Latest / Tech Talks With Kinsoft / Space Bears Ransomware: Landscape, Impact, and Defense

Transcript

Space Bears Ransomware: Landscape, Impact, and Defense · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. Great to
• 0:01
  have you with us. Today, we're tackling something
• 0:03
  really crucial, the cyber threat landscape. It
• 0:06
  just keeps changing, doesn't it? Our digital
• 0:08
  world, it's constantly shifting. And yeah, that
• 0:10
  brings a whole new set of security challenges.
• 0:12
  So our mission today is to, well, cut through
• 0:14
  the noise. We want to zero in on what's genuinely
• 0:16
  important right now. We'll be looking at key
• 0:18
  findings from a major industry report, and then
• 0:20
  we'll connect those broader trends to a very
• 0:24
  recent, pretty high -profile incident right here
• 0:26
  in Australia, actually. involving a managed service
• 0:28
  provider, the goal, to give you insights that
• 0:31
  aren't just surprising, maybe, but actually actionable,
• 0:35
  things you can use for your own security posture.
• 0:37
  Okay, let's get started. Right, first up, let's
• 0:40
  unpack some crucial new data. It's from the CyberCX
• 0:43
  2025 Threat Report. This report is, well, it's
• 0:47
  a goldmine for understanding where things stand
• 0:49
  with cybersecurity. It draws insights straight
• 0:51
  from CyberCX's digital forensics and incident
• 0:53
  response team, their DFIR team. These are the
• 0:56
  folks on the front lines responding to serious
• 0:58
  incidents all through 2024. So this is, you know,
• 1:01
  real world, fresh intelligence. And what's really
• 1:04
  fascinating here, maybe a bit unsettling, too,
• 1:07
  is how the nature of these attacks is changing
• 1:09
  subtly, but significantly. And it seems our traditional
• 1:13
  detection methods, well, they're struggling sometimes
• 1:15
  to keep pace with certain kinds of threats. Yeah,
• 1:19
  the report really highlights this pretty astonishing
• 1:21
  difference in detection times. We call it time
• 1:23
  to detect, or TTD. Basically, the number of days
• 1:26
  between when an attack starts and when someone
• 1:28
  finds it. For espionage incidents, the average
• 1:31
  TTD is now over 400 days. 400 days. Over 400.
• 1:36
  Yeah, just think about that for a second. An
• 1:38
  adversary potentially lurking undetected in the
• 1:41
  system for, well, more than a year. It's like
• 1:43
  having a spy living in your house for ages before
• 1:46
  you even know they're there, just quietly taking
• 1:48
  your most valuable secrets. Now compare that
• 1:50
  with financially motivated attacks. Those are
• 1:53
  detected on average in just 24 days. Wow. So
• 1:56
  the implications for espionage are huge. These
• 1:58
  incidents, OK, they make up about 5 percent of
• 2:00
  the data they looked at, but they represent this
• 2:03
  persistent, incredibly stealthy threat that's
• 2:05
  just, well, very hard to dig up. That's an incredible
• 2:08
  difference over a year versus less than a month.
• 2:11
  What does that really tell us? I mean, about
• 2:13
  the nature of these threats? Are we just not
• 2:16
  equipped to find the stealthy ones or is it baked
• 2:19
  into their design? It speaks volumes about their
• 2:22
  goals, doesn't it? Financial attackers, they
• 2:24
  want a quick payout. So they make noise, demand
• 2:26
  ransom, obvious stuff. But espionage actors,
• 2:29
  they prioritize persistent access. Long -term
• 2:31
  intelligence gathering, that's the aim. They
• 2:33
  try to blend in, use legitimate tools, make subtle
• 2:36
  movements. Makes it incredibly hard to spot them
• 2:39
  against normal network traffic. So this shift,
• 2:41
  it really highlights a major challenge for defenders.
• 2:45
  You know, we're often still geared up for those
• 2:46
  loud, quick financial attacks while the really
• 2:49
  damaging law. long -term compromises might be
• 2:51
  slipping right through the net. Right. And speaking
• 2:53
  of evolving tactics, the report brings up something
• 2:56
  many of us rely on heavily, multi -factor authentication,
• 2:59
  MFA. It's crucial. We all know that. But the
• 3:02
  report suggests it's being bypassed more and
• 3:04
  more. It's not quite the silver bullet we thought,
• 3:07
  is it? Precisely. Not anymore. In 2024, get this,
• 3:11
  a staggering 75 percent, three quarters of business
• 3:15
  email compromise, BEC attacks involved the attackers
• 3:18
  bypassing MFA. 75 percent. 75. They're using
• 3:22
  these sophisticated phishing kits. session hijacking
• 3:26
  kits, sometimes called adversary in the middle
• 3:28
  or ATM techniques. So imagine an attacker basically
• 3:31
  sitting between you and say your Microsoft 365
• 3:34
  login. They intercept your login details and
• 3:37
  that act of session token you get. after you
• 3:39
  MFA. Ah, the token. Exactly. That lets them bypass
• 3:43
  MFA entirely and just waltz into your account
• 3:45
  as if they are you. This is a massive jump from,
• 3:48
  what was it, only 10 % back in 2022? Huge jump.
• 3:51
  It's not just a number, right? It's a real wake
• 3:53
  -up call that even our strongest defenses are
• 3:55
  constantly being tested and, well, broken. The
• 3:59
  key insight here, I think, is that security isn't
• 4:01
  just about what tools you have, like MFA. It's
• 4:03
  also about how resilient you are when things
• 4:05
  inevitably go wrong, even when trusted things
• 4:07
  like MFA get bypassed. That is a sobering thought.
• 4:09
  OK, so we know how attacks are changing, but
• 4:12
  who are they hitting hardest? Does the report
• 4:14
  show clear targets? Oh, absolutely. Looking at
• 4:17
  the 2024 data, health care was hit the most 17
• 4:20
  percent of incidents, then financial services
• 4:22
  at 11 percent and education at 8 percent. OK,
• 4:26
  health care, finance, education. Yeah. And the
• 4:28
  common thread, it's pretty clear. They all handle
• 4:30
  huge amounts of sensitive personal data, PII,
• 4:33
  health records, financial details. That makes
• 4:35
  them really attractive targets. Doesn't matter
• 4:37
  what the attacker's ultimate motivation is. Right.
• 4:39
  The data itself is the prize. Exactly. That old
• 4:42
  saying, data is the new oil. Maybe now it's the
• 4:45
  new currency in the cyber underworld. And what
• 4:47
  about those motivations? Is it still mostly about
• 4:49
  money or are other reasons creeping up? Financial
• 4:52
  motivation, yeah, it still dominates. That was
• 4:54
  65 % of incidents. About 27 % had an unknown.
• 4:57
  motive. And like we said, 5 % were espionage.
• 5:00
  But here's another interesting shift within those
• 5:02
  financial attacks. A big increase in what they
• 5:05
  call ransomware only incidents. Ransomware only.
• 5:09
  Meaning ransomware gets deployed, systems get
• 5:12
  encrypted, but the attackers don't actually steal
• 5:15
  any data beforehand. That jumped to 38 % of incidents
• 5:18
  in 2024. It was only 13 % the year before in
• 5:21
  2023. And kind of the flip side. Cases where
• 5:25
  they only stole data but didn't deploy ransomware,
• 5:27
  those decreased. That shift to ransomware only
• 5:31
  is really interesting. So if they're not always
• 5:34
  stealing the data, what does that tell us? Maybe
• 5:36
  it's just simpler for them, less risky. I think
• 5:40
  that's part of it. It simplifies the whole operation
• 5:42
  for the attacker. No need to worry about storing
• 5:45
  huge amounts of stolen data, dealing with leak
• 5:47
  sites, law enforcement tracing data, none of
• 5:49
  that hassle. They just want the keys. They want
• 5:51
  the payment to unlock your systems and cause
• 5:53
  disruption. So even if your data isn't technically
• 5:55
  stolen and leaked, the paralysis from encrypted
• 5:58
  systems is still a massive threat. Absolutely.
• 6:01
  Business grinds to a halt. But, you know, one
• 6:03
  of the truly... One intriguing findings for me,
• 6:07
  maybe a bit unsettling, was something that kind
• 6:10
  of flips the script on ransomware. It's about
• 6:13
  what happens to the data that is stolen. If the
• 6:15
  victim doesn't pay the ransom, you'd think, OK,
• 6:17
  they don't pay. Data gets published. Simple.
• 6:19
  Yeah. That's the standard threat, isn't it? Pay
• 6:21
  up or we leak everything. So what did they find?
• 6:24
  Well, the report found that for about a quarter,
• 6:27
  25 percent of victims who had. data stolen but
• 6:31
  did not pay the ransom, that data was never actually
• 6:34
  advertised on leak sites or forums. A quarter.
• 6:37
  Yeah. So not paying doesn't automatically mean
• 6:40
  your data ends up plastered everywhere online.
• 6:43
  Now, the reasons why it wasn't published, that's
• 6:45
  the mystery. The report says it's unknown. It
• 6:47
  opens up a lot of questions, right? What are
• 6:48
  they doing with that data? Selling it privately,
• 6:50
  using it for other, maybe more targeted attacks
• 6:53
  later, intelligence gathering. So the threat
• 6:56
  landscape is getting murkier. Not paying is still
• 6:58
  risky. But the outcome isn't as predictable as
• 7:01
  we thought. Exactly. The threat model itself
• 7:03
  is becoming more opaque. It really underlines
• 7:06
  what Hamish Krebs from CyberCX said. He's their
• 7:08
  executive director of DFIR. He said, essentially,
• 7:12
  that despite everyone's best efforts, the threat
• 7:15
  landscape just keeps getting worse. Adversaries
• 7:17
  evolve. They up the tempo. It's relentless. OK,
• 7:21
  so these trends, they paint a worrying picture
• 7:23
  overall. But abstract trends are one thing. What
• 7:26
  does it look like on the ground? Let's shift
• 7:28
  gears and look at a very recent incident that
• 7:30
  really brings this stuff to life. The ransomware
• 7:33
  attack on Vertel, the Australian managed services
• 7:36
  provider. Right. This Vertel incident is a perfect
• 7:38
  example of these trends playing out right now.
• 7:40
  Vertel, they're based in Sydney, an MSP. They
• 7:43
  confirmed they had a cybersecurity incident starting
• 7:45
  around June 13th, 2025. The attackers were a
• 7:49
  group called Space Bears, relatively new ransomware
• 7:52
  operation. They listed Vertel on their leak site
• 7:54
  just five days later, June 18th. Space bears
• 7:57
  claim they took sensitive data, SQL databases,
• 8:00
  client TII, financial documents, that sort of
• 8:02
  thing. And they threatened to publish it all
• 8:04
  by the end of June if they didn't get paid. OK,
• 8:06
  standard ransomware playbook there with a threat.
• 8:08
  How did Voodoo Hotel respond? Their response
• 8:10
  seems pretty solid, actually. They brought in
• 8:12
  external cybersecurity experts, including CyberCX,
• 8:15
  interestingly, and Atmos. They're working with
• 8:18
  government authorities, too. And crucially, Vertell
• 8:21
  stated the incident hadn't impacted their ability
• 8:23
  to actually provide services to customers. That's
• 8:26
  key for an MSP. Keep the clients running. Absolutely.
• 8:29
  And they said they'd work directly with any clients
• 8:32
  who might be impacted as the investigation continues.
• 8:35
  Sounds like they're handling it professionally.
• 8:36
  Yeah. But connecting this back. Why MSPs? Why
• 8:40
  are providers like Vertel such attractive targets?
• 8:43
  We seem to hear about these attacks quite a bit.
• 8:45
  Yeah, it really highlights this growing vulnerability.
• 8:48
  MSPs are definitely prime targets. And this group,
• 8:52
  Space Bears. They only popped up in April 2024,
• 8:55
  but the report mentioned they've already hit
• 8:56
  73 victims. That's fast work. 73 in just over
• 9:00
  a year. Wow. Yeah. And what's really weird almost
• 9:02
  about Space Bears is their image. They have this
• 9:05
  unique kind of corporate persona. It's bizarre.
• 9:07
  Their leak site uses stock photos and they offer
• 9:10
  guarantees if you pay the ransom. Guarantees.
• 9:13
  Things like, you know, they promise to delete
• 9:15
  the data from their servers, give you the decryption
• 9:17
  tools, and even offer advice on how to prevent
• 9:19
  future attacks. Ransomware attackers offering
• 9:22
  security. advice. That's surreal. It's almost
• 9:24
  satirical, isn't it? A ransomware gang acting
• 9:26
  like a professional business offering customer
• 9:29
  service for extortion shows how businesslike
• 9:32
  these criminal operations have become. Now, origins.
• 9:35
  It's hard to pin down for sure, but they are
• 9:37
  believed to operate out of Moscow. And given
• 9:40
  the current geopolitical climate, well, these
• 9:43
  groups often act with a certain level of impunity,
• 9:45
  unfortunately. But back to your question why
• 9:48
  MSP is several big reasons. One. Centralized
• 9:51
  access. Attackers see an MSP as one key that
• 9:54
  potentially unlocks dozens, even hundreds of
• 9:57
  client networks. A single point of compromise
• 9:59
  for widespread impact. The jackpot scenario for
• 10:02
  them. Exactly. Two, high stakes data. MSPs often
• 10:06
  manage critical data for their clients. This
• 10:08
  increases the pressure, the likelihood that someone
• 10:10
  will pay the ransom because the cost of that
• 10:12
  data loss is just too high for the end clients.
• 10:14
  Three, the ripple effect. Hitting an MSP disrupts
• 10:18
  potentially numerous businesses all at once.
• 10:20
  once that amplifies the chaos and the pressure
• 10:23
  to pay quickly. Four, perceived weaknesses. Sometimes
• 10:26
  there's a perception, fair or not, that MSP security
• 10:29
  might be stretched thin because they're managing
• 10:31
  so many diverse clients with different setups
• 10:32
  and needs. And finally, five, trust and reputation.
• 10:36
  And MSP's whole business is built on trust. Attackers
• 10:39
  know this. They exploit it, figuring the MSP
• 10:41
  might pay just to minimize the reputational damage
• 10:44
  and restore client confidence fast. That makes
• 10:46
  perfect sense. So the Vertel attack isn't just
• 10:48
  some random event. It's a clear illustration
• 10:50
  of a major strategic vulnerability in the ecosystem.
• 10:53
  And it really underscores how critical it is
• 10:55
  for MSPs and honestly for everyone to double
• 10:58
  down on defenses, especially with groups like
• 11:00
  Space Bears out there getting more sophisticated,
• 11:02
  even if their branding is weird. OK, this brings
• 11:06
  us to the really crucial part. What can you listening
• 11:09
  right now actually do about all this? We've looked
• 11:11
  at the threats, how they're changing. The MFA
• 11:13
  bypasses the real world impact on organizations
• 11:16
  like Vertel. So let's focus now on actionable
• 11:19
  strategies. How can you protect yourself and
• 11:21
  your organization in this pretty challenging
• 11:23
  environment? Right. Building resilience, especially
• 11:26
  against ransomware with all these twists we've
• 11:28
  discussed, it really needs a layered, proactive
• 11:30
  approach. It's definitely not a one -time fix.
• 11:32
  It's ongoing. So let's break down some best practices
• 11:35
  for prevention. First, and you could argue it's
• 11:38
  the most important, the human element. Comprehensive
• 11:40
  employee training and awareness programs are
• 11:42
  just non -negotiable anymore. With that 75 %
• 11:45
  figure for MFA bypass and BEC attacks, your staff
• 11:50
  need education not just on basic phishing, but
• 11:52
  on these more advanced session hijacking attempts,
• 11:55
  spotting suspicious links, weird login prompts,
• 11:57
  stuff like that. Teaching them the subtle signs
• 12:00
  of an ATM attack, for example, makes them your
• 12:02
  absolute first line of defense, a critical line.
• 12:05
  Empowering the user. Makes sense. What about
• 12:07
  the deck side? Okay, technical fortification.
• 12:09
  This has several key layers. First, robust network
• 12:11
  security. That means strong firewalls, intrusion
• 12:14
  detection, intrusion prevention systems, and
• 12:16
  really critically, network segmentation. Segmentation,
• 12:20
  like dividing the network up. Exactly. Think
• 12:22
  of it like watertight compartments on a ship.
• 12:24
  If one area gets breached, ransomware hits one
• 12:27
  segment, it doesn't automatically spread and
• 12:29
  sink the whole ship. the whole network. It limits
• 12:32
  the blast radius. And of course, keep all your
• 12:34
  network gear regularly updated and patched. Basic,
• 12:37
  but vital. Second, advanced endpoint protection.
• 12:41
  You need solutions that go beyond just signature
• 12:43
  matching, things that use heuristic analysis,
• 12:46
  behavior monitoring, maybe AI. These tools look
• 12:49
  for suspicious activity on laptops, servers like
• 12:51
  unusual file encryption starting up, or attempts
• 12:54
  to tamper with system processes. They can often
• 12:56
  stop brand new, never seen before ransomware.
• 12:59
  And keep your standard anti -verisanti malware
• 13:01
  up to date too, naturally. Third, strong authentication.
• 13:05
  Enforce strong, unique passwords. Use password
• 13:07
  managers. And yes, even though we know MFA isn't
• 13:10
  a perfect silver bullet against every attack.
• 13:12
  Still essential. Still absolutely essential.
• 13:14
  Use it wherever you possibly can. It still blocks
• 13:17
  a huge number of attacks and significantly raises
• 13:20
  the difficulty for attackers. Fourth, data encryption.
• 13:24
  Encrypt your sensitive data, both when it's stored
• 13:26
  at rest and when it's moving in transit. If attackers
• 13:30
  do manage to steal it, strong encryption makes
• 13:32
  it useless garbage to them. And fifth, reduce
• 13:35
  your attack surface. Basically, disable any features,
• 13:38
  services, ports on your systems and applications
• 13:40
  that you don't actually need. Every unnecessary
• 13:43
  open door is a potential way in for attackers.
• 13:45
  Lock them down. Okay, that's a solid set of technical
• 13:48
  defenses. Human element, network, endpoint, authentication,
• 13:52
  encryption, reducing the surface. What else?
• 13:54
  Beyond those preventative tech measures, there's
• 13:56
  the ultimate safety net, regular data backup,
• 13:58
  and importantly, validation, testing those backups.
• 14:01
  Backups, always crucial. absolutely critical
• 14:03
  and they need to be stored securely off -site.
• 14:05
  Follow the 3 -2 -1 rule if you can. Three copies
• 14:09
  of your data on two different types of media
• 14:11
  with at least one copy off -site, and you must
• 14:13
  test them regularly to make sure you can actually
• 14:15
  restore from them. In a ransomware attack, having
• 14:18
  good tested backups is often the fundamental
• 14:20
  difference between getting back online relatively
• 14:23
  quickly and facing catastrophic, potentially
• 14:26
  business -ending data loss. And finally, preparation.
• 14:30
  Develop a proper, well -defined incident response
• 14:33
  plan. Know exactly what steps to take if an attack
• 14:35
  happens. Who does what? How do you contain it?
• 14:38
  Who communicates with whom? What are the recovery
• 14:40
  procedures? Having that plan ready before disaster
• 14:42
  strikes can drastically reduce the impact. And
• 14:44
  remember, all of this, it's an ongoing process.
• 14:47
  Prevention requires constant vigilance, constant
• 14:49
  adaptation to keep pace with these evolving threats.
• 14:51
  That's a really comprehensive rundown. And it
• 14:53
  hits home. The security isn't just a product
• 14:55
  you buy. It's a continuous process, a journey
• 14:57
  of adapting. So thinking about everything we've
• 15:00
  covered today, you know, the sophisticated MFA
• 15:03
  bypasses, these new ransomware groups like Space
• 15:06
  Bears with their weird corporate thing, those
• 15:08
  incredibly long dwell times for espionage, what
• 15:11
  really stands out to you listening about just
• 15:13
  how fast this cyber threat landscape is evolving?
• 15:16
  And maybe what continuous steps does your organization
• 15:19
  need to take to genuinely try and stay ahead?
• 15:22
  It really is a constant cat and mouse game, isn't
• 15:24
  it? And understanding the speed and the cleverness
• 15:27
  of the mouse is absolutely key for the cat. Something
• 15:29
  to think about. Well, that brings us to the end
• 15:31
  of another session here on Tech Talks with Kinsoft.
• 15:34
  We really hope this exploration of cyber trends
• 15:36
  for 2025 has given you some valuable insights,
• 15:39
  maybe some actionable knowledge to help protect
• 15:41
  your digital world. Staying informed, staying
• 15:43
  proactive. It's just more critical than ever
• 15:46
  in cybersecurity right now. And look, if you
• 15:48
  are looking to discuss your own security and
• 15:50
  IT needs, or maybe you want to learn more about
• 15:53
  how to protect your organization in this changing
• 15:55
  environment we've been talking about, you can
• 15:57
  find more information and reach out to the experts
• 15:59
  over at www .kinsoft .com .au. Thanks so much
• 16:03
  for tuning in, and we look forward to having
• 16:05
  you with us again next time on Tech Talks with
• 16:07
  Kinsoft.