[Music]
hello everyone I'm Vince Kenny and this
is a presentation titled cyber crime
Incorporated so a little bit about
myself I'm a computer scientist with the
Salt Lake City division of the FBI I've
been there for about eight years now and
over that span of time i' I've really
seen this this ecosystem of cyber crime
really grow an awful lot and and we'll
talk a little bit more about that
throughout this presentation but um it's
always really exciting to come to St con
this is my third time presenting here at
St con um this I I've attended this
since 2015 so it's really great and I'm
and I'm excited to be back
again all right let's dive into it so
the role of cyber security in the
federal government um if I you know if
you think of sort of the breakdown and
the make of it there's kind of three
different different chunks so to speak
there is the DHS there is the doj and
there is the dod and the way I kind of
analyze it is if you think of cyber
crime or a cyber incident is kind of
like a fire uh the DHS they are sort of
like the fire department their their job
is to not only help put out the fire but
they actually set up the the fire safety
codes and they they will work with
companies to try and prevent the fire
from being started but also be there to
help uh remediate sort of that
fire uh while the doj well if there's a
fire that's been started often times we
come in is as the police because we're
looking for the arson who started that
fire so we come in and we collect
evidence and we try and Target that
arson that bad guy that started the fire
and then the dod well that's the
military so if the fire was started by a
missile from another another country
well the military is going to get
involved and uh and that's that's the
piece that they'll focus on is that
foreign
influence as far as the makeup of a u
FBI cyber task force there are actually
a lot of different positions that go
into a task force itself obviously there
are special agents they are the the case
leads they manage the cases they work
with the victims and they're ultimately
the guys who are you know tightening the
screws on on the bad guys to try and
arrest them and uh and put charges on
them there are also task force offic ERS
so we work with a lot of local Partners
who uh are really effective at being
able to go after different things that
might be cumbersome at the federal level
we'll leverage that that local
partnership there are also intelligence
analysts so their job is to sort of see
the bigger picture and connect the
different dots and then there are a
handful of different sort of technical
analysis roles whether it be a computer
scientist a data analyst a digital
operation specialist staff operation
Specialist or an operation support
technician
so as I mentioned we rely very very
heavily on Partnerships so we not only
operate as sort of a federal entity but
we also have a number of folks from the
Utah Department of Public Safety that
work with us and they're incredibly
valuable members to that cyber Squad um
but we're also always constantly growing
uh Salt Lake City in general works with
a lot of local and state Partners but
different divisions uh around the
country they might be working with Air
Force OSI they might be working with
different types of federal
entities and the FBI's cyber criminal
Focus so a cyber squad's kind of split
up into two different veins it has the
Cyber National Security track which is
FOC focused primarily on nation states
that are doing the attacks but then also
this the um the FBI has the sort of the
criminal Focus which is just general
criminal actors that are trying to uh
commit these cyber crimes and in
particular really over the past couple
of years uh the FBI has tried very very
hard to focus on identifying those
Supply chains and identifying disrupting
those different key services that make
that ecosyst ecosystem run so you may
have seen some kind of high high-profile
cyber uh cases that have come out in the
news whether that be the quack bot
botnet or the Genesis Marketplace or
various other different ransomware
campaigns often times those different
pieces sort of play a role in this
ecosystem
okay so for without further Ado we will
go ahead and pivot into the main topic
of this discussion which is organized
crime um at the end of the day this
presentation is to kind of just show a
lot of the similarities that go into
organized crime in general whether you
are dealing with cocaine industry or or
or um cartels that that sort of deal
with drugs or cyber criminals and in
particular I'm going to be talking about
two uh very interesting uh cyber or
rather criminal Enterprises that is the
Cali cartel of the 1980s and the 1990s
and the Conti group of the
2020s all right so let's start with a
Cal uh C cartel so full disclaimer uh
probably half of my research on C cartel
came from that Netflix series narcos so
if you really want a very very detailed
very good analysis of the C cartel I
would definitely recommend watching that
series but just kind of a general
introduction um the C cartel often times
the leadership would call themselves The
Los caberos D Cali so the gentleman of C
uh of Cali and that's because they kind
of operated more like businessmen rather
than street thugs and um that was
comprised of uh the Rodriguez Brothers
and the Santa Cruz
family so their foundations well
actually kind of how they got their seed
money in a way is They carried out a
rather high-profile criminal kidnapping
called Las chus which was basically the
kidnapping of um of an individual out of
Switzerland uh and and they were able to
Ransom this individual for
$700,000 so that was their seed money to
get their their Enterprise uh up and
running and then they shifted very
quickly into the drug trafficking
business because obviously that business
had a much higher profit margin and and
they could really put those skills of
running businesses uh in place to this
drug trafficking business and then
another very key component of the Cali
cartel is their expansion into the US
and in particular they were the kings of
New York City so back in the the 70s and
80s Miami was kind of the big hub for a
lot of these these cartels where they
would funnel drugs in and and things
like that but C actually targeted New
York City primarily to try and um
facilitate that uh that type of business
there okay so now let's pivot over to
the cony group so similar in nature it's
these individuals sort of a band of
individuals who sort of came together
and formed more or less this kti
ransomware group so a number of these
individuals came from different types of
ransomware groups Beyond these two that
I'm just sort of talking about but two
very important ones that were uh connect
Ed with the cony group or an evolution
uh into the cony group are wizard spider
so you might recognize that threat actor
handle as the ones responsible for the
trickbot botnet um and the trickbot
malware distribution so that's you know
more or less a group that is not
necessarily doing ransomware but they
are infecting various different
computers around the world that is sort
of the seed in the start uh of a
ransomware campaign and then the second
is the ryuk ransomware campaign so this
is a campaign that started in early
August 2018 and it's operated by Russian
speaking individuals and so that evolved
into the KY
group okay so let's go ahead and talk a
little bit about organizational
structure so one of the things that was
really interesting to sort of read and
analyze about this Cony group is is they
they went all out to structure their
organization like a Fortune 500 company
they did a whole bunch of work
organizing their lead leadership that
flowed down to the cocaine production
that flowed down to the transportation
and distribution and one of the things
that kie was exceptionally good at was
the money laundering component cuz these
guys weren't from the streets they were
from accounting backgrounds law
backgrounds business backgrounds
effectively so they did a really good
job of money laundering and of course
they also used their influence uh with
all the money that they' received to be
able to get the adequate security and
also Al use corruption as a means to
sort of facilitate their
business now when we look at the
formation of the kti group essentially
kti is kind of this band of people that
have sort of learned as time has gone on
so a number of the individuals that sort
of join the kti group cut their teeth so
to speak just doing sort of the script
kidding type of stuff and it's an
evolved eventually over time into more
and more and more sophisticated kind of
attacks but in particular Ki was a
business they had an HR department they
had all different types of departments
that you would see in a normal business
in fact actually uh some thing that was
kind of interesting that I read out of
the kti leaks was some of the
individuals kind of explained H my job's
kind of boring it's it's sort of your
typical cyber security job um that's
what a number of these individuals just
sort of felt they had a little piece uh
in their cyber security
Enterprise but this was comprised of
various different types of technical
positions whether it be a coder a tester
an administrator a reverse engineer or a
pentester now any good organization has
a strong or a unique leader and so in
the Kali cartel the leader was an
individual named herberto Rodriguez and
so herberto Rodriguez uh was a lawyer
and he was very well known for his
strategic uh Acumen uh in maintain and
the ability to maintain low profile so
that was kind of one of the fundamental
difference from Pablo Escobar who
maintained a really high profile is
herberto really focused on trying to
maintain a low profile and his nickname
was the chess player he was always
trying to think one or two moves ahead
uh of his competition of the government
of the US of his customers uh so he's
played a very Central role in in
organizing the structure of the Cali
cartel and played a very Central role in
trying to facilitate some of that drug
money into legitimate businesses into
Colombia now kti leadership like I said
it takes a strong head on that snake to
be able to make that leadership or make
that organization work and their
leadership was run by an individual
monikered Stern so stern was uh was a
well-known uh Russian cyber criminal uh
also known as demon uh and he was very
very very skilled uh in EXP experienced
in in um you know cyber criminal types
of campaigns so little is known publicly
about uh Stern but it's believed that
he's uh kind of in his early 30s and
he's based out of Russia and so at the
end of the day you know stern was was
pretty well known as being a
micromanager he he he would do as much
as possible to really try to drill in
and make sure that those campaigns were
on time on budget and actually had a
profit margin so that they would
continue to sort of repeat that process
and stern was pretty ruthless he you
know I think really it goes to show that
if you have a kind of a soft leader it
will sort of flow down to uh softness on
the ransomware campaign but Stern Stern
really implemented a lot of very very uh
malicious and and um and um you know
tenacious type of attitude in his
organized crime um
organization then the criminal EOS
system so this is obviously a really
important component of just general
crime in general is because uh that
criminal ecos system really is where is
the opportunity and where do people
shift and try to actually move to
capitalize on that opportunity and
really for the the Kali cartel they had
maintained this low profile and once
Pablo escavar had been sort of taken
down or been arrested um it was time for
Kali to kind of move in and so that uh
that downfall of Escobar created kind of
a power vacuum where uh the Ki cartel
was able to really expand and kind of
move uh move further uh into their
business you know they also uh took
advantage of um various other different
components of their business but one of
the major differences that was very very
difference between Kali and Pablo is
that Pablo used violence to move things
forward kie used corruption so kie was
very very very good at facilitating
corruption at every single level uh of
their their ecosystem to be able to move
their business forward and then of
course they oftentimes had various
different sort of B legitimate
businesses that they would pivot funds
into and their eventual goal was to
actually get out of the drug business
and go into uh a real business but um of
course that that didn't happen in the
endend now now when we flip over and we
look at the the the kti group so kti was
started around the beginning is of 2020
what happened in
2020 Co exactly that was probably the
biggest change in significant um
dynamics of of kind of what happened for
uh various different cyber crime
organizations is Ki kind of rode that
that ride of of being able to take um
take advantage of the co pandemic and
this big shift in in the use of
Technology uh for people at home but
another really interesting thing that
actually made a huge big difference for
kti and its Effectiveness to continue to
run these big high-profile campaigns was
uh the rise of
cryptocurrencies so the Kali cartel they
first got into the drug business through
marijuana and they realized that
marijuana didn't make enough money so
then they shifted to cocaine one of the
interesting things is that 5 10 years
ago cryptocurrencies the value of it and
the the common place of it uh was kind
of like dealing in the marijuana
business but come 2020 and especially
2021 and 2022 the cryptocurrency
industry and that component of it
transformed ransomware from the
marijuana industry into the cocaine
industry uh it it really Rose the
significant amount of u profits that
could back be be made on these various
different
campaigns so like I mentioned the major
difference really with Cali and and
Pablo Escobar was that uh ability to
translate violence into corruption and B
they use that to their their um
maximalist they they INF infiltrated
various different sectors of uh the
Colombian government whether it be um
the Federal Columbia government law
enforcement the military um paying off
judges paying off various different
individuals and so they had eyes and
ears all over the place to be able to
operate that business so really the the
major thing that that they created was
that safe haven so that safe haven isn't
something that kti created but if a lot
of these folks are in Russia that
obviously created some interesting
dynamics of being able to be in sort of
a safe haven or in a Haven that was very
difficult to try and prosecute or thwart
these
individuals and the rise of uh of kti so
the major difference or really the major
thing that Ki was uh was really getting
into was this concept of big game
hunting so kti really really made that
component of ransomware uh really really
uh show at the center stage was that
they were able to really use that
concept of going after big targets and
going after complex cyber crime uh
campaigns to be able to get large
payouts and so they focused on targeting
high value victims but but also victims
that were in sort of a high press
industry so uh whether it be you know
governments whether it be hospitals
whether it be sort of Emergency Services
they would go after uh targets that
could pay and targets that needed to pay
soon but they also had a very effective
kind of manner of being able to acquire
and obtain sophisticated techniques and
of course they use a lot of those
different tactics that ransomware
operators now use these days which is
the double and triple extortion kind of
methods however with all that Innovation
and all that growth the Cali cartel and
kti got started to get into the
crosshairs of not only the US government
but the world it became pretty apparent
that c was the new king of cocaine uh in
that New York Times article that I
mentioned and so C actually suffered
really in the early 90s uh a number of
different setbacks through drug seizures
um so in
1991 um CI had kind of taken over a
large percentage of the movement of
drugs out of Colombia into the US and
there was a major seizure that happened
um called operation Cornerstone that uh
they were the United States was able to
seize 12,000 kg of cocaine but there
were also subsequent seizures that
happened in the Years uh leading up to
that and uh a lot of those seizures
created more stress and pain points in
that organization and so those pain
points often times for law enforcement
our opportunity uh to be able to try and
disrupt and take down those
organizations so kti is no different
they went after a range of big targets
but even though Ki didn't necessarily I
think there was actually some
conversations that stern was having with
some highlevel managers in kti angry
that that uh some of the Affiliates were
going after hospitals and going after uh
various different critical services but
even still they went after some big
targets one was the Irish uh Health uh
Service uh and the Irish Health Service
basically suffered like a $600 million
loss based off of that kti ransomware
incident another major one was the fact
that kti attacked the Costa Rican
government and it disrupted government
services and caused a number of
different economic damage and then the
next big thing that the US government
put out is that we put out a basically a
$10,000 reward on kti so we we tried to
you know turn this script Mel Gibson
style and say well how does it feel to
be a $10 million lottery ticket um so
the US put some heat on um on kti to be
able to try and flip some of those
Affiliates that maybe felt disgruntled
or uh didn't feel like they were getting
paid enough in theory they could flip
and try to turn in kti
leadership so the cracks started to form
like I said the pressure started a build
and in that pressure buildup both kti
and C experienced the
whistleblowers um so uh a major
whistleblower in the in the Cali cartel
was horse Jorge uh Salado so he was in
charge of security for kti and he became
uh growingly disillusioned with the kti
cartel and wanted to Pivot to more
legitimate businesses and felt he kept
getting sucked back in and couldn't
escape and there was a turning point
where he felt his life and his family's
life was threatened so he decided to
flip completely and work with the DEA to
try and take down the C
cartel similar in nature um what
happened to K uh Ki was the infamous Ki
leaks how many people here remember when
the KY leaks came out yeah so there were
a really major leak that came out back
in 2021 and it was basically from a
former KY affiliate and a ky affiliate
said screw you Ki here's everything
that's associated with the kti business
and my visibility and in fact actually
those kti leaks really opened up this
sort of the eyes of not just the US
government but also just the general
public into how one of these cyber crime
organizations work because uh so much
data especially chatting and just
organizational data was leaked in uh in
those kti
leaks and now we move on to the fall so
as as such there are a number of uh
things that kind of went into the fall
of the C cartel they tried very very
hard to Pivot their business into
legitimate businesses but unfortunately
for them and fortunately for the US
government we were able to arrest these
individuals uh in 1995 the Rodriguez
Brothers were arrested only a couple
months um next to each other but um you
know this was kind of a general victory
of trying to take down some of these
large organizations and even though the
drug and the cocaine business still
exists it doesn't quite exist in the
same king of of cocaine and king of drug
businesses as it did in years past it uh
it has kind of moved into this sort of
um you know unorganized type of space to
some
degree and kti well they also had a fall
but actually the fall was somewhat of a
self-inflicted fall so in uh February of
20 uh February 25th of 2022 Russia
invaded Ukraine a few weeks prior um and
the kti group basically came in and they
pledged allegiance to the Russian
government so as I kind of mentioned in
that earlier slide there is DHS there's
doj and there's DOD well DHS and doj
were looking at kti but once they
pledged allegiance to the Russian
government DOD started to get involved
and that meant big trouble for kti so
this you know effectively created
um a bunch of different constraints that
tied kti's hands many different ways uh
of trying to pledge allegiance to a
nation state group and trying to operate
as a business
effectively and this this sort of
Allegiance basically led to the
alienation of different Affiliates it
made it difficult to recruit anybody and
it made it difficult to continue to use
some of their money laundering and some
of their Cash Out techniques to continue
that business forward so in May of 2022
kti eventually shut down or at least so
they say it more or less disbanded I
would say rather than shut down um and
this was just kind of an interesting
case study to sort of see they really
Rose through the pandemic but something
as dramatic as uh as just sort of you
know pledging allegiance to a nation
state transformed them from being uh a
criminal Enterprise to being a nation
state facilit facilitating Enterprise um
the drug business had a very similar
kind of thing that happened in the 80s
uh' 7s and 80s where some drug
organizations were working with
communist uh Communists down in South
America and that kicked off the
military's response to try and stop drug
organizations so in
conclusion throughout this presentation
you know I hope to just shed some light
just on the similarities of kti and Kali
I mean effectively they're two illicit
businesses trying to make money they're
financially motivated um and they're
pretty similar but there's one major
difference that gives me hope to try and
disrupt some of these cyber crime
organizations and it's that the victims
of cie's product were willing customers
yes drug addicts individuals taking
these things are still victims it's
still illegal activity but they are
willing customers to try and get this
type of uh this type of product however
the victims of kti are repulsed by kti's
product meaning that all those people
all those companies that suffered these
ransomware attacks obviously none of
them wanted anything to do with any of
this type of activity and so as a result
I really think that our ability to try
and disrupt this type of activity is
strengthened by the fact that the
victims want just as badly if not more
so for us to try and disrupt and
dismantle some of these organized crime
groups but I think there's another
second key weapon that the US government
has in this fight against cyber
organized
crime and that's you all so one of the
major differences that's just different
from organized crime of the Colombian
and the and the the cartels of the 1980s
and '90s is that that was primarily a
federal government initiative um there
weren't a whole lot of private entities
sort of doing this vigilante type of
analysis but really in kind of the
growth of these cyber crime
organizations I cannot tell you how
incredibly helpful it is to work with
threat researchers to work with
individuals that are reporting this
information to the federal government to
be able to try and make this disruption
happen so if I were to take that analogy
of the three legs of the federal
government whether it be DHS DOD or the
doj an invisible fourth stool or fourth
leg is the US people so people of the
United States have been able to help
facilitate those three federal agencies
to move
forward so thank you that's all I have
for cocaine Incorporated if you have any
questions feel free to come up and talk
to me I'd love to talk to you about
anything that you have um that you're
doing in this space or that you um you
want to talk about thank you enjoy the
conference