John Hammond, I'd love your your take on it.

I'm going to have just another maybe lukewarm hot take, if even that, because I don't have a good answer either.

I know without a doubt there they really tried for coordinated disclosure and having enough of this to be ready at the timeline that they had set up.

But it just didn't.

And I got to be honest, hey, you know, we're trying to get the word out, spread the messaging on this.

Reporters and journalists are kind of knocking at the door and I'm the guy on the hook to answer their questions.

And they had asked a super sharp question where it said like, hey, is there something to learn from how this disclosure process unfolded? And honestly, because we were able to see the industry spring into action and start to do their analysis, look at defenses, figure out mitigations, isn't that good? but did it just as equally give the threat actors their time to spring into action? And I really, really struggled to answer that because it's, It's like, yes, there is sort of a silver lining because, okay, we got everybody spent up on it, but it felt more like panic than it did pleasantries.

We've got to keep it running.

But can you just give like a sorta lay of the land of what ClickFix is and sort of where it came from?

Absolutely.

And thank you for, hey, helping us kinda dive right into things because ClickFix is certainly one that has, yeah, caught some steam and has really spread like wildfire.

It's just about everywhere now.

But the technique is pretty simple.

Honestly, it boils down to some social engineering, a lie, deception, um, really taking advantage of just how regular end users are used to operating their computer and scrolling around, working on the internet.

So whenever you see one of those quick little, "I'm not a robot," or verify you're human, just sort of quick check boxes or a little CAPTCHA, um, rather than, okay, the follow-on, uh, interaction they're presenting you with the, "Oh, hey, try to just click however many fire hydrants you see," or, or, "Point to the number of cars," and the regular human verification thing.

I just read it not too long ago, yeah.

And then what warning signs existed that someone could have acted on to make sure that In the throes of this, it could have been neutralized and they could have saved themselves some heartache and headaches.

Absolutely.

Yeah, I believe this was a very similar case and incident where that entry point of ClickFix was then used to load those remote monitoring and management solutions that we tend to see oftentimes used and abused.

I think that's unfortunate.

Of course, they are trusted, legitimate, genuine solutions, but just used in the wrong hands.

And that scenario where, okay, that could then be leveraged if maybe the organization even had their own already in place solution, remote monitoring and management.

Oftentimes, that means access to all of the other computers in the environment.

But I'm wondering if there's some added layer considering how important a lot of this software is to just the greater technology community and everybody using this technology, whether it's on their phones or on their websites or wherever it is that they interact with it.

Can

we go into your downloads folder? Can we see what's happening on your desktop? Because normally we just don't need that.

But they were comfortable with it.

They said, OK, absolutely.

Whatever we want to do for the investigation and the analysis.

So we're digging through these downloads folder and we saw a weird one, a little zip file called VOA Korea dot zip.

And this is a voice of America, a voice of America, Korea.

But for somebody that is involved directly in it, I wanted to ask you.

Threat research.

I, for one thing.

Good question and a tough thing to answer because I really, maybe it sounds so boring and so basic, but I think it is the right answer of first and foremost, hey, do something that you think is fun, that you enjoy, that you like and you're willing to do more of because it is something you enjoy and it's fun and it's passion.

So that may or may not be, oh, strictly down the path of, threat intel, threat research, blue team defense, et cetera, if it's just more fun to, oh, kind of learn a little bit more of how these hacks work, how these vulnerabilities come together, exploits, and that attack chain, the attack chain, I think, is the most interesting aspect to it.

Because if you then wanted to bring that to the other flare or to something be a little bit more aligned with, sure, threat intel, threat research, whatever bucket and name tag you want to put on it, then...

Think about how did the attack chain come to life? And literally, I know people keep, oh, they use the cyber kill chain as a cool analogy and all these different words, but genuinely think of a chain because each of those little links, each of those components are things that you would now have an opportunity to break the chain.

Oh, put a mitigation, put some remediation in place, stop or block one aspect of what happened and when.

Yes.