(upbeat music)
- I wanna start today with a date
that feels like it belongs in a history book,
not a modern tech report, 2009.
- 2009, I mean, that is practically the Stone Age in tech years.
- Right.
- The iPhone 3GS was the hot new thing,
Windows 7 hadn't even fully taken over yet.
- Exactly, a completely different world.
- So picture this.
We're sitting here in January, 2026.
We're talking about AI agents managing our calendars,
quantum resistant encryption is rolling out, and yet.
- And yet.
- On January 7th, just two weeks ago,
CISA adds a new entry to its known
exploited vulnerability catalog,
a Microsoft vulnerability from 2009.
- It just stops you in your tracks, doesn't it?
It's a zombie bug.
17 years later, CVE 2009 0556 is back from the dead
and it's actively biting people.
- It's like fighting out your biometric smart home security
can be defeated by a rusty skeleton key
from the Victorian era.
And honestly, that bug, it sets the perfect stage
for the document we are tearing into today.
It really does.
We are doing a deep dive into the buyer nickel's threat brief,
specifically looking at the data
from the first half of January, 2026.
And the authors, Jeremy Nichols and Jeff Remitt,
they've painted a picture that is, well,
chaotic feels like an understatement.
- It's a collision, really.
You have this ancient history like that 2009 bug
and it's colliding with tools that feel like
they're ripped right out of a cyberpunk novel.
- And that's the mission for this deep dive.
We need to unpack that collision.
It's not just about patching old stuff, you know?
It's about how the entire criminal business model
has shifted here in 2026.
- How so?
- We're seeing a total change in who is being targeted,
how money is being squeezed out of them,
and the specific weaponry things like void link
and Kim Wolf that are making it all happen.
- Okay, so let's start at the top, the leaderboard.
The bad guy Olympics.
Who's standing on the podium right now to kick off 2026?
- The gold medal unfortunately goes to Krillin.
They are just absolutely dominating the landscape right now.
- Dominating.
- Responsible for over 20% of the ransomware activity
in just the first two weeks in the year, 20%.
One group controlling a fifth of the market is massive.
That's like, I mean, that's a market dominance,
you usually see with legit tech giants, not criminal gangs.
- It's huge and they've been the most active player
for over a year now, which shows a terrifying level
of stability in their operations.
- Yeah, it was by them.
- Followed by Akira at roughly 15%,
and then a group called Sonoa becoming in just under 10%.
But honestly, looking at who is attacking
is less interesting than who they are attacking.
- This was the part of the report
that made me underline it twice.
Because when I picture a ransomware attack,
I have this movie scene in my head,
a Fortune 500 company, giant glass skyscraper.
A mission control room going red, millions in ransom.
- And that whole movie scene is completely outdated.
If you look at the victim organization size
in this report, the reality is just much grittier.
80.79% of victims are small businesses.
- 80% that is staggering.
We are not talking about multinational conglomerates.
- No, we're talking about companies with 500 employees
or fewer.
- So it's not whale hunting anymore.
It's industrial trolling.
- Precisely, it's a volume game.
- The big game hunting era hasn't ended.
The company still get hit.
But the small game farming era is in overdrive.
- And these smaller companies.
- They don't have a 247 security operations center.
They have maybe one, maybe two IT people
who are also fixing the printers and setting up the Wi-Fi.
- They're low hanging fruit.
And looking at the sectors,
manufacturing is taking the brunt of it, right?
Number one target at nearly 22%.
- Followed by retail and construction.
But manufacturing being number one just makes perfect sense
when you think about leverage.
- Because downtime just kills them.
- Exactly.
Manufacturing includes critical infrastructure,
supply chain vendors.
If a sauce company goes down for a day, it's annoying.
If a factory stops running, physical goods aren't moving,
and money is being incinerated every single second.
- The pressure to pay is immediate.
- It is.
Plus, manufacturing environments are notorious
for running older technology, operational technology,
or OT, that is often legacy, fragile,
and just very hard to patch.
- Which brings us right back to that 2009 bug.
- Right.
- You have these critical machines running on ancient software,
because if it ain't broke, don't fix it.
Until someone breaks it for you.
- Right.
But the way they break it has changed too.
The report really emphasizes that the tactics have shifted.
The old lock the files and ask for Bitcoin model.
That's practically vintage now.
- We're talking about double extortion.
- We are.
- This is such a crucial concept for anyone listening
to understand, because it changes your defense strategy
completely.
- So walk us through the evolution,
because I think a lot of people still assume
that if they just have a backup, they're safe.
- So in the good old days of ransomware,
if we can even call them that, the attack was about availability.
I encrypt your server.
You can open your files.
You pay me for the key.
If you had great offline backups, you could just tell the hackers
to get lost, wipe your systems, restore,
and your back in business.
No payment needed.
- You had to get out of jail free card.
- You did, but groups like Quellen and Akira are businesses.
They realize they were losing revenue to good backups,
so they pivoted.
Now, they don't just encrypt your data,
they steal it first.
- Exfiltration before encryption.
- Exactly.
So even if I restore my files perfectly,
my business is up and running.
They're still holding my secrets.
- Correct. As the report states,
there is little victims can do once their data is stolen.
The leverage shifts from availability to confidentiality.
They threaten to leak customer data,
intellectual property, internal email,
- Embarrassing HR records, anything.
- It's just blackmail.
Plain and simple.
It's not just a technical problem anymore.
It's a PR crisis waiting to happen.
- It is, and the report highlights
they're moving faster than ever to do it.
We're seeing faster encryption windows.
They get in, grab the data, and lock the system in record time.
They're using commodity tooling to scale this up.
- So it's not a hacker in a hoodie typing furiously.
- No, it's an automated assembly line.
- And that assembly line requires specialized tools.
This is where I want to get technical,
because the specific weapons in the Byron Nichols report,
Gootloader, Kim Wolf, Voidlink,
these aren't just cool names.
They represent very different, very specific dangers.
- They cover the entire spectrum of the attack chain.
You've got access, evasion, and persistence.
- Let's start with access, the trap.
Gootloader.
The report calls it an opportunistic threat,
but that almost makes it sound passive.
It feels pretty aggressive to me.
- It's aggressive in how it manipulates human trust.
Gootloader weaponizes something we all use
dozens of times a day.
Search engines.
It uses SEO poisoning.
- Search engine optimization poisoning.
So they are hacking my computer directly.
They're hacking Google's rankings.
- Essentially yes.
They compromise legitimate websites,
often WordPress sites with poor security,
and they inject keywords.
They manipulate the algorithm.
So these compromise sites ranked very highly
for these boring specific business terms.
- Like what?
- Contract templates, lease agreement forms,
invoice examples.
- Oh, that's insidious.
Because if I'm a small business owner,
the exact target we just discussed,
I'm probably Googling standard consulting agreement
at two in the afternoon on a Tuesday.
- And you see a link, it looks legit.
It might even look like a forum
where people are discussing contracts.
You click it, you download a ZIP file,
you think is the document,
but inside is a JavaScript file.
- And the moment I double click that,
thinking it's a PDF.
- Gootloader executes.
But here's the clever part.
It checks your environment first.
It looks to see if your computer
is part of an active directory domain.
It wants to know if you're a corporate user.
If you're just a home user,
it might do nothing or just serve you ads.
But if it smells a corporate network,
- It's draft to payload.
- Boom.
Often cobalt strike, which gives the attackers
remote control of your machine.
And from there, they move through the network
and deploy ransomware.
It turns a simple Google search into a full-blown crisis.
- It's a trap just waiting for someone to do their job.
Okay, so Gootloader gets them in.
But the next tool on the list, Kimoff,
that one scared me because of where it lives.
It's not attacking the office,
it's attacking the living room.
- Yes.
- Google is a botnet, but its target is unique.
It abuses residential proxy networks.
- Break that down for us.
Why does a hacker want a residential proxy?
- Okay, think about how corporate security works.
We have firewalls, threat intelligence feeds.
If a bank sees traffic coming from a known data center
in a country with high cybercrime,
they just block it.
It's an easy filter.
But if the traffic is coming from a residential IP address,
like a Comcast or Verizon connection
in suburban Ohio, the bank trusts it.
That looks like a customer.
- So Kimoff allows hackers to wear the skin of a normal user.
- Exactly.
And to do that, they have to infect devices in people's homes.
And Kimoff specifically targets cheap Android TV boxes.
- The kind you buy online for 30 bucks
to stream pirated movies.
- The very same.
A lot of these cheap devices are shipped
with essentially zero security.
They have the Android Debug Bridge ADB ports
left wide open to the internet.
- So Kimoff just scans for them.
It scans the web, finds these open boxes,
infects them, and turns them into a proxy.
- So my neighbor's TV box could be part
of a massive D-Dosha attack against a government website
or use for ad fraud and they'd have no idea.
- They just think their streaming is a little slow today.
It turns the consumer internet into a weapon
against the corporate internet.
It's hiding in plain sight.
- And speaking of hiding, we have to talk about VoidLink.
If Kim Wolf is the home invader, VoidLink is the ghost
in the machine.
The report calls it a cloud native threat.
What makes it so special?
- VoidLink is probably the most technically impressive
piece of malware in this whole report.
We often talk about malware running on Windows or Linux.
VoidLink goes a layer deeper.
It is context aware.
- Context aware.
Like it knows where it is.
- Precisely.
When VoidLink infects a Linux system,
it doesn't just run blindly.
It checks its environment.
It asks, "Am I in an AWS EC2 instance?
Am I in a Azure container?
Am I running inside Docker or Kubernetes?"
- So it has situational awareness.
It's like a burglar checking if they're in a bank vault
or a grocery store.
- And based on the answer, it loads custom plugins.
The report mentions over 30 different ones.
If it's in AWS, it loads tools to exploit AWS metadata
services.
If it's in Docker, it loads container escape tools.
It adapts to whatever infrastructure it's inhabiting.
- That's terrifying.
It's not just smashing Windows.
It's finding the specific blueprints for the building
it's in and using them against the owner.
- The report calls it the cloud era equivalent
of cobalt strike.
Cobalt strike was the standard for Windows networks.
VoidLink is positioning itself to be the standard
for cloud networks.
It's designed to be persistent, stealthy,
and incredibly hard to dig out because it just blends in
with legitimate cloud processes.
- So we have SEO traps, infected TV boxes,
and cloud hopping ghosts.
But there was one more name that stood out
because it wasn't about theft or spying.
It was about pure maliciousness.
Sikari.
- Right, Sikari.
They claim an Israeli affiliation, though, you know,
attribution in these cases is always a bit tricky,
but their behavior is distinct.
Most ransomware is transactional.
Give me money, I give you files.
Sikari is what we call a destructive threat, a wiper.
- They just want to watch the world burn.
- Effectively, yeah.
Beyond just encrypting files, Sikari corrupts
the bootloader of the system.
- The bootloader.
That's the very first thing that loads
when you press the power button, right?
The ignition sequence.
- Correct.
So if you corrupt the bootloader,
the computer doesn't know how to be a computer anymore.
It just breaks the machine.
- So even if I pay to ransom.
- You can't just decrypt the files.
You have to rebuild the entire operating system
from scratch.
It makes system recovery exponentially harder and longer.
It's a scorched earth tactic.
- It's designed to cause maximum pain.
- Maximum pain and operational paralysis,
not just financial loss.
- It's incredible how specialized this whole ecosystem is.
You have tools for stealth, destruction, access.
But behind every tool is a human or a group.
The report highlights a few trending adversaries
and one that stood out as a standout risk was APT 41.
- APT 41 is fascinating because they really break the mold.
Usually we categorize hackers into two buckets.
State sponsored the spies or cyber criminals, the thieves.
- And APT 41 says, why not both?
They're the ultimate moonlighters.
They are a Chinese state sponsored group.
So they conduct espionage for the government stealing secrets,
tracking dissidents.
But then on the side,
they conduct financial crime for personal gain.
- They're blurring the lines.
- Completely between cyber warfare and cyber crime.
- And the report mentions they are masters
of living off the land or L-O-T-L.
I see this turn a lot, but I feel like we should define it.
It's not camping.
- No tense involved, no.
Living off the land means using the tools
that are already installed on the victim's computer
to conduct the attack.
- I like the analogy of a burglar breaking into your house.
But instead of bringing a crowbar,
they just use your own kitchen knives
and the spare key under the mat.
- That is a perfect analogy.
They use PowerShell, Windows Management instrumentation,
standard admin tools.
So if an IT security guard sees a PowerShell script running,
they might just assume it's the system admin doing maintenance.
- Oh, that's just Bob updating the server.
- But it's actually APT 41 stealing the database.
And by using legitimate tools,
they don't trigger antivirus alarms
that look for known malware signatures.
It makes detection incredibly difficult
because the activity looks normal.
- Sneaky.
But hey, it's not all bad news in the report, right?
We did see some handcuffs clicking.
- We did.
A significant win for the good guys.
The Spanish National Police arrested 34 suspects
linked to the Black Axe Cybercrime Group.
- Black Axe sounds like a villain group from a comic book.
- They are a very real, very dangerous,
organized crime syndicate.
Originally out of West Africa,
but with a global footprint,
they deal in everything from business email compromise
to romance scams and arresting 34 people.
That's not just a slap on the wrist
that disrupts their infrastructure.
It takes knowledge and personnel off the board.
- It shows law enforcement is coordinating across borders.
And speaking of criminals having a bad day,
I admit I did chuckle at one of the news items.
The breach forums hacking database was itself leaked.
- The irony is delicious, isn't it?
Breach forums is a marketplace where hackers go to buy
and sell stolen data.
Here's a million credit cards.
Here's a database of passwords.
And yet their own database was leaked,
exposing 324,000 of their own accounts.
- So the hackers got hacked.
The predator became the prey.
- It just goes to show in this ecosystem,
there is no honor among thieves
and apparently very little operational security among them either.
- I love that.
But I want to pivot to something
that I think is the most mind bending part of this deep dive.
We're in 2026.
But there's a new story here about a crypto theft,
eight and a half million dollars stolen from Trust Wallet
that is being traced back to a breach from 2022.
- The last past breach, yes.
This is a crucial lesson in the long tail of data breaches.
- 2022, as four years ago,
in the tech world that's ancient history.
How is a breach from four years ago
still draining wallets today?
- Because of what was stolen,
the last past breach exposed vault data.
Now, people change their email passwords,
their banking passwords.
But in the crypto world,
people store seed phrases or private keys
in those secure notes.
- And a seed phrase is forever.
You can't just reset it
unless you create a whole new wallet and move the funds.
- Exactly.
And the threat actors have been playing the long game.
They downloaded those encrypted vaults in 2022.
They've spent the last four years
using massive computing power to brute force
the master passwords protecting those vaults.
- They're cracking them one by one.
It's a slow motion robbery.
- And once they crack a vault,
if they find a seed phrase, the money is gone.
It just emphasizes that a data breach
isn't a one-time event like a car crash.
It's radioactive fallout.
It lingers.
- That is startling.
You think you've moved on, you think,
"Oh, that was the 2022 incident I'm safe."
But the criminals are just patient.
- Extremely patient.
And we're seeing other long-term geopolitical tensions
playing out in the cyber realm too.
The report mentions Taiwan
reporting a 10-fold increase
in energy sector attacks from China.
- 10-fold, that's not a spike, that's a strategy.
- It signals that cyber conflict is escalating
in parallel with physical and political tensions.
You attack the power grid to test defenses,
to send a message.
It's critical infrastructure targeting
as a form of state craft.
- And on the software side,
just to round out the things to worry about list,
we have the Ne8 Mer-Flaw.
- Clever name, Ne8 Mer.
- It is, this is for NN, right?
- Right, NN is a workflow automation tool.
Think of it as the glue that connects
all your different maps together.
- So.
- If you get an email here,
save the attachment to Dropbox there
and send a Slack message.
- So it has access to everything.
- Exactly.
And that's why the flaw is rated max severity.
If you compromise the automation tool,
you possess the skeleton key
to every single service it connects to.
And it affects nearly 60,000 instances.
- It seems like skeleton key is the theme of the day,
from the 2009 bug to this N18 flaw.
- It really is.
- So we've covered a lot of ground here.
From 17 year old zombie bugs to cloud hopping ghosts
and residential botnets.
If we have to distill this for someone listening
who might be feeling a little overwhelmed,
what's the headline?
- If we zoom out on this January, 2026 report,
I think three things stand out.
First, basic hygiene is still your best defense.
That 2009 Microsoft bug,
it's only dangerous if you haven't updated.
- Hush the boring stuff, got it.
- Second, the perimeter is everywhere.
With threats like Kim Wolf attacking Android TV boxes
and stealer malware like VVS stealer targeting discord users,
you can't just secure the office firewall.
Your employees home network, their gaming PC,
their cheap streaming box,
that is now part of your corporate attack surface.
- Because VVS stealer hides behind heavy obfuscation parmer,
the report notes to steal data from the apps we use
for fun like Discord to get to the serious stuff.
- Correct.
The lines between home and work are gone for the attackers,
so they need to be gone for the defenders too.
And third, just realize that obscurity is not security.
Being a small business doesn't make you safe,
it makes you a statistic.
- Remember that 80% figure.
- The automated tools don't care how big you are,
they just care that you're vulnerable.
- And watch out for those fake legal documents.
If you're searching for a contract,
being incredibly suspicious of what you download,
Goodeloader is waiting.
- Absolutely.
- Verify the source.
- You know, usually we end these deep dives with a summary,
but today I'm left with a slightly more unsettling feeling,
specifically about that last past story.
- Well, let me leave you with a provocative thought to chew on then.
We talked about the last past breach from 2022,
still causing damage in 2026.
And we talked about double extortion,
where groups like Quillen steal the data before they lock it.
- Right, the data is just out there.
- If data is stolen, it can be sold,
resold, and exploited years later.
So we have to ask ourselves,
is the concept of recovering from a cyber attack becoming a myth?
We might need to accept that in this new landscape,
once a breach happens, it never truly ends.
It just evolves.
You don't fix it.
You just live with the exposure forever.
- That is a heavy thought, the breach that never ends.
On that note, I'm gonna go check my software updates
and maybe throw my Android TV box out the window.
- Probably a wise decision.
- Thank you for guiding us to this minefield,
and thank you to our listener for joining us
on this deep dive into the buyer, Nichols Threatbrief,
Stakeurious, Stay Paranoid, and Stay Patched.
We'll see you next time.
- Reach out to us at jbuyer.com for comments and questions.
Follow us at buyer company on social media,
and if you'd be so kind, please rate and review us
in your podcast app.
[Music]