Latest / Tech Talks With Kinsoft / Qilin Hits WA's Mount Barker Co-operative

Transcript

Qilin Hits WA's Mount Barker Co-operative · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. I want you
• 0:03
  to just imagine a really tense hostage negotiation
• 0:06
  for a second. Okay. Sounds intense. I'm picturing
• 0:08
  it. Right. So the kidnapper is on the phone and
• 0:11
  they are demanding this massive ransom. They
• 0:14
  sound dangerous. They obviously have leverage
• 0:17
  and they're threatening to basically dismantle
• 0:20
  your life if you don't wire the funds right that
• 0:23
  second. Yeah. High pressure. Total panic. Exactly.
• 0:25
  But then you ask for proof of life. You ask to
• 0:29
  speak to the hostage. Or maybe you ask for a
• 0:31
  current photograph holding today's newspaper.
• 0:33
  Something like that. Standard protocol, right?
• 0:35
  You need to know it's real. Yeah, but then the
• 0:37
  kidnapper just goes silent. They hang up. Or,
• 0:39
  I don't know, maybe they send you a totally blank
• 0:41
  piece of paper. The entire dynamic of that situation
• 0:44
  just fractures instantly. Oh, absolutely. Because
• 0:47
  the psychological weight just shifts completely.
• 0:49
  Right. You have to stop and ask yourself, like,
• 0:51
  is this a genuine catastrophe? Or am I just being
• 0:54
  targeted by some incredibly elaborate, high -stakes
• 0:57
  bluff? Yeah, you aren't just calculating the
• 0:59
  cost of the ransom anymore. You are suddenly
• 1:02
  forced to calculate the actual probability that
• 1:05
  the threat actor even holds the cards they claim
• 1:07
  to be holding. It's paralyzing. It really is.
• 1:10
  It paralyzes decision making, which, I mean,
• 1:13
  in a crisis scenario, that's highly destructive.
• 1:15
  And that exact specific paralysis is actually
• 1:18
  playing out across the Australian digital landscape
• 1:21
  right now. It is. It's wild to watch. We are
• 1:23
  looking at this startling cyber extortion spree
• 1:27
  from... early 2026, and it was orchestrated by
• 1:30
  the Queelan Ransomware Group. Yeah, Queelan has
• 1:33
  been incredibly aggressive lately. Totally. So
• 1:35
  over the course of just a single month, Queelan
• 1:38
  targeted a quartet of Australian businesses.
• 1:40
  And for our discussion today, we are going to
• 1:43
  put one of those victims under the microscope,
• 1:45
  which is the Mount Barker Cooperative in Western
• 1:47
  Australia. That's a really good focal point for
• 1:50
  this. Yeah, because we really need to examine
• 1:52
  how modern cyber cartels like Quillen are structuring
• 1:57
  their operations. You know, like why the data
• 1:59
  they claim to hold is shrouded in so much mystery.
• 2:02
  And ultimately, what practical steps you and
• 2:05
  your business need to take to protect yourselves.
• 2:06
  And Mount Barker Cooperative serves as a perfect
• 2:09
  lens for this, honestly. It highlights a massive
• 2:12
  shift in threat actor targeting toward regional
• 2:14
  supply chains. Right. Getting away from just
• 2:16
  the giant city corporation. Exactly. And more
• 2:19
  importantly, it really exposes the somewhat chaotic,
• 2:22
  decentralized reality of modern ransomware. It
• 2:26
  kind of shatters that myth of the omnipotent,
• 2:29
  flawless hacker syndicate. Yeah, they aren't
• 2:31
  all just typing perfectly in green code in a
• 2:33
  dark room. Let's actually map out the timeline
• 2:35
  of this spree because it's interesting. Let's
• 2:37
  do it. So on January 30th, 2026, Colin goes on
• 2:41
  this sudden offensive. They hid an electronics
• 2:43
  retailer, Esperance Communications, out in Western
• 2:46
  Australia. OK, so starting at West. Right. And
• 2:49
  then shortly after that, they list another WA
• 2:51
  business, Esperance Meadowland. Now, with Meadowland,
• 2:54
  they claimed a very specific haul. They said
• 2:57
  they got 14 gigabytes of data encompassing over
• 2:59
  16 ,000 files. That is a very specific flex.
• 3:03
  It is. And then they break their Western Australian
• 3:05
  streak just briefly for a target in Queensland.
• 3:08
  But the real... The centerpiece of this whole
• 3:11
  campaign, the one we're focusing on, lands on
• 3:14
  February 11th. Right. The Mount Barker listing.
• 3:16
  Exactly. That is when Kwilin lists the Mount
• 3:19
  Barker cooperative on their dark web leak site.
• 3:22
  And they claim to have exfiltrated 40 gigabytes
• 3:25
  of internal business data. I mean, 40 gigabytes
• 3:28
  is a substantial volume of text and documents.
• 3:31
  It sounds like a lot. Oh, it is. Depending on
• 3:33
  the density of the files, that could easily be
• 3:35
  a decade's worth of financial ledgers, member
• 3:37
  databases, supply chain logistics, employee records,
• 3:40
  you name it. Really sensitive stuff. Yeah. For
• 3:42
  a regional food and farm cooperative, that is
• 3:45
  basically the operational crown jewels. But here
• 3:48
  is where it gets really interesting. Here's the
• 3:50
  twist. You navigate via a Tor browser to Quillen's
• 3:55
  dark web leak portal. to actually verify this
• 3:58
  claim, right? Because you want to see the proof
• 4:01
  of life. Exactly. And they boast that the 40
• 4:04
  gigabytes have been published to the world to
• 4:06
  see. So you click the directory link to the data
• 4:09
  and it just throws a 404. Not found error. This
• 4:12
  is a dead page. Delete dead end. And this wasn't
• 4:14
  just some isolated glitch for Mount Barker either.
• 4:17
  Across this entire four target spree, the hackers
• 4:21
  provided virtually zero hard verifiable evidence
• 4:24
  that the exfiltration was actually successful.
• 4:27
  Which is fascinating. From an operational standpoint.
• 4:30
  It's baffling. It's like a bank robber running
• 4:32
  out of the vault, waving this completely empty
• 4:34
  sack and screaming to the police that they took
• 4:37
  a million dollars. That's a great way to put
• 4:39
  it. Like, why would a hacker syndicate publicly
• 4:41
  announce a hack but fail to provide the proof?
• 4:44
  I struggle to understand the strategic value
• 4:46
  there. If your whole business model relies on
• 4:48
  reputational damage and terror, failing to produce
• 4:50
  the data just destroys your credibility. Well,
• 4:53
  see, that assumes their primary operational goal
• 4:56
  is maintaining this pristine, reliable reputation
• 4:59
  rather than simply generating immediate blinding
• 5:03
  panic. Oh, interesting. So the panic is the point.
• 5:06
  Often, yes. We have to look at the psychological
• 5:08
  warfare of that initial leak site post. When
• 5:11
  Qualyn lists Mount Barker, automated scrapers
• 5:14
  pick that up instantly. Right, the threat intelligence
• 5:16
  feeds. Exactly. Threat intelligence feeds broadcast
• 5:19
  it. The cybersecurity media starts making calls.
• 5:22
  The board of directors demands an immediate incident
• 5:24
  briefing. Even with the 404 error? Even with
• 5:27
  the 404 error staring them right in the face.
• 5:30
  The victim organization is instantly plunged
• 5:32
  into chaos. The uncertainty itself becomes a
• 5:35
  weapon. Okay, but I'd argue that the uncertainty
• 5:37
  might actually backfire on the attacker. How
• 5:39
  so? Well, if the IT team investigates and realizes,
• 5:42
  hey, no massive data transfer actually occurred,
• 5:45
  the board might just refuse to pay. They'd call
• 5:48
  the bluff. That's a fair point. But think about
• 5:51
  the initial shockwave. The IT team still have
• 5:54
  to assume a breach until they can definitively
• 5:56
  prove otherwise. Ah, I see. Which means 24 -7
• 5:59
  forensic analysis, completely isolating their
• 6:02
  networks and essentially halting business operations
• 6:04
  just to prove a negative. Just to prove the data
• 6:07
  didn't leave. And proving a negative in IT is
• 6:10
  brutal. Precisely. Proving a negative in a complex
• 6:14
  network environment takes weeks. During that
• 6:17
  window of extreme exhaustion and operational
• 6:19
  downtime, executives might feel pressured to
• 6:23
  negotiate anyway just to make the public relations
• 6:25
  nightmare vanish. Regardless of whether the 404
• 6:28
  error is there or not. Wow. Well, let's actually
• 6:31
  dig into that 404 error technically for a second,
• 6:34
  because it points to something fundamentally
• 6:35
  broken in Quillen's execution. It definitely
• 6:37
  does. A 404 on a hidden service means the server
• 6:41
  itself is reachable, but the specific resource
• 6:43
  just isn't there. It suggests an automated system
• 6:46
  probably generated the leak page, but the backend
• 6:49
  payload, the actual data never arrived. Yeah,
• 6:52
  that points to the architecture of the group.
• 6:53
  Right. Which brings us to how Quillen is actually
• 6:56
  structured. They aren't just this cohesive team
• 6:58
  sitting in a single room somewhere. They operate
• 7:01
  what's called a ransomware as a service or row
• 7:03
  S model. Yeah. Radis is essentially the industrialization
• 7:07
  of cybercrime. Break that down for us. Sure.
• 7:10
  So the core Killen developers, the guys at the
• 7:12
  top, they build the sophisticated encryption
• 7:14
  binaries. They maintain the dark web infrastructure
• 7:17
  and they manage the extortion negotiation portals.
• 7:21
  They build the tool. Right. But they outsource
• 7:24
  the actual network intrusion to independent contractors.
• 7:27
  The affiliates. Exactly. Known in the ecosystem
• 7:29
  as affiliates. So the core group takes a percentage
• 7:32
  of the final ransom and the affiliate keeps the
• 7:36
  rest. It's literally a franchise model. And according
• 7:39
  to a November 2025 report from ThreatLocker,
• 7:42
  this franchise model has allowed Quillen to scale
• 7:45
  at just a terrifying rate. The numbers are staggering.
• 7:49
  They really are. They went from claiming 45 victims
• 7:51
  in 2022 to boasting more than 800 victims in
• 7:54
  2025. Yeah, and you don't hit 800 victims a year
• 7:57
  without heavy automation. Exactly. So my hypothesis
• 8:00
  is that the Quillen leak site is hooked into
• 8:03
  an API. When an affiliate successfully detonates
• 8:06
  the ransomware inside a target network, the equivalent
• 8:09
  infrastructure automatically generates a leak
• 8:11
  page to start that extortion clock. That makes
• 8:13
  perfect sense. But the core system doesn't actually
• 8:16
  verify if the affiliate bothered to successfully
• 8:19
  exfiltrate the data first. I think that API disconnect
• 8:23
  is a highly probable scenario because in a decentralized
• 8:28
  RAAS model, quality control is practically non
• 8:32
  -existent. You get what you get with these affiliates.
• 8:34
  Yeah, you are mixing highly sophisticated initial
• 8:36
  access brokers with, frankly, impatient amateurs.
• 8:40
  Right, someone who just bought a login and wants
• 8:42
  a quick payout. Exactly. An affiliate might breach
• 8:45
  Mount Barker's perimeter, stumble around a bit,
• 8:47
  trigger an endpoint detection and response alert,
• 8:50
  panic, and then immediately execute the encryption
• 8:53
  binary before they even establish a stable exfiltration
• 8:55
  channel. So they lock the doors before stealing
• 8:58
  the furniture. Yeah. The ransomware phone's home
• 9:00
  to Creeland saying, hey, target encrypted. The
• 9:02
  API auto -publishes the victim's name and an
• 9:05
  estimated data size based on the network, but
• 9:07
  the actual data repository on the dark web remains
• 9:10
  empty. Hence, the 404. Or, you know, considering
• 9:14
  we're talking about 40 gigabytes here, they might
• 9:17
  have tried to push that volume out of the network,
• 9:19
  hit a bandwidth bottleneck, and the connection
• 9:22
  just timed out. Also very possible. Moving 40
• 9:25
  gigs quietly without tripping a network traffic
• 9:27
  anomaly alert isn't exactly trivial for a sloppy
• 9:31
  affiliate. No, it's not. And that variability
• 9:33
  in affiliate skill is really what makes defending
• 9:36
  against a rice threat. So unpredictable. The
• 9:39
  left hand doesn't know what the right hand is
• 9:41
  doing. Precisely. The core cooling operators
• 9:43
  might be sitting there expecting a clean double
• 9:46
  extortion play, stealing the data and locking
• 9:48
  the machines. But the affiliate on the ground
• 9:51
  just botched the heist and ran out the door empty
• 9:54
  handed. Leaving the core group to just bluff
• 9:56
  their way through the negotiation with a 404
• 9:58
  page. Exactly. But. We really shouldn't let the
• 10:03
  sloppy data exfiltration lull us into a false
• 10:06
  sense of security here. Oh, absolutely not. Because
• 10:08
  while their backend data handling might be throwing
• 10:10
  404s, the methodology they use to actually penetrate
• 10:13
  and occupy these networks is incredibly persistent.
• 10:17
  Let's look at the timeline of an intrusion for
• 10:18
  a minute. It's eye -opening. The ThreatLocker
• 10:21
  report highlighted a statistic that fundamentally
• 10:23
  changes how we need to view these attacks. They
• 10:26
  found that Quillen affiliates have an average
• 10:28
  dwell time. Of 19 days. 19 days. Let that sink
• 10:33
  in. They are inside a network for nearly three
• 10:36
  weeks before the encryption payload is ever detonated.
• 10:39
  That is wild. It completely shatters that legacy
• 10:42
  idea of a cyber attack being this quick smash
• 10:45
  and grab operation. It really does. Because if
• 10:48
  they are maintaining persistence for 19 days,
• 10:50
  they aren't just blasting a malicious executable
• 10:52
  and hoping for the best. They are actively evading
• 10:55
  detection. Very carefully evading it. My assumption
• 10:58
  is. They're using what we call living off the
• 11:01
  land techniques, right? That's exactly what they
• 11:02
  do. So instead of bringing in noisy malware that
• 11:05
  a standard antivirus would immediately flag,
• 11:08
  they compromise an administrator's credentials.
• 11:10
  And then they just use the network's own native
• 11:12
  legitimate tools like PowerShell or Windows Management
• 11:15
  instrumentation to move laterally. Yeah. That
• 11:19
  is exactly how they maintain that stealth profile.
• 11:21
  They co -op the very administration tools that
• 11:24
  your own IT department uses every single day.
• 11:28
  Which makes them look like normal employees to
• 11:30
  the system. Right. And during those 19 days,
• 11:32
  the affiliate is conducting rigorous enumeration
• 11:35
  and discovery. Boking around, seeing what's what.
• 11:38
  Methodically mapping the Active Directory environment.
• 11:41
  They locate the domain controllers to escalate
• 11:44
  their privileges to domain admin. They identify
• 11:47
  exactly where the critical databases for operations
• 11:50
  and finance are housed. They are basically reading
• 11:54
  your playbook while you sleep. But wait, if I'm
• 11:57
  running a modern security operations center,
• 11:58
  how does an attacker sit in my environment for
• 12:01
  19 days querying active directory and scanning
• 12:03
  subnets without lighting up my telemetry like
• 12:05
  a Christmas tree? Well, often they just disable
• 12:08
  or blind the telemetry. Seriously? Yeah. If they
• 12:11
  compromise an account with sufficient privileges
• 12:13
  early on, their first move is usually to tamper
• 12:16
  with the EDR agents on the endpoints. They are
• 12:19
  essentially turning off the security cameras
• 12:21
  before they start moving the heavy equipment.
• 12:23
  That is terrifying. It is. But you know, the
• 12:26
  most critical phase of that entire 19 -day dwell
• 12:28
  time isn't just finding the data to steal, it's
• 12:31
  hunting down the backups. Ah, of course. Because
• 12:33
  backups are the ultimate leverage breaker. 100%.
• 12:36
  If an affiliate encrypts the Mount Barker Cooperative
• 12:39
  servers, but the IT director can just press a
• 12:42
  button and spin up a clean snapshot from yesterday,
• 12:44
  the ransom demand is totally toothless. The affiliate
• 12:48
  knows this. So they spend those two weeks methodically
• 12:51
  seeking out the backup servers. They delete volume
• 12:53
  sh - shadow copies and they attempt to corrupt
• 12:56
  offsite storage credentials. They want to make
• 12:59
  sure you have no safety net. Exactly. They want
• 13:01
  to ensure that when they finally execute that
• 13:03
  Qualen binary on day 19, the victim is totally
• 13:06
  paralyzed. Which honestly makes the 404 error
• 13:09
  we discussed earlier even more complex. An affiliate
• 13:12
  might successfully spend 19 days crippling your
• 13:15
  backups and deploying the encryptor perfectly,
• 13:17
  but then they just fail at the data exfiltration
• 13:20
  piece. Right. The company is still paralyzed,
• 13:22
  even if the data wasn't actually stolen. Exactly.
• 13:25
  And this brings us to the targeting strategy,
• 13:27
  I think, because if these affiliates are spending
• 13:30
  three weeks methodically dismantling a network,
• 13:33
  they are putting in significant effort. Why aim
• 13:37
  that level of effort at a regional food and farm
• 13:40
  cooperative in Western Australia? Well, it is
• 13:43
  a very ruthless calculation of the risk to reward
• 13:46
  ratio. How so? Regional cooperatives operate
• 13:49
  at this critical intersection of physical supply
• 13:51
  chains and digital logistics. They manage payments
• 13:55
  for local farmers. They coordinate freight. They
• 13:57
  handle vast amounts of member data. And they
• 14:00
  often interface with physical industrial control
• 14:02
  systems. So they have incredibly high uptime
• 14:05
  requirements. Massive uptime requirements. If
• 14:07
  Mount Barker Cooperative goes offline, it's not
• 14:09
  just a digital inconvenience. You know, it's
• 14:12
  real world impact. Exactly. Local agriculture
• 14:15
  logistics grind to a halt. Produce physically
• 14:17
  doesn't move. Payments freeze. The cascading
• 14:20
  effect on the regional economy is immediate and
• 14:23
  severe. And high criticality translates directly
• 14:25
  to high extortion leverage for the hackers. Precisely.
• 14:29
  However, historically, these regional hubs do
• 14:32
  not possess the massive enterprise tier cybersecurity
• 14:35
  budgets of, say, a tier one bank in Sydney. They
• 14:38
  might have leaner I .T. teams, maybe. managing
• 14:41
  sprawling legacy infrastructure. Yes. So for
• 14:45
  Array Esiliot, a regional cooperative represents
• 14:47
  a target that will experience immense immediate
• 14:50
  pain from downtime, but they may lack the layered
• 14:53
  zero trust architecture needed to stop a determined
• 14:56
  intruder from escalating privileges. It's basically
• 14:59
  the perfect storm of high leverage and potentially
• 15:01
  softer perimeters. It unfortunately is. So let's
• 15:04
  talk solutions. How do we disrupt this attack
• 15:06
  chain? Because we know the adversary's playbook
• 15:09
  now, right? We have opportunistic access, a 19
• 15:12
  -day lateral movement phase, targeting of backups,
• 15:15
  and a delayed payload detonation. Right. The
• 15:17
  blueprint is clear. So if you are operating a
• 15:19
  business outside a major metropolitan center
• 15:21
  or running any organization where downtime is
• 15:23
  catastrophic, how do you actually defend against
• 15:25
  this decentralized Reyes threat? You have to
• 15:28
  engineer your defenses to exploit their specific
• 15:30
  operational requirements. Okay. Where do we start?
• 15:33
  The first countermeasure tackles their initial
• 15:35
  access vectors. Most of these affiliates purchase
• 15:37
  compromised session tokens or utilize credential
• 15:40
  stuffing to breach the perimeter. So just standard
• 15:43
  passwords aren't enough? Not even close. And
• 15:46
  honestly, standard multi -factor authentication
• 15:48
  is no longer sufficient either. Really? Why is
• 15:51
  that? Because attackers routinely bypass it using
• 15:54
  MFA fatigue attacks. That's where they bombard
• 15:56
  a user with push notification approval requests
• 15:59
  until the user gets annoyed and accidentally
• 16:01
  clicks accept. Or they use adversary in the middle
• 16:05
  phishing proxies to steal the session token after
• 16:07
  the user authenticates. Oh, wow. So what's the
• 16:10
  move then? The move is toward phishing -resistant
• 16:13
  MFA, like FIDO2 hardware security keys. Okay,
• 16:16
  the physical keys you plug in. Exactly. With
• 16:19
  those, the authentication is cryptographically
• 16:21
  bound to the physical device in the specific
• 16:23
  login domain. Even if an affiliate buys a stolen
• 16:26
  password or intercepts a session token, the hardware
• 16:29
  key requirement stops the initial intrusion cold.
• 16:32
  Because they physically don't have the key in
• 16:34
  their hands in Russia or wherever they are? Precisely.
• 16:37
  That secures the perimeter. But... As always
• 16:41
  in cybersecurity, you must assume breach. Right.
• 16:44
  Assume they get it anyway. Yes. And this is where
• 16:47
  active threat hunting and network segmentation
• 16:50
  come into play to disrupt that 19 -day dwell
• 16:53
  time. Because if an attacker does bypass the
• 16:56
  perimeter, they rely on a flat network architecture
• 16:59
  to move laterally. Right. Like moving from a
• 17:02
  compromised receptionist's workstation straight
• 17:05
  over to a critical financial database. Exactly.
• 17:07
  So by segmenting the network, putting strict
• 17:10
  access controls and firewalls between different
• 17:12
  departments and server clusters, you force the
• 17:15
  attacker to make noise. You put hurdles in their
• 17:17
  way. Right. Every time they try to cross a boundary,
• 17:20
  they generate an anomaly. If you have a system
• 17:22
  actively monitoring for anomalous lateral movement
• 17:24
  or unexpected Active Directory queries, you catch
• 17:27
  them on day two of their discovery phase, long
• 17:29
  before they find the backups. And speaking of
• 17:32
  those backups, they must be genuinely immutable,
• 17:34
  right? We hear immutables thrown around as a
• 17:36
  buzzword a lot lately. It is a buzzword, but
• 17:39
  it's critical. Let's define what actually saves
• 17:41
  a business here, because it's not just having
• 17:44
  a backup on a different server down the hall.
• 17:46
  No, definitely not. An immutable backup is written
• 17:48
  in a write -once -read -many state. Okay. Once
• 17:51
  the data is committed to that storage, it cannot
• 17:53
  be altered, encrypted, or deleted by anyone,
• 17:56
  not even a domain administrator. And it stays
• 17:59
  that way for a predetermined retention period.
• 18:02
  So the ransomware literally can't touch it. Right.
• 18:05
  Furthermore, the authentication plane for the
• 18:07
  backup infrastructure must be completely isolated
• 18:10
  from your primary Active Directory environment.
• 18:12
  Ah, so they can't use the stolen credentials
• 18:15
  to log into the backup server. Exactly. If the
• 18:18
  Quillen affiliate compromises your domain admin
• 18:20
  credentials, those credentials should be utterly
• 18:24
  useless for accessing the backup storage. That
• 18:26
  makes total sense. If you implement isolated
• 18:29
  immutable storage, you basically neutralize the
• 18:31
  entire Quillen business model. You take away
• 18:34
  their power. Yeah, even if they sit in the network
• 18:36
  for 19 days, even if they deploy the encryptor
• 18:39
  flawlessly, you just refuse the negotiation.
• 18:42
  You wipe the environment and restore operations
• 18:44
  from those immutable snapshots. The threat of
• 18:46
  a 40 -gigabyte ransom shifts from a company -ending
• 18:50
  disaster to just a contained incident response
• 18:53
  exercise. You strip away their leverage and,
• 18:55
  by extension, their psychological terror. Exactly.
• 18:58
  This whole examination of the Quillen attacks
• 19:01
  really highlights the shifting mechanics of cyber
• 19:03
  warfare. I mean, we are dealing with an industrialized
• 19:07
  RIAS ecosystem scaling to hundreds of victims,
• 19:09
  executing these patient - day infiltrations and
• 19:13
  aggressively targeting the vital but often under
• 19:16
  defended regional supply chains like the Mount
• 19:18
  Barker Cooperative. It's a very sophisticated
• 19:20
  threat landscape. It is. And yet the operational
• 19:23
  friction of this gig economy model frequently
• 19:25
  results in chaotic execution, leaving victims
• 19:28
  staring at 404 errors while trying to decipher
• 19:31
  if they've actually lost their data or not. Yeah.
• 19:33
  But, you know, before we conclude, there is a
• 19:35
  natural and frankly disturbing evolution of this
• 19:38
  missing data tactic that. organizations really
• 19:41
  must prepare for. Oh, what's coming next? Well,
• 19:44
  we analyzed how a group like Quillen generates
• 19:47
  panic simply by listing a company's name on a
• 19:50
  leak site, even without providing the stolen
• 19:53
  data, right? Yeah, the bluff. The next phase
• 19:56
  is the weaponization of generative AI. Wait,
• 19:58
  like synthesizing the proof? Exactly. In the
• 20:01
  near future, an attacker won't need to spend
• 20:04
  19 days carefully exfiltrating 40 gigabytes of
• 20:07
  authentic data. They will just breach the perimeter,
• 20:11
  scrape a few public documents, feed them into
• 20:14
  a large language model, and instantly generate
• 20:16
  hundreds of highly convincing, completely fabricated
• 20:20
  internal records. Like doctored financial ledgers,
• 20:23
  falsified board minutes, manufactured HR scandals.
• 20:26
  Exactly. They will use this synthetic data to
• 20:29
  extort companies who were never meaningfully
• 20:31
  breached in the first place. If a 404 error creates
• 20:34
  chaos today, imagine a leak site filled with
• 20:36
  hyper -realistic, AI -generated corporate fabrications.
• 20:40
  It will be devastating. That is the ultimate
• 20:43
  evolution of the hostage bluff. They don't just
• 20:44
  pretend to have the hostage. They use deepfakes
• 20:46
  to put the hostage on the phone. Precisely. It's
• 20:49
  coming. Man, that is a chilling thought. To ensure
• 20:52
  your organization is equipped to navigate these
• 20:54
  complex, evolving threats, whether it's an advanced
• 20:57
  RAIS affiliate or a synthetic extortion campaign,
• 21:00
  you need resilient, layered architecture. You
• 21:03
  really do. So visit www .kinsoft .com .au to
• 21:07
  discuss your security and IT needs. You must
• 21:10
  engineer your environment so that when the threat
• 21:12
  actors come testing your perimeter, you are the
• 21:14
  one holding the leverage. Thank you for joining
• 21:16
  our discussion today. stay vigilant assume breach
• 21:19
  and isolate your backups secure your environments
• 21:22
  everyone