Latest / Tech Talks With Kinsoft / Gregory Jewellers Data Breach – Kairos Ransomware Claims 574GB

Transcript

Gregory Jewellers Data Breach – Kairos Ransomware Claims 574GB · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. I want you
• 0:03
  to imagine, just for a second, walking into a
• 0:06
  really high -end Sydney boutique. Oh, like one
• 0:09
  of those places with the armed guards at the
• 0:10
  door? Yeah, exactly. Heavy glass, marble floors,
• 0:13
  the whole thing. And you've just selected a luxury
• 0:17
  watch or maybe a piece of fine jewelry to celebrate
• 0:20
  a milestone. Right. And to process the transaction,
• 0:23
  maybe you're claiming an international tax refund.
• 0:26
  So you hand over your passport to the person
• 0:28
  behind the counter. Which feels pretty standard
• 0:30
  in that environment. Right. They scan it, the
• 0:32
  paperwork clears, and you just walk out into
• 0:34
  the sunshine with your new watch. But imagine
• 0:37
  a few weeks later, a Russian -speaking cyber
• 0:39
  syndicate sends you an email. Oh, wow. And it
• 0:42
  contains a high -resolution scan of that exact
• 0:45
  passport right alongside an itemized receipt
• 0:47
  of your purchase. And they are demanding a ransom.
• 0:51
  It's I mean, it's a completely terrifying scenario.
• 0:53
  It really is. And our mission today is to pull
• 0:56
  back the curtain on a story where this highly
• 0:59
  polished, fortified world of physical luxury
• 1:02
  just, you know, collides head on with the messy,
• 1:07
  invisible vulnerabilities of the digital landscape.
• 1:10
  Yeah, the contrast is huge. We are unpacking
• 1:12
  the recent cyber incident hitting a really prominent
• 1:15
  Australian brand. Gregory Jewelers. And, you
• 1:18
  know, it's a situation that fundamentally challenges
• 1:20
  how we even perceive security. Because when we
• 1:23
  look at this, we have a highly respected family
• 1:26
  owned legacy brand and they're suddenly dealing
• 1:29
  with a really sophisticated ransomware operator.
• 1:32
  Which has resulted in the theft of an absolutely
• 1:35
  massive trove of sensitive data, both corporate
• 1:38
  and consumer data. Yeah. And for you listening,
• 1:40
  whether you are an IT professional architecting
• 1:44
  network defenses or just, you know, someone who
• 1:46
  occasionally hands over personal details or retail
• 1:48
  register, this is really a masterclass in modern
• 1:50
  digital risk. It absolutely is. We're going to
• 1:52
  examine the mechanics of this breach. Map out
• 1:55
  the threat group. claiming responsibility this
• 1:58
  syndicate known as Kairos, and analyzed the real
• 2:01
  -world fallout of the data they stole. Mmm. Okay,
• 2:05
  let's unpack this by looking at the Target itself.
• 2:07
  Yeah, let's start there. Because the physical
• 2:09
  reality of Gregory Jewelers contrasts so sharply
• 2:13
  with what happened digitally. I mean, they're
• 2:15
  an Australian -owned retailer with, what, over
• 2:17
  45 years of heritage? Yeah, 45 years. They specialize
• 2:20
  in fine jewelry, watches, all of that. And their
• 2:24
  production is based right in the heart of Sydney's
• 2:26
  CBD. Right. And when you walk into one of their
• 2:29
  physical storefronts, the security is overt.
• 2:32
  It's, frankly, intimidating. Oh, for sure. You've
• 2:35
  got armed guards, reinforced glass cases, heavy
• 2:37
  steel vaults. High def cameras everywhere. You're
• 2:40
  essentially stepping into a fortress. Exactly.
• 2:42
  But to operate a modern retail business, especially
• 2:45
  one dealing with global supply chains and high
• 2:48
  net worth clients, that physical fortress has
• 2:50
  to connect to a digital infrastructure. And that
• 2:53
  is exactly where the Cairo's ransomware gang
• 2:55
  found their entry point. Yeah, they did. And
• 2:58
  they're claiming to have stolen a staggering
• 3:01
  574 gigabytes of data. Which is just an immense
• 3:05
  amount of data. It really is. And, you know,
• 3:08
  574 gigabytes might sound abstract to some people.
• 3:11
  If we were talking about raw 4K video files,
• 3:13
  maybe it wouldn't sound so catastrophic. Right,
• 3:15
  because video files are huge. Yeah. But when
• 3:18
  we are talking about text -heavy files, you know,
• 3:21
  spreadsheets, PDF scans, email archives, customer
• 3:25
  records. That's not just a few digital filing
• 3:28
  cabinets. No, not at all. That is essentially
• 3:30
  digital tractor trailers full of filing cabinets.
• 3:33
  We are talking about warehouses of concentrated,
• 3:36
  searchable, historical data. And that 45 year
• 3:39
  history of the company is actually a really critical
• 3:41
  factor in why the volume is so high. How so?
• 3:43
  Well, when a legacy business transitions through
• 3:46
  different eras of technology, you know, going
• 3:48
  from paper records to early databases in the
• 3:51
  90s to modern cloud environments. They just drag
• 3:54
  everything with them. Exactly. They carry an
• 3:56
  immense amount of technical debt. It's kind of
• 3:58
  like trying to build a state of the art titanium
• 4:01
  bank vault on top of a decaying wooden foundation.
• 4:04
  Wow. That's a great way to put it. You've got
• 4:07
  decades of accumulated customer interactions,
• 4:10
  old employee records, and just operational data
• 4:13
  sitting on servers. So the attackers aren't just
• 4:15
  getting today's transactions. They're getting
• 4:17
  the historical ledger of the entire business.
• 4:21
  Precisely. And this shows a real strategic shift
• 4:24
  in the ransomware economy. Right. Because they
• 4:28
  used to just go after tech companies. Yeah. Tech
• 4:30
  companies, big financial institutions, critical
• 4:32
  infrastructure. But those sectors have spent
• 4:35
  the last decade really hardening their defenses.
• 4:37
  So the syndicates are pivoting. Yeah. They are
• 4:40
  hunting where the money and the high net worth
• 4:42
  customer data reside in environments that might
• 4:46
  not have the same level of digital fortification
• 4:48
  as, say, a global bank. Right, which makes a
• 4:51
  luxury jeweler an incredibly lucrative target.
• 4:54
  The data they hold is tailor -made for exploitation.
• 4:58
  Oh, absolutely. Well, let's talk about that because
• 5:00
  the sheer volume of the data is just the beginning,
• 5:02
  right? The real shock comes when you look at
• 5:04
  what is actually inside those filing cabinets.
• 5:06
  Yeah, the contents are what matter. The reporting
• 5:09
  gives us a really clear look at the sample data
• 5:12
  that Kairos initially leaked. And they publish
• 5:15
  client personal information, customer purchase
• 5:17
  histories. Internal documents relating to an
• 5:21
  investigation. Yeah, that internal investigation
• 5:23
  stuff is sensitive. Really sensitive. And crucially,
• 5:27
  identity documents, including a passport. What's
• 5:30
  fascinating here is the potency of this specific
• 5:32
  combination. In cybersecurity, we actually refer
• 5:35
  to this as a data cocktail. A data cocktail.
• 5:38
  OK, I like that term. Yeah, because a single
• 5:40
  piece of data in isolation might just be mildly
• 5:44
  problematic, right? Like if someone steals a
• 5:46
  list of email addresses, it's a nuisance. more
• 5:48
  spam sure but when you mix specific high -value
• 5:52
  data points together the resulting cocktail becomes
• 5:55
  incredibly lethal for the victim but wait I want
• 5:59
  to push back on this for a second because I think
• 6:00
  a lot of people listening might find this part
• 6:02
  jarring okay it makes complete sense that a company
• 6:04
  has employee files but a customer's passport
• 6:08
  alongside their jewelry purchase history. That
• 6:11
  feels intensely personal. Honestly, it feels
• 6:14
  like a massive overreach just for buying a necklace.
• 6:17
  It does feel intrusive. But there are strict
• 6:21
  mechanical reasons for it in the luxury sector.
• 6:24
  Really? Like what? Well, first, you have international
• 6:26
  travelers using the tourist refund scheme. Oh,
• 6:29
  to claim back taxes. Right. And that legally
• 6:32
  requires the retailer to process and verify international
• 6:35
  identity documents. Oh, OK. And secondly, and
• 6:38
  this is probably more important, are the anti
• 6:40
  -money laundering regulations, the AML laws.
• 6:43
  Of course. If an individual walks into a boutique
• 6:45
  and wants to buy a $100 ,000 watch with cash
• 6:48
  or even a wiretrap, the jeweler is legally obligated
• 6:52
  to verify exactly who that person is. So they
• 6:54
  have to prevent the laundering of illicit funds.
• 6:57
  Yes. To comply with the law, the retailer has
• 7:00
  to scan and store the most sensitive identity
• 7:02
  document a person has. Wow. But then the vulnerability
• 7:06
  arises once that scan enters the digital ledger.
• 7:09
  Exactly. If that storage environment isn't heavily
• 7:12
  segmented and, you know, encrypted, it becomes
• 7:16
  a major target. And Kairos understands exactly
• 7:18
  how to weaponize that combination. Because a
• 7:21
  purchase history alone is bad. But pairing a
• 7:24
  luxury purchase with a passport creates a really
• 7:28
  severe extortion threat. It creates a two -pronged
• 7:30
  extortion model. How does that work? Well, the
• 7:33
  primary extortion targets the corporate entity,
• 7:36
  right? Pay us the ransom or we destroy your reputation
• 7:39
  and you get hit with massive regulatory fines.
• 7:42
  Right. The standard corporate shakedown. Yeah.
• 7:44
  But the secondary extortion vector targets the
• 7:47
  clients directly. Oh, wow. Yeah. The attackers
• 7:49
  cross -reference the purchase history with the
• 7:52
  contact details and they reach out to the high
• 7:54
  net worth individual. They essentially say, we
• 7:56
  have your passport. We know you bought a $50
• 7:59
  ,000 diamond ring last Tuesday. Pay us in crypto
• 8:02
  or we publish your identity and your assets to
• 8:05
  the world. That is just a terrifying level of
• 8:07
  leverage. It really is. But there's this strange
• 8:10
  detail in the reporting about this specific leak.
• 8:14
  At the time of the reporting, the listing for
• 8:17
  Gregory Jewelers, along with that terrifying
• 8:19
  sample of passports and purchase histories, it
• 8:22
  had completely vanished from the Cairo's dark
• 8:24
  web leak site. Yeah, and that vanishing act is
• 8:26
  actually a very calculated move. Really? Because
• 8:29
  from a layman's perspective, if the listing disappears,
• 8:33
  it kind of looks like the hackers just packed
• 8:34
  up and gave up. No, they do not walk away from
• 8:37
  leverage. We have to look at this through the
• 8:40
  lens of standard ransomware playbooks. When a
• 8:43
  threat group publicly posts a victim in a sample,
• 8:47
  it's a demonstration of capability. They are
• 8:49
  proving they actually breached the network. Right.
• 8:52
  Showing their hand. Exactly. So when that listing
• 8:54
  is removed, it's almost always a signaling mechanism.
• 8:57
  It typically means the victim company has opened
• 8:59
  a channel of communication. You know, negotiations
• 9:01
  have begun. Oh, so it's not a retreat. It's a
• 9:03
  temporary ceasefire. It's a show of conditional
• 9:06
  compliance. They take it down to prove they control
• 9:09
  the publication process. The implicit threat
• 9:11
  is basically, we proved we can publish it. We
• 9:14
  proved we can take it down. If you pay, it stays
• 9:17
  down. But if negotiations stall, it goes right
• 9:19
  back up. And the rest of the 574 gigabytes follows.
• 9:23
  Yeah. It is pure psychological pressure. That
• 9:27
  is incredibly manipulative. And if we're dealing
• 9:29
  with a group... employing these kinds of psychological
• 9:32
  and extortion tactics, we really need to look
• 9:35
  at who is pulling the strings. We do. Let's talk
• 9:37
  about Kairos. According to the threat intelligence
• 9:40
  firm CYJX, they are a relatively new operator.
• 9:44
  Very new. Yeah, they only announced their first
• 9:46
  victim in November 2024, yet they have already
• 9:49
  claimed over 80 victims. It's a massive scale
• 9:52
  -up. And apparently they're active on Russian
• 9:54
  language hacking forums, but they operate seemingly
• 9:57
  independently. No obvious links to older hacking
• 10:00
  groups. Right. But here's where it gets really
• 10:03
  interesting. Kairos has developed this recent
• 10:06
  fixation on Australia. Yeah, they really have.
• 10:08
  They targeted at least three Australian victims
• 10:10
  in April alone. And to really illustrate their
• 10:15
  ruthlessness, we have to look at their attack
• 10:17
  on Strata Republic. Yes. The Strata Republic
• 10:19
  case is a crucial case study here. They're a
• 10:22
  New South Wales -based property management company,
• 10:25
  right? And Kairos claimed 441 gigabytes of data
• 10:29
  from them. And this case strips away the abstract
• 10:33
  concept of a data breach. Yeah, because it shows
• 10:36
  the gritty, humiliating reality of their tactics.
• 10:39
  Exactly. When you look at what Kairos leaked
• 10:41
  from Strata Republic, it wasn't just boring corporate
• 10:44
  spreadsheets. No, it was deeply personal. They
• 10:46
  leaked an employee's letter of reprimand. They
• 10:48
  leaked tax reports that included tax file numbers.
• 10:51
  Which is huge. Let's look at why a tax file number,
• 10:55
  a TFN, is so prized. In Australia, your TFN is
• 10:59
  a foundational pillar of your financial identity.
• 11:01
  Right, you need it for everything. Yeah, if an
• 11:03
  attacker has your TFN, your full name, and a
• 11:06
  scanned copy of your driver's license, which
• 11:08
  Kairos... also leaked, they can impersonate you
• 11:10
  to the Australian Taxation Office. Oh, man. So
• 11:14
  they can lodge fraudulent tax returns. Yes, and
• 11:16
  route the refunds to themselves or open lines
• 11:19
  of credit. It takes months, sometimes years,
• 11:23
  to unwind that kind of identity theft. But they
• 11:26
  went even further than financial damage, right?
• 11:29
  Because of the most aggressive thing they leaked?
• 11:31
  was an inappropriate photograph. It was from
• 11:34
  a Christmas party featuring several men standing
• 11:37
  around a topless woman. If we connect this to
• 11:39
  the bigger picture, this is where we see the
• 11:42
  evolution of ransomware tactics. Kairos is weaponizing
• 11:46
  embarrassment. They're curating the leaks for
• 11:48
  maximum reputational damage. Exactly. They aren't
• 11:51
  just dumping unstructured data. They actively
• 11:54
  parse through thousands of emails and HR folders
• 11:57
  looking for the single most damaging reprimand
• 12:00
  or the most inappropriate photo. They want to
• 12:02
  inflict chaos. They want to prove to future victims
• 12:05
  like Gregory Jewelers that they are willing to
• 12:07
  play dirty. they have absolutely no moral boundaries.
• 12:10
  Which forces rushed decision making, right? Executives
• 12:13
  are panicking about what informal messages or
• 12:15
  photos might be on their servers. And panic usually
• 12:18
  leads to a ransom payment. Well, knowing this
• 12:21
  ruthless playbook, how is Gregory Jewelers actually
• 12:23
  responding to this high stakes pressure? They've
• 12:26
  issued an official statement. Right. The official
• 12:29
  line from the company confirms an unauthorized
• 12:31
  third party accessed part of their IT systems.
• 12:35
  Standard PR phrasing. Yeah. They say they're
• 12:38
  engaging independent experts and they've notified
• 12:40
  the Office of the Australian Information Commissioner,
• 12:43
  the OAIC, and the Australian Cyber Security Centre,
• 12:46
  the ACSC. Which means they are doing things by
• 12:49
  the book. And they also said they are communicating
• 12:51
  with staff and clients. But the phrase that stands
• 12:54
  out to me in their statement is, we are operating
• 12:56
  as usual. Yeah, operating as usual. It's like
• 12:59
  a duck on a pond, right? How do you mean? Well,
• 13:01
  gliding calmly on the surface for the customers
• 13:04
  walking into the boutique, but paddling furiously
• 13:06
  underwater to figure out the extent of the damage.
• 13:09
  That's a perfect analogy. So what does this all
• 13:11
  mean for their response team? It means breaking
• 13:14
  down the corporate response playbook. By involving
• 13:17
  the OAIC and ACSC, they are handling the regulatory
• 13:21
  and threat intelligence side. But the fact that
• 13:24
  they stated investigations into the type and
• 13:27
  extent of data impacted are ongoing, that means
• 13:30
  the true scope of the fallout is still a looming
• 13:33
  shadow. They don't actually know everything that
• 13:35
  was taken yet. Exactly. The physical storefront
• 13:38
  might be operating, but behind the firewall,
• 13:40
  the IT infrastructure is an active crime scene.
• 13:43
  The incident response team is trying to reverse
• 13:46
  engineer the attack while the attackers are holding
• 13:49
  that dark web listing over their heads. It's
• 13:52
  a nightmare scenario. It really is. And I think
• 13:54
  it leaves us with a provocative thought to mull
• 13:56
  over. What's that? Well, in an era where digital
• 13:59
  threat actors like Kairos can weaponize everything
• 14:02
  from a luxury watch receipt to an embarrassing
• 14:05
  party photo, the concept of a secure purchase
• 14:08
  extends way beyond the physical security of a
• 14:10
  jewelry store. Right. The armed guards don't
• 14:13
  matter if the server is open. Exactly. How much
• 14:15
  of our physical lives, you know, our identities,
• 14:17
  our movements, our purchases are inextricably
• 14:20
  linked to the digital ledgers of the business?
• 14:22
  as we frequent. Yeah, that is a really unsettling
• 14:25
  thought and an important one. We want to thank
• 14:27
  you for joining us to explore this topic. Yeah,
• 14:30
  thank you for listening. And if listening to
• 14:32
  this has you thinking about your own digital
• 14:34
  safety, maybe wondering how secure your own digital
• 14:37
  ledgers are, we highly encourage you to visit
• 14:39
  www .kinsoft .com .au to discuss your own security
• 14:44
  and IT needs. You definitely don't want to wait
• 14:46
  until a group like Tyrose finds you. Thanks for
• 14:49
  joining us, and we'll see you next time.