Latest / Tech Talks With Kinsoft / VSP Solutions – Stormous Hits a Security-Hardware Distributor

Transcript

VSP Solutions – Stormous Hits a Security-Hardware Distributor · Tech Talks With Kinsoft

• 0:00
  You know, usually when we think about a corporate
• 0:02
  cyber attack, we picture a direct frontal assault.
• 0:06
  Right. We imagine the digital equivalent of a
• 0:08
  bank robber just, you know, walking straight
• 0:10
  through the front door. Demanding the cash from
• 0:12
  the vault. Exactly. And making a run for it.
• 0:15
  The traditional smash and grab. You breach the
• 0:17
  perimeter, you grab what you can carry, and,
• 0:20
  well, you get out before the alarms trigger a
• 0:22
  response. But the reality of modern cyber threats
• 0:25
  is it's so much more intricate than that. Oh,
• 0:28
  absolutely. It's less about robbing a single
• 0:30
  vault and much more about infiltrating the entire
• 0:33
  plumbing system of an industry. So welcome to
• 0:36
  Tech Talks with Kinsoft. Glad to be here. The
• 0:39
  premise of our show is simple. We take a stack
• 0:41
  of sources like articles, research, our own notes,
• 0:45
  and we extract the most critical nuggets of knowledge.
• 0:48
  So you, the listener, can stay perfectly informed
• 0:51
  without feeling completely overwhelmed. Exactly,
• 0:54
  because there is just a constant flood of information
• 0:56
  out there. We aim to cut through the noise and
• 0:59
  find the signal. And today's signal is coming
• 1:01
  from a very specific incident that acts as a
• 1:04
  perfect microcosm of where enterprise security
• 1:07
  is failing right now. Yeah, today we are focusing
• 1:09
  on a recent exclusive report. It was published
• 1:12
  by Cyber Daily on June 1st, 2026. A really fascinating
• 1:16
  piece. It really is. The core story here is that
• 1:18
  VSP Solutions, which is a major Australian video
• 1:21
  security firm, they were hit by a cyber attack
• 1:24
  resulting in a 40 gigabyte data leak. Right,
• 1:27
  but our mission today isn't just to read you
• 1:29
  the news. No, not at all. We are using this VST
• 1:32
  incident as a practical lens to understand three
• 1:34
  massive concepts. Okay, lay them out. We're looking
• 1:37
  at third party supply chain risks, the hidden
• 1:40
  dangers of what companies call historical data,
• 1:43
  and the modern, highly corporate playbook of
• 1:46
  ransomware leak sites. To understand the severity
• 1:48
  of any cyber incident, you really have to look
• 1:51
  past the headline numbers. You have to analyze
• 1:53
  the actual anatomy of the breach. Like what exactly
• 1:55
  was exposed when the digital alarms went off?
• 1:57
  Exactly. And how fast the escalation happened.
• 1:59
  Well, let's look at the timeline because the
• 2:01
  speed here is... It's honestly alarming. It really
• 2:04
  is. On Wednesday, May 13th, 2026, VSP Solutions
• 2:08
  became aware of an incident involving their business.
• 2:11
  Okay, so that's day one. Fast forward just 10
• 2:13
  days, right, to May 23rd, and they were officially
• 2:16
  listed on a Darknet leak site. Wow. 10 days.
• 2:21
  10 days. 10 days from realizing something is
• 2:24
  wrong in your network to having your corporate
• 2:26
  secrets just pasted on the dark web. And the
• 2:29
  hackers were very explicit about what those secrets
• 2:31
  included. Yeah, we are talking about 40 gigabytes
• 2:34
  of data. And this included... Full financial
• 2:37
  backups from QuickBooks and Reckon, email archives,
• 2:41
  staff personal folders. Customer and client databases,
• 2:43
  too. Right, specifically installers and integrators
• 2:46
  nationwide. And shipment and order tracking from
• 2:49
  major physical security brands like Hikvision
• 2:51
  and Access. You know, 40 gigabytes might sound
• 2:53
  like a rounding error if you're talking about
• 2:55
  high -definition video files. Yeah, I mean, that's
• 2:57
  like, what, a few 4K movies? Exactly. But 40
• 3:00
  gigabytes of pure text, spreadsheets, SQL databases,
• 3:03
  and email archives. It's massive. It is an absolutely
• 3:07
  staggering volume of highly structured, deeply
• 3:10
  sensitive information. Millions of rows of raw
• 3:14
  corporate reality. Okay, let's unpack this. Because
• 3:17
  stealing this specific combination of data isn't
• 3:21
  just a smash and grab. Right. It's like stealing
• 3:23
  the architectural blueprints, the bank statements,
• 3:26
  and the employee diaries of a company all at
• 3:29
  once. That's a great way to put it. It's a complete...
• 3:32
  unredacted historical map of the business. And
• 3:34
  it gives the attackers total leverage. We know
• 3:37
  modern ransomware groups operate on a double
• 3:39
  extortion model. Right. They don't just encrypt
• 3:41
  your network to cause operational downtime anymore.
• 3:44
  Exactly. They exfiltrate the data first and threaten
• 3:46
  to publish it. But the mechanics of how they
• 3:50
  leverage this specific type of structured data,
• 3:53
  well, that is where the real threat lies. How
• 3:55
  so? When a group pulls out a QuickBooks backup,
• 3:58
  they aren't just looking at your bottom line.
• 4:00
  They're looking at your accounts payable, your
• 4:02
  vendor payment schedules, your payroll structure.
• 4:04
  Oh, wow. They're looking for the financial pressure
• 4:06
  points they can squeeze during negotiation. I
• 4:08
  understand the financial leverage, but looking
• 4:12
  at that list of stolen data. The shipment and
• 4:15
  order tracking for major physical security brands
• 4:18
  like Hikvision and Axis, that really jumps out
• 4:20
  to me. Oh, it sure does. Because we are talking
• 4:23
  about a distributor of security cameras and Axis
• 4:26
  control panels. Right, which adds a highly unique
• 4:29
  layer of physical security risk to what is essentially
• 4:32
  a digital breach. Right. Consider the crossover
• 4:35
  here. If an attacker has the shipment tracking.
• 4:38
  MFE addresses and customer databases for enterprise
• 4:41
  video security products, they know exactly which
• 4:44
  businesses across Australia are currently installing
• 4:46
  new cameras. That's terrifying. They know where
• 4:48
  the blind spots might be during the installation
• 4:50
  phase. They know what specific models of access
• 4:53
  control systems are guarding certain facilities.
• 4:56
  So a digital map has suddenly become a physical
• 4:58
  map of vulnerabilities across the country. Exactly.
• 5:01
  A threat actor could theoretically cross -reference
• 5:04
  those shipment logs with known hardware vulnerabilities.
• 5:07
  Wait, really? Yeah, like if they see VSP shipped
• 5:10
  a specific batch of Axis cameras to a government
• 5:13
  contractor, and that specific model has an unpatched
• 5:17
  firmware flaw. Then what? Well, the attacker
• 5:20
  doesn't even need to hack the contractor's network
• 5:22
  directly. They just exploit the hardware fresh
• 5:25
  out of the box. You got it. So who is actually
• 5:27
  executing this level of analysis? Because analyzing
• 5:30
  the threat actor reveals exactly why a mid -sized
• 5:33
  Australian distributor was targeted in the first
• 5:35
  place. Yes. The group claiming responsibility
• 5:38
  goes by the name Stormus. Stormus. Right. They
• 5:42
  emerged in 2022. They've claimed more than 140
• 5:45
  victims, and they operate using a ransomware
• 5:48
  -as -a -service model, or RACE. But basically
• 5:50
  running a corporate franchise. Exactly like a
• 5:52
  franchise. Much like legitimate tech companies
• 5:55
  use software -as -a -service models, Stormis
• 5:57
  provides the core encryptor malware, the dark
• 6:00
  web leak site infrastructure, and the negotiation
• 6:03
  dashboard. Like a turnkey solution for cybercrime?
• 6:06
  Precisely. They franchise this toolkit out to
• 6:09
  affiliates. Affiliates, like independent hackers
• 6:12
  who do the actual breaking and entering. I get
• 6:14
  that Raise operates like a franchise, but how
• 6:16
  do they handle the actual financial split securely
• 6:20
  without exposing themselves? Does the core group,
• 6:23
  like Secro the crypto? Well, the modern Raise
• 6:26
  ecosystem is incredibly specialized. Often the
• 6:29
  affiliate doesn't even do the initial hacking.
• 6:31
  Wait, they don't? No. They buy compromised credentials
• 6:34
  from initial access brokers. Oh, so specialists
• 6:37
  who just break down the front door and sell the
• 6:39
  keys. Exactly. The affiliate takes those keys,
• 6:42
  deploys the stormless malware, and exfiltrates
• 6:45
  the data. If the victim pays, the ransom goes
• 6:48
  into a multi -signature cryptocurrency wallet.
• 6:51
  And then it just splits automatically. Yeah.
• 6:52
  The RaiseApp platform automatically takes its
• 6:55
  platform fee, usually around 20 to 30 percent,
• 6:57
  and routes the rest to the affiliate. It's automated.
• 7:00
  trustless profit -sharing among criminals. That
• 7:03
  level of corporatization is terrifying. Now,
• 7:06
  according to the threat intelligence platform
• 7:08
  Socratar, Stormis is classified as a pro -Russian
• 7:11
  group. Right. And just to be clear for everyone
• 7:13
  listening, our goal today isn't to dive into
• 7:15
  geopolitics or take sides. Of course not. We
• 7:18
  are simply looking at what the intelligence reports
• 7:20
  are telling us, right? We're not endorsing any
• 7:23
  viewpoints, just conveying the factual claims
• 7:26
  made in the source material regarding the attacker's
• 7:28
  reported allegiances. Right, just the data we
• 7:30
  have. But taking that report at face value, I
• 7:33
  have to push back a bit. Okay, go ahead. If Stormis
• 7:35
  is ideologically motivated, why target an Australian
• 7:39
  video security distributor in Minchenbury, New
• 7:42
  South Wales? That is a very good question. Is
• 7:44
  it just opportunistic economics? Because hacking
• 7:48
  a mid -sized distributor doesn't immediately
• 7:51
  look like a grand geopolitical maneuver. What's
• 7:53
  fascinating here is how the group itself justifies
• 7:58
  its targeting parameters. Oh, they actually talk
• 8:00
  about it. Yeah. In an interview given by a Stormis
• 8:02
  spokesperson back in October 2025, they explicitly
• 8:06
  stated that their operations blend financial
• 8:09
  and political motivations. OK, so a bit of both.
• 8:11
  Right. They claim target selection is guided
• 8:13
  by both perceived ideological alignment and economic
• 8:17
  opportunity. But the critical phrase they used
• 8:19
  was that they prioritize opportunities that maximize
• 8:22
  impact. both financially and in terms of influence.
• 8:26
  Maximizing influence. Yes. So it's not just about
• 8:28
  the ransom payout. It's about the blast radius
• 8:30
  of the attack. That is the core of their strategy.
• 8:33
  The developers build the tools to create maximum
• 8:36
  leverage, and the affiliates scour the globe
• 8:39
  looking for the weakest link in the chain. The
• 8:41
  chain that connects to the most valuable targets.
• 8:44
  Exactly. Stormis primarily targets organizations
• 8:46
  in the technology and business services sectors
• 8:49
  across the U .S., Spain, the UAE, and France.
• 8:53
  So it's a global operation. Yes. And VSP is one
• 8:56
  of several victims they claimed after taking
• 8:59
  an almost six -month hiatus. Stormis' stated
• 9:02
  goal of maximizing influence directly explains
• 9:04
  why a distributor like VSP is the absolute perfect
• 9:08
  target. Because of their position in the market.
• 9:10
  Right. It's not really about the distributor
• 9:12
  itself. It's about everyone connected to them.
• 9:14
  Let's look at the target. VSP Solutions isn't
• 9:17
  just a standalone shop. No. They have a massive
• 9:19
  reach. They are based in New South Wales, but
• 9:22
  they have offices in Queensland, Victoria and
• 9:24
  Western Australia. They've been distributing
• 9:27
  video security products since 1993. Over three
• 9:30
  decades of industry relationships, contracts
• 9:33
  and digital handshakes. Right. They supply bespoke
• 9:36
  solutions, everything from physical access control
• 9:39
  to advanced cloud surveillance platforms. Oh,
• 9:43
  and they supply these to installers and integrators
• 9:45
  nationwide. Here's where it gets really interesting.
• 9:49
  distributor isn't just hitting one business.
• 9:51
  It's like it's like stealing the master key for
• 9:55
  an entire apartment complex rather than kicking
• 9:57
  down individual doors or like poisoning a river
• 10:00
  at its source. That's a very vivid analogy, but
• 10:03
  it's accurate. You aren't just attacking the
• 10:05
  water. You're impacting every town downstream
• 10:06
  that drinks from it. Exactly. If you breach an
• 10:09
  end user, you compromise one company. If you
• 10:11
  breach a distributor, you potentially compromise
• 10:13
  hundreds or thousands of companies down the line.
• 10:16
  If we connect this to the bigger picture. This
• 10:19
  is the very definition of third -party and supply
• 10:21
  chain risk. Which we hear a lot about lately.
• 10:23
  Right, because attackers have realized that enterprise
• 10:26
  companies spend millions securing their own internal
• 10:28
  networks. A major bank or a government agency
• 10:31
  will have world -class firewalls, strict multi
• 10:34
  -factor authentication, and a 247 security operations
• 10:38
  center. Hacking them directly is expensive and
• 10:40
  loud. Yeah, but that same bank has to hire a
• 10:43
  local integrator to install their security cameras.
• 10:46
  Right. buys their hardware from a distributor
• 10:50
  like VSP. The attacker looks at this chain and
• 10:53
  realizes the distributor is the fulcrum. So if
• 10:56
  they compromise the vendor, they gain immense
• 10:59
  leverage over the vendor's massive network of
• 11:02
  clients. Exactly. Let's talk about the mechanics
• 11:04
  of how this data becomes a downstream weapon.
• 11:06
  Okay. If Stormis has VSP's email archives and
• 11:10
  customer databases, they can launch incredibly
• 11:12
  sophisticated spear phishing campaigns. Because
• 11:15
  they aren't sending generic spam anymore. No.
• 11:17
  They can send an email to an integrator that
• 11:19
  says, hey, regarding your current order of 50
• 11:21
  Axis cameras for the new downtown bank branch,
• 11:23
  we need you to review this updated. shipping
• 11:26
  invoice that is so specific the email comes from
• 11:29
  a real vsp email thread referencing a real purchase
• 11:33
  order speaking to the exact person who handles
• 11:35
  procurement And the integrator clicks the invoice,
• 11:38
  their network is compromised, and the attacker
• 11:40
  uses that access to pivot directly into the bank's
• 11:43
  network during the installation phase. Exactly.
• 11:46
  When Stormist leaked those customer databases
• 11:49
  mapping out nationwide security installations,
• 11:51
  they turned a localized IT headache into a nationwide
• 11:55
  supply chain vulnerability. The domino effect.
• 11:58
  One piece falls and it threatens the entire board.
• 12:01
  Precisely. So once the attackers execute this
• 12:04
  double extortion play on a critical supply chain
• 12:07
  node, the victim's immediate response dictates
• 12:10
  the fallout. Let's look at how VSP handled this
• 12:12
  because there are lessons here. Yes. VSP's public
• 12:15
  response was honestly textbook crisis management.
• 12:18
  Oh, really? Yeah. They stated that the incident
• 12:20
  did not affect their current business operations
• 12:22
  and that they are continuing to serve clients
• 12:24
  with full confidence. Right. They clarified something
• 12:27
  crucial, though. They claimed the impact of data
• 12:29
  was historical in nature and pertained to a related
• 12:31
  business. And they immediately took steps to
• 12:35
  contain the incident, engaging forensic experts
• 12:37
  and cybersecurity advisors. Yeah, they engaged.
• 12:40
  with law enforcement and notified relevant Australian
• 12:42
  government agencies. They also explicitly committed
• 12:45
  to communicating transparently with their clients
• 12:48
  and stakeholders. Which is exactly what you're
• 12:50
  supposed to do. Right. This is the modern blueprint
• 12:52
  for how to handle a leak site listing. You acknowledge
• 12:55
  it, isolate it, bring in the experts and communicate
• 12:58
  the scope of the impact to anyone downstream
• 13:00
  who might be affected. There is a detail in this
• 13:03
  story, though, that is just dripping with. dark
• 13:05
  humor. Oh, the file sharing part. Yes. So the
• 13:08
  hackers, Stormus, took this 40 gigabytes of stolen
• 13:12
  corporate data and published it on a popular
• 13:14
  public file sharing platform. But within a few
• 13:18
  days, the data was gone. And not because of a
• 13:21
  massive international police sting? No, because
• 13:24
  the hosting service terminated the hacker's account
• 13:26
  for a violation of our terms of service. It's
• 13:29
  hilarious, really. It highlights the bizarre
• 13:31
  ecosystem of modern cybercrime. It really does.
• 13:34
  You have highly sophisticated operations utilizing
• 13:37
  advanced encryption and initial access brokers,
• 13:40
  but they still rely on mundane, everyday Internet
• 13:44
  infrastructure to host their stolen files. It
• 13:47
  is literally like an international jewel thief
• 13:49
  successfully robbing the Louvre, bypassing laser
• 13:53
  grids and armed guards, making a clean getaway
• 13:56
  and then immediately getting their getaway car
• 13:58
  towed because they parked in a loading zone.
• 14:00
  The mundane rules of the Internet still apply.
• 14:02
  Exactly. But underneath that irony, there is
• 14:05
  a very serious warning hidden in VSP's statement
• 14:08
  about the data being historical in nature. Yeah,
• 14:12
  this is something I really want to dig into.
• 14:13
  Why do companies keep so much historical data,
• 14:16
  and why is it so dangerous? This raises an important
• 14:19
  question for any IT leader listening today. Okay.
• 14:22
  Companies are usually hypervigilant about securing
• 14:24
  their active, day -to -day operational data.
• 14:27
  They put it in the cloud, behind the newest zero
• 14:29
  -trust security protocols. But they often leave
• 14:32
  decades of old data sitting on legacy servers.
• 14:35
  They keep it for compliance reasons, tax audits,
• 14:38
  or simply because no one wants to take the responsibility
• 14:40
  of hitting the delete button on 10 years of corporate
• 14:44
  history. It's the digital equivalent of putting
• 14:46
  an unpickable smart lock on your front door,
• 14:49
  but leaving your old financial records in a cardboard
• 14:52
  box by the curb. To an attacker, that old data
• 14:55
  is a goldmine. Let's look at the forensic realities
• 14:57
  of what historical data actually contains. What's
• 15:00
  usually in there? It holds legacy network architectures.
• 15:03
  It holds old email archives that reveal the internal
• 15:06
  power dynamics of the company. Most dangerously,
• 15:09
  it holds old passwords. And we know human psychology.
• 15:12
  People reuse passwords. Constantly. If an attacker
• 15:16
  pulls an employee's password from a five -year
• 15:18
  -old database, there is a statistically significant
• 15:20
  chance that employees using a variation of that
• 15:23
  exact same password for their current... highly
• 15:25
  secured accounts. Wow. Furthermore, historical
• 15:28
  financial data gives attackers the baseline they
• 15:30
  need to craft highly convincing business email
• 15:33
  compromise scams, like those QuickBooks files.
• 15:36
  Right, the Reckon and QuickBooks backups. Even
• 15:39
  if the data doesn't disrupt your operations today,
• 15:41
  it gives the attacker massive leverage for extortion,
• 15:44
  it damages your reputation with clients who trusted
• 15:48
  you, and it triggers serious privacy law violations.
• 15:52
  So what does this all mean for the people listening?
• 15:54
  Let's summarize. When we look at this VSP incident
• 15:57
  holistically, a few massive takeaways emerge.
• 16:00
  Okay, first one. First, ransomware has evolved
• 16:03
  into a highly franchised corporate business model
• 16:07
  through ransomware as a service. Like we talked
• 16:09
  about, we are dealing with specialized supply
• 16:12
  chains of cybercrime. Absolutely. And the second.
• 16:15
  Second, attackers are deliberately targeting
• 16:17
  the distributors and the vendors because breaching
• 16:20
  the middleman maximizes their downstream leverage
• 16:23
  and influence over hundreds of other companies.
• 16:25
  And the final takeaway. And third, your old forgotten
• 16:28
  historical data can and will be weaponized against
• 16:31
  you if it isn't properly secured or systematically
• 16:34
  destroyed. I urge organizations to reflect on
• 16:37
  that last point immediately. If cyber criminals
• 16:40
  are actively digging up historical data. to use
• 16:42
  as leverage in double extortion schemes, it forces
• 16:46
  us all to ask a difficult question. What's that?
• 16:49
  When does archiving data stop being a strategic
• 16:52
  business asset and start becoming a toxic liability?
• 16:55
  Think about your own infrastructure right now.
• 16:57
  How many digital ghosts of old businesses, forgotten
• 17:01
  projects, and legacy backups are sitting quietly
• 17:04
  on your company's servers, just waiting for an
• 17:06
  initial access broker to find them? It is a really
• 17:09
  sobering thought, and it's exactly why being
• 17:11
  proactive is the only real defense here. It's
• 17:13
  not enough to secure the perimeter. You have
• 17:15
  to understand exactly what is sitting inside
• 17:17
  it. So to make sure your active and historical
• 17:19
  data is actually protected and to discuss your
• 17:22
  security and IT needs before they become a dark
• 17:25
  web headline, visit www .kinsoft .com .au. Stay
• 17:31
  secure out there. Thank you so much for joining
• 17:33
  us on Tech Talks with Kinsoft. Stay informed,
• 17:35
  and we'll catch you next time.