And then I want to get, does anyone think the initiative is with the defender here?

Well, I'm really excited that people, CEOs, people who didn't really think about cyber that much or thinking about it more, right? And they're kind of chasing, like, this seems like a big deal.

This seems really scary.

And so I think that's great.

I've had a lot of really good conversations around cybersecurity in general because of what AI has brought up.

And I love that part.

When you look, though, at what the actual threat it poses, really it's the exact same problems that were on a network a year ago.

Where do you see things today in a post, we had a recent Xi Trump meeting, a little more pomp and circumstance than there there, but I'd be curious what your thinking is here.

What are some of the important details about these things that these folks are trying to sell?

The first important detail about what these folks are trying to sell is not all of them are actual AI tools.

There's a lot of fraud out there.

Our team didn't buy all the tools and evaluate which ones worked, but not all of them are actually AI.

but some of them are.

And the ones that are include what a lot of your listeners have heard before, Worm GPT, right? Isn't that, that's the one that we all heard of right when we were thinking and hearing about LLMs taking off.

Now, the original Worm GPT, this LLM without restrictions is, It's since gone away.

So based on the information you all have gathered here, what are your recommendations for the defenders in our audience? How can they leverage this information to their own advantage?

Do you find that vacuum? If you maybe, you know, consider there is one, could that be exposing businesses, especially here in the U.S., to more risks?

AI is a difficult term.

kind of new emerging technology for the government to be thinking about the ways in which that they're protecting systems because it's moving so fast, right? AI is moving at the speed of AI and government moves at a much slower pace.

So I think as you see the government grappling with these elements, they're not necessarily going to be able to weigh in on the technology itself.

What I would like to see them do more of is focus on technology.

Guidelines, evaluations, any kind of like overall checks on outcomes, testing, reporting, any incidents, right? Being able to focus in on the end result of what we're seeing from AI rather than trying to stay ahead of the technology is likely going to yield results.

more dividends.

But are the attackers, are they taking more benefit from it than the defenders and the IT security teams? I mean, who's winning, Cynthia? My

Who do you think is behind this attack?

I would be shocked if Iran wasn't behind this attack.

When I was at the FBI, we looked at several different aspects when we were thinking about attribution, especially initially in a campaign.

One was, have we seen this type of targeting recently? The answer here is yes.

Just a week ago, FBI and CISA, as well as a host of other US government agencies, put out an urgent warning saying that Iran was continuing to target these mini computers that control much of our critical infrastructure, including water infrastructure.

The second aspect we looked at on attribution was, do they have a motive to do it now? Is the attack actually for money or is it for disruptive actions? This appears focused on disruption, not money.

And geopolitically, the actor that has the main motive here is Iran.

Have those cuts impacted the United States' ability to counter these kinds of threats? Does this worry you?

Who do you think is behind this attack?

I would be shocked if Iran wasn't behind this attack.

When I was at the FBI, we looked at several different aspects when we were thinking about attribution, especially initially in a campaign.

One was, have we seen this type of targeting recently? The answer here is yes.

Just a week ago, FBI and CISA, as well as a host of other US government agencies, put out an urgent warning saying that Iran was continuing to target these mini computers that control much of our critical infrastructure, including water infrastructure.

The second aspect we looked at on attribution was, do they have a motive to do it now? Is the attack actually for money or is it for disruptive actions? This appears focused on disruption, not money.

And geopolitically, the actor that has the main motive here is Iran.

Have those cuts impacted the United States' ability to counter these kinds of threats? Does this worry you?

But I'm wondering, and maybe a good way to transition into what you talked about yesterday in your keynote, the state of ransomware and how industry looks at it, how government looks at it, the two together.

So I feel like I was a late comer into really thinking ransomware is as big of a problem as it is.

I spent most of my career at the FBI looking at nation states, right? So China, China, China, Russia, Iran, North Korea.

And to me, it was like, well, these are existential threats, right? Getting into critical infrastructure, like what happens in a wartime, and really thinking it that way.

And it took until an attack called Colonial Pipeline, I think, which everyone's familiar with, to really say, well, that Ransomware attack only affected the business networks, but it had impact across everything and its operations.

This really feels like it impacts everyday people.

I kept going and really thinking, what's the threat of today to Main Street, today to the organizations? It's a threat we're facing right now, and it just keeps getting bigger.

this really resonated with folks or this is what folks really are thinking about and we should really focus on this area?

When you talk about the, the full attack life cycle, what, what, what happens during that window between initial access to encryption?

So Akira typically is able to get onto networks through the exploitation of certain vulnerabilities.

Uh, one of those really is the SonicWall vulnerabilities that we've been able... that, uh, we've seen several actors start to use.

But they're getting on, they're, they're establishing that initial foothold, starting to develop and identify credentials, and then they rapidly cascade into a full domain compromise.

So they'll commonly use tools when they go across your network that are often found already there.

They're using Impacket, like, data staging tools.

They are developing persistence through things like AnyDesk and then, uh, using just other items which we've seen across other attack cycles.

So what are your recommendations here based on all the information that you've put together in this research? How should defenders, uh, best position themselves to protect themselves here?

How are you seeing that evolve? How are you seeing companies actually wanting to use and build from within or still dependent on external offerings?

So being able to build within is really important in a way to consistently know what's going on in your network, be able to fix those vulnerabilities I talked about in real time, and then be able to identify other errors or things that might be going on that are malicious across a network.

But it's only going to know what's plugged into it.

It's not gonna have a lot of these addit- this additional information, what a threat group might be saying in a dark web forum.

What's the new zero day that might be coming down the pike? Figuring out that aspect, being able to plug the really sensitive crate information the private sector has into some of these new processes organiz- ...

You.

Just means cybersecurity is gonna be better.

Can you take us to allies? Can you take us as to how strong their defenses are?

What are you anticipating this coming year when it comes to ransomware?

So I think right now we would say that AI hasn't fundamentally changed ransomware tactics, but it's changed kinda the economics of ransomware, right? It's lowered the barriers, and it's accelerated some discrete tasks, some workflows.

I think that's where you're going to see some of this improvement and some more of these discrete tasks.

So in the hearing, Google talked about the use of, uh, AI in, you know, certain points of the attack chain that really did enable certain components to be a little more autonomous, to act a little more autonomously, uh, and do that kind of in real time, to also thinking about the discrete tasks that are available with initial access.

I feel like that's where we've seen a lot of the technology go, where you can kind of imagine how it is really beneficial to adversaries, like think making a lot more believable phishing emails, deepfakes.

So I think in the next year what we'll likely see is deepfake social engineering really start to overtake just the traditional identity attack, a traditional social engineering.

And we're also gonna see actors then start to experiment with some of these more niche things that were talked about in the hearing.

Mm.