Latest / Tech Talks With Kinsoft / Metricon Homes Ransomware Attack and Orange France System Breach

Transcript

Metricon Homes Ransomware Attack and Orange France System Breach · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. Great to
• 0:02
  be here. Today we're going to unpack some, well,
• 0:04
  pretty significant cybersecurity incidents that
• 0:07
  have happened recently. Yeah, things that offer
• 0:09
  some really crucial lessons for, you know, pretty
• 0:11
  much everyone navigating the digital world. Exactly.
• 0:14
  We want to look beyond just the headlines. Right.
• 0:16
  Try to understand the patterns, maybe the broader
• 0:19
  implications of these threats, especially for
• 0:21
  industries going through rapid digital changes.
• 0:25
  Okay, so let's jump straight into a big one.
• 0:27
  The Metricon Homes ransomware attack. Ah, yes,
• 0:31
  Metricon, Australia's largest home builder. They
• 0:34
  confirmed they were hit by the Quillen ransomware
• 0:37
  group. This was discovered around July 24th,
• 0:40
  2025. Though the attack itself probably started
• 0:43
  a few days earlier, maybe July 21st. And the
• 0:46
  scale of this breach. Yeah. What did we find
• 0:49
  out? Well, it was quite alarming actually. The
• 0:51
  attackers, Quillen, claim they took about 128
• 0:54
  gigabytes of sensitive data. Wow, 128 gigs, that's
• 0:58
  a lot. It really is, over 98 ,000 files. And
• 1:00
  it wasn't just random data either. No, what kind
• 1:03
  of stuff? We're talking confidential financial
• 1:05
  documents, proprietary architectural plans. Think
• 1:08
  about the IP value there. Huge. Internal marketing
• 1:11
  strategies, company credits, even employee details,
• 1:14
  credit card receipts, finance and HR info, profit
• 1:18
  and loss statements, staff salaries, commission
• 1:21
  rates. So really sensitive internal information.
• 1:24
  Extremely. And the hackers gave them a deadline,
• 1:26
  right? Seven days to meet demands or they'd publish
• 1:29
  it all. Okay, so that's the threat. How did Metricon
• 1:32
  reportedly handle it? Well, First Public Statements
• 1:35
  mentions swift containment, bringing in external
• 1:38
  experts. They claimed no impact on safety or
• 1:41
  construction, that internal systems were back
• 1:43
  online, payments going through normally, you
• 1:46
  know, the standard. response playbook. And they
• 1:48
  notified the authorities. Yes. The Australian
• 1:50
  Cybersecurity Center, the ACSC, also the Office
• 1:53
  of the Australian Information Commissioner, the
• 1:55
  OAIC and law enforcement. All the right boxes
• 1:57
  ticked, seemingly. Is there more to it when a
• 2:00
  company this size gets hit, especially by this
• 2:03
  Quillen group? Absolutely. While, you know, swift
• 2:06
  containment is good, it suggests they had some
• 2:08
  kind of incident response plan. Right. The fact
• 2:11
  this breach happened and with this much data
• 2:13
  extracted by Quillen. That's significant. Quillen
• 2:17
  is apparently the third most active ransomware
• 2:20
  group globally right now. Third most active.
• 2:23
  Wow. Yeah, something like 625 claimed victims
• 2:26
  since August 2022. They're a Russian speaking
• 2:29
  group operating what's called Ransomware as a
• 2:32
  Service or RAIS. RAIS, Ransomware as a Service.
• 2:34
  So they build the tools and let others carry
• 2:36
  out the attacks. Exactly. Like a franchise model
• 2:39
  for cybercrime. They provide the malware, the
• 2:41
  infrastructure, and affiliates lease it to launch
• 2:43
  attacks. itself was first spotted back in July
• 2:46
  2022. So pretty sophisticated operation then.
• 2:49
  In terms of impact and organization, yes. But
• 2:51
  what's really interesting is how they often get
• 2:53
  in. Okay. Despite the scale of attacks like Metricon,
• 2:56
  their initial access often relies on pretty,
• 2:59
  well, basic methods. Phishing, spear phishing.
• 3:02
  Malicious emails, messages. Yeah. That kind of
• 3:04
  thing. Exactly. Or exploiting known vulnerabilities
• 3:08
  in common software like Citrix or remote desktop
• 3:11
  protocol, RDP. Things that should be patched.
• 3:14
  So it's not always some super complex zero -day
• 3:17
  exploit. Often not. It really highlights that
• 3:20
  even these major threat actors frequently rely
• 3:22
  on fundamental weaknesses. You know, human error
• 3:25
  or just basic security hygiene like patching.
• 3:28
  That's a really important point. The entry point
• 3:30
  doesn't always reflect the eventual damage. Precisely.
• 3:34
  And for you listening, this matters because it
• 3:35
  goes beyond just Metricon's immediate problems.
• 3:38
  Think about those stolen architectural plans.
• 3:41
  Competitors could gain huge strategic advantages.
• 3:44
  It could undermine their competitive edge for
• 3:46
  years, long after the breach is supposedly contained.
• 3:49
  It shows the long -term risks. Definitely. The
• 3:52
  long tail of a data breach. Which brings us to
• 3:54
  the construction industry itself. Metricon is
• 3:57
  a huge player. But why does this sector seem
• 4:01
  so, well, appealing to cyber criminals? Is it
• 4:04
  just about ransomware? That's a great question.
• 4:07
  It's not just ransomware. And construction has
• 4:09
  this sort of unique mix of factors making it
• 4:11
  a prime target. Okay, like what? Well, first
• 4:13
  off, high value transactions. Construction projects
• 4:17
  involve enormous sums of money. Contracts. Payments.
• 4:21
  Millions. Easily. Right. So that makes it ripe
• 4:23
  for ransomware demands, sure. But also phishing
• 4:26
  aimed at diverting payments, financial fraud.
• 4:29
  The potential payout is just huge. Makes sense.
• 4:33
  What else? Second, the sheer amount of sensitive
• 4:35
  data they handle. Blueprints, designs, bids,
• 4:39
  contracts, employee details, client information.
• 4:41
  All valuable on the dark web. Absolutely. For
• 4:44
  identity theft, corporate espionage, or like
• 4:46
  we said, giving competitors an edge. Okay. Transactions,
• 4:49
  data. What's number three? Third, and this is
• 4:53
  a big one for construction, complex supply chains.
• 4:56
  Projects involve tons of stakeholders, main contractors,
• 5:00
  subcontractors, suppliers. Right. Hundreds of
• 5:02
  different companies potentially involved in one
• 5:04
  project. Exactly. And they all have different
• 5:06
  levels of cybersecurity maturity. A hacker might
• 5:09
  breach a smaller, less secure vendor. Like an
• 5:11
  HVAC company or something. Yeah, precisely. And
• 5:14
  use that as a stepping stone into the main contractor's
• 5:16
  network. It's the classic weakest link problem.
• 5:19
  That makes the whole ecosystem vulnerable. Very
• 5:21
  much so. Then fourth, you often find outdated
• 5:25
  cybersecurity measures. Legacy systems. Old software.
• 5:29
  Yeah, especially maybe in smaller firms. Systems
• 5:32
  that just don't have protection against modern
• 5:34
  threats. Easy targets for hackers scanning for
• 5:37
  known vulnerabilities. We're not always talking
• 5:40
  cutting edge attacks here. Just unpatched systems
• 5:43
  sometimes. Sometimes, yes. And finally, there's
• 5:45
  the increasing digitalization. Ah, the move towards
• 5:48
  more tech. BIM software, IoT sensors, cloud platforms.
• 5:53
  Right. All these things boost efficiency, which
• 5:55
  is great. But adopting them quickly can mean
• 5:57
  security sometimes lags behind. Expanding the
• 6:00
  attack surface. Dramatically. Every connected
• 6:02
  device, every cloud service, every remote worker
• 6:04
  is a pinch of entry point if not secured properly
• 6:07
  from the start. It's a double -edged sword. More
• 6:09
  efficiency, but also more risk. That paints a
• 6:12
  really clear picture. High value, rich data,
• 6:15
  complex chains, maybe lagging security, and rapid
• 6:18
  tech adoption. A perfect storm almost. It can
• 6:20
  be, yeah. So ransomware gets the headlines, but
• 6:24
  you mentioned other threats. What else are we
• 6:26
  seeing frequently targeting industries like construction
• 6:29
  and others? Oh, absolutely. Ransomware is visible,
• 6:32
  but there's a whole toolkit attackers use. Phishing
• 6:35
  is still huge. We mentioned that as an entry
• 6:37
  point for Quillen. Exactly. Tricking users into
• 6:40
  giving up info via email, texts, sometimes even
• 6:44
  voice calls now. That's called phishing. Voice
• 6:46
  phishing. Okay. It works well in construction
• 6:48
  with lots of temporary staff or subcontractors
• 6:50
  who might not know the usual protocols. It's
• 6:52
  like getting a fake urgent request from head
• 6:54
  office. Precisely. And it's not just small companies.
• 6:57
  Even Google got hit by vishing recently. The
• 7:00
  shiny hunters group used it back in June to steal
• 7:02
  business contact info from Google Salesforce.
• 7:05
  Google. Wow. Shows anyone can be vulnerable to
• 7:09
  that social engineering side. It really does.
• 7:10
  Then there's business email compromise or BEC.
• 7:14
  That's the one where they impersonate the CEO
• 7:16
  or someone. Exactly. Pretending to be a senior
• 7:19
  person to request a fraudulent wire transfer
• 7:21
  or sensitive data. Very totent in construction
• 7:24
  because of the large sums changing hands constantly.
• 7:27
  Fake invoices, requests to change bank details
• 7:30
  happens all the time. Scary stuff. Then supply
• 7:33
  chain attacks, which we touched on. Getting into
• 7:36
  your network via a less secure partner. Right.
• 7:38
  Emphasizing the need to. Vet vendors. Definitely.
• 7:41
  And distributed denial of service, DDoS attacks,
• 7:45
  flooding a network to knock it offline. Disrupting
• 7:48
  operations. Maybe demanding a ransom to stop.
• 7:51
  Correct. We saw a big example just recently with
• 7:53
  Orange, France. The big mobile provider. Yeah,
• 7:55
  huge. Serves like 290 million customers across
• 7:58
  Europe and Africa. They detected an attack on
• 8:01
  an internal system around July 25th. What happened?
• 8:03
  Caused significant service disruptions, mainly
• 8:05
  in France, for both business and consumer customers.
• 8:08
  And it happened amid worries about state -sponsored
• 8:11
  threats and telecoms, so it raised questions
• 8:13
  about espionage, too. So disruption and potentially
• 8:17
  something more sinister. Potentially. And just
• 8:21
  quickly, other recent things. Over 200 ,000 New
• 8:25
  Zealand government and health credentials found
• 8:27
  on the dark web. Massive personal data exposure.
• 8:31
  Huge. But on a brighter note, there was the global
• 8:34
  takedown of the Black Suit ransomware group.
• 8:37
  Ah, good news for a change. Yeah. They'd apparently
• 8:39
  extorted over half a billion dollars from about
• 8:42
  184 victims. So law enforcement is fighting back,
• 8:46
  but the threats are relentless. Wow. OK, that's
• 8:49
  quite a landscape of threats. So putting it all
• 8:52
  together for businesses listening, especially
• 8:53
  those in vulnerable sectors like construction,
• 8:56
  what are the absolute must do cybersecurity practices?
• 9:00
  What's non -negotiable? Right. How do you build
• 9:02
  resilience? It really comes down to a layered
• 9:04
  approach. Several key things. First, and maybe
• 9:07
  the most fundamental, employee training and awareness.
• 9:11
  Continuously. Not just a once a year thing. Absolutely
• 9:13
  not. Regular training on spotting, phishing,
• 9:15
  social engineering, understanding company policies.
• 9:18
  Your people are your first line of defense, but
• 9:20
  they need the knowledge. Makes sense. What's
• 9:22
  next? Multi -factor authentication. MFA. It's
• 9:25
  not optional anymore. The code to your phone
• 9:27
  thing. Yeah, adding that extra layer beyond just
• 9:29
  a password. But you also need to guard against
• 9:32
  ways attackers try to bypass it, like MFA fatigue
• 9:35
  attacks, where they spam you with requests. It
• 9:38
  needs to be everywhere. Okay, MFA is critical,
• 9:40
  then. Regular software updates and patch management
• 9:42
  keep everything current. Operating systems, applications.
• 9:46
  Close those known security holes. Exactly. So
• 9:50
  many breaches exploit known, unpatched flaws.
• 9:53
  It's basic hygiene, but crucial. Got it. Patching.
• 9:57
  What else? Network segmentation. This is about
• 10:00
  dividing your network into smaller isolated zones.
• 10:03
  So if one part gets breached. It doesn't automatically
• 10:06
  give the attacker access to everything. It contains
• 10:09
  the damage, limits their ability to move laterally.
• 10:12
  It's part of a zero trust mindset. Smart. Slows
• 10:14
  them down. Right. Then strict access controls.
• 10:17
  The principle of least privilege. Only give people
• 10:19
  access to what they absolutely need for their
• 10:21
  job. Precisely. Limit who can see or touch sensitive
• 10:25
  data. Okay. And protecting the data itself. Data
• 10:27
  encryption, both when it's stored and when it's
• 10:30
  being transmitted, makes it unreadable even if
• 10:33
  stolen, unless they have the key. Like locking
• 10:35
  it in a safe. Good analogy. And speaking of safety
• 10:38
  nets. Robust data backup and recovery systems.
• 10:42
  Having copies stored securely offsite. Yes, and
• 10:45
  regularly testing that you can actually restore
• 10:47
  from those backups. Essential for bouncing back
• 10:50
  quickly from ransomware or other data loss events.
• 10:53
  Minimizes downtime. Crucial for business continuity.
• 10:57
  Very. Also, vendor and supply chain management.
• 10:59
  Really vetting your partner's security practices.
• 11:02
  Remember the weakest link. Right, that supply
• 11:04
  chain risk again. And finally, having an incident
• 11:06
  response plan and actually test. Testing it.
• 11:08
  Practice drills. Tabletop exercises. Exactly.
• 11:12
  Knowing who does what, who to call, how to isolate
• 11:14
  systems before an attack happens makes the response
• 11:17
  much smoother and more effective. Don't wait
• 11:19
  for a crisis to figure it out. That's a really
• 11:21
  comprehensive list. Training, MFA, patching,
• 11:24
  segmentation, access control, encryption backups,
• 11:27
  vendor management and planning. Seems like a
• 11:29
  solid defense. It provides layers. No single
• 11:33
  thing is foolproof. But together, they build
• 11:36
  strong resilience. But even with all that, no
• 11:39
  system is perfect, right? What's the final safety
• 11:42
  net? the thing that helps when the worst still
• 11:44
  happens. Yeah, that's where cyber insurance comes
• 11:46
  in. And it's important to see it as part of the
• 11:49
  overall strategy, not a substitute for good security.
• 11:52
  Right. It doesn't prevent attacks, but helps
• 11:54
  manage the aftermath. Exactly. It helps mitigate
• 11:57
  the financial fallout, covers things like business
• 11:59
  interruption costs, data recovery expenses, legal
• 12:02
  fees, PR help, things that might not be covered
• 12:06
  by your general liability insurance. So it fills
• 12:08
  specific cyber related gaps. Yes. And a really
• 12:11
  valuable part of many policies is access to expert
• 12:15
  panels. Specialists. Yeah. Like forensic IT lawyers.
• 12:18
  Precisely. Pre -vetted experts you can call on
• 12:21
  immediately during a crisis. That can be invaluable
• 12:24
  for managing the incident quickly and effectively,
• 12:26
  protecting your operations, your reputation,
• 12:28
  and your finances. Makes sense to have that expert
• 12:31
  help on standby. Definitely. But policies vary
• 12:33
  a lot, so it's really important to talk to a
• 12:35
  licensed insurance professional to get the right
• 12:37
  coverage for your specific business and risks.
• 12:40
  Good advice. So wrapping up then, these incidents,
• 12:45
  Metricon, Orange, France, they really show that
• 12:48
  cyber techs are, well, a constant evolving threat.
• 12:51
  Across all industries. And having strong layered
• 12:54
  cybersecurity practices isn't just a nice to
• 12:57
  have anymore. It's absolutely essential. Non
• 13:00
  -negotiable, really. And maybe a final thought
• 13:02
  to leave people with. Yeah. As everything gets
• 13:04
  more digital. And AI gets woven deeper into,
• 13:08
  well, everything. How do we all organizations,
• 13:11
  individuals adapt, not just to use these new
• 13:14
  technologies, but to actually secure them against
• 13:16
  these really sophisticated and persistent risks?
• 13:19
  That's a big question. Securing the future as
• 13:21
  we build it. Yeah, it's the challenge ahead.
• 13:23
  Definitely something to think about. If you,
• 13:25
  our listener, are interested in discussing your
• 13:26
  own security and IT needs, you can find more
• 13:29
  information and speak with experts over at www
• 13:32
  .kinsoft .com .au. They can certainly help navigate
• 13:35
  these challenges. Well, thanks for joining us
• 13:37
  today on Tech Talks with Kinsoft. My pleasure.
• 13:40
  We look forward to our next discussion.