AI ransomware, hiring fraud and the end of Scattered Lapsus$ Hunters

The “Retirement” of Scattered Lapsus$ Hunters is Likely a Ruse

The panel unanimously agrees that the recent announcement by the cybercrime collaboration Scattered Lapsus$ Hunters to “go dark” is not genuine. The consensus is that this is a strategic maneuver to divert law enforcement attention and reduce public scrutiny.

• A Tactical Pause: Dave Bales asserts, “This is a ruse. This is a look at the right hand while the left hand’s doing something else.” The group is likely using this quiet period to regroup, rethink their strategy, and potentially develop more sophisticated, “2025-2026 focused” attacks, as Sridhar Muppidi suggests.
• Psychological Justification: The group’s claim of waging a “‘war on power’ meant to humiliate those who humiliated” is dismissed as a psychological justification, a “Robin Hood type” narrative to rationalize their criminal activities.
• Future Breaches: The gang’s message that more breaches will be attributed to them from past activities is viewed with suspicion. The panel believes this indicates that new attacks are already in motion and have not yet been discovered.

AI-Powered Ransomware and the Ethics of Research

The discussion turned to “PromptLock,” a proof-of-concept for AI-powered ransomware developed by NYU researchers. The malware uses LLMs to autonomously perform reconnaissance, generate payloads, and conduct personalized extortion without human intervention.

• Accessibility is the Main Threat: The primary concern is not the novelty of the technology but its accessibility. Michelle Alvarez likens it to the advent of exploit kits, which enabled individuals without deep technical skills to launch sophisticated attacks. AI lowers the barrier to entry for creating potent malware.
• Responsible Disclosure Debate: The panel debated the ethics of publicly releasing such a proof-of-concept.
  • Sridhar Muppidi supports the research, comparing it to automotive crash testing, but emphasizes the need for “responsible AI” principles. He argues for releasing such tools with a defensive focus, for example, to help organizations test their applications against AI-driven red agents.
  • Dave Bales strongly disagrees with the public release, stating, “The bad guys are getting these as well.” He advocates for keeping such research within the trusted cybersecurity community to prevent it from being weaponized by adversaries.

A Single Phishing Email Exposes Deep Supply Chain Flaws

A significant breach where a single AI-assisted phishing attack on a developer led to the compromise of 20 popular npm packages highlighted critical vulnerabilities in the software supply chain.

• Single Point of Failure: The incident demonstrates how millions of users and organizations can be compromised through a single weak link. Sridhar Muppidi notes that such events, while damaging, serve as a necessary “awakening call” that forces the industry to improve security, much like the Tylenol tampering case led to safety caps.
• Beyond SBOM: While a Software Bill of Materials (SBOM) is a good starting point for transparency, it is not sufficient. The panel advocates for coupling SBOMs with continuous verification and anomaly detection to secure the supply chain effectively.
• Sophisticated Social Engineering: The attack’s success against a savvy developer underscores the sophistication of modern phishing. It’s a reminder that everyone is susceptible. The key takeaways are the necessity of continuous, adaptive user training and operating under the assumption that compromise will eventually happen.

Growing Threats to OT and Critical Infrastructure

A new IBM X-Force analysis reveals that Operational Technology (OT) and critical infrastructure face severe threats, with attackers aiming for physical disruption and sabotage, not just data theft.

• Why Target OT?:
  • Easy Targets: OT environments often run on older technology that is difficult to patch without causing significant downtime. Security has historically been an afterthought to uptime.
  • High Leverage: As Dave Bales points out, disrupting a power grid or water supply creates immense pressure for a quick payout because “you can’t make a backup of your water supply.”
  • Varied Motivations: The motivation depends on the actor. Nation-states may seek to cause disruption, while cybercriminals see a clear path to financial gain.
• The Problem with CVSS Scores: The analysis noted that nearly half of disclosed OT vulnerabilities had a “critical” or “high” CVSS rating. However, the panel expressed deep skepticism about the value of these scores.
  • Dave Bales calls the CVSS system “completely broken,” noting many vulnerabilities receive a default high score of 9.8 without proper analysis.
  • Sridhar Muppidi suggests a “weaponization score”—which would measure how easily a vulnerability can be exploited—would be a far more practical metric for prioritization. The consensus is that exploitability and asset relevance are more important than a numerical score.

The Rise of Business Identity Compromise (BIC)

Also known as hiring fraud, BIC is an emerging scam where attackers use AI tools like deepfakes and text generators to pose as legitimate candidates for remote jobs. Once hired, these “insider threats” can steal data, compromise systems, or simply collect a paycheck to fund other illicit activities.

• A “Perfect Storm”: The rise of BIC is attributed to a combination of factors: the prevalence of remote work, increased reliance on AI tools in the hiring process, and immense pressure on HR departments to fill roles quickly.
• Countermeasures: Combating this requires a multi-pronged approach:
  • Technology: Implementing “liveness tests” during interviews to verify the applicant is a real person.
  • Process & Education: Training HR staff to recognize the signs of this new type of fraud.
  • Monitoring: Developing new methods to detect anomalous behavior in a remote work environment.

A Lighter Note: When Hackers Make Mistakes

The podcast concluded with the amusing story of a cybercriminal who installed Huntress EDR on their own machine, giving security researchers a front-row seat to their entire operation. This incident serves as a crucial reminder that adversaries are human and make “operational errors.” Sridhar Muppidi noted that such mistakes provide an invaluable “backstage pass” for defenders to study attacker methods and improve defenses.

• Tags:
• AI
• Cybersecurity
• Feature
• Ransomware
• Social Engineering
• Supply Chain Security
• OT Security
• Hiring Fraud