Latest / Tech Talks With Kinsoft / Goodstone Group Breach – Passport Scans Leaked in CMD Ransomware Attack

Transcript

Goodstone Group Breach – Passport Scans Leaked in CMD Ransomware Attack · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. Glad to be
• 0:02
  here. You know, I was just thinking before we
• 0:04
  hit record, I want you to imagine waking up to
• 0:07
  find that your employees' actual passports aren't
• 0:10
  just, you know, stolen. Right. Which is bad enough.
• 0:14
  Exactly. But they are actively being auctioned
• 0:17
  off on, well, essentially a dark web version
• 0:20
  of eBay. Yeah, to the highest bidder. It's completely
• 0:23
  wild. It feels entirely dystopian, right? But
• 0:26
  it's actually unfolding right in our own backyard.
• 0:28
  So today we are undertaking a thorough exploration
• 0:31
  into a recent close to home cyber incident to
• 0:34
  understand exactly how modern ransomware groups
• 0:37
  are evolving their extortion playbooks. Yeah.
• 0:39
  And we're looking specifically at how they're
• 0:41
  moving away from those private behind closed
• 0:44
  doors threats into these massive public spectacles.
• 0:47
  Right. Highly public market driven spectacles.
• 0:49
  We're basing our discussion today on an exclusive
• 0:52
  article that David Hollingworth published in
• 0:54
  Cyber Daily back on May 15th, 2026. And really,
• 0:58
  the whole landscape of digital threats is I mean,
• 1:00
  it's undergoing this fundamental economic shift
• 1:03
  right now. Yeah, definitely. Okay, let's unpack
• 1:05
  this. I want you to put yourself in the shoes
• 1:07
  of a business leader for a second. You are running
• 1:12
  a successful, well -regarded local business,
• 1:16
  right? Implying hundreds of people in your community.
• 1:18
  A real pillar of the town. Exactly. You manage
• 1:21
  your properties, you take care of your staff,
• 1:23
  and then completely out of the blue, you realize
• 1:25
  that your most sensitive, confidential, corporate,
• 1:29
  and personal documents are just Up for public
• 1:33
  auction. In front of the entire world. Yes. The
• 1:36
  psychological whiplash of that transition, you
• 1:38
  know, going from standard daily operations to
• 1:41
  a globally visible crisis, it's just staggering.
• 1:44
  It really is. And it's designed to be completely
• 1:48
  destabilizing. That jarring transition is actually
• 1:50
  the primary source of leverage for these threat
• 1:53
  actors now. Right. They're no longer just exploiting
• 1:55
  software vulnerabilities. They are actively engineering
• 1:58
  a pressure cooker environment. Because they want
• 2:00
  everyone panicking. Right. Exactly. They want
• 2:02
  the board of directors, the IT team, the local
• 2:04
  community, everybody reacting all at once. It
• 2:07
  creates this chaotic environment where, honestly,
• 2:10
  paying a ransom starts to look like the only
• 2:12
  valve to release all that pressure. Yeah. And
• 2:14
  that pressure cooker is currently a stark reality
• 2:17
  for the Goodstone Group. Yeah, unfortunately.
• 2:19
  For context, the Goodstone Group is a major hospitality
• 2:22
  operator based down in Devonport. So right in
• 2:25
  northern Tasmania. Right. And they are a massive
• 2:28
  part of that local economy. According to the
• 2:31
  reporting, they employ over 350 Tasmanians. That's
• 2:35
  a huge footprint for a regional area. It really
• 2:37
  is. We're talking about nine different hotel
• 2:41
  properties, five standalone bottle shops and
• 2:43
  a nightclub property, too. Wow. Yeah. This is
• 2:46
  a regional hospitality staple, deeply, deeply
• 2:49
  embedded in its community. And, you know, the
• 2:51
  profile of the victim here is highly indicative
• 2:53
  of current targeting trends. How so? Well, geographic
• 2:56
  isolation or, you know, operating outside of
• 2:59
  major metropolitan hubs, that provides zero friction
• 3:02
  to global cybercrime networks. Right. Distance
• 3:05
  means nothing on the Internet. Exactly. And regional
• 3:07
  hospitality groups are just incredibly complex
• 3:09
  ecosystems. They manage high volumes of transient
• 3:12
  customer data. They've got constant payment processing,
• 3:16
  integrated booking systems. High staff turnover,
• 3:18
  too, usually. Yes, exactly. high staff turnover
• 3:21
  so when uh threat actors automated scanners are
• 3:25
  out there just you know pinging around looking
• 3:27
  for a foothold A hotel's sprawling vendor network
• 3:31
  often presents a much more accessible attack
• 3:33
  surface than, say, a highly locked down bank.
• 3:36
  Yeah, that makes total sense. And the timeline
• 3:39
  of how this attack surface is really indicative
• 3:41
  of that new pressure model you were talking about.
• 3:44
  Right. Because Goodstone confirmed that on April
• 3:46
  18th, 2026, they officially began responding
• 3:49
  to a cybersecurity incident. But it didn't go
• 3:52
  public right away. No, no. The attackers didn't
• 3:54
  just lock the servers and leave a text file on
• 3:56
  a desktop like the old days. Public escalation
• 3:58
  happened a couple of weeks later, on May 2. Oh,
• 4:01
  okay. A newly emerged hacking group posted good
• 4:04
  stone onto their dark web leak site. And they
• 4:07
  published a sample of the stolen data to, you
• 4:09
  know, prove they actually had the goods. And
• 4:11
  we've seen this double extortion model really
• 4:13
  become the industry standard over the last few
• 4:15
  years. Yeah. But the curation of that leaked
• 4:18
  sample, it's become a dark art in itself. It
• 4:21
  really has. They don't just dump random server
• 4:23
  logs anymore. No, not at all. They meticulously...
• 4:27
  Select the documents that will cause the absolute
• 4:30
  maximum amount of internal panic and external
• 4:33
  liability. Right. And the sample they curated
• 4:35
  here is just devastating. I mean, they published
• 4:37
  employee passport scans. Oof. Yeah. That's rough.
• 4:41
  A highly sensitive confidentiality agreement
• 4:43
  and detailed bank reconciliation documents from
• 4:48
  one of Goodstone's hotels. Just worst case scenario
• 4:50
  stuff. Totally. Think about the physical equivalent
• 4:53
  of this tactic. Right. Like obviously it's a
• 4:55
  modern cyber attack. But if we compare it to
• 4:57
  a physical burglary the burglar doesn't just
• 5:00
  break in take the cash from the safe and you
• 5:02
  know slip away into the night. Right. Instead
• 5:04
  they take Polaroids of your employees passports
• 5:07
  snap pictures of your private financial ledgers
• 5:09
  and then they. literally walk into the center
• 5:11
  of town and pin those photos to the public notice
• 5:14
  board. What's fascinating here is the stark contrast
• 5:18
  between the incredibly damaging, ruthless nature
• 5:22
  of those, well, those metaphorical Polaroids
• 5:25
  and the highly mature, responsible reaction from
• 5:29
  the victim. Yeah, Goodstone handled it really
• 5:31
  well. We so often critique incident response
• 5:34
  on this show, but Goodstone handled the immediate
• 5:37
  fallout with textbook precision. They really
• 5:40
  did not try to sweep this under the rug at all.
• 5:42
  The source material outlines that Goodstone's
• 5:44
  response was immediate and transparent. Which
• 5:47
  is exactly what you want to see. Yeah. The moment
• 5:49
  they realized the scope of the incident, they
• 5:51
  took aggressive steps to contain it and they
• 5:53
  immediately engaged external cybersecurity experts.
• 5:56
  Crucial first step. And furthermore, they proactively
• 5:59
  notified the Australian Cybersecurity Center
• 6:02
  and the Tasmanian government. They even set up
• 6:05
  a dedicated email. And that level of proactive
• 6:08
  communication. is critical for mitigating long
• 6:11
  -term reputational damage. But, you know, it
• 6:14
  also exposes the raw asymmetry of modern cyber
• 6:18
  warfare. What do you mean by asymmetry there?
• 6:21
  Well, on one side, you have this regional business
• 6:24
  adhering to complex legal frameworks, regulatory
• 6:28
  reporting requirements, community obligations,
• 6:30
  doing everything by the book. And on the other
• 6:32
  side, you have a completely unconstrained, faceless
• 6:35
  entity operating totally outside of any legal
• 6:37
  jurisdiction. And they are leveraging the personal
• 6:40
  identities of local hospitality workers as essentially
• 6:44
  disposable bargaining chips. Yeah. It's wild
• 6:46
  that a local business handled this with such
• 6:48
  textbook corporate maturity while the attackers
• 6:51
  are well, the attackers are actually trying to
• 6:53
  play the exact same corporate game. Right. But
• 6:55
  in a completely twisted way. Exactly. So the
• 6:57
  group responsible for pinning those Polaroids
• 6:59
  to the board, they call themselves the CMD organization.
• 7:02
  CMD organization sounds very official. Right.
• 7:06
  Beasley Security analyzed this breach in a May
• 7:08
  14 blog post and noted this group is incredibly
• 7:11
  new. Like they only began operations in March
• 7:14
  2026. So they are super new to the scene, but
• 7:17
  obviously operating with immense aggression.
• 7:19
  The sources indicate they've claimed eight victims
• 7:22
  so far in that really short window. Yeah, making
• 7:24
  Goodstone their very first Australian target.
• 7:27
  Wow. And reading their public -facing materials
• 7:30
  in the Cyber Daily piece, it's just a surreal
• 7:32
  experience. CMD organization aggressively frames
• 7:36
  itself as a legitimate corporate entity. Oh,
• 7:38
  really? Yeah. Their leak site literally claims
• 7:41
  that they are a, quote, new kind of company that
• 7:44
  specializes in corporate system security and
• 7:47
  in identifying vulnerabilities. You're kidding.
• 7:50
  No. They have a published mission statement,
• 7:52
  okay? To create a secure online environment where
• 7:55
  every company is safely protected. I mean, it
• 7:59
  reads like a brochure for a tier one risk advisory
• 8:02
  firm. It does. Which is a masterful, if entirely
• 8:06
  cynical, exercise in cognitive manipulation.
• 8:09
  Cynical is putting it mildly. It's like a mafia
• 8:11
  protection racket trying to rebrand as a neighborhood
• 8:14
  watch program. Right, exactly. They smash your
• 8:16
  windows, raid your cash register, and then hand
• 8:19
  you this sleekly embossed business card claiming
• 8:21
  they specialize in structural integrity audits.
• 8:26
  How does the cybercrime ecosystem arrive at a
• 8:30
  place where threat actors feel the need to adopt
• 8:33
  high -end corporate branding? Well, the psychology
• 8:36
  behind this corporate veneer serves a highly
• 8:38
  calculated economic purpose. Okay, lay it out
• 8:41
  for me. When a company experiences a major breach,
• 8:44
  the executive team is operating under extreme
• 8:46
  stress, obviously. Sure. If the attacker communicates
• 8:50
  like a chaotic... unhinged criminal, it reinforces
• 8:54
  the narrative that the board is dealing with
• 8:56
  a terrorist. And, you know, corporate governance
• 8:58
  dictates that you do not fund terrorism. Right.
• 9:01
  You lock down and refuse to pay. Exactly. But
• 9:03
  if the attacker communicates using the language
• 9:05
  of an auditor framing the extortion demand as
• 9:07
  a consultancy fee or a bounty for identifying
• 9:10
  critical vulnerabilities, it introduces this
• 9:12
  cognitive dissonance. It softens the psychological
• 9:15
  blow. It tricks a stressed executive team into
• 9:18
  feeling like they are resolving an aggressive.
• 9:21
  B2B contract dispute rather than, you know, capitulating
• 9:24
  to an international crime syndicate. That's it.
• 9:27
  Exactly. It normalizes the extortion. Yeah. They
• 9:29
  use terms like timeliness. data integrity and
• 9:32
  confidentiality guarantees because it gives the
• 9:34
  victim's management team a psychological off
• 9:37
  ramp. Oh, that's so manipulative. It provides
• 9:39
  them with the internal justification to authorize
• 9:42
  a multimillion dollar payout under the guise
• 9:44
  of procuring a nontraditional security service.
• 9:47
  Wow. But Beasley securities analysis completely
• 9:50
  punctures that elite consultant persona. Yeah,
• 9:53
  it really does. Because despite the slick PR
• 9:56
  and the high minded mission statements, Beasley
• 9:58
  assesses CMD or organization's actual tradecraft
• 10:02
  as having, quote, limited operational maturity.
• 10:05
  Which is very telling. Right. They suggest CMD
• 10:08
  might simply be relying heavily on initial access
• 10:10
  brokers or IABs. And we know how the specialization
• 10:14
  of labor works in the cybercrime ecosystem. But
• 10:16
  outsourcing the actual hacking fundamentally
• 10:18
  undercuts their whole elite security firm narrative.
• 10:21
  It absolutely exposes them as opportunists rather
• 10:25
  than sophisticated operators. The dark web economy
• 10:29
  has evolved into this highly segmented supply
• 10:31
  chain, right? Yeah. Initial access brokers are
• 10:34
  specialized actors who do nothing but scan the
• 10:37
  Internet for compromised credentials, unpatched
• 10:40
  software or vulnerable remote desktop gateways.
• 10:44
  They just find the open doors. Right. They pry
• 10:46
  the window open, but they lack the infrastructure
• 10:48
  or the desire to actually orchestrate a multimillion
• 10:52
  dollar extortion campaign. So they monetize that
• 10:55
  access by selling the coordinates of the open.
• 10:57
  window to a group like CMD. Exactly. Historically,
• 11:00
  IABs would sell that access for a flat fee, maybe
• 11:03
  a few hundred or a few thousand dollars, depending
• 11:05
  on the revenue of the target company. Okay. But
• 11:08
  the economic model is really shifting toward
• 11:10
  affiliate structures now. An IAB might hand over
• 11:13
  the access in exchange for a 20 % cut of the
• 11:16
  final ransom. This means groups like CMD Organization
• 11:20
  don't need elite, groundbreaking engineers writing
• 11:23
  zero -day exploits. They just need capital to
• 11:26
  buy access, some off -the -shelf ransomware to
• 11:28
  deploy once inside, and a slick PR front -end
• 11:32
  to manage the extortion. So CMD is essentially
• 11:34
  just the customer service and billing department
• 11:37
  for a decentralized network of hackers. That's
• 11:39
  a perfect way to put it. They buy the access,
• 11:42
  grab the data and slap their corporate logo on
• 11:44
  the ransom note, which frankly makes the way
• 11:47
  they are attempting to monetize the good stone
• 11:49
  data even more alarming. Right. Because the corporate
• 11:52
  messaging isn't their only innovation. They are
• 11:55
  fundamentally altering the mechanics of the digital
• 11:57
  extortion market. And the financial demand in
• 12:00
  this case is substantial, which really serves
• 12:02
  as. the baseline for this new market mechanic.
• 12:04
  Yeah, let's talk numbers. The extortion demand
• 12:07
  for the Goodstone data is roughly $1 million.
• 12:09
  In cryptocurrency terms, based on the article's
• 12:12
  publication date, that translates to nine Bitcoin.
• 12:16
  But the innovation isn't the price tag. CMD organization
• 12:19
  has introduced a tactic where they're allowing
• 12:22
  anyone on the Internet to bid on the stolen data
• 12:25
  offered on their website. Which represents a
• 12:27
  radical structural shift in how data breaches
• 12:30
  are weaponized. Yeah. And here's where it gets
• 12:33
  really interesting. I mean, is this public bidding
• 12:35
  war actually. a functional economic model or
• 12:39
  is it purely a psychological weapon? It's a great
• 12:42
  question. Because the idea of a dark web eBay
• 12:44
  for stolen passports sounds terrifying. But I
• 12:47
  have to wonder about the liquidity of that market.
• 12:50
  Like, are there really dozens of competing criminal
• 12:52
  syndicates sitting around with a million dollars
• 12:54
  in Bitcoin ready to outbid each other for the
• 12:56
  HR files of a Tasmanian hotel group? If we connect
• 13:00
  this to the bigger picture, the auction format
• 13:02
  is heavily weighted towards psychological warfare,
• 13:04
  sure. but the underlying product they are selling,
• 13:07
  which is exclusivity, holds immense very real
• 13:10
  economic value for a specific subset of buyers.
• 13:14
  Beasley Security's analysis highlights that this
• 13:16
  tactic completely shatters the traditional closed
• 13:19
  room negotiation model. Right, because the victim
• 13:21
  is no longer just negotiating against the attacker's
• 13:24
  patients. They're negotiating against a public
• 13:27
  countdown clock and the threat of this invisible
• 13:30
  market. Exactly. When negotiations happen in
• 13:33
  secret, the threat actor's leverage is capped
• 13:35
  by what the victim's cyber insurance policy will
• 13:38
  cover or what the company's cash reserves can
• 13:40
  handle. Makes sense. But by dragging a podium
• 13:43
  into the town square and taking public bids,
• 13:46
  the attacker removes that cap. They are signaling
• 13:49
  to the victim, we don't actually need you to
• 13:51
  pay. We have an entire marketplace of buyers
• 13:54
  who will. Whether or not a massive bidding war
• 13:58
  actually materializes is almost secondary to
• 14:01
  the panic that the threat of the auction induces
• 14:03
  in the boardroom. Yeah, the panic is the point.
• 14:05
  But Beasley Security points out a very specific
• 14:08
  technical danger here, which is the concept of
• 14:11
  exclusive access. Right. If someone wins this
• 14:14
  auction, CMD locks the sale to that single buyer.
• 14:18
  And, you know, I always assumed that when negotiations
• 14:20
  failed, stolen data was just dumped onto a public
• 14:24
  forum for any low -level scammer to grab. That
• 14:26
  used to be the standard, yeah. But locking it
• 14:28
  to a single buyer changes the entire economic
• 14:30
  model of identity theft, doesn't it? It changes
• 14:33
  the model completely by introducing the luxury
• 14:36
  of time. The fundamental problem with publicly
• 14:39
  dumped data is noise. Too many people using it
• 14:43
  at once. Exactly. If CMD releases the Goodstone
• 14:45
  employee passports and banking details to the
• 14:48
  general public. Thousands of disparate actors
• 14:51
  descend on the exact same data set simultaneously.
• 14:53
  And they all try to monetize the exact same identities
• 14:56
  at the exact same time. Which immediately triggers
• 14:59
  the fraud detection algorithms at major financial
• 15:01
  institutions. Right. Of course it does. If 50
• 15:04
  different IP addresses try to use the same Tasmanian
• 15:06
  passport to open cryptocurrency exchange accounts
• 15:09
  or apply for credit cards within a 24 -hour window,
• 15:12
  the anti -money laundering and know -your -customers
• 15:14
  systems flag the identity immediately. So the
• 15:17
  banks freeze the accounts, the passports are
• 15:19
  marked as compromised, and the data set becomes
• 15:22
  essentially worthless overnight. Precisely. Public
• 15:25
  data depreciates instantly because of the sheer
• 15:27
  volume of chaotic competing attacks. So by selling
• 15:31
  exclusive access, CMD is guaranteeing the buyer
• 15:34
  a silent environment. Yes. If a malicious syndicate
• 15:37
  pays a premium at this auction, they are the
• 15:40
  only ones inside the vault. They don't have to
• 15:42
  rush. They purchase dwell time. the exclusive
• 15:45
  buyer can spend weeks or even months quietly
• 15:48
  analyzing the internal reporting structures of
• 15:51
  the goodstone group oh man they can use the stolen
• 15:54
  confidentiality agreements to craft highly convincing
• 15:57
  targeted spear phishing emails to external vendors
• 16:00
  they can slowly synthesize the passport scans
• 16:03
  with other data points to build robust synthetic
• 16:06
  identities all while patiently bypassing kyc
• 16:09
  protocols without tripping any concurrent alarms
• 16:11
  exactly it dramatically increases the return
• 16:13
  on investment for the criminal buyer. But conversely,
• 16:16
  it makes the data infinitely more dangerous for
• 16:19
  the actual human bills whose information was
• 16:21
  stolen. On questions. The employees of Goodstone
• 16:23
  Group aren't just dealing with their data being
• 16:25
  cast into the noisy wind of the Internet. Their
• 16:28
  identities are being handed over to a dedicated,
• 16:30
  heavily invested syndicate who paid top dollar
• 16:33
  at an auction. Right. That syndicate now has
• 16:37
  a massive financial incentive to squeeze every
• 16:40
  conceivable cent of value out of those specific.
• 16:43
  passports to recoup their million dollar investment.
• 16:46
  It is the ultimate commoditization of human identity.
• 16:49
  The attackers have optimized the supply chain
• 16:52
  via initial access brokers. They have normalized
• 16:56
  the extortion through corporate branding. And
• 16:58
  now they are maximizing the yield. through exclusive
• 17:01
  public auctions. It's chilling. They're utilizing
• 17:04
  fundamental marketplace economics to engineer
• 17:06
  maximum leverage. It really strips away any remaining
• 17:09
  pretense of amateur hacking, doesn't it? Completely.
• 17:12
  This is a highly organized, market -driven industry.
• 17:14
  The Goodstone incident makes it undeniably clear
• 17:17
  that cyber attacks are no longer localized IT
• 17:20
  problems that can be quietly resolved by a tech
• 17:23
  support team resetting some servers. They are
• 17:25
  high stakes, highly visible corporate crises.
• 17:28
  The defensive strategy can no longer just focus
• 17:31
  on building a taller firewall. Organizations
• 17:34
  have to understand the economic drivers of the
• 17:37
  adversaries they are facing. You really have
• 17:38
  to know the business of your enemy. Exactly.
• 17:41
  When attackers are mimicking corporate structures
• 17:43
  and utilizing sophisticated market dynamics,
• 17:45
  the defense requires an equally mature, comprehensive
• 17:49
  approach to incident response, data segregation,
• 17:53
  and identity management. Well said. And as we
• 17:55
  wrap up this discussion, I want you, the listener,
• 17:59
  to... really sit with what this market evolution
• 18:01
  means for the future of our personal information.
• 18:04
  The big question. It is. If ransomware cartels
• 18:06
  are successfully moving toward exclusive public
• 18:08
  bidding wars, what happens to the fundamental
• 18:10
  concept of privacy? Yeah. We are entering an
• 18:13
  era where your stolen identity isn't just a byproduct
• 18:16
  of a corporate breach. It becomes a rare single
• 18:19
  owner commodity aggressively optioned off to
• 18:22
  the highest bidder on a dark red trading floor.
• 18:25
  It's a sobering reality for sure. It really is.
• 18:28
  And it underscores exactly why robust modern
• 18:30
  security architectures are absolutely not optional
• 18:33
  anymore. If you're wondering how to protect your
• 18:35
  own organization from these rapidly evolving
• 18:37
  market -driven threats, we'd love to help you
• 18:39
  prepare and build out those defenses. Please
• 18:41
  visit www .kinsoft .com .au to discuss your own
• 18:45
  security and IT needs. Thanks for joining us
• 18:47
  and stay safe out there.