Latest / Tech Talks With Kinsoft / Champion Homes Data Breach – Inside the DragonForce Ransomware Attack

Transcript

Champion Homes Data Breach – Inside the DragonForce Ransomware Attack · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. What does
• 0:02
  a scoop of gelato on a sunny afternoon have in
• 0:05
  common with, you know, the architectural blueprints
• 0:08
  to a multi -million dollar custom home? Well,
• 0:11
  on the surface, absolutely nothing. I mean, one
• 0:14
  is a fleeting sugar rush and the other is probably
• 0:18
  the most stressful financial commitment of your
• 0:20
  entire life. Right. Exactly. But right now, the
• 0:23
  data generated by both of those completely mundane
• 0:26
  activities, your dessert preferences and your
• 0:28
  structural engineering documents, they are actually
• 0:30
  funding one of the fastest growing extortion
• 0:33
  cartels in the global cyber underground. Yeah.
• 0:37
  And it completely shatters that illusion of localized
• 0:39
  safety. kind of carry around, we are conditioned
• 0:42
  to think of cybercrime as this, well, this invisible
• 0:45
  war, right? Right. Like the way it's against
• 0:46
  massive international banks or defense contractors
• 0:49
  or tech giants. Yeah, the big guys. Exactly.
• 0:52
  Right. But the reality of the modern threat landscape
• 0:54
  has just shifted dramatically. The front lines
• 0:56
  are no longer just in Silicon Valley or Wall
• 0:57
  Street. They are sitting in your neighborhood
• 0:59
  strip mall and on your local construction sites.
• 1:03
  Which brings us to our mission for today's exploration.
• 1:06
  We are looking at some recent reporting from
• 1:08
  Cyber Daily and real estate business regarding
• 1:11
  a major cyber event that hit an Australian home
• 1:14
  builder called Champion Homes. Right. A very
• 1:17
  localized target. Yeah. We are going to figure
• 1:19
  out exactly how this breach occurred. pull apart
• 1:22
  the shadowy and, frankly, shockingly corporate
• 1:25
  business model of the attackers, and understand
• 1:28
  the impossible tightrope modern companies are
• 1:30
  forced to walk when their digital walls are suddenly
• 1:33
  breached. Okay, let's unpack this. To really
• 1:35
  grasp the gravity of this situation, we need
• 1:39
  to look closely at the target itself. Champion
• 1:41
  Homes is a prominent Sydney -based home builder
• 1:44
  headquartered in Hoxton Park. Okay, so a major
• 1:47
  regional player. Very much so. They service the
• 1:49
  greater Sydney and Illawarra areas. They handle
• 1:52
  everything from initial home designs to knockdown
• 1:55
  and rebuild projects and custom house and land
• 1:58
  packages. So they are managing people's biggest
• 2:00
  life investments. I mean, you're talking about
• 2:02
  immense amounts of trust here. Oh, absolutely.
• 2:05
  Clients hand over incredible amounts of financial
• 2:07
  and personal data just to get the process started.
• 2:10
  Right. And on April 21st, that reservoir of trust
• 2:13
  was breached. Champion Homes was officially listed
• 2:16
  on a dark web leak site by a ransomware operation
• 2:19
  known as Dragonforce. Dragonforce. Yeah. And
• 2:23
  they didn't just list the company's name as an
• 2:25
  empty threat. They dumped 44 gigabytes of highly
• 2:28
  sensitive data. directly onto the open dark web
• 2:32
  for anyone to download. Wow. Let's visualize
• 2:35
  that payload for a second because 44 gigabytes
• 2:38
  can sound deceptively small if you were thinking
• 2:40
  about modern video files, right? Yeah. A handful
• 2:42
  of 4K movies could hit that limit in no time.
• 2:44
  Exactly. But we are talking about text and PDFs
• 2:47
  here. So imagine a massive industrial warehouse
• 2:50
  floor. Now fill that entire floor with rows and
• 2:53
  rows of tall, heavy metal filing cabinets, completely
• 2:56
  packed with dense, text -heavy paper documents.
• 2:59
  That's a lot of paper. It's a staggering amount.
• 3:02
  But here is the critical part about how modern
• 3:05
  ransomware works. They didn't just lock the doors
• 3:08
  to that warehouse. Before they lock the company
• 3:10
  out, they silently wheeled every single filing
• 3:14
  cabinet out the back door, photocopied every
• 3:17
  single page, and then put them back. What's fascinating
• 3:20
  here is the specific alchemy. of that stolen
• 3:23
  data mix. This is what we call double extortion
• 3:25
  in the industry. Double extortion, right, because
• 3:27
  they hit you twice. Exactly. The hackers encrypt
• 3:30
  the system to stop your business from functioning,
• 3:32
  but they also steal the data to threaten you
• 3:35
  with public exposure. In this 44 gigabyte dump,
• 3:39
  you have two very distinct, very dangerous categories
• 3:42
  of information exposed simultaneously. Okay,
• 3:45
  so what's the first category? First, you have
• 3:48
  the corporate operational secrets. The reporting
• 3:50
  shows this included tender documents, proprietary
• 3:53
  pricing models, and subcontractor agreements.
• 3:56
  Oh, wow. So that is the absolute lifeblood of
• 3:58
  a construction company's competitive edge. You
• 4:01
  essentially hand a competitor your entire playbook
• 4:03
  on a silver platter. Yeah, it's devastating commercially.
• 4:06
  But beyond the corporate espionage angle, you
• 4:09
  have the deeply personal, highly sensitive human
• 4:11
  element. The leak included dense spreadsheets
• 4:15
  of employee payroll data. Which is so much more
• 4:17
  than just a paycheck stub. Oh, way more. Payroll
• 4:20
  data isn't just a list of names and hourly rates.
• 4:23
  It contains tax file numbers, home addresses,
• 4:26
  bank account routing numbers, and superannuation
• 4:28
  details. Which, for our global listeners, is
• 4:32
  the mandatory Australian retirement pension system.
• 4:34
  That's practically a full identity theft starter
• 4:37
  kit. It really is. Add in the thousands of detailed
• 4:40
  customer quotes, which likely contain personal
• 4:43
  contact details, financial limits and property
• 4:45
  addresses, and you have a ready -made treasure
• 4:47
  trove for identity thieves. We are talking about
• 4:50
  highly organized, incredibly localized data extraction
• 4:54
  here. This isn't a random automated virus from
• 4:56
  the early 2000s that just, you know, bricks your
• 4:58
  computer. No, not at all. Someone had to specifically
• 5:01
  target, extract and organize this data, which
• 5:05
  brings up the obvious question. Who actually
• 5:08
  has the resources and the operational capacity
• 5:10
  to hit a regional Australian home builder with
• 5:14
  this level of precision? Well, the entity claiming
• 5:16
  responsibility goes by the name Dragon Force.
• 5:19
  And to understand how they operate, we have to
• 5:21
  look at the evolution of digital extortion. Dragonforce
• 5:24
  functions as an economy, not just a standalone
• 5:27
  gang of hackers. Here's where it gets really
• 5:29
  interesting. Dragonforce operates under a model
• 5:32
  known as ransomware as a service, or RAS. Yeah,
• 5:35
  RAS. Historically, a threat actor had to be a
• 5:38
  technical polymath. You had to code complex encryption
• 5:41
  malware from scratch, figure out how to bypass
• 5:43
  enterprise security networks, manage encrypted
• 5:45
  communication servers, and, you know, handle
• 5:48
  the actual insertration. It was a one -man band,
• 5:50
  basically. Exactly. The barrier to entry was
• 5:52
  incredible. incredibly high, which naturally
• 5:54
  limited the number of attacks happening globally.
• 5:56
  But ransomware as a service completely dismantled
• 5:59
  that barrier. Think of Rayass like a twisted
• 6:02
  franchise model. Right. But let's look at the
• 6:04
  actual mechanics of it. You don't need to know
• 6:07
  how to design commercial kitchen equipment to
• 6:09
  open a fast food franchise. Right. You just buy
• 6:11
  the system. Exactly. The corporation, in this
• 6:14
  case, Dragon Force, builds the kitchen. They
• 6:16
  write the sophisticated encryption algorithms.
• 6:18
  They build the sleek. automated payment portals
• 6:22
  on the dark web where victims are sent to negotiate.
• 6:25
  They even maintain the leak sites. Yeah. All
• 6:28
  the franchisee or the affiliate has to do is
• 6:30
  walk down the street and find a storefront with
• 6:33
  an unlocked back door. They scan the internet
• 6:36
  for a server with an outdated password, or they
• 6:38
  trick an employee into clicking a phishing link.
• 6:41
  Once they are in, they just deploy the corporation's
• 6:44
  software. The division of labor is incredibly
• 6:46
  efficient. Dragonforce focuses purely on software
• 6:50
  development and infrastructure management, while
• 6:52
  a decentralized army of affiliates handles the
• 6:55
  breaking and entering. And they recruit these
• 6:57
  affiliates pretty openly, right? Oh, yeah. They
• 7:00
  advertise these franchise opportunities publicly
• 7:02
  on Russian -language hacking forums. Let me share
• 7:05
  the actual recruitment pitch Dragonforce recently
• 7:07
  posted. Please do. It reads, We are ready to
• 7:11
  open our doors for researchers. Creating your
• 7:14
  team has never been easier. Just enter your TOX
• 7:16
  ID, new login with password and pay the $500
• 7:20
  verification with XMR or BTC. Calling digital
• 7:23
  extortionists researchers is a staggering level
• 7:26
  of corporate cynicism. Isn't it? But I want to
• 7:29
  pause on that onboarding process because it sounds
• 7:31
  dangerously frictionless. What is a TOX ID? So
• 7:34
  TOX is a peer -to -peer, end -to -end encrypted
• 7:37
  messaging protocol. Unlike WhatsApp or Signal,
• 7:41
  it doesn't require a phone number, an email address,
• 7:43
  or any central server that law enforcement could
• 7:45
  potentially subpoena. So there's no paper trail
• 7:48
  whatsoever? None. You are just a string of random
• 7:50
  alphanumeric characters. It guarantees absolute
• 7:52
  anonymity from the moment you apply. Wait, I
• 7:54
  need to push back on this $500 verification fee.
• 7:57
  If these cards... It seems low, right? Yeah.
• 8:06
  Is there a technical catch or is it really that
• 8:08
  cheap to become an international cyber criminal?
• 8:11
  It really is that cheap. The low upfront cost
• 8:13
  is a calculated strategy to maximize volume.
• 8:17
  The real revenue is generated on the back end
• 8:19
  through profit sharing. Dragonforce passes up
• 8:22
  to 80 % of the ransom payments directly to these
• 8:26
  affiliates. An 80 -20 split. That is incredibly
• 8:29
  generous for the affiliate. It is, but Dragonforce
• 8:32
  is taking zero operational risk. The affiliate
• 8:35
  is the one actually intruding into the networks,
• 8:37
  leaving digital footprints and risking exposure.
• 8:40
  Ah, I see. Dragonforce sits back, takes a 20
• 8:42
  % cut from merely maintaining the software, and
• 8:45
  lets the affiliates do the risky labor. It heavily
• 8:48
  incentivizes volume. If you keep 80 % of the
• 8:51
  take, your goal is to hit as many targets as
• 8:53
  possible as quickly as possible. And the payment
• 8:56
  methods themselves ensure the money vanishes
• 8:58
  the moment it changes hands. The pitch specified
• 9:00
  payment in XMR or BTC, meaning Monero or Bitcoin.
• 9:04
  Exactly. Now, most people have heard of Bitcoin,
• 9:07
  but Monero seems to be the currency of choice
• 9:09
  for the dark web lately. Why the distinction?
• 9:12
  Well, Bitcoin operates on a public ledger. Every
• 9:15
  transaction is visible, meaning forensic accountants.
• 9:18
  and law enforcement can actually trace the flow
• 9:21
  of Bitcoin from a victim's wallet to a hacker's
• 9:24
  exchange account. Right. It's pseudonymous, not
• 9:27
  fully anonymous. Precisely. Monero, or XMR, uses
• 9:31
  advanced cryptography to completely obfuscate
• 9:33
  the sender, the receiver, and the amount being
• 9:36
  transferred. It is a true privacy coin. So once
• 9:39
  money is converted into Monero, it essentially
• 9:41
  falls into a black hole. Completely untraceable.
• 9:44
  This combination of anonymous recruitment, untraceable
• 9:46
  currency, and an 80 -20 profit split really explains
• 9:50
  the sheer velocity of their attacks. The sources
• 9:53
  note that Dragonforce was only first observed
• 9:55
  in December of 2023. Which is very recent. Yeah.
• 9:58
  Yet in roughly five months, they and their affiliates
• 10:00
  have been responsible for at least 506 ransomware
• 10:03
  attacks. Over 100 successful, devastating attacks
• 10:06
  a month. within three a day. It is an industrial
• 10:09
  scale of digital violence that we have never
• 10:11
  seen before. And it brings us back to that scoop
• 10:13
  of gelato we talked about at the start. The sources
• 10:16
  explicitly point out that 16 of those 506 incidents
• 10:20
  targeted Australian organizations. Right in our
• 10:23
  backyard. Yeah. Before the attack on Champion
• 10:26
  Homes in late April, their most recent local
• 10:29
  victim was Gelatissimo, the popular gelato brand.
• 10:32
  Because to a Dragon Force affiliate, a target
• 10:35
  is just an IP address with a vulnerability. They
• 10:38
  don't care if you sell desserts or if you pour
• 10:39
  concrete for custom homes in Oxton Park. You
• 10:42
  are just a node on their revenue stream. Which
• 10:45
  shifts our focus to the morning after. When an
• 10:48
  organization actually discovers that its blueprints,
• 10:50
  customer quotes, and employee tax files have
• 10:53
  been dumped onto a dark website by a franchise
• 10:55
  cyber gang, what exactly does the response look
• 10:58
  like? It triggers an immediate, multi -track
• 11:00
  crisis protocol. Based on the reports, Champion
• 11:03
  Homes executed the standard incident response
• 11:06
  playbook. A spokesperson confirmed that upon
• 11:08
  becoming aware of the cyber event, they immediately
• 11:11
  engaged leading cyber experts to provide advice
• 11:13
  and containment. OK, but what does containment
• 11:16
  actually mean in a technical sense? You can't
• 11:19
  just unplug the router and call it a day. No,
• 11:21
  definitely not. Forensic investigators have to
• 11:24
  actively hunt the attackers inside the network.
• 11:27
  They look for indicators of compromise or IOCs.
• 11:31
  Like fingerprints at a crime scene. Exactly.
• 11:33
  This means analyzing server logs to see which
• 11:36
  user accounts were hijacked, tracking lateral
• 11:38
  movement to see how far the hackers spread, and
• 11:41
  identifying the malicious command and control
• 11:43
  beacons the hackers left behind to maintain access.
• 11:46
  So containment is an active combat zone. Very
• 11:49
  much so. Containment means severing those connections,
• 11:52
  patching the initial vulnerability, like closing
• 11:55
  that unlock backdoor we talked about, and ensuring
• 11:58
  the threat actors are permanently locked out
• 11:59
  of the environment. The company stated that the
• 12:02
  event was contained and that it had a, quote,
• 12:04
  limited impact on our operations, unquote, allowing
• 12:07
  them to continue providing services to their
• 12:09
  clients as usual. Which makes sense from a business
• 12:11
  standpoint. Right. From a sheer business survival
• 12:14
  standpoint, I understand the phrasing. You have
• 12:17
  massive construction projects underway, contractors
• 12:20
  waiting for materials and deadlines to meet.
• 12:22
  You have to keep the physical hammers swinging.
• 12:24
  But there is an intense friction there. Oh, massive
• 12:28
  friction. The friction between business continuity
• 12:30
  and data reality is the hardest tightrope modern
• 12:33
  executives have to walk. For sure. The physical
• 12:36
  infrastructure, you know, the pouring of concrete,
• 12:38
  the framing of walls, that can all continue.
• 12:41
  But behind the scenes, the company had to publicly
• 12:44
  acknowledge a far more damaging reality. An investigation
• 12:48
  revealed that a subset of data was likely copied
• 12:51
  from our systems. And we know that subset was
• 12:53
  a 44 gigabyte warehouse of tender documents and
• 12:56
  personal payroll data. What stands out to you
• 12:59
  listening right now? It's a chilling thought.
• 13:01
  It's terrifying for the customer. knowing your
• 13:26
  tax file number is compromised. The PR instinct
• 13:29
  is to project stability, but the human cost of
• 13:32
  the breach is actively unfolding. If we connect
• 13:35
  this to the bigger picture, it illustrates exactly
• 13:38
  why regulatory bodies exist. Companies cannot
• 13:41
  be trusted to self -regulate a crisis that threatens
• 13:44
  their own survival. Because their primary instinct
• 13:46
  is just to survive. Exactly. Champion Homes noted
• 13:49
  this impacts some of our employees and customers.
• 13:52
  We will be communicating with impacted individuals
• 13:54
  in line with our obligations. Those obligations
• 13:57
  are a rigid, non -negotiable legal framework.
• 14:00
  The sources outlined that Champion Homes took
• 14:02
  the necessary regulatory steps, reporting the
• 14:05
  event to two distinct governmental bodies. The
• 14:08
  Office of the Australian Information Commissioner.
• 14:11
  The OAIC and the Australian Cyber Security Center,
• 14:15
  the ACSC. Those are critical. So why are both
• 14:17
  of these notifications legally required? They
• 14:20
  serve two vital, completely different functions
• 14:22
  in the cyber ecosystem. The ACSC is focused on
• 14:25
  the mechanics of the crime and national defense.
• 14:28
  Okay, the technical side. Right. When they receive
• 14:30
  reports that the Dragon Force is hitting Gelatissimo
• 14:32
  and then a home builder. They can extract those
• 14:36
  indicators of compromise we talked about earlier.
• 14:38
  They map the attacker's tactics, share threat
• 14:40
  intelligence with other businesses, and build
• 14:42
  a broader defense strategy. They need to know
• 14:45
  how the attack happened. So the ACSC is tracking
• 14:48
  the weapons and the tactics. Exactly. Whereas
• 14:50
  the OAIC is entirely focused on the victims.
• 14:53
  They enforce the notifiable data breaches scheme
• 14:55
  under Australian privacy law. If an organization
• 14:58
  loses control of personal information that is
• 15:00
  likely to result in serious harm, Like the very
• 15:04
  real threat of identity theft stemming from stolen
• 15:07
  payroll and superannuation data. They are legally
• 15:10
  obligated to notify the OAIC. And more importantly,
• 15:14
  they are legally obligated to notify the affected
• 15:16
  individuals. So the OAIC essentially forces the
• 15:20
  company to look the victims in the eye. They
• 15:22
  ensure the business doesn't just focus on getting
• 15:24
  their servers back online, but also takes legal
• 15:27
  responsibility for the human cost of the leaked
• 15:30
  data. They hold them accountable. Champion Homes
• 15:33
  issued a statement saying, We take the protection
• 15:35
  of our data seriously and sincerely apologize
• 15:37
  for any concern this event may have caused. But
• 15:41
  an apology, no matter how sincere, does not unleak
• 15:44
  44 gigabytes of data. No, it doesn't. Once the
• 15:47
  data is exfiltrated and published, the damage
• 15:49
  is permanent. For the affected employees, it
• 15:52
  means years of monitoring their credit profiles,
• 15:54
  securing their superannuation accounts, and remaining
• 15:56
  hypervigilant against targeted phishing scams.
• 15:59
  Because the hackers will use that specific info
• 16:01
  to trick them later. Exactly. They might use
• 16:04
  their stolen tender documents or payroll details
• 16:06
  as bait to trick them into revealing even more
• 16:09
  information. Which shows how this cycle of extortion
• 16:12
  feeds itself. The data stolen today becomes the
• 16:15
  phishing lures used to breach the next company
• 16:17
  tomorrow. We are witnessing the total commoditization
• 16:20
  of cybercrime. When malicious tools can be rendered
• 16:23
  for a $500 verification fee, the threat actors
• 16:26
  no longer need to be sophisticated engineers.
• 16:28
  They just need to be persistent opportunists.
• 16:30
  Exactly. But if we project this trend forward...
• 16:35
  We're approaching a terrifying new threshold.
• 16:37
  What happens when they optimize it even further?
• 16:40
  Well, think about the integration of artificial
• 16:42
  intelligence into this ransomware as a service
• 16:44
  model. Right now, a human affiliate still has
• 16:47
  to pay $500, scan for vulnerabilities, and manually
• 16:50
  deploy the payload. It still requires human effort.
• 16:53
  Right. What happens when Dragon Force trains
• 16:55
  an AI to autonomously scan the Internet, write
• 16:58
  hyper -personalized phishing emails based on
• 17:01
  previously lead data, and deploy ransomware 24
• 17:04
  hours a day, seven days a week, without human
• 17:07
  intervention? The scale just explodes. The barrier
• 17:09
  to entry drops from $500 to absolute zero. And
• 17:12
  the scale goes from three attacks a day to 3
• 17:14
  ,000. So what does this all mean? It means the
• 17:18
  old defense of being too small or too analog
• 17:20
  to be a target is entirely obsolete. You could
• 17:23
  be building custom homes, you could be churning
• 17:25
  gelato, or you could be running a local accounting
• 17:28
  firm. It really doesn't matter anymore. If your
• 17:30
  business holds digital data, you are participating
• 17:33
  in a global ecosystem where someone, somewhere,
• 17:37
  views your network as a potential payday. Security
• 17:41
  is no longer just an IP problem. It is a fundamental
• 17:44
  pillar of existing as a business. You can't just
• 17:47
  build strong physical houses. Your digital foundations
• 17:50
  have to be equally robust or the entire structure
• 17:53
  collapses. That's a great way to put it. www
• 18:12
  .kinsoft .com forward slash to discuss your own
• 18:18
  security and IT needs. You want to make sure
• 18:21
  your defenses are ready because the tools to
• 18:23
  dismantle them are only getting cheaper and more
• 18:25
  accessible. Outpacing the opportunist requires
• 18:27
  proactive strategy. Preparedness is the only
• 18:30
  viable defense mechanism we have left. That brings
• 18:33
  us to the end of our discussion for today. Thank
• 18:35
  you so much for joining us on this exploration.
• 18:37
  We will catch you next time. Goodbye, everyone.
• 18:38
  Remember, your everyday data is always on the
• 18:41
  main stage. Stay vigilant.