In this episode of the Intrusions InDepth Podcast, host Josh Stepp dives into the 2024 Polyfill.io incident, a wake-up call for the web development community that exposed the vulnerabilities of the internet’s sprawling infrastructure. What began as a trusted open-source service, used by over 100,000 websites to ensure cross-browser compatibility, turned into a vehicle for widespread malware distribution after its domain and GitHub repository were sold to a Chinese company, Funnull. Josh explores the timeline of the attack, the mechanics of the malicious JavaScript payloads, and the broader implications for open-source software and internet trust. With a mix of technical analysis, commentary on open-source economics, and a touch of conspiracy-adjacent speculation, this episode unpacks how a seemingly innocuous service became a vector for a global cyberattack and what it means for the future of the web.

Main Topics Discussed

* Polyfill.io Attack Overview

* Timeline of Events

* Malware Mechanics

* Open-Source Vulnerabilities

* Implications and Solutions

Call to Action:

* Subscribe to the podcast for more episodes on high-profile cyber intrusions.

* Visit our website at intrusionsindepth.com for additional stories and insights.

* Share your thoughts on social media using #IntrusionsInDepth.

Links and Resources:

* https://blog.qualys.com/vulnerabilities-threat-research/2024/06/28/polyfill-io-supply-chain-attack

* https://cside.dev/blog/the-polyfill-attack-explained

* https://therecord.media/polyfill-cloudflare-trade-barbs-supply-chain-attack

* https://news.ycombinator.com/item?id=40792136

* https://news.ycombinator.com/item?id=40804254

* https://risky.biz/RB755/

* https://web.archive.org/web/20230505112634/https://polyfill.io/v3/ownership-transfer

* https://web.archive.org/web/20230601214142/https://jakechampion.name/

* https://web.archive.org/web/20231011015804/https://polyfill.io/

* https://web.archive.org/web/20231101040617/https://polyfill.io/

* https://github.com/polyfillpolyfill/polyfill-service/commit/5f4fc040e09436371f70ffcebe47ca0e3cdccac0

* https://github.com/polyfillpolyfill/polyfill-service/commit/aa261a834b36131e8dbd20d725c6b5d773f736d9

* https://github.com/polyfillpolyfill/polyfill-service/issues/2892

* https://sansec.io/research/polyfill-supply-chain-attack

* https://www.theregister.com/2025/05/06/from_russia_with_doubt_go/

* https://huntedlabs.com/the-russian-open-source-project-that-we-cant-live-without/

* https://x.com/weirddalle/status/1922396432977346973

* https://www.berkshirehathaway.com/

* https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk/

* https://blog.cloudflare.com/automatically-replacing-polyfill-io-links-with-cloudflares-mirror-for-a-safer-internet/

* Host: Josh Stepp

* Produced by: Josh Stepp

Thank you for tuning in to IntrusionsinDepth. Stay informed, stay safe, and see you in the next episode!

Step back into the late 1980s and early 1990s in Sofia, Bulgaria, a nation transitioning from communism and becoming an unexpected epicenter for early computer virus creation. This episode delves into the story of Vesselin Bontchev, a young researcher studying the nascent threat of computer viruses, and the emergence of the notorious virus writer known only as "Dark Avenger". Explore the destructive nature of early viruses like "Eddie" and the escalating rivalry between Bontchev, who sought to counter the viral threat, and Dark Avenger, who released increasingly malicious code and even targeted Bontchev directly. Discover how American Sarah Gordon stumbled into this world, her interactions with Dark Avenger, and the creation of the revolutionary, dangerous Mutation Engine (MtE). We'll also examine the unique socio-economic conditions in Bulgaria that fostered this "Virus Factory," including a surplus of skilled tech enthusiasts with limited opportunities and widespread software piracy.

Main Topics Discussed

* The Bulgarian Virus Scene: The episode explores how Bulgaria, particularly Sofia, became a surprising hub for computer virus creation in the late 80s and early 90s, coinciding with the country's political and economic transition.

* Vesselin Bontchev vs. Dark Avenger: A central theme is the rivalry between Vesselin Bontchev, an anti-virus researcher, and the prolific, malicious virus writer known as Dark Avenger. This includes Dark Avenger's increasingly sophisticated viruses (like Eddie and Nomenklatura), his targeting of Bontchev and others, and Bontchev's efforts to analyze and combat the viruses.

* Sarah Gordon and the Mutation Engine (MtE): The story of Sarah Gordon, an American who became fascinated with the Bulgarian virus scene and interacted with Dark Avenger. This interaction led to Dark Avenger creating the groundbreaking and dangerous Mutation Engine (MtE), a tool allowing viruses to constantly change their code to evade detection.

* Psychology and Sociology of Virus Writing: The episode touches upon the motivations behind virus creation, including seeking fame, rebellion against authority, socio-economic factors like lack of opportunity and widespread software piracy in Bulgaria, and Sarah Gordon's research into the mindset of virus writers.

* Early Computer Viruses and Anti-Virus Efforts: The discussion covers the nature and mechanics of early computer viruses (e.g., infecting .com/.exe files, corrupting disk sectors, targeting the FAT) and the nascent anti-virus techniques and communities forming to combat them (like CARO and FidoNet).

Call to Action:

* Subscribe to the podcast for more episodes on high-profile cyber intrusions.

* Visit our website at intrusionsindepth.com for additional stories and insights.

* Share your thoughts on social media using #IntrusionsInDepth.

Links and Resources:

* https://bontchev.nlcv.bas.bg/papers/factory.html#The%20Dark%20Avenger

* https://www.f-secure.com/v-descs/eddie.shtml

* https://www.theguardian.com/news/2023/may/09/on-the-trail-of-the-dark-avenger-the-most-dangerous-virus-writer-in-the-world

* https://en.wikipedia.org/wiki/Sarah_Gordon_(computer_scientist)

* Fancy Bear Goes Phishing: The Dark History of the Information Age, in Five Extraordinary Hacks by Scott J. Shapiro

* https://(.)youtu.be/1iq9w5Tn_DQ

* https://(.)www.youtube.com/watch?v=NtJ0CQ7K6_4&ab_channel=DEFCONConference

* Host: Josh Stepp

* Produced by: Josh Stepp

Thank you for tuning in to IntrusionsinDepth. Stay informed, stay safe, and see you in the next episode!

Episode Description:

Dive into the complex world of cybersecurity and geopolitics with this addendum episode of Intrusions in Depth, hosted by Josh Stapp. Expanding on the Salt Typhoon episode, this podcast explores China's strategic cyber operations, global ambitions, and the evolving nature of modern warfare. From hacking tactics to pursuing economic and military dominance. Learn how groups like Salt Typhoon fit into China's broader geopolitical goals.

Main Topics Discussed:

* China’s Strategic Goals and the "China Dream": Examines Xi Jinping’s vision for China’s rejuvenation, aiming for economic prosperity, technological leadership, and military strength by 2049, with initiatives like Made in China 2025 and the Belt and Road Initiative.

* Evolution of Warfare and Unrestricted Warfare Doctrine: Analyzes how China’s approach to warfare, inspired by the 1999 book Unrestricted Warfare, blends cyber, economic, and psychological tactics to exploit vulnerabilities, contrasting with Western military strategies.

* The AI Race and Technological Competition: Explores the U.S.-China race for AI dominance, highlighting differences in innovation styles, data privacy approaches, and the role of AI as a force multiplier in modern conflicts.

* Soft Power and Global Influence: Discusses China’s soft power strategies, including cultural exports like Confucius Institutes, economic diplomacy via the Belt and Road Initiative, and narrative control to shape global perceptions.

* Deterrence and Defense Against Cyber Threats: Proposes solutions to counter groups like Salt Typhoon, weighing the challenges of bolstering cyber defenses and imposing economic or diplomatic costs on adversaries without escalating conflicts.

Call to Action:

* Subscribe to the podcast for more episodes on high-profile cyber intrusions.

* Visit our website at intrusionsindepth.com for additional stories and insights.

* Share your thoughts on social media using #IntrusionsInDepth.

Links and Resources:

* https://fs.blog/bias-conjunction-fallacy/

* https://en.wikipedia.org/wiki/Torrijos%E2%80%93Carter_Treaties

* https://en.wikipedia.org/wiki/Operation_Fox_Hunt

* https://en.wikipedia.org/wiki/Chinese_intelligence_activity_abroad

* https://www.sentinelone.com/labs/cyber-soft-power-chinas-continental-takeover/

* https://www.propublica.org/article/operation-fox-hunt-how-china-exports-repression-using-a-network-of-spies-hidden-in-plain-sight

* https://foreignpolicy.com/2018/10/11/if-the-u-s-doesnt-control-corporate-power-china-will/

* https://www.fbi.gov/news/speeches/the-threat-posed-by-the-chinese-government-and-the-chinese-communist-party-to-the-economic-and-national-security-of-the-united-states

* https://en.wikipedia.org/wiki/Alberto_Fujimori

* https://en.wikipedia.org/wiki/Ferdinand_Marcos

* https://foreignpolicy.com/2025/01/07/china-salt-typhoon-hack-threat-panic-washington/

* https://scholarworks.uvm.edu/cgi/viewcontent.cgi?article=1440&context=hcoltheses

* https://luluyan.medium.com/deepseeks-prompt-engineering-secret-there-is-no-secret-8107b14e1e56

* https://www.vellum.ai/blog/the-training-of-deepseek-r1-and-ways-to-use-it

* https://www.techtarget.com/whatis/feature/DeepSeek-explained-Everything-you-need-to-know

* https://www.theguardian.com/world/2019/mar/11/china-database-lists-breedready-status-of-18-million-women

* https://www.cfr.org/backgrounder/made-china-2025-threat-global-trade

* https://apt.etda.or.th/cgi-bin/showcard.cgi?g=APT%2031%2C%20Judgment%20Panda%2C%20Zirconium&n=1

* https://www.sentinelone.com/labs/cyber-soft-power-chinas-continental-takeover/

* https://breakingdefense.com/2021/09/chinas-new-data-security-law-will-provide-it-early-notice-of-exploitable-zero-days/

* https://en.wikipedia.org/wiki/Made_in_China_2025

* https://en.wikipedia.org/wiki/Century_of_humiliation

Books:

* Mindf*ck: Cambridge Analytica and the Plot to Break America

by Christopher Wylie

* Targeted: My Inside Story of Cambridge Analytica and How Trump and Facebook Broke Democracy by Brittany Kaiser

* Unrestricted Warfare: China's Master Plan to Destroy America

by Qiao Liang, Wang Xiangsui

* Principles for Dealing with the Changing World Order: Why Nations Succeed and Fail by Ray Dalio

Credits:

* Host: Josh Stepp

* Produced by: Josh Stepp

Thank you for tuning in to Intrusions in Depth. Stay informed, stay safe, and see you in the next episode!

Episode Description:

This episode of The IntrusionsinDepth Podcast released on March 15, 2025, explores the Chinese hacking group Salt Typhoon, a sophisticated cyber-espionage outfit linked to the Ministry of State Security that infiltrated nine U.S. telecom companies and the Treasury by exploiting vulnerabilities in Cisco and BeyondTrust systems. The host traces the group’s evolution from its broad 2019 attacks on Southeast Asia to its refined 2023-2025 campaigns, wielding custom malware like Ghost Spider to steal sensitive data from telecoms, governments, and tech sectors worldwide. With aliases like Ghost Emperor and UNC2286, Salt Typhoon’s history builds on decades of Chinese cyber operations—shifting from the PLA’s early economic theft to the MSS’s strategic espionage—culminating in recent breaches exposing D.C.-area VIP calls and unclassified Treasury documents. The U.S. response of symbolic sanctions on a Chinese firm and an MSS-affiliated hacker underscores the ongoing challenges with groups like this.

Main Topics Discussed:

1. Who is Salt Typhoon?

* Known by aliases like Ghost Emperor and UNC2286, they’ve been active since 2019, tied to China’s MSS.

* Targets include telecoms, governments, and tech globally, with a focus on espionage.

2. History of Chinese Cyber Attacks

* Early attacks (2003-2010s) by the PLA stole tech secrets, like Operation Aurora against Google.

* Modern APTs like Salt Typhoon showing more refined, widespread operations.

3. Salt Typhoon’s Campaigns

* Early hits (2019-2022) targeted Southeast Asia; later ones (2023-2025) hit U.S. telecoms and Treasury.

* Malware like Ghost Spider evolved, using clever tricks to stay hidden and adaptable.

4. U.S. Attacks & Response

* Recent breaches exposed D.C.-area VIP calls and Treasury data via Cisco and BeyondTrust flaws.

* U.S. countered with symbolic sanctions on a Chinese firm and hacker, Yin Jinping, but the threat persists.

Call to Action:

* Subscribe to the podcast for more episodes on high-profile cyber intrusions.

* Visit our website at intrusionsindepth.com for additional stories and insights.

* Share your thoughts on social media using #IntrusionsInDepth.

Links and Resources:

* https://blog.polyswarm.io/salt-typhoon-targets-telecoms-with-ghostspider?

* https://www.npr.org/2024/12/17/nx-s1-5223490/text-messaging-security-fbi-chinese-hackers-security-encryption

* https://www.cisa.gov/sites/default/files/2024-12/guidance-mobile-communications-best-practices.pdf

* https://techcrunch.com/2024/10/13/meet-the-chinese-typhoon-hackers-preparing-for-war/

* https://mashable.com/article/salt-typhoon-breach-att-verizon-clear

* https://techcrunch.com/2024/12/04/fbi-recommends-encrypted-messaging-apps-combat-chinese-hackers/

* https://techcrunch.com/2024/10/07/the-30-year-old-internet-backdoor-law-that-came-back-to-bite/

* https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b

* https://www.reuters.com/technology/cybersecurity/us-adds-9th-telcom-list-companies-hacked-by-chinese-backed-salt-typhoon-2024-12-27/

* https://therecord.media/nine-us-companies-hacked-salt-typhoon-china-espionage

* https://en.wikipedia.org/wiki/Ministry_of_State_Security_(China)

* https://en.wikipedia.org/wiki/2010%E2%80%932012_killing_of_CIA_sources_in_China?

* https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/

* https://www.justice.gov/opa/pr/member-sophisticated-china-based-hacking-group-indicted-series-computer-intrusions-including

* https://cloud.google.com/blog/topics/threat-intelligence/chinese-espionage-tactics/

* https://www.fbi.gov/news/stories/chinese-hackers-charged-in-equifax-breach-021020

* https://en.wikipedia.org/wiki/Operation_Fox_Hunt

* https://en.wikipedia.org/wiki/Salt_Typhoon

* https://www.theguardian.com/us-news/2021/oct/27/us-bans-china-telecom-from-operating-over-national-security-concerns

* https://www.theguardian.com/technology/2020/jan/21/amazon-boss-jeff-bezoss-phone-hacked-by-saudi-crown-prince

* https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/analyzing-salt-typhoon-telecom-attacker/

* https://www.crowdstrike.com/en-us/blog/an-analysis-of-lightbasin-telecommunications-attacks/

* https://www.reuters.com/technology/china-linked-hacking-group-accessing-calling-records-worldwide-crowdstrike-says-2021-10-19/

* https://www.darkreading.com/data-privacy/chinese-apt-backdoor-found-in-ccleaner-supply-chain-attack

* https://news.sky.com/story/obama-tells-china-president-hacking-must-stop-10345126

* https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach

* https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf

* https://en.wikipedia.org/wiki/PLA_Unit_61398

* https://en.wikipedia.org/wiki/Titan_Rain

* https://www.csis.org/programs/strategic-technologies-program/survey-chinese-espionage-united-states-2000

* https://www.nytimes.com/2024/12/16/us/politics/biden-administration-retaliation-china-hack.html

* https://github.com/shadow1ng/fscan/blob/main/README_EN.md

* https://github.com/sensepost/reGeorg

* https://www.cisa.gov/sites/default/files/2024-05/MAR-10448362.c1.v2.CLEAR_.pdf

* https://proxylogon.com/

* https://www.picussecurity.com/resource/blog/salt-typhoon-removing-chinese-telecom-equipment

* https://threatpost.com/famoussparrow-spy-hotels-governments/174948/

* https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf

* https://www.trendmicro.com/en_us/research/24/k/earth-estries.html

* https://cyberscoop.com/suspected-chinese-hackers-took-advantage-of-microsoft-exchange-vulnerability-to-steal-call-records/

* https://portswigger.net/daily-swig/a-whole-new-attack-surface-researcher-orange-tsai-documents-proxylogon-exploits-against-microsoft-exchange-server

* https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/

* https://cyberscoop.com/famoussparrow-eset-microsoft-exchange-proxylogon/

* https://www.c4isrnet.com/cyber/2024/04/10/secretive-us-cyber-force-deployed-22-times-to-aid-foreign-governments/

* https://www.meritalk.com/articles/report-salt-typhoon-using-backdoor-malware-tactics/

* https://www.wsj.com/politics/national-security/u-s-officials-race-to-understand-severity-of-chinas-salt-typhoon-hacks-6e7c3951

* https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/

* https://www.trendmicro.com/en_us/research/23/g/supply-chain-attack-targeting-pakistani-government-delivers-shad.html

* https://www.trendmicro.com/en_us/research/24/k/breaking-down-earth-estries-persistent-ttps-in-prolonged-cyber-o.html

* https://cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda-zero-day-remediation

* https://www.trendmicro.com/en_us/research/24/k/earth-estries.html

* https://www.bleepingcomputer.com/news/security/salt-typhoon-hackers-backdoor-telcos-with-new-ghostspider-malware/

* https://cyberscoop.com/chinese-hack-nsa-tool-check-point/

* https://teamwin.in/index.php/2025/02/15/redmike-hackers-exploited-1000-cisco-devices-to-gain-admin-access/

* https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally

* https://cyberscoop.com/treasury-sanctions-chinese-cybersecurity-company-salt-typhoon-hacks/

* https://www.techtarget.com/searchsecurity/news/366617509/Treasury-Department-breached-through-BeyondTrust-service

* https://www.bleepingcomputer.com/news/security/us-treasury-department-breached-through-remote-support-platform/

* https://cyberscoop.com/salt-typhoon-us-telecom-hack-earth-estries-trend-micro-report/

* https://www.reuters.com/technology/cybersecurity/us-treasury-dept-issues-sanctions-related-salt-typhoon-hack-2025-01-17/

* https://www.wired.com/story/us-names-one-of-the-hackers-allegedly-behind-massive-salt-typhoon-breaches/

* https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices

* https://risky.biz/BTN106/

* https://en.wikipedia.org/wiki/Salt_Typhoon

* https://jsac.jpcert.or.jp/archive/2025/pdf/JSAC2025_1_5_leon-chang_theo-chen_en.pdf

* https://learn.microsoft.com/en-us/defender-xdr/microsoft-threat-actor-naming

* https://nvd.nist.gov/vuln/detail/cve-2023-2868

* https://www.washingtonpost.com/national-security/2024/11/21/salt-typhoon-china-hack-telecom/

* https://malpedia.caad.fkie.fraunhofer.de/actor/ghostemperor

* https://www.sentinelone.com/labs/cyber-soft-power-chinas-continental-takeover/

* https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/

* https://blog.talosintelligence.com/salt-typhoon-analysis/

Credits:

* Host: Josh Stepp

* Produced by: Josh Stepp

Thank you for tuning in to IntrusionsinDepth Podcast. Stay informed, stay safe, and see you in the next episode!

Episode Description:

Welcome to the first Ask Me Anything (AMA) episode of The Intrusions in Depth Podcast! Host Josh Stepp takes a break from scripting his next deep-dive episode to answer listener questions in an unscripted, off-the-cuff format. To kick off this new series, Josh tackles a listener's question about the TikTok ban, its national security implications, and President Trump’s decision to delay enforcement for 75 days. 

What starts as a straightforward discussion spirals into a multi-faceted analysis—covering creators, consumers, legal ambiguities, historical precedents, and even a bit of conspiracy theorizing. From Romanian election recalls to the potential for government ownership of social media, Josh explores the messy intersection of technology, democracy, and geopolitics. Whether you’re a TikTok skeptic or a free-speech advocate, this episode offers plenty to chew on.Joining the mailing list to participate:

Main Topics Discussed

* The TikTok Ban Overview

* Listener question: Thoughts on the TikTok ban, national security allegations, and Trump’s 75-day enforcement delay.

* Josh’s approach: Analyzing the issue through multiple lenses—creators, consumers, the platform itself, legal precedent, and conspiracy angles.

* Creators and Consumers

* Sympathy for creators who rely on TikTok for livelihoods, especially those with limited job prospects (e.g., ex-felons, mental health challenges).

* Counterpoint: National security may outweigh individual needs; alternative platforms (YouTube Shorts, Instagram Reels, etc.) exist for diversification.

* Audience perspective: Claims of First Amendment violations are weak—governments already limit speech for security (e.g., classification).

* National Security and Precedents

* Historical examples: FDR’s Office of Censorship post-Pearl Harbor, Trump’s WeChat ban, and Russia’s Sputnik/RT restrictions.

* TikTok concerns: Data harvesting by China, potential influence ops, and speculative backdoor risks (e.g., Pegasus-style exploits).

* Comparison: U.S. tech giants (Meta, Google, X) could pose similar risks—why single out TikTok?

* The Law Itself

* Critique of the TikTok ban legislation: Vague terms (“foreign adversary,” “significant threat”) invite abuse.

* Hypothetical misuse: Could target platforms like X if tied to foreign influence (e.g., Musk’s China ties).

* Suggestion: Write clearer laws (e.g., ban data transmission to China) rather than broad, ambiguous bans.

* Romanian Election Recall (2024)

* Context: Far-right candidate’s lead annulled due to alleged TikTok interference (possibly Russian-linked).

* Pro-recall: Evidence of coordinated campaigns; protects electoral integrity.

* Anti-recall: Evidence is circumstantial; risks censorship and voter agency.

* Broader issue: Balancing tech, democracy, and free speech in the digital age.

* Conspiracy Time

* Theories debunked: TikTok moving servers to Meta during a blackout—impractical for modern apps.

* Speculation: Congress’s shift possibly due to classified briefings (e.g., NSA findings).

* Trump’s reversal: Political strategy, donor influence (Jeff Yass), or a deal-making play for U.S. ownership.

* Trump’s 75-Day Delay and Future Outlook

* Possible motives: Appealing to young voters, donor pressure, or negotiating U.S. stakes in TikTok.

* Innovative idea: Government ownership of tech stakes (e.g., Alaska’s oil fund model) to benefit taxpayers.

* Prediction: Ban likely upheld, but TikTok persists under U.S. ownership (e.g., Oracle, Musk).

Call to Action:

* Subscribe to the podcast for more episodes on high-profile cyber intrusions.

* Visit our website at intrusionsindepth.com for additional stories and insights.

* Share your thoughts on social media using #IntrusionsInDepth.

Links and Resources:

* http(s)://www.youtube.com/watch?v=e1pTCSFrkbk&ab_channel=All-InPodcast

* https://en.wikipedia.org/wiki/Office_of_Censorship

* https://newsroom.tiktok.com/en-eu/continuing-to-protect-the-integrity-of-tiktok-during-romanian-elections

* https://www.bbc.com/news/articles/cm2v13nz202o

* https://x.com/mtaibbi/status/1865269938597879902

* https://x.com/mtracey/status/1865097680805839008

Credits:

* Host: Josh Stepp

* Produced by: Josh Stepp

Thank you for tuning in to Intrusions inDepth. Stay informed, stay safe, and see you in the next episode!

Episode Description:

Intrusions and Depth welcomes its first-ever guest, John Prieto, a cybersecurity professional with experience at CrowdStrike, Mandiant, USAA, and the U.S. Air Force. Together, they dissect the chaotic rise and fall of the Lapsus$ hacking group—a crew of teenagers who turned the cybersecurity world upside down with brazen attacks on tech giants like Microsoft, Nvidia, and Rockstar Games.

Josh and John explore how Lapsus$ used social engineering, MFA fatigue, and even taunted their victims on social media, all while making rookie mistakes that led to their downfall. They also dive into the murky world of ransomware crews, the evolution of financially motivated cybercrime, and the blurred lines between threat actor clustering and sanctions.

Main Topics Discussed:

* Lapsus$: The Chaotic Rise & Brazen Attacks

* How a group of teenagers breached top corporations using unsophisticated yet highly effective tactics.

* Their public Telegram channel, taunts, and lack of operational security (OPSEC).

* Incident Response & Attribution Challenges

* John shares behind-the-scenes insights from responding to Lapsus$ intrusions.

* How security firms track threat actors despite constantly changing tactics and naming conventions.

* The Immature Yet Dangerous Nature of APT Teens

* Comparing Lapsus$ to professional ransomware gangs—why their unpredictability made them so dangerous.

* The business dynamics of Ransomware as a Service.

* The Future of Cybercrime & Security Lessons

* The rising threat of hacktivist-style APT teens and their potential impact on infrastructure.

Call to Action:

* Subscribe to the podcast for more episodes on high-profile cyber intrusions.

* Visit our website at intrusionsindepth.com for additional stories and insights.

* Share your thoughts on social media using #IntrusionsInDepth.

Links and Resources:

* htt(p)s://www.youtube.com/watch?ab_channel=NextGenHacker101

* https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf

* https://www.microsoft.com/en-us/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/

Support the Podcast! USE MY LINKS!!

* deleteme.com promotional link

Credits:

* Host: Josh Stepp

* Produced by: Josh Stepp

Thank you for tuning in to Intrusions in Depth. Stay informed, stay safe, and see you in the next episode!

PsyOps, short for psychological operations, involves the use of tactics to influence emotions, perceptions, and behavior. This series explores the diverse applications of psychological influence, from media strategies to social interactions. There’s no specific order or structured episodes—each piece stands on its own, offering unique insights into the power of persuasion. To explore the entire series, click here

Episode Description:

In this episode of Intrusions InDepth, Josh Stepp explores the fascinating world of psychological operations (PSYOPs) and information warfare. Using a recent 60 Minutes interview about alleged Mossad operations against Hezbollah as a case study, Josh delves into the tactics, ethics, and impact of these covert influence campaigns while analyzing the interview itself as a PsyOp, highlighting the power of narrative control and perception manipulation in modern conflicts.

Topics Discussed:

* PsyOp Fundamentals: An overview of PsyOp, their purpose, and applications in various contexts.

* The Pager and Walkie Talkie Attacks: A detailed account of the alleged Mossad operation, including the meticulous planning, device modification, and execution of the attacks on Hezbollah.

* The 60 Minutes Interview as a PsyOp: An analysis of the interview itself as a strategic tool for information warfare, shaping perceptions, and influencing adversaries.

* Open Source Intelligence (OSINT) Analysis: A demonstration of OSINT analysis techniques using the 60 Minutes interview as an example, evaluating source credibility and identifying potential motives behind the information.

* The Ethics and Effectiveness of PSYOPs: A discussion on the ethical considerations surrounding PSYOPs and their effectiveness in achieving long-term strategic goals.

Call to Action:

* Subscribe to the podcast for more episodes on high-profile cyber intrusions.

* Visit our website at intrusionsindepth.com for additional stories and insights.

* Share your thoughts on social media using #IntrusionsInDepth.

Links and Resources:

* https://www.cbsnews.com/news/israeli-mossad-pager-walkie-talkie-hezbollah-plot-60-minutes/

* https://irp.fas.org/doddir/army/atp2-22-9.pdf

* https://www.bunniestudios.com/blog/2024/turning-everyday-gadgets-into-bombs-is-a-bad-idea/

* https://www.reuters.com/world/middle-east/irans-ambassador-lebanon-injured-by-pager-explosion-2024-09-17/

* By Way of Deception by Victor Ostrovsky & Claire Hoy

* https://en.wikipedia.org/wiki/Calls_for_the_destruction_of_Israel

* https://www(.)youtube(.)com/watch?v=FLUUUZWjfGk&t=1s&pp=ygURNjAgbWludXRlcyBtb3NzYWQ%3D

Credits:

* Host: Josh Stepp

* Produced by: Josh Stepp

Thank you for tuning in to Intrusions in Depth. Stay informed, stay safe, and see you in the next episode!

Episode Description:

In this episode of Intrusions and Depth, Josh Stepp unpacks the audacious rise and chaotic downfall of the Lapsus$ hacking collective. Known for targeting some of the biggest names in technology, including Microsoft, Nvidia, and Rockstar Games, this group rewrote the playbook on cybercrime with tactics as unconventional as their teenage leadership. From SIM-swapping and MFA fatigue attacks to social engineering and public Telegram boasts, Josh examines how Lapsus$ exposed glaring vulnerabilities in global cybersecurity defenses while raising ethical questions about balancing punishment and rehabilitation for young offenders.

Main Topics Discussed:

* The Rise of Lapsus$

* Lapsus$ emerged in 2021 as a flamboyant hacking group known for bold, public-facing tactics, including defacing websites and leaking sensitive corporate data.

* Their attacks included high-profile breaches at companies like Microsoft, Nvidia, Uber, and Rockstar Games.

* Methods and Tactics

* Lapsus$ favored social engineering over sophisticated exploits, using techniques like SIM-swapping, MFA fatigue, and exploiting support team access to gain entry.

* A notable hallmark was their public taunting of victims and recruitment via Telegram.

* High-Profile Breaches

* Nvidia: Demanded removal of the cryptocurrency mining limiter from GPUs, escalating into a public back-and-forth.

* Microsoft: Compromised 37GB of source code for Bing and other internal projects.

* Rockstar Games: Leaked early footage of Grand Theft Auto VI, sparking fan outrage and security debates.

* The Downfall

* Arrests in 2022 and 2023 revealed the group’s youthful composition, with some members as young as 16.

* The sentencing of leader Arion Kurtaj to indefinite detention highlighted the intersection of cybercrime and mental health issues.

* Lessons for Cybersecurity

* Reflections on how Lapsus$ forced global organizations to rethink their reliance on MFA and social engineering defenses.

Call to Action:

* Subscribe to the podcast for more episodes on high-profile cyber intrusions.

* Visit our website at intrusionsindepth.com for additional stories and insights.

* Share your thoughts on social media using #IntrusionsInDepth.

Links and Resources:

* https://www.bbc.com/news/technology-66549159

* https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf

* https://www.reuters.com/world/americas/bolsonaro-dismisses-vaccination-requirement-entry-into-brazil-2021-12-07/

* https://www.reuters.com/technology/brazils-health-ministry-website-hit-by-hacker-attack-systems-down-2021-12-10/

* https://www.zdnet.com/article/brazilian-ministry-of-health-suffers-cyberattack-and-covid-19-vaccination-data-vanishes/

* https://www.microsoft.com/en-us/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/

* https://blog.checkpoint.com/security/lapsus-ransomware-gang-uses-stolen-source-code-to-disguise-malware-files-as-trustworthy-check-point-customers-remain-protected/

* https://malpedia.caad.fkie.fraunhofer.de/actor/lapsus

* https://www.aha.org/system/files/media/file/2022/04/hc3-tlp-white-threat-briefing-lapsus%24-okta-and-the-health-sector-4-7-22.pdf

* https://techcommunity.microsoft.com/discussions/securityandcompliance/new-blog-post--dev-0537-criminal-actor-targeting-organizations-for-data-exfiltra/3264957

* https://en.wikipedia.org/wiki/Samy_Kamkar

* https://krebsonsecurity.com/2022/04/the-original-apt-advanced-persistent-teenagers/

* https://unit42.paloaltonetworks.com/lapsus-group/

* https://x.com/vxunderground/status/1506114493067186183/photo/4

* https://www.darkreading.com/cyberattacks-data-breaches/ransomware-group-s-claim-that-it-hacked-okta-prompts-concerns-of-another-solarwinds

* https://www.law.cornell.edu/wex/chevron_deference

* https://www.zscaler.com/blogs/product-insights/what-you-need-know-about-lapsus-supply-chain-attacks

* https://www.uber.com/newsroom/security-update

* https://blog.avast.com/nvidia-allegedly-hacks-back-avast

* https://www.crn.com/news/security/nvidia-hacks-ransomware-gang-back-to-block-data-leaks-group-claims?

* https://www.spiceworks.com/it-security/data-security/news/nvidia-data-breach-lapsus/

* https://www.threatdown.com/blog/nvidia-the-ransomware-breach-with-some-plot-twists/

* https://www.wired.com/story/lapsus-hacking-group-extortion-nvidia-samsung/

* https://www.optimumsr.co.uk/anniversary-of-the-lapsus-hack-on-rockstar-what-have-we-learned/

* https://www.bleepingcomputer.com/news/security/e-commerce-giant-mercado-libre-confirms-source-code-data-breach/

* https://www.bleepingcomputer.com/news/security/samsung-confirms-hackers-stole-galaxy-devices-source-code/

* https://www.bleepingcomputer.com/news/security/nvidia-data-breach-exposed-credentials-of-over-71-000-employees/

* https://www.bleepingcomputer.com/news/security/lapsus-hacker-behind-gta-6-leak-gets-indefinite-hospital-sentence/

* https://therecord.media/rockstar-confirms-cyberattack-leak-of-confidential-data-including-gta-6-footage

* https://therecord.media/british-prosecutors-accuse-teen-lapsus-member-of-uber-revolut-rockstar-hacks

* https://flashpoint.io/blog/lapsus/

* https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-they-were-hacked-by-lapsus-extortion-group/

* https://www.aha.org/system/files/media/file/2022/04/hc3-tlp-white-threat-briefing-lapsus%24-okta-and-the-health-sector-4-7-22.pdf

* https://x.com/davidmarcus/status/1862867849988944361

* https://www.businessinsider.com/meta-libra-crypto-project-regulators-david-marcus-2024-12

* https://archive.is/xGIdu

* https://www.sophos.com/en-us/content/pacific-rim

* https://www.brennancenter.org/our-work/analysis-opinion/house-passes-section-702-reauthorization-bill-without-protections-against

Credits:

* Host: Josh Stepp

* Produced by: Josh Stepp

Thank you for tuning in to Intrusions in Depth. Stay informed, stay safe, and see you in the next episode!

Episode Description: This episode breaks down insights from the 2024 Global Threat Report by Elastic and the 2024 Digital Defense Report from Microsoft. It explores the blurring lines between state-sponsored hackers and cybercriminals, the rising role of generative AI in cyber-attacks and propaganda, and the use of commodity malware by sophisticated threat actors.

Josh shares both the report highlights and his reflections on how these trends reshape the cybersecurity landscape, especially in light of ongoing geopolitical tensions.

Topics Discussed:

* Blurred Lines Between Nation-State and Cybercriminal Activities

How state-sponsored actors, including those from North Korea and Iran, increasingly adopt criminal tactics for financial gain, with North Korea using cybercrime to fund its nuclear and missile programs.

* Generative AI and Its Role in Cyber Threats

A deep dive into the uses of generative AI by both defenders and attackers, including the development of sophisticated phishing scams, influence operations, and automated malware production.

* Commodity Malware and Open-Source Tools

The use of off-the-shelf hacking tools like Cobalt Strike and Sliver, which simplify cyber operations for threat actors. Josh explores how these tools blur the line between advanced and lower-skill attacks.

* Social Engineering and AI-Powered Phishing

Insights from the reports show how generative AI enables more tailored and realistic phishing campaigns, amplifying the effectiveness of social engineering at scale.

* State-Backed Influence Operations via AI

Case studies of AI-driven influence campaigns, including Russia’s deepfake audio tactics in Slovakia and China’s misinformation campaigns, demonstrate AI’s role in sowing discord and manipulating public perception globally.

Call to Action:

* Subscribe to the podcast for more episodes on high-profile cyber intrusions.

* Visit our website at intrusionsindepth.com for additional stories and insights.

* Share your thoughts on social media using #IntrusionsInDepth.

Links and Resources:

* https://www.elastic.co/resources/security/report/global-threat-report

* https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/microsoft-digital-defense-report-2024

* https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

* https://cloud.google.com/blog/topics/threat-intelligence/apt45-north-korea-digital-military-machine

* https://malpedia.caad.fkie.fraunhofer.de/details/win.sliver

* https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/

* https://attack.mitre.org/groups/G0138/

* https://learn.microsoft.com/en-us/defender-xdr/microsoft-threat-actor-naming

* https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/

* https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-048a

* https://cloud.google.com/blog/topics/threat-intelligence/apt42-charms-cons-compromises

* https://www.reuters.com/world/us/accused-iranian-hackers-successfully-peddle-stolen-trump-emails-2024-10-25/

* https://www.reuters.com/world/us-issues-iran-related-sanctions-over-election-interference-2024-09-27/

* https://www.npr.org/2023/09/28/1202110410/how-rumors-and-conspiracy-theories-got-in-the-way-of-mauis-fire-recovery

* https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big-sleep.html

* https://securityintelligence.com/articles/malicious-ai-worm-targeting-generative-ai/

* https://cert.gov.ua/article/6278521

* https://cloud.google.com/blog/topics/threat-intelligence/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor

Credits:

* Host: Josh Stepp

* Produced by: Josh Stepp

Thank you for tuning in to Intrusions in Depth. Stay informed, stay safe, and see you in the next episode!

Episode Description: In this episode of IntrusionsInDepth, host Josh Stepp uncovers the story of how a Ukrainian-developed artillery targeting app, designed to assist soldiers on the battlefield, was compromised by the Russian cyber espionage group Fancy Bear. The episode explores the technical breakdown of the malware used, its devastating impact on Ukrainian forces, and the broader implications of integrating technology into warfare. Josh takes listeners through the timeline of events from 2014-2016 and discusses the challenges of attribution, malware analysis, and the future of cyber warfare as an integrated component of military operations.

Main Topics Discussed:

* The Compromise of the D-30 Howitzer App

* The episode kicks off with a discussion on the Ukrainian artillery officer Yaroslav Sherstuk’s development of the Correction-D30 app, which sped up artillery targeting. Fancy Bear, a Russian cyber espionage group, inserted X-Agent malware into a trojanized version of the app, leading to devastating consequences for Ukrainian artillery.

* Understanding the D-30 Howitzer

* Josh explains the technical aspects of the D-30 Howitzer, a Soviet-designed 122mm artillery piece, and how the Correction-D30 app was designed to speed up targeting calculations, increasing efficiency and accuracy in battle.

* Fancy Bear and the X-Agent Malware

* The episode provides an in-depth analysis of Fancy Bear’s use of the X-Agent malware in compromising the app. This includes a technical breakdown of how the malware worked, including its reconnaissance capabilities, use of Android’s built-in APIs, and its ability to collect sensitive data from infected devices.

* Impact of the Malware on Ukrainian Forces

* Josh examines how the malware allowed Russian forces to track Ukrainian artillery movements, leading to the loss of up to 20% of Ukraine’s D-30 Howitzers in combat. The discussion touches on the implications of this kind of cyber warfare for real-world military tactics.

* Attribution Challenges

* The episode delves into the complexities of attributing the attack to Fancy Bear, touching on the challenges of tracking malware use across different threat actors. Josh discusses how Crowdstrike and other security firms identified Fancy Bear’s involvement and the challenges of confirming attribution with certainty.

Call to Action:

* Subscribe to the podcast for more episodes on high-profile cyber intrusions.

* Visit our website at intrusionsindepth.com for additional stories and insights.

* Share your thoughts on social media using #IntrusionsInDepth.

Links and Resources:

* https://www.crowdstrike.com/wp-content/brochures/FancyBearTracksUkrainianArtillery.pdf

* https://web-assets.esetstatic.com/wls/2016/10/eset-sednit-part-2.pdf

* https://en.interfax.com.ua/news/general/395186.html

* https://blog.focal-point.com/focal-point-releases-malware-analysis-of-android-x-agent-implant

* https://www.scribd.com/document/468214030/X-Agent-Malware-Technical-Analysis-Focal-Point

* https://www.realclearinvestigations.com/articles/2020/05/13/hidden_over_2_years_dem_cyber-firms_sworn_testimony_it_had_no_proof_of_russian_hack_of_dnc_123596.html

* https://www.crowdstrike.com/en-us/blog/bears-midst-intrusion-democratic-national-committee/

* Change Agents - Dmitri Alperovitch

Books:

* Fancy Bear Goes Phishing: The Dark History of the Information Age, in Five Extraordinary Hacks by Scott J. Shapiro

Credits:

* Host: Josh Stepp

* Produced by: Josh Stepp

Thank you for tuning in to Intrusions in Depth. Stay informed, stay safe, and see you in the next episode!