Marcus Hutchins

Since my posts have been shared here ~30 times in the past few weeks, it seems like I'm going to be contributing to Space Karen's Ketamine Extravaganza whether I like it or not.

I don't really intend to be active here, but I'll post some of the more important cybersecurity-focused stuff, since it gets screenshotted anyway. That way, people don't have to read post a week late and out of context.

idk about this whole "AI enables attackers to write more effective phishing emails" thing. If AI slop is more effective than you at phishing, you should probably take that information to the grave. Couldn't waterboard it out of me.

When I think of highly effective autonomous attacks, I don't think of anything from the AI era. I think of Emotet. I'd argue it was the pinnacle of sophistication for at-scale financially-motivated malware operations.

The malware lands on a corporate endpoint, immediately exfiltrates the victim's SMTP (email) credentials, as well as their email inbox. Their inbox gets sent to the threat actor's backend processing pipeline, which scrapes the victim's inbox for email threads where the last reply was by someone other than the victim.

The pipeline then crafts a reply to the email thread containing a backdoored Microsoft Office document, which is usually presented as an invoice or something time-sensitive that the target is likely to open. The emails were then farmed out to the infected systems, and sent using legitimate stolen SMTP credentials.

The use of legit credentials + corporate systems as spam bots bypassed SPF / DKIM, and IP based spam blocklists, ensuring the email was highly likely to land in the target's inbox, not get blocked or sent to spam.

The recipient receives an email from a party they know, trust, have had previous communications with, and is in reply to an existing email exchange between the target and victim. Basically email worm meets extremely effective spearphishing at scale.

They say you don't gotta hand it to them, but you kinda do. The engineering that went into this botnet's infrastructure was incredible. The pipeline had a polymorphic engine that would rewrite the malware's code every time antivirus vendors tried to add detections for it. It put plenty of state-sponsored malware operations to shame.

The malware was so effective that 8 different countries banded together to stop it. They hacked into the command-and-control infrastructure, then used the malware's self-update command to push out code that removed the malware from the system and then deletes itself.

It set precedent for governments being able to, in extreme circumstances, mass-hack victim systems and deploy code designed to disinfect said systems. Previously, there was only law enforcement precedent for triggering the malware's built in remove command, displaying warning messages, or simply just seizing / hijacking the control infrastructure.

The botnet had been running for about 12 years when it was taken out in 2021. They just don't make malware like they used to. Everything from the post AI-era is borderline slop and I'm bored out of my mind analyzing it.

The below image is what the Microsoft Office documents the target received would look like. Clicking the "Enable Content" button runs the malware.

The reason these "throw everything at once" style agentic cyberattacks work is because most orgs are chronically terrified of deploying deterministic detection + remediation automations.

Most security products have a "lock out this account" or "disconnect this system" or "block this IP" options that you can set if certain alerts are triggered. But because business function takes precedent, most orgs would rather risk a successful intrusion than an accidental disruption.

There's no reason to believe that "agentic defenders" would be a viable solution. Defenders need to consume many times more context/signals that attackers do, therefore by nature are slower. Defenders win on controlling the playing field, not out-maneuvering attackers like it's some Hollywood style fighter jet battle.

In the same way that reactive human defenses are slower than human offense, reactive AI defense are slower than AI offense (and regular old deterministic automations, too). The whole "fight AI with AI" thing is pretty ridiculous and misunderstands what good defense looks like.

The only answer is proactive defense + fast deterministic detection & response. But nobody is ready for that talk yet, so we're probably just gonna do like 10 years of "agentic AI SOC", until everyone runs out of money and/or figures out it doesn't work.

My internet connected fridge with default credentials and a private key of 4 was hacked by DPRK using abliterated GLM to craft extra clickable job offer phishing emails.

I fear we may lose public key cryptography :(