Interviewing The Leader behind one of the Most Secretive Cybercrime Teams

Key Takeaways

Who are you and what do you do? >> Okay. Uh, so my name is Alex Kosawe and I'm the chief security strategist for Bit Defender. >> What does that mean? [gasps and sighs] >> It's a madeup title. I really don't know [laughter] myself. Yeah. So, um, it is a title that suggests that I do some sort of strategic stuff. uh in reality I'm involved in many many projects uh R&D development um also going at events speaking to people networking um uh business opportunities so a little bit of everything. >> So a little bit of everything I think my audience will be fascinated by is by something to do with cyber crime. Can you tell me a bit about what that is? >> Cyber crime? Well, I think it's something that we've been involved since the beginning of our company, which is like uh 24 years ago. And uh we actually have a special project within P Defender related to cyber crime. Uh in terms of back in uh 2015 uh we created a team called Draco team and this is a specialized team that works close to law enforcement and it's helping out with their investigations. Uh it usually uh it goes both ways in terms of sometimes law enforcement reaches out to us to ask for assistance or sometimes the uh the team is doing their own investigations on a particular topic that's interesting to them and they figure out that okay we reach this point we can't really go further uh with the details. uh for instance, they identify a uh C2 server, a command and control server. They know what it is. They know what it does, but they can't actually access it as a private company, right? So, they go to law enforcement. They say, "Look, we have this investigation. Would you be interested? Do you have a case on this particular threat actor?" And if the law enforcer has a case or it's willing to work with it, yes, there's a a joint investigation that starts up. They bring the they seize the server. uh sometimes they provide it to us uh to do the forensic analysis. Sometimes they do their own and there's some uh data to be shared and that's how the the investigation progresses and it goes further and further until uh it ends in a miraculous way. Uh usually it ends up in in three possible ways. There's a disruption that happens. Disruption means you can't really arrest anyone because they let's say they live in unfriendly countries. So you can't really touch them, right? >> Uh so then you do the the disruption which means taking down the infrastructure, seizing uh maybe seizing some of the funds if there's money involved. >> Or the third option is that there's not really much you can do about it and the criminal is already on the run. So yeah. >> Wow. Now that sounds like an insane team. Um can you tell me who's on the team? >> No. [laughter] >> Uh obviously the people that are within this team, they are spread within the company and in different countries. First of all, it's not a team that works uh in the same office. Uh it's actually uh people that are uh spread with in different other teams. And this Draco team is actually a virtual team. So it doesn't have a management. There's no project managers deciding what's going to happen. Now it's people uh that have a that share a common interest to to combat cyber crime and everybody is doing their own thing working on a different uh project. Uh and also uh since they work from different teams they all have different skill sets but if you put them together they cover the entire ecosystem. >> It's like the Avengers. >> Uh it's like the Avengers without the enthusiasm. [laughter] >> I'm sure they're excited. >> No, they are excited. What I mean is that when when this team was created, everybody was seeing themselves not as the Avengers, but let's say the James Bond of the internets and uh you know in James Bond there's like you know in one hour and a half there's a lot of thing going on. Well, when it comes to investigations things are slow especially when you work with law enforcement uh they're they work slower but not because they want to it's because they have to follow the law. So they have to have the right paperwork. They have to send uh subpoenas. They have to send international cooperation letters and so on. And obviously uh this is very challenging because they have to abide the law but criminals don't need to do that. So they switch identities at countries within minutes while on the investigation side this takes months. >> So it's being frustrating but it's admirable because the temptation is probably there. like they they have the skill set to just let's just do it. >> We call it the emotional roller coaster. [laughter] >> I like that. Now, how can someone join the Draco team? Are there tryyouts? What's the situation there? I know my audience hears that and they go, "That sounds badass. How do we join?" >> Yeah. Well, first of all, you need to work for Bit Defender. That'll be that'll be the first uh No, I mean there are other companies out there which have similar teams. So where it's not like we invented u the hot water or anything. So each company has some sort of team uh that's working with law enforcement. Uh they have their own uh cool names. Ours is Draco. Uh but yeah, so you need to work for Bit Defender and second you need to want to do this and then you reach out to uh one of the members. Uh we know we know ourselves within Bit Defender just outside of the Bit Defender. um uh the people that are within the team don't want to disclose their identity like hey that guy is a Draco team because you know you don't want to tell everybody that you're an investigator right um yeah so once you talk to one of the members uh there's going to be like a a meeting or a discussion and then it's up to you like what you want to do if you want to do uh malware analysis sure there's plenty of malware that's involved in through law enforcement investig igations that you can look at. Uh cryptocurrency investigations, sure, there's a lot of crypto you can look at, no problem. Botn nets, forensics, anything. There's there's plenty of stuff to do on the table. So, that's not a problem. And not only like I said, it starts in two ways. Either uh law enforcement will reach out for a case or you can do your own thing and then reach out to them if required. It doesn't mean it you have to involve law enforcement. Uh there's plenty of investigations that are fully developed only by V Defender employees by the Draco team and then published. >> Wow. >> Wow. Okay. So, are there any any investigations that stand out that you're allowed to talk about that you can tell like walk us through? >> Yeah, there's there's a couple that are um public so to speak. Um I think the team was involved in two uh ransomware investigations called so one of them was Gandrab. I know the name doesn't ring a bell. Uh and this is a case from back to 2017 so quite a while ago. But back then this particular ransomware had a let's call a 50% market share. So one in two victims of ransomware had this particular uh strain of ransomware. Yeah. And uh it it was a very interesting uh very interesting investigation. It it took about two and a half years and um uh throughout this time frame there were like five decryption tools that were released because every time the there was a decryption tool that was released to the public uh they actually modify the malware. So now you will not be able to to decrypt the new version. But then we released a new one. So and so on. And after five different um decryption tools, they just closed their business because what happened was uh this was a um ransomware as a service model, which means that there was a core group that was building the infrastructure that was coding the malware and improving the malware. Um and then you had uh the the affiliates which are the people that are actually carrying out the infections that are doing uh the the find finding the victims and encrypting the data and they split the money like uh 30% goes to the core group the developers 70% goes to the affiliates. So if I want to do ransomware tomorrow for instance, I would pick one of the ransomware families out there. Uh depending on which one I think it's cooler or whatever and then I'll um I'll reach out to them there. You can contact them and say, "Hey, I want to join this this thing of yours." And if they agree, sometimes they have to test you that you're not an undercover police officer or anything. And then they give you access to to their infrastructure. So you can take them all, go infect somebody, uh that person will pay and you receive back the 70% of the money. Well, what happened in the Gantra case was that every time we released a decryption tool, the victims were able to decrypt all their files for free, which means all the affiliates worked for nothing. And after five times what happened was that we severely uh destroyed the trust between the affiliates and the developers which means the affiliates moved away to work with other groups and the administrators had no people to work with them. So they just said we're closing shop. So that what happened >> that's so when you were doing the investigation or when you were um >> it wasn't me, it was a team. [laughter] >> Yeah. I'm using a general term. Uh when you when the team was doing this uh were they aware that the they were frustrating this this ransomware group >> uh the ransomware group was actually very vocal they were even giving uh interviews in the media. They had a Twitter account and they were cursing B defender quite often. So I'm guessing yeah they were aware that they're provoking some uh some frustration back there. >> That's just encouragement, right? >> Yeah. Yeah. Yeah. [laughter] So to speak. So to speak. Yeah. >> Now you said uh involvement with law enforcement. Which law enforcement? >> Uh I hear I think uh the team works with any law enforcement in friendly countries. So we're looking in Europe at all European countries and we're also working with um um law enforcement in in the United States. So when you do an investigation when the when when a consortium does an investigation meant by consortium mean the countries that are involved in the case uh and you also have the private partners that help with the data. When you have a consortium usually a country participates in investigation if they have either victims in their country, if they have suspects in their country or if they have infrastructure, criminal infrastructure in their countries. So that's why they put everything together on the table. They meet and discuss about the topic. So when all these countries discuss, they have the bigger view of what's going on. If there's only one or two countries investigating h but you have things outside of this, you don't have the clear picture, right? So obviously the whole point is to work together with them and also Europole is providing a lot of support by uh facilitating discussions between the countries uh organizing meetings and so on. So that's they they also have a huge involvement in this in this case and uh us as private partners but like I said it's not just B defender there's others as well that are are coming to help. We're offering technical assistance on the on the cases. I think everybody is imagining that we have an involvement on the suspects as well. No, we do not because uh it wouldn't be legal for us to involve into finding real persons that are actually doing the investigation. So, what we do, we do our technical stuff. We go and present what we have. But when there's discussions about suspects or things like that, we step out of the room. We don't have access to that information. >> So, would you say that the Drago team has a pretty good pulse on the cyber criminal uh world? >> Uh yeah, I would say so, but don't get me wrong, there's a lot of other types of crimes that are cyber crime that it's very hard for the Draco team to investigate. U we can look at, for instance, the uh business email compromise. Uh this means that one of the um key members within an organization um his email is uh breached right uh the uh let's say hacker has access to the communications between that person and other organizations other companies and at some point uh when this person this let's say the CEO or CFO wants to do a purchase they'll just interfere within the communication and send uh an invoice but with a different account. So, he's going to send the money to the attacker instead of the legit company. This is hard for for for us to investigate. >> I mean, it's easy to look at, okay, this is what happened if you do some some forisings, but talking to the banks and all that kind of stuff. It's nothing that we we cannot do. >> Ah, see, so you don't you guys don't have like a uh the Draco team doesn't have like access to or contacts at banks or financial institutions. I I imagine them like, "Hey, I I'm calling JP Morgan. We got their their hacking team on the on the phone. Can they do that or is that a >> uh We can try, but no bank will give us that information." [laughter] >> It makes sense. It makes sense. So, cyber criminals, what is the current state of that right now? What can you kind of tell me like what they're about? What's the the scale and scope of how they operate right now? Oh, there's so many types of cyber criminals. It's hard to to give a scale. I can give you some some examples though. So, in terms of um cyber crime targeting organizations, I think top two threats that we look at here are business compromise obviously and ransomware. And in terms of ransomware, here is something that we can we can do something about it. uh in terms of um uh targeting individuals. Uh here we're looking at um these sort of scams that are promoted to social media and then you are lured either in investment fraud or in romance scams and so on. So basically they trick you into giving them money either directly like you're investing or uh in some cases you actually they convince you to give them access to your own phone or computer or to your banking system and that's how you they they they get all the money and this is super hard to investigate because you have entire call centers that this is what they do from morning till night. They call people and they uh lure them. They teach them. Okay, so I'm going to teach you how to make millions and fix figure this out. So you start small like as an investor. You you send them some money and then they send you the profit. You're like, "Oh, it's real. I send $100 and now I have 200." And maybe you do it again and then they convince you, "How about putting 10 grand?" And that disappears. So if you stop early, you're actually stealing from the criminal. >> So you just do it one time. >> Yeah. Yeah. No, no, no, no, no, no. We're not suggesting that. No, no, no, no, no. [laughter] >> So when I know like most people when they hear cyber criminal, they're picturing some CD looking dude in a basement, hacker mask on, hacking away, and >> and hood >> and and a hood, of course. [laughter] >> What's the [snorts] actual profile on a cyber criminal? What what would you say that looks like? And and are are these like companies who just run cyber criminal operations or are they individuals? >> Yeah, the call centers these are actually organized very well organized. They hire people, they train them if they don't have the the knowhow. Uh I heard uh there was even cases where um they were performing uh test with a lie detector. So they make sure that they're not uh hiring a undercover police officer. So they did the if they pass the lie detector test then yes they could actually work for them. Uh but this is like the the organized crime but you also have like just individuals. Uh there's no age in particular. So it's a wide it's a wide range. Uh female male doesn't matter. We've seen both sides doing this either in groups or individually. Uh I don't know. No, I don't think there's a specific characteristic besides the fact that they decided the these are these are smart people, right? Besides the fact that they decided to stay on the dark side, they could easily put their skill set on the good side. Work for cyber security company, work for police, work for uh I don't know, sock centers. There's plenty of stuff on the job market if you have the skill set. But they decided to make money faster uh by not playing fair. But on the other hand, you can imagine that these guys uh sleep not that good at night. They always believe that maybe somebody will bust their door and so on. >> I would hope they're worried. Yeah, the Draco team's out there. [laughter] >> The Avengers. Uh but we've seen there was um a recent arrest in Russia uh a couple of months ago and they were filming uh the his house and he had like a few one Ferrari, one Lamborghini, a helicopter. [laughter] Yeah. The the video is in on YouTube so you can you can find it. >> Oh wow. So the business is good on that side. >> Yes. especially [clears throat] on on ransomware. These guys are making hundreds of millions of dollars because uh defender did a statistic a while back and uh according to that statistic 50% of the victims of ransomware pay but that's only what they said. If you talk to law enforcement which also looks at u the actual databases of people who paid it's actually 70%. >> Oh my goodness. So, in terms of combating cyber crime, do you feel like you're um you're you're a force that's keeping them at bay or are they just kind of overwhelming? Like you can't even like put a a dent in it. >> I think putting a dent in it, it's the fair. I mean, we're not definitely not stopping it. We're definitely not derailing it, but putting a dent, yeah, I would I would say that's the fair. Now, um, regarding your role at the Defender because you you um you handle strategic operations, which again still is a madeup title. Y >> um >> what what is your day-to-day like? What are you most excited about your your everyday life? >> Uh I can tell you that uh rarely my days are similar. >> So there's a lot of stuff uh there a lot of stuff going on. There's so besides the um the various meetings that you have to to to have and to understand what's going on where the company's going uh to from a technological point of view. Now we also have this all this conversation around AI and um we have machine learning and artificial intelligence within our products or in the back end since 2004. So but the nobody really cared like two years ago right now the AI marketing term. >> Yeah. Yeah. Yeah. So there's a lot of uh fuss around this topic and you see a lot of companies that are trying to cut corners and embedding AI within their their offerings like um tech support and things like that. Um so obviously we also are looking like okay we know this topic we know this field how can we uh work with it so that we can automate even more what we have cuz in the cyber criminality world um they are they can easily integrate new technologies they can now use AI to generate uh better written fishing scams they can improve code u what AI brought to the table uh for the criminals was that it completely eliminated the gap between a junior developer and a senior developer. So they can actually move faster. They can write better code. So we obviously have to do the same thing on this side. So and then you have uh victims calling say I need help. I need forensics. Uh I need this and that. So there's a lot of stuff going on. So, uh, when I was talking about gan crab, the reason we actually got involved in that case was because the criminal did a huge mistake. They infected the computer of the girlfriend of one of our most talented penetration testers. >> Huge [laughter] mistake. So, and that's why we started working on the case. Um, because yeah, there was like a personal event data. Exactly. Exactly. And um we also noticed that um law enforcement had also uh there were obviously victims all around the world. So they said like hey if you can help with the technical stuff please jump in. We started one on the case and that turned out after two years that to be a successful investigation and uh there was with all these decryptors uh we managed to save around $100,000 which wasn't much because GAN crab uh had a very interesting model in terms of they were working with all the affiliates. It didn't really matter. They didn't do any sort of selection. Um and also the the so they were targeting individuals and companies and also whenever they infected the machine the price they were asking was directly coordinated with the uh amount of interesting files on the drive and there was a default $600. So if the machine was like fresh Windows installation nothing interesting there $600. But if you had like the computer's name was a database or they found PDFs or Excel files that were interesting, the money was getting upper and upper. >> That's funny. The idea fascinating >> and uh so we we we put the dent in this group. They they disappeared. They said like uh they actually publicly stated that they made enough money so they'll um move to something else and and then they disappeared. The next case that was interesting to look into was another ransomware group called Revel or also known as Sudinoi. And the reason we started looking at this one so to speak why how do we choose? The reason we started to look at this one is because it was sharing 50% of the code with GAN prep. So basically they rebranded. They didn't go anywhere, right? And um this was another investigation that took about two years. So it finalized in 2019 something like that and uh we were also able in this case to have another decryption tool and this time this decryption tool stopped $1 billion from being paid to the criminals. >> That's amazing. This is something that the Draco team developed. Yes. Yes. >> That's incredible. A massive achievement. >> Exactly. Yeah. I think there's ads on the internet saying we saved a billion dollars. [laughter] >> That's good marketing. >> Yeah. Other other investigations are uh when we look at dark markets for instance because you were asking like do we lurk on the dark web? Yes, we have automated crawlers. So not really a person doing that and there's um >> how do you do that? Because the dark web isn't crawable by like traditional web crawling methods. >> Uh it's not as easy but it is crawable. It is searchable uh if you know where to look. [laughter] Uh it it pretty much depends what you're looking for. Uh there's a lot of uh the dark websites, the onion sites so to speak that wish to remain anonymous. But if you look at dark markets, these need to be public. You cannot trade on a market if you don't know about the market. So they will advertise these markets. It's actually quite easy to find them. And then you're going to have your forums where people talk about, I don't know, uh, hacking of other topics. And there sometimes they suggest, hey, I went on this other website and I found this and that. Oh, okay. I'll crawl that too from now on. There are plenty of companies out there that sell darknet intelligence because that's what they do. They crawl, they index, so then you can search, okay, where do I find stolen credit cards or passwords and all that kind of stuff. But in the case of the markets, like I said, they advertise themselves because they need to be aware. The administrators of the markets, which are basically the people that build the entire website, um they will do this advertising for them because they make a commission out of it. It's usually around two or 3%. And uh one of the um investigations that uh the team was involved was in Hansa market. And this is like 5 years ago, so it's not really recent, but that was very a very cool investigation because Hanza market was number three in terms of the top markets. Yeah, we had uh there was Alpha Bay number one, uh Dream Market number two, and three was Hanza. And the investigation is quite cool because um the uh FBI was investigating Alpha Bay and the Dutch police was investigating Hanza and uh Alpha Bay was charging 2% commission. Uh Dream was uh asking for 4% and Hanza was asking for 3% for 2%. So when the FBI started talking with the uh Dutch authorities, they made a plan and um their bet was that um the Dutch authorities actually had access within the server of the server of the Hanza Bay of the uh Hanza market. So what happened was not to do the operation at the same time. What they did was to first uh they closed Alpha Bay and they started monitoring everything that happens on Hanza and all the vendors and all the buyers migrated to Hanza and not to Dream because Dream was more expensive and then they take it took it down and they performed house searches, house visits and so on. >> Oh, that's fascinating. Oh my goodness. Now, uh getting back to the AI conversation real quick. Um, are you are you worried about the state of AI and hacking? Because you're right, every junior [clears throat] can suddenly be a very skilled hacker overnight and they know how to prompt it correctly. >> It's not just hacking, it's also writing better code. So if you're doing uh any type of malware, whether it's a file infectctor, whether it's a you're targeting IoT and so on. So it's hacking, it's development, if you're doing all these sort of scams there. I think you've seen all these uh videos of important people talking saying you should invest in this and and it's deep fake right it's not it's not real so it's uh it's a I would worry I would worry uh from a business or a consumer perspective that these are getting better and better into impersonating into creating uh more uh harder to detect or to interpret and so on and Look at all the people uh look at all the I don't want to be judged but look at all the people that let's say seniors do not really have uh experience with the internet and from my point of view we're already broken the internet. I mean imagine somebody 70 years old that wants now they have time and they want to browse the internet. You open your laptop you punch in a page or you just Google for it and then what do you do? You have to accept all the cookies. Then you have to say no. Uh I don't want to be uh notified whenever you publish something new. And then you have to publish to close all the ads that pop up here and there and movies and so on. It's pretty annoying for somebody that wants to know how to make zucchini in the oven. They're just looking for a recipe, but they have to look at all these ads, these movies, these cookies. What What's are the cookies, right? >> Yeah. And and on top of that, you blink AI and you do all these elaborate scams. It's a nightmare. This is not going anywhere good. No, it's so elaborate and crazy. Now, I I do hear a theory that um AI like the good AI chat good is going to remove the um the internet as we know it to like being where we simply interact with agents and the internet won't be websites. It'll be simple databases and markdowns and API endpoints for AI just to interact with. >> I think it's already happening. Uh when you Google something now, you already have a summary written by AI. This is what you're looking for. And then sure, you have the websites below. Uh and I think yes, the your prediction is pretty much on the spot, especially because it's so annoying right now to visit particular websites that are going to try to sell something to you. So yes, I would I would think that's that's correct.