is quite a forward looking country in terms of crypto, but that also has an underside where that's an area where you can get rid of crypto and start washing it.

So my suspicion is the Conti gang senior members have either ended up in Dubai or have significant links there because that's where they're trying to offload their dodgy crypto.

That's my assumption.

Absolutely.

You do see Dubai and Sabu Dhabi as one of those places where a lot of the cryptocurrency influencers are showing off and showing basically their luxury lifestyle.

But the question is, is that, you know, and I don't think some of the, some of the criminals you covered in the past also ended up in the same location as well.

Exactly.

Yeah, yeah.

Famous hush puppy who laundered money.

North Koreans was, was living in the Palazzo Versace in Dubai.

Look, it's a mixed picture.

You know, on the one hand, as I say, these countries are trying, Abu Dhabi and Dubai trying to be forward looking, you know, financially and in crypto generally they're trying to say, look, we, we're crypto friendly.

The problem with that is people who have dodgy crypto will then turn up in your country because they can see, you know, conduits through which they can wash it.

So it's, it's, it's, it's tricky.

Absolutely, absolutely.

When you can pay for a lot of things in Bitcoin that tends to be, you know, much more acceptable also when regulations a bit more kind of lenient also kind of follows as well.

So always interesting.

But yeah, I always find that, you know, that one of the things for Costa Rica in that scenario was, I think it was also a change in targets as well.

When a lot of countries sanctioned Russia after the war had started, it became more difficult for those gangs to get payment through the, because of the sanctions as well.

So you've seen a rise in Central and South America and also African countries becoming victims following the sanctions as well.

So kind of because those countries didn't have the sanctions against Russia.

Yes.

So it became much easier for them to pay.

So, so it was a switch in Targeting to countries where sanctions were not in place because payments to the gangs could also continue.

Really interesting.

I hadn't.

That's a.

That's an interesting aspect.

I hadn't thought about that.

But, yes, that does make sense.

We also had, of course, the diversification of ransomware gangs because Gang X would get sanctioned, but they would basically rebrand as Gang Y and then just attack the same.

So, oh, we're not Gang X, you can pay us.

We're not sanctioned.

So we had that.

Which was an interesting evolution as well.

Absolutely.

Or they just became into the proxy scenarios where they basically become service providers to other gangs and, you know, become proxies from.

From a lot of.

I think the proxies a lot of was in Southeast Asia where they had to basically, you know, it's like, okay, we're not going to do it direct.

We'll just provide it as a service and now become somebody else's getting the payment and they're just getting the royalties.

So, you know, the ransom as a service became a big popular way to the affiliate program.

Yeah, yeah.

So their channel.

Channel and partners became another.

Another interesting area.

So it's really, really exciting.

What's.

What's.

Where do you see the evolution of ransomware moving to?

What.

What's.

You know, from a lot of the research that you've done for the documentary and what's next for ransomware, where's the direction going?

Yeah, it's interesting.

I think what we're going to see is there's this interesting pendulum effect with ransomware where what you've got to understand about the ransomware gangs is they don't want to get too big.

They don't want to become the headline.

And we saw this in the attack on Colonial Pipeline attributed to the Dark side gang.

That was a big problem for the Dark side gang.

And they kind of rode back from it and said, oh, we didn't want this to happen because you end up in the headlines.

You end up with a target on your back.

You know, what the ransomware gangs want to do is occupy a middle zone.

You obviously want to make enough money that you can buy your Lamborghini, but you don't want to make so much money and cause so many problems that you're then target number one for law enforcement.

So staying within that kind of middle zone is going to be quite important.

I think the evolution of that is going to be targeting not necessarily the biggest companies in the world, but the companies that link together or are important conduits or central connectors.

Between companies, you know, the Collins Aerospace, I would argue, is an example of that.

I'd never heard of Collins Aerospace, you know, but it turns out they're a massive linchpin tying together all these different airports.

So if you ran somewhere Heathrow, that's major critical infrastructure, you know, that's going to get you a lot of attention.

But you ran somewhere, Collins Aerospace, you have the effect on not just Heathrow or Belfast, you know, all these other airports that Collins Aerospace was servicing.

So you effectively, by targeting the linkages between the big companies, you get all of the effect of targeting the big companies, but without the headlines.

So for companies that are in that space, if you're a connector, if you're a service provider that connects all these big companies together and you're the linchpin holding some of that bit together, you're a target because they can hit you and they poison the waterhole and they poison all the beasts.

They don't have to go after the beasts individually.

I think that's the evolution.

If I had to lay a bet, that's why I'd back come.

Yeah, yeah.

And also the extortion war as well, you know, so you're not actually taking down the service, but you've actually stolen the data, threatening it because.

So then that tends to be as.

We as citizens don't tend to see it because the service is still functioning.

It's just that our data has been basically, you know, stolen and being threatened against, I think a lot of ransomware gangs.

They want to kind of move to the extortion where.

And data theft, where it's not bringing too much attention to them in the public space.

But there's still negotiations between the victims going behind the scenes as well.

So sometimes you find that that's a way to stay.

Stay, you know, out of the news.

Yeah, that's really true, isn't it?

Yeah.

With the ransomware, you know, you are really pummeling your victim, but you're also doing it quite publicly.

But interestingly, if we do get back to that stage, slightly depressingly, I feel like we've sort of gone back in time 10, 15 years.

When I first started covering this stuff, when there was data thefts and that was, you know, we just didn't realize that extortion could be part of that.

We're still back at the stage where stealing a chunk of data from a company is the thing that the hackers are after.

It's like.

Yeah, well, they were after that 15 years ago when I started covering this.

You know, Absolutely.

And it's interesting as well.

So especially with AI being able to quickly analyze that data at really fast.

You know, that's one thing I find is that those attackers, where they are really using AI, is to analyze the data train, you know, understand and ask it questions.

Where's the sense of information?

What's the value?

Where's the credit card information, you know, in that data?

Because it used to take them months to analyze it.

You know, they, you know, you've got like 10 terabytes of data.

Yeah, that's a lot of data to go through.

But if you got it, if you put it through an AI algorithm with, you know, proper GPUs and large language models and natural language processing, you can ask it questions and get answers immediately.

Yeah.

So the speed at what the attackers are understanding, what they've stolen is much more accelerated than it has ever been in the past as well.

And that AI gives them a lot of new capabilities.

Yeah.

I was thinking back to the Move it breach, which obviously the software that moved, you know, data around in organizations and was.

Was hacked a few years back.

Part of the issue, as I understand it, for the gang that the Klopp gang, I think I might in saying, was the movie part of the issue Klopp had was they were overwhelmed.

They had so much stuff they couldn't triage it.

A lot of victims were caught up in that.

Never got an extortion demand in the end.

To your point, you know, these days, you'd be getting chatgpt on the case and saying, right, look through this, rank these victims in order of market capitalization, you know, come up with a sense, you know, to use that tool.

Makes perfect sense.

Although I will say I did approach various ransomware gangs because obviously they have channels through which you can talk to them.

And I just asked them, you know, are you using AI?

And the few that responded did sort of say, well, no, you know, we're using it at a low level, but at the stage of negotiation, we wouldn't use it.

You don't want the AI running your negotiation and costing you millions.

But you're right, maybe in the background triaging data, some of them did say target reconnaissance.

AI can be useful for that.

So there were uses around the edges, I think, for this stuff.

Absolutely.

Even the social engineering side is also improving with the phishing heavy use in that initial target side.

So for the documentary, where's the ways that people can access it and where can they learn about it?

Is it going to be on podcasts, platforms, Is it going to be in YouTube?

Where's it going to be available?

Yeah, I think if you search BBC Cyber Hack, that's, that's the best thing.

It will be on BBC Sounds, which is obviously the BBC's own platform, but it'll also be on Spotify, it'll be on Apple Podcasts and wherever you get your podcasts, that's what the Americans say.

Ever you get your podcasts.

Well, I'll make sure that I'll.

I'll add it to the links so the show notes so people can easily find it.

And what ways do you.

How do you stay up to date?

You know, because, you know, for, you know, rather than reading through tons of messages from the Conti leaks, what other ways do you stay up to date?

How do you stay informed?

Well, there's a great quote from, I think, this guy called Richard Knuth, who was a software developer.

People who know this stuff will be ashamed of the fact that I don't.

Will cast shame on me for the fact I don't know which software he developed, but he was a software developer of note.

And he has this great quote that he said, you know, a lot of people stay on top of things.

They want to stay on top of things.

That's not my job.

My job is to get to the bottom of things.

And so famously, if you sent him an email, you get a response that said, I'm working on a project.

I will get back to you in three months.

If it's still important, then like, literally, the guy was there.

You know, I don't want to talk to people for three months.

I've got work to do.

So I try and I try and balance being on top of things.

And that's mainly through LinkedIn and through looking at the feed and following various people.

But I also, there are times when I have to get to the bottom of things.

I have to read through 45,000 Russian hacker messages.

So for that, I think books are really important podcasts.

I love a deep dive that takes you into a world and sort of explains it to you in a story.

And suddenly you.

This world.

There's a great book called Dead in the Water, which is about insurance industry fraud in the maritime sector.

It's about a ship that goes aground, basically, and the insurance stuff that happens.

Fascinating.

I had no idea about any of that.

And it's a brilliantly written book.

It's a great story.

So things like that.

I really love just taking a deep dive through a book or a podcast into world that I didn't know about and just letting a story guide you through.

And at the end of it, you go, I kind of understand how that world works now.

So.

And that's what I'm trying to do, you know, obviously, with things like the cyber hack and Lazarus.

Fantastic.

I mean, again, thanks for, for everything that you do.

So it's really, you know, a lot of the depth and details that you bring out.

You.

You really educate the rest of us into things that sometimes, you know, takes that focus and dedication in order to really analyze and understand large amounts of data.

And it's, it's a, it's a very.

I mean, it's a tough, tough thing to do.

It's, it's a lot of focus, a lot of research, a lot of reading, a lot of kind of just bringing context to something that for many people would not, you know, know, come to light without somebody like yourself and going through that.

That hard work and hard research that, that brings that information to at least the visibility and transparency that it needs.

That's really kind.

Thank you.

Yeah, yeah, it's, it's, it's often fun to do, but can be quite grueling as well.

Yeah, yeah.

It reminds me, I used to, I used to, years ago when I was doing financial, foreign exchange, money markets, I used to go through like, you know, digs of logs, you know, thousands and thousands of log entries looking for two goods that were actually identical to try and find where money was missing.

You know, it didn't do the full transaction.

It's tough to go through and correlate and analyze.

I kind of, you know, while you enjoy it, it's a difficult thing to do, at least correlate things as well.

If the audience has questions afterwards, what's the best way to contact you?

Reach out or, you know, if they want to learn more.

What's the best way to contact you?

I'm on LinkedIn.

If you search for Jeff White, Jeff with a gift and White, like the color.

There's also my website, jeffwhite Tech.

If you want to contact me there, my email address and mobile number is all over the place.

So you have people to contact me as long as they're not North Korean.

Fantastic.

Fantastic.

Well, there's ways to check.

Now, I love to say something bad about North Korea.

Leadership will definitely make them struggle to answer that question.

So there's no ways to check.

I love the Jim hates Scams where it's hold your hand in front of your face.

You, Jeff.

It's always great talking to you.

I always learn a lot.

Hopefully, at some point in time, we'll cross paths in person in the near future, which I'm I'm pretty sure we'll do.

So for everyone, hopefully, this has been educational.

We'll definitely make sure, you know, go watch the documentary.

Go learn.

Go.

Go get educated.

This is a really important topic.

It's something that impacts everybody.

And what myself and Jeff are really here to do is is make the world a safer place, bring information to you, help educate you, and for those in the industry, you know, help shape your career to, you know, really making it very kind of a successful one.

So for everyone, tune in to the Security By Default podcast every two weeks.

New episodes, new guests, new thought leadership.

Take care.

Stay safe until the next time.

Thank you.