Good morning everyone. Thanks a lot for tuning in to this morning's short morning refresher webinar on threat intelligence from noise to action. I'm Johannes and I'm joined here by Julius. Great to be here. We're looking very much forward to spending the next approximately half hour together with you guys talking through some of the recent things that are going on out there related to AI and how threat actors are using AI and what we can learn from it. Quick introduction to both of us. I am Johannes. I work at the CyberTech Service in the Tech Collective. I'm one of my principal advisors. Work across a lot of our different clients with advice on how you can use threat intelligence or have a data driven threat led approach to how you actually prioritize and implement security. initiatives initiatives in your organizations. I also lead our advanced persistent threat group. We have around 10 people that are very, very skilled hackers and operators and work with how we can actively integrate threat intelligence into how we run adversary testing for our clients. I'm joined here today by Julius. Yep. Great to be here. Thanks for inviting me. And thanks everyone for joining this Tuesday morning. My name is Julius. I work as a solutions engineer at Recorded Future. For those of you who aren't familiar with Recorded Future, we are the world's largest threat intelligence provider. What we do is essentially collect and what we do is essentially collect and scrape data from every corner of the internet, open source, dark web, technical telemetry to identify cyber risks and geopolitical risks for our clients. And my role as a solution engineer is to work very closely with all of our customers across the Nordics, helping them expand how intelligence can enable their security operations and security functions to become more threat led and threat driven with a lot of the work that Johannes and his team is doing. Been in the company for going on eight years now, based in Stockholm. So great to be here. Looking forward to this. And I guess the introductions to both of us would make a lot more sense when we dig into the weeds quite shortly. So let's just get started. Yep. We have an ambitious agenda for today. We're going to try to cover some of the recent events we've all seen in the papers. We're going to talk a little bit about how we become better at actually using those to learn from, how they can help us inform what we prioritize, what we do and how we do it. Then we're going to move a little bit into what we're actually seeing in the threat intelligence space. What are we seeing threat actors do? How are they using these new technologies to their advantage? What can we learn from that? How can we track it? And then a little bit into what can we actually do different already next week if we decide to do so while we are waiting for AI technologies to really give us that upper hand we really need as defenders. Yeah. And one thing to just add to this as well. There is an open chat. So if at any point you have questions, we will try to cover them towards the end unless there's something very pressing that we can cover as we're going through the slides as well. But just a general sort of mention of that, that if you do have any questions, feel free to put them in and we'll try to keep an eye on them as we go through this as well. Exactly. Great. I guess we've all seen the news recently. We've all seen the very catastrophic headlines on some of the ways that the big frontier model houses are testing and developing their AI models to become more and more powerful, to become more and more experimental and very, very stubborn. Most recently we've seen how the big frontier model houses have, their testing has actually gone wrong. And we are seeing some very catastrophic sensationalist ways that the media is describing this. Just I've brought a few of them here just to give you a sense of the language that is being used. Like an article here says like the models went rogue. AI is developing a culture of its own. They gathered in groups and called it a collective. They even named some of the agents in there. It's a compelling narrative and I kind of understand why the journalists are using it. But it also adds more weight to what I think we as analysts and as security professionals can actually stand in for. So our job as security professionals is to separate facts from fiction. To see how we can understand what actually happened. What we can learn from it and what we can do about it. And I just want to stress I'm not saying that these narratives does not make sense. But I also want to stress that the framing can lead to different conclusions and different activities. For that reason it's super important that we all try to take it slowly and try to actually dissect what we can actually learn from these events. We'll dig into that in the next slide. Cool. This is a little bit of a convoluted slide. But it also shows how messy it is when a swarm of agents or a swarm of processes actually spin out of control and run in different directions. This is a little bit of a convoluted slide. That's the first thing I want to mention before we dig into it. I am not going to go through the full slide. I'm going to focus on some of the key takeaways that we as security professionals can actually take from this. Cool. The timeline is built based on the reporting and information sharing from OpenAI. The perpetrator in this case. The hogging phase. The victim in this instance. And then also Meter and Redwood. An independent company that was hired to investigate the incident. None of these, and I want to stress that initially, gives me as a security professional the information I need to go out and do something differently. There is still some work to be done in terms of actually deciphering and deconstructing and learning from the incidents in a practical and sensible manner. That's important because that is something that is lacking from what we have in terms of information today. That's also the reason why this timeline is reconstructed with a medium confidence. The first thing I want to stress besides that is that there is no attacker. As a cyber threat intelligence analyst, I have been trained to work with building threat actor profiles, threat clusters, understanding what threat actors do, why they do it, how they do it. There's no threat actors here. There's a bunch of agents and processes that was given an impossible task, unlimited amount of resources, and a very, very wide playing field to play in. And that was the formula for disaster. So, the first thing is to take away from this one is putting agent identities and behaviors in front of not only the teams that need them to perform and adopt agentic ways of working, but also in front of the security and the governance teams that can help you build in a governance and a security profile around it. The second key takeaway from this instance is not related to Hocking Face. It's more related to OpenAI. OpenAI thought that they had built a test bench around their agents that could separate the agents, allow them to work isolated in trying to solve a very difficult problem, and not reach the internet. They were allowed to fetch resources that could allow them to solve their problems better, but they were not supposed to go outside of their sandbox and onto the internet. Both of these things failed. The agents were able to break out of their isolation environment. They were later on able to find a creative way to reach the internet. They were able to find a way to learn how to work with agents and your agent take adoption or in general work with your security architecture. Isolation and security boundaries are assumptions until you test them. This is the really important takeaway from this. You have to assume that things break. You have to test them constantly. If not, it is just a fancy line on a diagram. Third thing is actually also related to OpenAI and how they responded. Interesting takeaway from this incident was that the agents actually broke the systems at OpenAI. And they actually would have been able to catch it if they had looked and if they had actually tried to understand what actually went wrong. So, spending time investigating root causes when you restart systems or restart workflows, ensuring that they work as intended, that you have visibility into what they do, how they work, could actually have also limited the impact of this incident. And then the final thing I want to mention about this incident and what we can take away from that is more related to Hodling Face. It's related to a lot of what we do as professionals with our clients. We build threat profiles. We help our clients understand what type of threat actors would go for you, why would they go for you, and how would they do it based on the data and what we're seeing. Hodling Face was not the victim of OpenAI. OpenAI was not a threat actor towards Hodling Face. The agents just thought that they could use Hodling Face to solve their problems. So, that means that we all will begin to inherit a lot bigger threat profile. Our attack versus surface will expand because we suddenly have to think about that we can become intermediate targets to other things that work in a non-deterministic way. We can't really understand by just looking at threat actors that have intentions to target us. So, the main takeaway here is that the OpenAI incident towards Hodling Face was a security and a governance failure. It was not a capability breakthrough. We see the same mistakes happen at our clients and in the conversations we have every day. The difference here is that agentic agents with unlimited resources, if they come from the right places, actually have the abilities to find those mistakes or inconsistencies in our infrastructure much faster and use them much faster. So, I guess we all will now say like what does this imply to us? Should we care about the frontier models? And none of us are running test benches with unlimited resources to just test how strong our models are and how complex problems they can solve. So, just a very quick one on this one is that we will all start adopting agentic ways of working using agents in our infrastructure, using models that have more or less guardrails tied to them. And we need to learn from the incidents and from the security intrusions we are actually seeing. Because a lot of it comes down to basics. It's just being applied in a different new security domain where we use new technologies, we use models, we don't really understand how it works, and we use new type of infrastructure and applications together with them. So, it's still the basics of proper access controls, having your infrastructure in place, knowing that your isolation works, knowing that your security boundaries work, knowing that you have governance and accountability tied to your agentic workflows and identities they run on, and knowing that you actually look at them. So, while we are not frontier model houses, we can still learn from this to ensure that we stay accountable, keep adopting a risk-based approach for how we start employing AI in our work. Having said that, I think it's time to turn to you Julius about some of the ways that threat actors are using AI. Yep. No, absolutely. And I think there is so much to take away from what Johannes was kind of reconstructing there with the AI models, with the hugging face incident. Yeah, I mean, it's difficult enough for organizations today, it seems like, to monitor their own identities, the employees, especially working remotely, working in the office. Like, how do we start to approach that question when we have millions of agents operating in similar fashions and trying to approach the same type of questions about privileges and isolation? With that too, which I think we could spend an entirely different webinar going through as well. But I think before I jump directly into the data of what we're seeing when it comes to what threat actors are doing with AI today, I think it's important to take a step back because if we go through what Johannes talked about from the beginning, a lot of the reporting that we're seeing in the media and when we were talking to friends and family, it's very easy to assume that every AI-enabled attack, if we can call the hugging face that to some extent as well, is the same. Because they're all basically reaching the same types of headlines in the media. But this is fundamentally not true. It is very different concepts to using AI to write a phishing email to send to someone than it is to do the full on hugging face incident that the open AI agents did. And so that's why we at Recorded Future created this concept or this framework known as the AI M3, which is the AI malware maturity model, which is essentially a way of trying to separate and understand genuine AI-driven threats from more of the marketing hype that we see. So when we think about the different levels that exist at the bottom, we have experimenting and adopting. This is your kind of classic testing out AI to maybe run a hypothesis on it or test some idea that you have. Or adopting, which is more using generative AI to create phishing emails to be used in some fraudulent campaign that you're trying to run. And then we have the higher tier AI-enabled attacks, transforming and scaling, which is again, the open AI and hugging face incident is a kind of standalone in the top tier of that scaling approach, which is essentially defined as having agents running where there is no human in the loop, which is what we saw with the hugging face incident, essentially agents working together to be able to solve problems and get through the network to be able to answer the question and the task that was given. However, what we're seeing is that despite all this, this is of course kind of a standalone or unique incident amongst all of the AI-enabled attacks that we've seen. And the reporting that the INSEC group has done from the report earlier this year, which I would highly recommend others to read, it's available on our website, about the malware and vulnerability trends from the first half of this year, is that we did see most of the AI-enabled malware activity aligning with the lower tier of one to three in this. And I think as much that happens with AI these days, this is kind of a hockey stick analogy where just because we have one today doesn't mean we'll have the next one in three years. It tends to go very quickly in that aspect. But it's very important to track these types of AI-enabled attacks in this way because it gives us a way of actually understanding these and understanding more of how we should approach it when it comes to defending ourselves against this. But if we then go on to the next slide, what I want to take some time to look at here today is that there is actually very few organizations today who are able to pull off an attack that the agents at OpenAI were able to do. Johannes mentioned it as well, but it's just the amount of resources that are required to be able to host these types of agents. The models, the top tier frontier models that you need, the resources, the infrastructure to be able to pull this off. It really sits with a single handful of organizations globally who can do this. The problem is though that we typically see the capabilities of these frontier models generally being available to the rest of the world within about three to six months after that. So this isn't to say that this isn't going to happen. It will likely, these types of capabilities will likely reach the general public pretty soon. And if history tells us anything, it's normally within the next few months. And so whilst we're not seeing these fully autonomous, no-human-in-the-loop type of attacks happening today at scale, it doesn't mean that we won't very soon. And this is the kind of main takeaway here that we have a very short window to adapt to this. And we need to ensure that we're taking it as seriously as we can. But AI nonetheless is making threat actors considerably more efficient in a lot of the work that they do. We talk a lot about this at Recorded Future by the lowering of the barrier of entry when it comes to conducting attacks. Less capable actors are now able to conduct more sophisticated attacks. And so the way that we used to think about capability and motive for understanding threat actors, the concept of do those with the capability actually have the motive? And do those with the motive actually have the capability? That doesn't maybe ring as true today because you can actually, a very non-capable actor is able to launch a considerably more capable attack today because of the tools that are available out there. And we talked a lot about OpenAI and that incident, but Anthropic as well, one of these frontier models, actually released a report the other week that looks at some of the data that they have, which is incredibly fascinating to look at because they, of course, have access and visibility into the terminal, which is essentially being able to track a lot of these threat actors on the keyboards, if you could call them that, or the agents on the keyboards when they look at what they're doing. And one of the examples that they talked about was from the threat actor called Shiny Hunters, which is this collective of actors, users who have pulled off some really big attacks against enormous organizations, typically involved with data exfiltration and extortion in that sense. And they showed in their data that one of the people involved in the Shiny Hunters, a guy from France, a French user, actually downloaded or used AI to download millions of APKs from the Android store so their app store. And essentially, in those, reverse engineered those apps to identify API keys and other sensitive things that they could use for further attacks in the future. And this isn't sort of an autonomous attack that's happening, but what it's doing is it's something that was fundamentally impossible for a human to do previously and now enables them to be able to pull off considerably more attacks as a result of being able to use these tools in the way that they're doing it. And we're seeing ransomware actors do this as well. The concept of double extortion in ransomware where we're able to conduct an attack, they exfiltrate all the data, but then threat actors and ransomware actors used to sit on just terabytes of documents that they had to understand before being able to extort a company. And now AI has basically given them the ability to be able to very quickly sift through terabytes of documents, millions of documents that they've exfiltrated to find the most sensitive documents immediately, to be able to use those for much more successful negotiations. And that takes me to point three, which is actually really that most organizations and most threat actors that we're seeing today, there isn't really the incentive to fundamentally change how they're conducting their attacks. Because what they're doing is so financially valuable for them that they're able to continue working with the same types of tools, same types of TTPs. Why use autonomous agents if you can just access someone's credentials or identities that's available on the dark web? The same thing goes for exploiting vulnerabilities that haven't been patched for 10 years, which is how we're continuing to see a lot of these ransomware actors conducting their attacks. But AI is making them work clearly more efficiently. But right now there just isn't the ROI or the return on investment for them to fundamentally change how they're conducting their attacks, because what they're doing today really works. And that's why, to Johannes' point previously, it is a lot of the same security controls that we need to have in place, because whilst everything is going to start moving way faster, it's not fundamentally altering how these exploits are continuing to happen. And so where does this actually take us and where are we going with this? Because what all of this does is it just ensures that everything is moving a lot faster. And this kind of defensive timelines that we typically used to have, have compressed significantly to the point that we have to start almost rethinking how an analyst should approach their work going forward here. So with that, just a couple of, if we go to the final slide here. As a working at Recorded Future, intelligence and threat intelligence is at the core of everything that we do. And what this fundamental change in speed has done is that it's actually started to invert the intelligence workflow. If we think back to kind of how we imagine an intelligence analyst to operate, the way that you've been in the space for very long and others as well, and it's like you used to want to be able to receive intelligence, you would consume it, you would read it, you would analyze it, you would assess it, you would figure out what was the most important side of the parts of this, and then you would decide and act on that data. There is, we don't have the time to do that anymore in the same sense, because of how quickly these types of attacks are starting to happen, and the defensive timelines are compressing. As intelligence analysts, we're not able to use or to work with data in the same way that we did previously. And so what we're starting to see and how we approach this as well at Recorded Future is really that we have to start relying on the data or the intelligence that we receive. We don't have time to kind of review it and assess it in the same way anymore. And what this is approaching in the way that we talk about it internally at our company is about this machine grade intelligence. So how do we ensure that the agents and the AI that we're putting into work to be able to work at the same speed as the defenders is actually trained on the same, the best type of data that enables your machines to be able to act on the data and the intelligence that they receive without needing humans to intervene or be in a loop. And so we could potentially have lived in a scenario where good enough intelligence or good enough data was a thing when we had time to review, assess, add our own analysis on top of it. But in today's world where we're seeing these attacks happen and the defensive timelines compressed to the extent that they are, we need to approach having machine grade intelligence at the foundation of how we approach enabling autonomous defensive measures internally as well. I agree. And just, I just want to make a quick recap of what you said before. You praised Entropic for the big report where they go into depth with how threat actors are using it. They ran it from January to August. It's a 150 page PDF document with almost no tangible things that you can take and use tomorrow, right? So despite the fact of information being really relevant and interesting, it is exactly the opposite of this. Yeah. Yeah. Yeah. So having said that, and as a backdrop, what can we actually start doing already now to harness some of the AI also as defenders? If AI adoption is working really well, we've just seen it with OpenAI and the others, the models are trained on a vast amount of offensive training data. The defensive side is still catching up, but there are things we can already do now. You can start using and feeding your security agents with what Julius just said. Good data sources that points at what capabilities does adversaries have. What exposure do we have? And then test that at machine speed. So basically there's a room where we can start doing more of the things we're seeing the threat actors do today. There is no capability gap here. There's nothing that withholds us from start doing the same things as the threat actors are doing. So running agentic testing setups on the infrastructure you care about, either in testing, primary testing or external attack surface, for example. Having agents look at your attack surface, identify weak spots, test different ways of exploiting them is actually something that you can adapt today with a not significant amount of resources needed. So that in the first instance, while the defensive side is still catching up on the blue team, you can start pushing your red teams to adopt agentic AI as well, to ensure that you are testing your security boundaries and your assumptions continuously and at machine speed as well. As Julius mentioned, adversarial intent will mean less and less because we're going to allow these capabilities and they're going to float into the hands of more and more people. So focusing on capability and opportunity and feeding that into your testing work is where you're going to get the bang for your buck. That is where you will get bigger return on investment on your security work. And just to add to that, and I think this is where that kind of good enough versus the best type of intelligence comes into play, because you can have all these processes in place, you can put, you can test, you can test the kind of capabilities and opportunities that you're seeing from reports, as we mentioned, that maybe came out a few months ago that were done on a very small subset of information. But are you ensuring that you're actually going to be testing the capabilities or the opportunities from adversaries that are the correct ones for your organization to focus on? And that's where it's the capability to be able to ensure that you're consuming the threat intelligence that actually provides you with the visibility and the data that you need that's been trained against your organization becomes critical in this. Because if you're doing this at machine speed, but you're doing it on the wrong data, then you're just failing a lot faster. And so how do we, bearing this in mind, and when you work with organizations like the Tech Collective or others, make sure that you're asking them the right questions about how are they prioritizing, how are they identifying the types of TTPs and things to test against, to ensure that you guys are actually testing your controls against the correct intelligence out there. Yeah. Yeah. But basically, the technology is there. We might as well use it to our advantage as defenders, as security professionals, to test how we're able to detect, respond and recover from these types of attacks. I think that's the most important takeaway for this. Absolutely. Yeah, no, we ran over three minutes. I think that's very good to be able to squeeze in. I'm sure both you and I could have stood here to talk for another half an hour if we could have. We would have loved to. There was tons of ground to cover in very little time. You could have expand on all of it. There's a question as to whether you can see this again later. This will be recorded and put on a website so everybody can access it. We are also available for follow up conversations if someone finds this interesting, if you want to dig into different parts of the process at a later stage. But we will send out follow on emails with more information on where you can find it. Yep. No, appreciate everybody joining and sticking around as long as you did. And again, as Johannes mentioned, if there are any questions, you can always reach out to us. Otherwise, we will follow up accordingly after this. Yeah. Thanks everyone. Thanks a lot. Bye.