So tell us what you're thinking about.

What keeps me up at night? Aside from the obvious 800-pound gorilla in the room, which is the hijacking of large language models and using them for systemic cyber attacks, I'm very concerned about the reality that you have an axis of evil in cyberspace that are collaborating more so than I've ever seen them before.

consisting of four rogue nation states, obviously Russia, China, North Korea, and Iran, where they're actually sharing capabilities and command and control.

And you're seeing a dramatic evolution of the skill sets and the capabilities of these second tier actors like Iran and North Korea, thanks to the information sharing and consulting by their Russian partners.

I would say that is disturbing to me because those threat actors are more willing to become destructive against critical infrastructures.

And as evidenced in the UK and as evidenced in the US, there have been targeted attacks to destroy and dismantle water utilities, energy facilities, et cetera.

So that's very concerning to me.

But tell defenders, tell our listeners what they should be doing today to help mitigate some of these attacks and incursions that we're seeing.

Who seems to be behind these things these days? Are, are there particular groups that you're tracking?

Yeah, there's three groups that are probably the most active in targeting US financial institutions.

You got Fin7, otherwise known as Carbon Spider, probably the most prolific.

We've heard about them for years.

They've moved from their tools of Carbonak and Diceloader to Monodo.

Um, they're now u- deploying a, a Python-based RAT called Anubis Backdoor, which allows them to do memory, in-memory injection of additional modules and leave almost no fingerprints behind.

Um, they're highly prolific.

In this context, what does that mean for the financial sector?

Do you see that with AI, the intent of the attacker has actually shifted? If you do, what is it that CISOs and security leaders should do differently because of that?

Yeah, I mean, look, not all models are the same.

Some models pay much closer attention to the security and the security of their guard roles.

But that being said is, you know, you really need to implement principles like least privilege, eliminate shadow AI.

But respect the fact that, again, ungoverned AI is going to be a natural C2 and a natural living off the land model.

capability or platform for adversaries once they're in your environment.

It improves their capacity to conduct reconnaissance, delivery, lateral movement, but more importantly, persistence.

Are financial institutions at all in your surveys, in your conversations with them, using agentic AI for defensive solutions? And if so, what happens when you run out of tokens in the middle of an incidental response?

See full terms at mintmobile.com.

[upbeat music] So you're shorting and doxing.

I think different forms of market manipulation because of these advanced forms of persistence, as illustrated by Banana Rat and others, um, this type of RAT could be used for a multitude of things.

It could go, could go far beyond just wire transfer fraud.

And, and that's what's concerning here.

I think the lesson learned here is that, A, please don't underestimate the cybercrime cartels of Latin America, particularly the Brazilian ones, and B, what else can be done with that level of persistence, um, from a f-financial fraud perspective, market manipulation perspective, even an island hopping, as I would call it, perspective, um, where the institution itself's infrastructure is now being used to, to attack their customers and constituency.

Um, and that has already been realized in Brazil previously, where one of their major payment systems was compromised by a group that I'm not gonna name here on this interview, and that payment system was then in turn used to attack customers and institutions throughout Brazil.

Well, looking specifically at this campaign, what's your advice to defenders, uh, to disrupt an operation like this?