And since we have the lead analyst that did the investigation in this campaign, Uh, Kyle, why don't you tell them about Remus?

Uh, absolutely.

Yeah.

So Remus, uh, InfoStealer, it's an expansion or a, or an iteration on, uh, LumaStealer.

Um, the developers continuously keep up with this.

Features have been, have been updated.

I lost count of how many features have been updated this year alone.

Kyle, what tools or strategies are you seeing that are effective to prevent against these threats? Other than coming to you guys and saying, what is this and how do we protect ourselves? Have you seen any strategies distributed that you think are very effective here?

And since we have the lead analyst that did the investigation in this campaign, Kyle, why don't you tell them about Remus?

Absolutely.

Yeah.

So Remus, InfoStealer, it's an expansion or an iteration on LumaStealer.

The developers continuously keep up with this.

I lost count of how many features have been updated this year alone.

Among the things that the InfoStealer does that makes it particularly dangerous is targeting session tokens, targeting tokens rather than necessarily trying to break or obtain credential, username, password combinations.

Kyle, what tools or strategies are you seeing that are effective to prevent against these threats? Other than coming to you guys and saying, what is this and how do we protect ourselves? Have you seen any strategies distributed that you think are very effective here?

Kyle, are there early indicators or TTPs that CTI teams should monitor?

Yes, absolutely.

I believe Brian had mentioned RAG databases, for example.

So with your RAG databases, your models have access to your data, increased functionality, reduced hallucinations.

One of the things to be mindful of is... prompt rejections can result in data in those, in the extensible databases being manipulated.

That manipulated data can end up being used in output going forward.

So it's important to make sure that you have input filtering on any kind of, anything that's going into models processing, making sure the information that does end up making its way into any kind of RAC database is monitored, checked for, you know, log manipulations to that and check for any irregularities or anomalies.

Cal, any recommendations or any thoughts on practical controls to reduce these types of exposures that we've identified here?

And one thing I reflect on, Kyle, here is as we start to build capable defenses, and we build the better mousetrap, it's then the next layer, as it were, of, well, if I can't use unreputable sources, why then don't I change my tactics to reputable sources and platforms that bypasses elements of defense in depth? Any thoughts on that prediction, Kyle?

Oh, absolutely.

This one rings true to my day-to-day operations.

As you were touching on, from a defensive perspective, what I like to do to apply security mechanisms for members or whatever services it is we're providing, I like to try to find some kind of a bottleneck feature.

What's a domain I could block or a series of domains I can block that's going to thwart threat actor activity? Not just now, but also I can throw in some potential future activity that will be caught under this umbrella action.

Where the bad guy is taking advantage of the trusted services, there's cloud player services, GitHub or file sharing services like that.

I can't apply those domain or IP blocks.

So it had to be us figuring out, our CTI team figuring out, how is this pattern, which is a legitimate pattern that Cloudflare creates, in which ways are these patterns being married with other techniques to for us to be able to identify that those are malicious in nature