Is Your Ransomware Negotiator Working With Hackers?

About this Episode

Welcome back to the Scinary Information Nexus! This week, Richard, Joseph, Hunter, and Mario kick things off by suffering through "The Trojan Horse", a cocktail spiked with ghost pepper tincture, before jumping straight into two wild cybersecurity stories breaking across the industry.

First up, Joseph breaks down a fresh attack chain uncovered in the Scinary SOC: cybercriminals are buying Google ads that funnel users searching for ChatGPT directly to malicious custom GPT models hosted right on OpenAI. Once there, the custom model fakes an error message and redirects victims to a ClickFix CAPTCHA lure, tricking them into pasting malicious PowerShell commands that sideload dangerous DLLs.

Next, the crew digs into the explosive news surrounding ransomware negotiators cutting covert deals with cybercrime syndicates like ShinyHunters. We break down the arrest of Edward Dubrovsky, allegations against MonsterCloud, and the twisted financial incentives that plague the incident response and cyber insurance racket. Finally, we take a quick detour to France, where script kiddies weaponized an old 2021 controller vulnerability to spoil industrial refrigerators.

In this episode, we discuss:

• How Google search ads are steering users toward malicious custom GPT models on OpenAI.
• The ClickFix trap: Why you should never paste terminal commands from a fake CAPTCHA.
• DLL sideloading and how attackers abuse signed applications for exfiltration.
• The arrest of ransomware negotiator Edward Dubrovsky and ties to ShinyHunters.
• "Ransomware drop-shipping" and why some firms secretly buy decryptors at a markup.
• Why Scinary offers incident response without billable-hour conflicts of interest.
• How an unpatched 2021 OT vulnerability spoiled refrigerated food in France.

Have you seen ClickFix lures pop up in your organization, or did the ransomware negotiator scandal catch you off guard? Let us know in the comments below!

---

Connect with Us:
https://www.scinary.com
https://x.com/scinarycyber
https://www.linkedin.com/company/scinarycyber/

00:00 Intro
05:45 Weaponized Custom GPTs & ClickFix
28:45 Corrupt Ransomware Negotiators & ShinyHunters
49:25 Hacked French Refrigerators: OT Vulnerabilities

Cybersecurity #InfoSec #Ransomware #Malware