Latest / Tech Talks With Kinsoft / 3P Corporation – Space Bears Claims a Melbourne Finance Firm

Transcript

3P Corporation – Space Bears Claims a Melbourne Finance Firm · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. I mean, imagine
• 0:02
  you are running a business, right? Your security
• 0:05
  dashboards are flashing green and your automated
• 0:08
  IT reports are proudly declaring, you know, zero
• 0:11
  data stolen. Yeah. Everything looks perfect on
• 0:14
  paper. Exactly. The system worked. But at that
• 0:17
  exact moment, cyber criminals are literally standing
• 0:21
  in the public square waving around your client's
• 0:23
  most private financial data for anyone to see.
• 0:26
  It is a total nightmare scenario for any company.
• 0:29
  Today we are unpacking this modern digital hood
• 0:33
  unit. It is basically the cybersecurity equivalent
• 0:35
  of a bank manager standing in front of you, arms
• 0:37
  crossed, insisting the vault is perfectly secure
• 0:40
  and the alarms never went off. Right. While,
• 0:43
  you know, literally across the street, the bank
• 0:45
  robbers are happily handing out the bank's cash
• 0:47
  to random passersby. They're handing out the
• 0:49
  cash, the safe deposit boxes, the security camera
• 0:51
  footage, and honestly, probably the bank manager's
• 0:54
  personal diary too. Yeah, pretty much everything.
• 0:57
  Because the contradiction between what internal
• 0:59
  systems report and what threat actors publicly
• 1:01
  demonstrate, well, it's becoming one of the most
• 1:04
  pressing challenges in incident response today.
• 1:06
  Oh, for sure. And our target in this specific
• 1:09
  mystery is 3P Corporation. They are this boutique
• 1:13
  financial services aggregate based right in the
• 1:15
  heart of Melbourne's finance district. Right
• 1:17
  down in Melbourne. Yeah. Founded back in 2013
• 1:19
  by the author and TV personality Peter Ziggy.
• 1:23
  They offer like a comprehensive suite of services.
• 1:26
  We are talking accounting, tax, financial planning,
• 1:30
  legal advice, human resources. And that business
• 1:34
  model is precisely why they are so relevant to
• 1:37
  this discussion, because a financial services
• 1:39
  aggregate isn't just a single company, right?
• 1:41
  No, it's like a hub. Exactly. It functions as
• 1:44
  a central nervous system for thousands of other
• 1:46
  entities. When attackers look at a boutique firm
• 1:49
  like 3P, they don't just see one target. They
• 1:52
  see a backdoor. Right, a backdoor into every
• 1:54
  single business client that relies on 3P for
• 1:56
  payroll or tax lodgment or legal structuring.
• 1:59
  Yeah, it is a classic supply chain attack. Which
• 2:02
  makes them an absolute goldmine. I mean, they
• 2:05
  hold the actual crown jewels of identity theft
• 2:07
  for thousands of people. But, you know, they
• 2:10
  probably don't have the billion dollar cybersecurity
• 2:12
  budget that a massive bank does. Or the, you
• 2:15
  know, 500 person 2047 Security Operations Center
• 2:18
  either. Right. Exactly. They operate on leaner
• 2:21
  margins, which creates this massive asymmetry
• 2:24
  that hackers just love to exploit. And that asymmetry
• 2:28
  brings us to the threat actor involved here.
• 2:30
  The ransomware gang calls themselves Space Bears.
• 2:34
  Space Bears. You know, you got to love the names
• 2:37
  these groups come up with. It's ridiculous, but
• 2:39
  they are very serious. They are not a legacy
• 2:42
  group that has been around for a decade, though.
• 2:44
  They emerged onto the scene relatively recently,
• 2:47
  back in April 2024. Oh, OK, so fairly new. Yeah,
• 2:50
  but they were presumed to be a Russia -based
• 2:52
  operation, and they function like a highly efficient
• 2:54
  corporate enterprise. I mean, before this incident,
• 2:57
  they had already claimed to 71 victims worldwide.
• 2:59
  Wow. 71. And they have a proven track record
• 3:02
  locally in Australia, too, right? They absolutely
• 3:04
  do. Yeah, because their most recent Australian
• 3:07
  victim prior to this was a New South Wales charity,
• 3:10
  Christian Community Aid, which was breached by
• 3:13
  them in January of 2025. So, I mean, they aren't
• 3:16
  just making idle threats. No, not at all. They
• 3:19
  possess the operational capacity to infiltrate
• 3:21
  and extract data, which. you know, sense the
• 3:24
  stage for the incident at 3P Corporation. Right.
• 3:26
  Let's get into the timeline. So according to
• 3:28
  the timeline provided by Space Bears, they compromised
• 3:31
  3P systems on April 7, 2026. Okay, April 7. And
• 3:36
  just three days later, on April 10, the group
• 3:38
  publicly listed 3P on their dark web leak site.
• 3:42
  They claimed a massive haul over 200 gigabytes
• 3:46
  of data. 200 gigabytes. And the specifics of
• 3:49
  that claim were honestly terrifying. Space Bears
• 3:51
  stated they had the core database, internal financial
• 3:54
  documents and the personal information of both
• 3:56
  employees and clients. Yeah, it's basically the
• 3:58
  worst case scenario list. And they set a ransom
• 4:00
  deadline for around April 18, basically issuing
• 4:03
  an ultimatum, you know, pay up by the state or
• 4:06
  we release everything to the public. Well, and
• 4:08
  when a threat actor makes a claim like that.
• 4:10
  You have to remember, they are relying heavily
• 4:11
  on fear. Sure. Ransomware groups are, by nature,
• 4:14
  criminal extortionists. They have a massive vested
• 4:18
  interest in exaggerating their whole. Right.
• 4:20
  To scare the executive. Exactly. To terrify a
• 4:24
  company's executive board into authorizing a
• 4:26
  payout. But I would assume they bluff constantly.
• 4:29
  Right. I mean, a hacker could. Theoretically
• 4:32
  grab a tiny handful of superficial files like
• 4:35
  some public marketing brochures or I don't know
• 4:37
  an outdated employee phone list. Oh happens all
• 4:39
  the time. And then they loudly claim they possess
• 4:41
  the crown jewels. You can't just take a professional
• 4:44
  liar at their word. No you really can't. That
• 4:47
  critical thinking is essential in crisis management.
• 4:50
  Security teams assume the adversary is lying
• 4:53
  until proven otherwise. Makes sense. This is
• 4:56
  why a company's initial reaction relies so heavily
• 4:58
  on their own internal telemetry, the automated
• 5:02
  data and system alerts flowing through their
• 5:04
  network. But look, if you are a 3P corporation,
• 5:06
  you can't just ignore a ticking ransom clock.
• 5:08
  You have to respond to the public claim. You
• 5:10
  do. And their response wasn't a negotiation.
• 5:14
  It was a flat out rejection. The contrast between
• 5:18
  the attacker's claim and the company's official
• 5:20
  stance is incredibly stark here. 3P completely
• 5:24
  and unequivocally disputed the claim that any
• 5:26
  data was stolen. Yeah, they did. A spokesperson
• 5:29
  for 3P confirmed that an incident did take place
• 5:32
  on April 7. But they deliberately framed it as
• 5:36
  an attempted ransomware attack. Attempted. So
• 5:38
  they are saying it failed. Right. The company
• 5:40
  laid out a very confident corporate defense based
• 5:43
  on, well, basically two distinct pillars. So
• 5:46
  the first pillar was operational. They stated
• 5:48
  their internal investigations found their systems,
• 5:50
  detected the attack and stopped it before any
• 5:53
  data could be compromised. Right. So the system
• 5:55
  worked. The alarms went off. The automated doors
• 5:57
  locked. The threat was neutralized. And the second
• 5:59
  pillar of their defense was structural. Yeah.
• 6:02
  This part is really interesting. Interesting.
• 6:03
  They argued that because three key corporation
• 6:05
  LTD is technically a holding company, it does
• 6:09
  not hold any direct client data in the first
• 6:11
  place. Oh, wow. So they're saying they literally
• 6:12
  don't even possess the things the hackers are
• 6:15
  claiming to have stolen. Exactly. The logical
• 6:17
  conclusion being. There was nothing sensitive
• 6:20
  for the hackers to steal, even if they had bypassed
• 6:22
  the defenses. Well, to be fair to 3P, they didn't
• 6:25
  just sweep the internal alert under the rug.
• 6:27
  I mean, they followed the textbook procedural
• 6:30
  playbook for an attempted breach. They absolutely
• 6:33
  did the right things procedurally. Yeah, they
• 6:35
  reported the incident and the findings of their
• 6:38
  internal investigation to the Australian Cybersecurity
• 6:40
  Center. They informed their staff. They proactively
• 6:44
  notified potential clients that an incident had
• 6:47
  occurred, and they closed the perceived gaps
• 6:50
  in their network to strengthen their controls.
• 6:53
  On paper, that is exactly how you handle a neutralized
• 6:56
  threat. You rely on your system logs, you notify
• 6:59
  the relevant authorities, and you reassure your
• 7:02
  stakeholders. Right. But this brings us back
• 7:04
  to the central mystery. The company says their
• 7:06
  system stopped the attack, no data was taken,
• 7:08
  and they structurally don't hold client data.
• 7:11
  Right. The vault is perfectly secure. But the
• 7:13
  hackers stand there claiming they possess over
• 7:15
  200 gigabytes of it. And the burden of proof
• 7:18
  shifts heavily when that ransom deadline expires.
• 7:21
  Because when April 18 passed without a payment,
• 7:24
  Space Bears didn't just walk away. No, they followed
• 7:27
  through. Yeah, they followed through on their
• 7:28
  threat, moving from making claims on the dark
• 7:31
  web to actually publishing the files. And they
• 7:34
  published a 213 .3 gigabyte compressed archive
• 7:38
  to a popular clear web file hosting site. And
• 7:41
  that clear web aspect is crucial. Right, it's
• 7:44
  not hidden away. Exactly. They didn't bury this
• 7:47
  in some obscure, heavily encrypted corner of
• 7:49
  the dark web where only sophisticated hackers
• 7:51
  congregate. By putting it on a clear web hosting
• 7:54
  site, anyone with a standard web browser could
• 7:57
  reach it. And the metrics on that file hosting
• 7:59
  site are just staggering. According to the site's
• 8:02
  own properties, that massive archive was downloaded
• 8:05
  196 times. Wow. 196 times. That isn't just one
• 8:10
  security researcher looking at it. That represents
• 8:12
  potentially 196 different threat actors or identity
• 8:15
  thieves or data brokers grabbing a complete copy
• 8:18
  of the archive for themselves. To determine the
• 8:21
  truth between the two competing narratives, journalists
• 8:23
  at Cyber Daily conducted a review of this leaked
• 8:26
  data. Oh, good. So we have actual eyes on the
• 8:29
  payload. Yeah. They examined the 30 folders of
• 8:32
  company data that were dumped and what they found
• 8:34
  forcefully dismantled the company's defense that
• 8:38
  a holding company doesn't hold direct client
• 8:40
  data. Wow. OK, so what was actually in it? Well,
• 8:44
  the contents are highly sensitive and incredibly
• 8:45
  specific. The leak includes hundreds of authority
• 8:49
  to deduct funds forms. Authority to deduct funds.
• 8:53
  So those are used for tax returns, right? Exactly.
• 8:56
  And they feature full bank details. They feature
• 8:58
  actual wet signatures from customers. And they
• 9:01
  are stamped on official 3P letterhead. Oh, that's
• 9:04
  not good. No. They were even found in a folder
• 9:06
  explicitly labeled 3P accounting and tax trust
• 9:09
  account. Man, that totally destroys the holding
• 9:12
  company argument. It does. The review also uncovered
• 9:15
  trust account statements. remittance advice,
• 9:17
  employee pay slips, and internal document templates.
• 9:20
  The files relate to more than 4 ,500 business
• 9:23
  service clients. 4 ,500 businesses. Yeah, we
• 9:26
  are looking at their private correspondence,
• 9:28
  their tax returns, and signed corporate deeds.
• 9:31
  The most terrifying discovery, though, was a
• 9:34
  single document within this leak that contains
• 9:36
  more than 2 ,700 tax file numbers. 2 ,700 TFNs.
• 9:42
  Yeah, a tax file number is the absolute holy
• 9:44
  grail for IT. identity theft in Australia. Because
• 9:47
  you just can't change it, right? Exactly. It
• 9:49
  functions as a permanent identifier. You cannot
• 9:51
  easily change it if you can change it at all.
• 9:53
  When an identity thief acquires a TFN alongside
• 9:56
  a wet signature, a person's full name, and their
• 9:59
  banking details, they possess a complete turnkey
• 10:02
  kit for executing severe financial fraud. That's
• 10:05
  horrifying. They can open lines of credit. file
• 10:08
  fraudulent tax returns, and systematically dismantle
• 10:11
  a person's financial life. So we are looking
• 10:13
  at what I can only describe as Schrodinger's
• 10:16
  brooch. I like that. You know the famous thought
• 10:18
  experiment, right? Yeah. The cat in the box is
• 10:21
  simultaneously alive and dead until you open
• 10:24
  it and look. In this case, the data is allegedly
• 10:27
  completely safe, locked away and uncompromised,
• 10:30
  according to the company's internal system logs
• 10:32
  and official statements. But simultaneously,
• 10:35
  it is demonstrably public, downloaded nearly
• 10:38
  200 times and being analyzed by journalists on
• 10:41
  the clear web. Schrodinger's breach perfectly
• 10:43
  captures the cognitive dissonance of modern incident
• 10:46
  response. I mean, it highlights a dangerous overreliance
• 10:50
  on internal software to tell us what reality
• 10:52
  is. Wait, if the logs say everything is fine,
• 10:55
  but the data is demonstrably gone, the hackers
• 10:58
  must be tampering with the cameras, so to speak,
• 11:00
  right? Yes, exactly. Are they just logging in
• 11:02
  as administrators and simply turning the security
• 11:04
  software off so it can't record them? That is
• 11:07
  one of the primary methods, and it requires a
• 11:09
  fundamental shift in how we understand cybersecurity
• 11:12
  software. People tend to view security logs as
• 11:15
  this omniscient, all -seeing eye that monitors
• 11:17
  the entire network from above. Like a magic camera.
• 11:20
  Right. But logs are just software programs. They
• 11:23
  only show you what they are specifically consigned
• 11:26
  to monitor, and crucially, they only report what
• 11:30
  the operating system's permissions allow them
• 11:32
  to see. OK, so if an attacker gains administrative
• 11:35
  privileges, maybe by stealing the credentials
• 11:38
  of a high level IT worker through a phishing
• 11:41
  email, they basically become the boss of the
• 11:44
  network. They can just tell the security cameras
• 11:46
  to look the other way. Or they can operate entirely
• 11:49
  out in the open using legitimate tools. This
• 11:52
  is a tactic known as living off the land. Living
• 11:54
  off the land. What does that mean in this context?
• 11:57
  Well, IT departments back up. gigabytes of data
• 12:00
  every single day, right? They use standard file
• 12:02
  transfer software to move massive amounts of
• 12:04
  information to cloud servers for safekeeping.
• 12:07
  Sure, regular maintenance. If an attacker uses
• 12:09
  those exact same administrative tools to move
• 12:11
  the data out of the network, the security software
• 12:14
  doesn't trigger an alarm. Oh, wow. It looks at
• 12:17
  the activity and assumes it's just a routine
• 12:19
  Tuesday server backup performed by an authorized
• 12:22
  user. So the software isn't broken. It's just
• 12:25
  being tricked by stolen credentials into validating
• 12:27
  the robbery. Precisely. And the mechanism of
• 12:30
  ransomware dwell time makes this even more deceptive.
• 12:33
  Hackers don't just break in and immediately start
• 12:36
  encrypting things. Right. They hide. Yeah. They
• 12:38
  often sit silently in a network for days, weeks
• 12:41
  or even months. They spend that time mapping
• 12:44
  the network, finding the most valuable data and
• 12:47
  quietly exfiltrating it using those legitimate
• 12:49
  tools we just talked about. And all of that happens
• 12:52
  without triggering a single alarm. Nothing. Total
• 12:55
  silence. So when does the security software actually
• 12:58
  wake up and declare an attack is happening? At
• 13:00
  the very end of the attack sequence. Once the
• 13:03
  hackers have successfully copied all the data
• 13:05
  they want, they trigger the actual ransomware,
• 13:08
  the malicious payload that scrambles the company's
• 13:10
  files and throws a ransom note on the computer
• 13:13
  screens. Oh, I see. This encryption process is
• 13:16
  highly anomalous behavior. The security software
• 13:18
  finally recognizes the malware, springs into
• 13:21
  action, and blocks the encryption from completing.
• 13:24
  So the system generates a cheerful automated
• 13:26
  report saying, hey, success, we detected and
• 13:30
  stopped a ransomware attack. Yes. And the company
• 13:33
  looks at the log, breathes a sigh of relief,
• 13:36
  and writes a confident PR statement. While completely
• 13:39
  missing the fact that the encryption was just
• 13:41
  the noisy distraction at the end of the heist?
• 13:43
  Exactly. It stopped the encryption, but the silent
• 13:46
  data theft, the exfiltration, had already occurred
• 13:49
  days beforehand. That is wild. Relying purely
• 13:52
  on automated initial alerts to draft a definitive
• 13:55
  public denial is incredibly dangerous. It leads
• 13:59
  directly to the contradiction we see in this
• 14:01
  case. It fundamentally changes how a company
• 14:03
  should weigh contested claims. I mean, let's
• 14:05
  say you are a business owner managing a crisis
• 14:07
  response team. The hackers say they have your
• 14:10
  data, but your IT dashboard is completely green.
• 14:13
  You cannot artificially generate 2 ,700 valid
• 14:16
  Australian tax file numbers tied to real names
• 14:19
  just to run a bluff. No, you can't. The physical
• 14:21
  evidence of a 213 .3 gigabyte compressed file
• 14:25
  filled with verified letterhead stamped documents
• 14:28
  heavily outweighs the internal log report. Oh,
• 14:31
  absolutely. When evaluating leak site claims,
• 14:34
  security professionals look for proof of life.
• 14:37
  Proof of life. They need a sample of data that
• 14:39
  proves the attacker actually breached the core
• 14:41
  systems and didn't just scrape public websites.
• 14:44
  In this scenario, the attackers didn't just provide
• 14:47
  a small sample. They dumped the entire payload.
• 14:50
  Yeah, 200 plus gigs. A file of that magnitude
• 14:53
  containing deeply specific financial histories
• 14:56
  is impossible to fake. So the sensible, mature
• 15:00
  response requires active verification. If you
• 15:03
  find yourself in the middle of a suspected breach,
• 15:06
  the absolute wrong move is to issue a blanket
• 15:08
  denial based solely on automated alerts. It's
• 15:11
  the worst thing you can do. You have to look
• 15:13
  outward. When the hackers post a claim or a sample
• 15:15
  on the dark web, your incident response team
• 15:18
  must actively cross -reference those specific
• 15:20
  dark web samples with your own internal databases.
• 15:23
  You have to check if the files the hackers are
• 15:24
  holding match the files in your cabinet. If the
• 15:27
  threat actor posts... posted document titled
• 15:29
  Trust Account Statement April PDF, your forensic
• 15:32
  team needs to immediately search your network
• 15:34
  for that exact file structure and hash. If it
• 15:38
  matches, you know your perimeter was breached,
• 15:41
  regardless of what the green lights on your dashboard
• 15:43
  say. Which brings up a huge point about communication
• 15:45
  strategy. 3P Corporation told their clients early
• 15:49
  on that an attack was attempted, but no data
• 15:51
  was compromised. Yeah, they did. Imagine being
• 15:54
  one of those 4 ,500 business clients. You read
• 15:57
  that email, you breathe a sigh of relief, and
• 15:59
  you tell your own employees that everything is
• 16:02
  fine. And then reality hits. A month later, you
• 16:05
  read in the news that your wet signature and
• 16:07
  your employees' TFNs have been downloaded almost
• 16:10
  200 times by unknown actors. The betrayal of
• 16:14
  trust there is enormous. It's catastrophic for
• 16:17
  a business relationship. Transparent, ongoing
• 16:19
  communication with clients is far safer and ultimately
• 16:24
  better for long -term reputation than a premature
• 16:27
  all -clear. Right. You can't just cross your
• 16:29
  fingers. No. It is completely acceptable to tell
• 16:31
  clients, look, we detected an intrusion. We successfully
• 16:35
  stopped the encryption process, but we are currently
• 16:37
  conducting a deep forensic analysis to determine
• 16:40
  if any data was copied before we intervened.
• 16:42
  That sounds so much more professional. We advise
• 16:45
  you to remain vigilant while we confirm the facts.
• 16:48
  Yeah, that approach sets realistic expectations.
• 16:51
  It treats the client like a partner in the security
• 16:53
  process rather than, you know, a liability to
• 16:57
  be managed and minimized. It shows you actually
• 16:59
  understand the complexity of the threat landscape.
• 17:01
  And when a PR denial gets... debunked by journalists
• 17:04
  reviewing the actual leaked data days or weeks
• 17:07
  later the company doesn't just look like a victim
• 17:10
  of a sophisticated cyber attack anymore no they
• 17:12
  look terrible they look either grossly incompetent
• 17:15
  or actively deceptive recovering from that specific
• 17:18
  kind of reputational damage um The loss of trust
• 17:22
  from your core clientele is far harder than recovering
• 17:24
  from the initial technical hack. Because you
• 17:26
  cannot spin your way out of a mathematical reality.
• 17:29
  Once a 213 gigabyte archive containing 2 ,700
• 17:32
  tax file numbers and thousands of physical signatures
• 17:35
  is downloaded 196 times on the clear web, that
• 17:39
  digital footprint is permanent. Oh, it's out
• 17:41
  there forever. It is distributed across the globe,
• 17:44
  sitting on hard drives from Moscow to Miami.
• 17:46
  Data absolutely cannot be unleaked. And the permanence.
• 17:50
  of that leak raises fundamental questions about
• 17:53
  our regulatory frameworks and our corporate crisis
• 17:55
  playbooks. Yeah, they feel outdated. Because
• 17:58
  many of these playbooks were written a decade
• 17:59
  ago, designed for an era where a breach meant
• 18:02
  a lost laptop, not a silent exfiltration of an
• 18:06
  entire corporate aggregate. It really leaves
• 18:08
  us with a massive lingering question to ponder
• 18:11
  as we wrap up today's exploration. If our current
• 18:14
  data notification laws allow a company to confidently
• 18:17
  rely on flawed internal logs to deny a breach,
• 18:21
  a breach that has already been downloaded 200
• 18:24
  times by unknown actors, how can you, the listener,
• 18:27
  ever truly know your identity is safe? It's a
• 18:30
  scary thought. If the bank manager doesn't even
• 18:32
  know the vault is empty because the camera monitors
• 18:34
  were paused, the alarms are entirely useless.
• 18:37
  The security apparatus we rely on might just
• 18:39
  be offering the illusion of control. Something
• 18:41
  every business needs to think about. Before we
• 18:43
  go, if this story has you looking sideways at
• 18:46
  your own system logs, wondering what your blind
• 18:48
  spots are, or realizing your business might be
• 18:51
  an aggregate target, You need to take action
• 18:53
  before an incident occurs. We strongly encourage
• 18:56
  you to visit www .kinsoft .com .au to discuss
• 19:01
  your security and IT needs, ensuring your systems
• 19:03
  and response plans are tested, verified, and
• 19:06
  actually ready for the realities of modern cyber
• 19:08
  threats. Definitely check them out. Thank you
• 19:10
  for tuning in to Tech Talks with Kinsoft. We
• 19:12
  will be back soon to help you navigate the next
• 19:14
  complex story. Until then, keep an eye on the
• 19:17
  vault and don't just trust the green lights.
• 19:18
  Stay safe out there.