Latest / Tech Talks With Kinsoft / Lessons from the Regis Resources Ransomware Incident

Transcript

Lessons from the Regis Resources Ransomware Incident · Tech Talks With Kinsoft

0:00
Hello and welcome to Tech Talks with Kinsoft.
0:01
Hey there. This is the show where we unpack the
0:05
latest shifts in technology, security, and digital
0:09
resilience. Really just to keep you ahead of
0:11
the curve. I am your host and I have to say,
0:13
just looking at the headlines for the last few
0:15
weeks. Oh yeah. I mean. 2026 has just decided
0:18
not to ease us in gently at all. No, definitely
0:21
not. It feels like the digital landscape just
0:23
woke up and chose violence this year. It is great
0:26
to be here and you are absolutely right about
0:27
that. If if anyone thought the cybersecurity
0:30
turbulence of late 2025 was just going to plateau
0:33
or calm down. Right. Well, January 2026 has effectively
0:37
shattered that illusion. It has been an absolute.
0:40
roar of activity, specifically right here in
0:43
Australia. We are seeing a shift in targets,
0:45
a shift in tactics, and honestly, just a massive
0:48
shift in the sheer volume of incidents. Exactly.
0:51
And usually, you know, when we open the show
0:53
with a statement like it has been a busy month
0:54
in cyber, we are about to dissect an absolute
0:57
disaster. Usually, yes. But I want to flip the
1:00
script a bit today. I want to start with a story
1:02
that, well, while it's terrifying in its potential,
1:06
it is actually a massive win. A rare thing these
1:08
days. Very rare. Or at least it's a master class
1:11
in how to stare down a barrel and not blink.
1:13
We really need to talk about Regis Resources.
1:16
I was really hoping we would start there. The
1:18
Regis case is practically the only thing industry
1:20
insiders are talking about right now. I bet.
1:22
It is the perfect case study because it completely
1:26
defies the usual narrative of, you know, big
1:29
company gets hit, big company pays ransom, big
1:33
company issues a very sad public apology. Right,
1:36
right. Let's set the stakes for the listeners
1:38
who maybe haven't dug into their financials recently.
1:41
Regis Resources is... a massive Australian gold
1:45
producer. Massive. And when I say massive, their
1:47
quarterly report just dropped. They announced
1:49
a record quarter with a cash and bullion build
1:51
of $255 million. Which brings their total balance
1:55
to $930 million. Nearly a billion dollars in
1:59
liquid assets and gold just sitting on the books.
2:02
That is not just a balance sheet. That is basically
2:05
a neon sign for every single threat actor on
2:08
the dark web saying, open for business. Precisely.
2:11
In the criminal ecosystem, A pot of gold that
2:13
size, literally and figuratively, it attracts
2:15
the apex predators. So in November 2025, they
2:18
were targeted. Right. But the public really only
2:21
learned the details in January 2026 once the
2:24
dust had settled. And here is the twist that
2:27
I just love. Usually when a billion dollar company
2:29
gets hit by ransomware, we see a massive insurance
2:32
claim and some quiet under the table payout.
2:35
But Regis didn't pay a cent. No data was exfiltrated.
2:40
Operations just kept running. It's almost like
2:41
watching a heist movie where the bank vault actually
2:44
does its job. It is incredibly rare. And what
2:46
we are going to do today is tear apart exactly
2:48
how they did that. Because it wasn't magic and
2:51
it definitely wasn't luck. It was architecture.
2:54
And we also need to pivot from there to discuss
2:57
why these access failures are effectively replacing
3:01
traditional hacking as the primary threat factor.
3:04
And we'll look at the absolute carnage of January
3:07
2026 to see why so many other companies failed
3:11
exactly where Regis succeeded. Let's get right
3:13
into the crime scene then. Who exactly was knocking
3:16
at their door? The group is called Lynx. If you
3:19
follow the threat intelligence feeds, you definitely
3:21
know them. They have this really bizarre branding
3:24
where they claim to be ethical ransomware operators.
3:27
Ethical ransomware. I always find that pitch
3:30
just hilarious. It is like a mugger leaving you
3:33
bus fare. You know, we robbed you, but we did
3:35
it politely. It is a fascinating psychological
3:37
play on their part. They claim they don't target
3:39
hospitals or nonprofits or critical infrastructure
3:42
because those sectors are quote unquote vital.
3:44
But generous of them. Right. They frame their
3:46
extortion as a dialogue or a get this a security
3:49
audit fee. Wow. A security audit fee. But make
3:53
no mistake, they aggressively target high cash
3:56
flow businesses like mining because they know
3:58
the liquidity is there. They saw that billion
4:00
dollar balance sheet and they moved in. OK, so
4:02
links. lists a Regis subsidiary, Maxillimus Gold,
4:07
on their leak site. They're fully expecting a
4:09
massive payout. But Regis holds the line. You
4:13
mentioned architecture earlier. Break that down
4:15
for us. Because once malware is actually inside
4:17
the perimeter... The game is usually over. Exactly.
4:21
How did they stop the bleed? It really came down
4:23
to two things. Speed and segmentation. First,
4:27
their automated detection systems were perfectly
4:28
dialed in. They identified the intrusion anomalies
4:31
almost immediately. Wow. We aren't talking days
4:33
here. We're likely talking minutes. The system
4:36
automatically slammed the blast door shut, restricting
4:38
access and isolating the infected network segments.
4:41
Which is standard procedure on paper, but rarely
4:44
executed that fast in the real world. But the
4:47
real savior here was the backup strategy, right?
4:49
The air gap. And I know we throw that term around
4:51
a lot in tech circles, but we really need to
4:54
appreciate the discipline required to actually
4:55
maintain an air gap in 2026. That is exactly
4:59
what I wanted to ask you about. In a modern corporate
5:01
environment where we want real -time analytics,
5:04
seamless cloud integration, instant data availability
5:08
everywhere, true air gapping, which is keeping
5:11
backups physically or logically disconnected
5:14
from the network, that is a logistical nightmare.
5:17
It is. It feels almost archaic. How do you balance
5:20
that level of security with operational efficiency?
5:23
That is the million -dollar question, or in this
5:26
case, the billion -dollar question. You are right.
5:28
True air gapping creates friction, slows things
5:31
down. But Regis proved that the friction is just
5:34
the price of survival. Yeah. They had backup
5:36
copies of their data that the ransomware simply
5:38
could not touch. period when the malware tried
5:42
to crawl laterally through the network to encrypt
5:44
the recovery points it just hit a dead end so
5:46
they didn't even need the decryption key from
5:48
links because they already had a clean slate
5:49
ready to go exactly they wiped the infected servers
5:52
and restored from the clean offline backups and
5:55
the result really speaks for itself despite a
5:57
massive highly sophisticated attack they produced
6:01
96 600 ounces of gold in that exact quarter that
6:05
is incredible operational impact was effectively
6:07
zero that is the only metric that matters at
6:10
the end of the day. But this brings me to a broader
6:12
industry trend I want to explore. Why mining?
6:16
I mean, obviously the money is there, but structurally,
6:19
mining feels like it should be so much harder
6:22
to hack than, say, a digital bank. It is. Rocks,
6:27
dirt, and big trucks in the middle of nowhere.
6:29
See, that is the common misconception. Mining
6:32
is actually currently sitting right in the middle
6:34
of a perfect storm of vulnerability. It is all
6:36
about the convergence of IT and OT operational
6:39
technology. Ah, the classic IT and OT friction.
6:42
It is the biggest headache in the industrial
6:44
sector right now. You have these modern mines
6:46
that are incredibly automated. They're pushing
6:48
gigabytes of data to the cloud every second for
6:51
yield optimization and predictive maintenance.
6:53
Sure. But the physical machines actually doing
6:55
the work. the crushers, the conveyor belts, the
6:57
processing plants, they are often running on
7:00
industrial protocols that are 30 or 40 years
7:02
old. Things like Modbus and Berfibus. Right.
7:05
Protocols that were designed before the public
7:07
Internet was even a consideration for businesses.
7:10
They were built strictly for reliability and
7:12
not security. They have no encryption, no authentication.
7:15
They just blindly trust whatever commands they
7:17
receive on the wire. Exactly. They were never,
7:20
ever meant to leave the local closed loop. But
7:24
now, in the name of efficiency and cloud analytics,
7:27
we are plugging these medieval systems straight
7:29
into modern Internet connected networks. We are
7:32
basically putting a state of the art smart lock.
7:35
on a wooden castle gate that has rusty hinges.
7:38
That is a terrifying image. And you add the geography
7:41
factor to it. Regis operates in the Dupton Belt
7:43
in Western Australia. These aren't sites you
7:46
can just drive IT support out to an hour if a
7:48
server crashes. That is the kicker. These sites
7:50
are remote, extremely remote. They absolutely
7:53
require remote access for daily maintenance.
7:56
You have vendors, external contractors, and systems
7:59
engineers logging in from Perth, from Sydney,
8:01
maybe even from overseas. Every single one...
8:04
One of those remote access points is a potential
8:06
door. And if you have a legacy protocol sitting
8:08
completely undefended behind that door, once
8:11
an attacker slips in, they can move through a
8:13
physical infrastructure incredibly fast. Which
8:16
segues perfectly into the access failure concept
8:19
I wanted to discuss today. But when we talk about
8:21
these major corporate breaches, the popular image
8:25
in everyone's head is still the movie hacker,
8:27
right? Oh, yeah. The guy in the hoodie. Exactly.
8:30
Someone writing custom code in a dark room to
8:33
exploit some unknown zero -day vulnerability
8:36
in a firewall. But that is not really the reality
8:40
anymore, is it? Almost never. There was a fantastic
8:42
report by Tenable that came out recently that
8:45
really crystallizes this shift. They argue that
8:48
the era of the hacker breaking down the digital
8:50
wall is ending. We are now firmly in the era
8:53
of the access failure. Meaning they aren't breaking
8:55
in, they are just logging in. Precisely. They
8:57
are finding valid keys. Tenable's research shows
9:00
that the vast majority of Australian breaches
9:02
aren't sophisticated technical exploits at all.
9:04
They are simply failures of identity governance.
9:07
We are talking about forgotten passwords, exposed
9:10
API keys accidentally left in public code repositories,
9:14
or service accounts that should have been deleted
9:17
three years ago when an employee left. Oh, service
9:19
accounts are the silent killers. You know how
9:22
it goes. You spin up a quick bot to do a data
9:24
transfer. You give it full admin rights because
9:26
you just don't have the time to figure out the
9:28
specific granular permissions it needs. Yep,
9:31
happens all the time. And then five years later.
9:33
That box is still running silently in the background
9:35
with a password like admin123. And that is exactly
9:38
what the industry calls toxic clutter. As companies
9:42
rapidly move their operations to the cloud, the
9:45
sheer number of identities, both human users
9:47
and machine accounts, is just exploding. Secrets
9:51
management becomes literally impossible for humans
9:54
to do manually. It's too much data. Way too much.
9:57
Tenable points out that to a security system,
9:59
a hacker using a valid stolen API key looks exactly
10:03
like a legitimate automated process. The alarm
10:06
doesn't ring because the key fits the lock perfectly.
10:08
It is the digital equivalent of leaving the house
10:10
key under the doormat and then wondering why
10:13
the home alarm didn't go off when the burglar
10:15
just walked through the front door. It really
10:17
is. And unfortunately, while Regis somehow managed
10:20
to keep their keys incredibly safe, the rest
10:22
of the corporate landscape in January 2026 was.
10:25
Yeah, let's look at the scoreboard for a minute
10:28
because it is pretty grim reading. I was looking
10:30
through the Black Fog report for January and
10:32
the numbers are just staggering. They are. 91
10:35
publicly disclosed ransomware attacks just in
10:38
the month of January. And remember, those are
10:41
just the ones we actually know about because
10:43
of disclosure laws. The real number behind the
10:45
scenes is likely much, much higher. And the sector
10:48
breakdown was super interesting to me. It wasn't
10:50
finance sitting at the top of the list. No, it
10:52
was health care. Number one, with 27 separate
10:55
incidents, followed closely by government agencies
10:57
and manufacturing. Health care being top is always
11:00
just devastating because the leverage there isn't
11:03
just financial. It is literally people's lives.
11:06
Yeah. But we had some major local hits here in
11:09
Australia, too. Presura, the big insurer, got
11:12
hit really hard. That was a highly significant
11:14
breach, about 300 ,000 customers affected. And
11:18
this brings us right back to the inherent value
11:20
of raw data. The attackers accessed names, policy
11:24
info and travel details. Travel details. Yeah.
11:27
Now, they didn't get credit card info, which
11:29
the company pushed as the silver lining. But
11:32
think about what a smart attacker can do with
11:34
detailed travel itineraries. Oh, it is prime
11:38
fishing fuel. If I get an email that knows exactly
11:41
where I just flew, what dates I was there, and
11:43
what my specific insurance policy number is,
11:45
my skepticism drops to zero instantly. I am absolutely
11:49
clicking that link. Exactly. It allows for highly
11:52
targeted, incredibly convincing social engineering.
11:55
And we had the Victorian Department of Education
11:58
breach. That one really bothered me. Unauthorized
12:01
access to student names, personal emails, and
12:04
crucially, encrypted passwords. Now, I have heard
12:08
people online say, oh, it's fine, the database
12:10
was encrypted, they can't read the passwords,
12:12
but we really need to bust that myth right now.
12:14
Please do, it drives me crazy. Just because a
12:16
password is encrypted or hashed in a database
12:18
doesn't mean it is safe, especially if the hashing
12:21
algorithm is old or weak, or if the passwords
12:24
weren't properly salted with random data. If
12:27
an attacker actually downloads the encrypted
12:29
file, they can just use rainbow tables or massive
12:32
GPU server farms to brute force crack those passwords
12:36
entirely offline at their own pace. Especially
12:39
if the students or staff were using common, weak
12:42
passwords. The word password with a 123 at the
12:45
end, even when encrypted, is still easily cracked
12:47
in seconds. Exactly. And the real danger there
12:49
is credential stuffing. People reuse passwords
12:52
everywhere. If an attacker cracks your school
12:54
portal password, they're... immediately going
12:56
to run a script to try that exact same email
12:59
and password combination on your banking app,
13:01
your personal email and your social media. It
13:04
is a cascading failure across a person's entire
13:07
digital life. And then there was the Lely family
13:09
doctor's breach, which was targeted by the Anubis
13:12
group. Anubis is nasty. They perfectly represent
13:14
the double extortion tactic that really dominated
13:16
the January threat landscape. Right. So let's
13:19
clarify double extortion for you listening. This
13:22
is where the backup strategy we just praised
13:24
Regis for potentially falls short if you aren't
13:26
extremely careful about your perimeter. Correct.
13:28
In the old days, say five years ago, ransomware
13:31
just encrypted your machine in place. If you
13:34
had good backups, you just ignore the ransom,
13:35
wipe the drive, and restored. Simple. But double
13:38
extortion means they steal a copy of the data
13:41
first. Then they encrypt the local machines.
13:44
So you might restore your servers from your pristine
13:47
air -gapped backups and be back online in an
13:49
hour. But the hacker is still holding a copy
13:52
of your private patient records, your student
13:54
data, or your corporate trade secrets on their
13:56
own servers. And they threaten to publish it
13:58
to the dark web if you don't pay up. Exactly.
14:00
So the ransom isn't actually for the decryption
14:03
key anymore. It is a hush payment. It's pure
14:05
blackmail. Right. This is exactly why... the
14:07
access failure theory is so critical right now.
14:10
You have to stop them from entering and exfiltrating
14:13
data in the very first place. Once the data leaves
14:16
your building, your backups cannot save your
14:18
reputation. Honestly, this feels overwhelming.
14:22
I mean, we are describing a landscape where you
14:24
have legacy machines that literally cannot be
14:27
secured by modern standards, cloud complexity
14:30
that hides open doors in millions of lines of
14:33
code, and attackers who are silently stealing
14:35
data before you even know they're on the network.
14:37
If you were a board member listening to this,
14:39
what is the actual move? The move is a fundamental
14:42
mindset shift. Governance is the new firewall.
14:46
The security experts are making this very clear.
14:48
This is no longer an IT support ticket. It is
14:51
a boardroom issue. So what specific questions
14:54
should the board be asking? Because just asking
14:56
the IT guy, are we secure, is a totally useless
14:59
question. Totally useless. The question they
15:01
need to be asking is, what is our identity inventory?
15:04
Do we actually know every single human and every
15:07
single machine script that has a valid key to
15:09
our front door? Okay, actionable advice time.
15:11
We have talked a lot. about the problems. What
15:13
are the tangible solutions for companies in 2026?
15:16
Three main things. First, exactly as proven by
15:19
Regis, air gap your backups, but you have to
15:22
do it intelligently. Use immutable backups in
15:25
the cloud. That is storage that literally cannot
15:27
be overwritten, modified, or deleted for a set
15:30
retention period, even by someone with top -level
15:33
admin credentials. Oh, that's smart. So that
15:35
protects you from the road credential issue.
15:37
Even if a hacker perfectly steals the head of
15:39
IT's password, they physically cannot delete
15:42
the backup files. Exactly. The system won't let
15:45
them. Second, least privilege. It sounds incredibly
15:49
boring, but it is absolutely vital. Why does
15:52
the summer marketing intern have admin access
15:54
to the finance server? They shouldn't. Right.
15:57
Why does that third -party HVAC vendor have 24
16:00
-7 remote access to the network when they only
16:04
do maintenance on the second Tuesday of the month?
16:06
Lock it down. Only give access when it is needed
16:09
and revoke it immediately when it's not. Convenience
16:11
really is the enemy of security. We say it on
16:13
the show every time, but it just keeps proving
16:15
true. It does. And third. Continuous discovery.
16:19
You cannot protect what you do not know exists.
16:22
You need automated security tools that are constantly
16:25
hunting through your own network for exposed
16:27
credentials, shadow IT applications that employees
16:30
install without asking, and forgotten API keys.
16:33
You basically need to find the keys hiding under
16:35
the mat before the hackers do. It is like treating
16:38
your digital environment like a physical mine
16:40
site. In mining, they have these strict zero
16:43
harm safety policies. They inspect every harness,
16:46
every vehicle, every single day before shift
16:48
starts. Regis essentially applied zero harm to
16:50
their data environment. They treated data toxicity
16:53
with the exact same respect and fear that they
16:56
treat cyanide in the gold extraction process.
16:58
That is the perfect analogy. That cultural translation
17:01
from physical safety to digital safety is what
17:04
saved them. They operationalized cyber safety
17:06
at every level of the company. Well, before we
17:09
wrap up today, I want to leave you with... one
17:10
final thought to mull over, or maybe it's more
17:12
of a warning. We are deep into February 2026
17:15
now. We have seen the stats from January. Where
17:17
is this cat and mouse game going next? AI. It
17:21
is the absolute elephant in the room. We are
17:23
seeing artificial intelligence being integrated
17:25
into everything for corporate efficiency, but
17:27
the attackers have access to the exact same tools.
17:30
We are standing on the precipice of a... massive
17:34
automated wave of AI -driven social engineering.
17:37
Deep fakes. Deep fakes. Real -time voice clones.
17:41
We are already seeing the early warning signs
17:43
of it out in the wild. If I am an attacker and
17:46
I can't hack your password because your company
17:48
has good hygiene and immutable backups, I will
17:51
just call you on the phone and I will sound exactly
17:53
like your CEO. Oh, yeah. Or exactly like your
17:56
spouse. And I will casually ask you for the access
17:58
code. That is just terrifying. It means that
18:01
Zero Trust isn't just a software arc. architecture
18:03
setting anymore. It has to become a literal life
18:05
philosophy. Yeah. Verify everything. Skepticism
18:08
is your absolute best defense going forward.
18:11
If your boss calls you out of the blue and asks
18:12
for an urgent wire transfer or password reset,
18:15
hang the phone, call them back immediately on
18:17
a known, trusted internal number. The human firewall
18:19
has to become much harder to break than the digital
18:22
one. Well, on that slightly paranoid but absolutely
18:24
necessary note. We're going to wrap things up
18:27
for today. It is crystal clear that whether you
18:30
are sitting on a billion dollars of physical
18:32
gold or just a database of customer emails. The
18:36
rules of engagement have completely changed this
18:39
year. They definitely have. But as Regis showed
18:41
us, preparation pays off. You can survive the
18:44
worst -case scenario if you have the architecture
18:47
and the strict governance already in place. Exactly.
18:50
Look, if today's discussion about access failures,
18:52
identity governance, and the sheer mess of the
18:54
January threat landscape has you looking at your
18:57
own systems a little differently and maybe sweating
18:59
just a little bit, please don't leave it to chance.
19:01
Definitely not worth the risk. Go to www .kinsoft
19:04
.com .au. to discuss your security and IT needs.
19:08
The team there really understands the nuances
19:10
we talked about today, from setting up immutable
19:12
air gapping to conducting a full identity inventory.
19:15
They are the folks who know how to lock the doors
19:17
properly, so you do not end up as a cautionary
19:19
statistic in next month's Blackfog Report. Again,
19:22
go to www .kinsoft .com .au. Stay safe out there.
19:27
Thanks for listening to Tech Talks with Kinsoft.
19:29
Catch you next time.