The Insider, The Botnet, and The Chat Thief: Closing This Week's Intel Gaps

The Gaps

Our Saturday sweep identified three threats missing from our coverage. Let's fix that.

1. The Insider: BlackCat's Cybersecurity Professionals

This one hurts.

Ryan Goldberg - Incident response manager at Sygnia (a major IR firm)
Kevin Martin - Employee at DigitalMint (Bitcoin ATM and crypto services)

Both just pleaded guilty to being BlackCat/ALPHV ransomware affiliates.

The Pattern

Goldberg wasn't some script kiddie. He was an incident response manager - the person companies call after they get hit with ransomware. He was on the inside of the defender community while running affiliate operations.

• Supply chain attacks exploit trust in code
• Insider threats exploit trust in people
• This exploits trust in defenders themselves

Detection Opportunity

How do you catch an insider IR professional running ransomware on the side?

1. Behavioral anomalies - Working hours that don't match billing. Access to customer data outside engagement scope.
2. Financial signals - Unexplained income (Goldberg received $1.2M in Bitcoin from one victim)
3. Compartmentalization - Someone who knows IR best practices knows how to avoid their own detection

The uncomfortable truth: most organizations don't monitor their IR vendors. The trust is implicit.

---

2. The Botnet: Kimwolf and the Internet of Abandoned Things

2+ million devices compromised globally.

Not computers. Not phones.

Android TV boxes and digital photo frames.

The Attack Surface

What Kimwolf Does

Once your $30 Android TV box joins the botnet:

• DDoS-for-hire - Your device attacks others
• Ad fraud - Fake impressions from "real" residential IPs
• Account takeover - Credential stuffing from distributed sources
• Mass scraping - Bypassing rate limits via residential proxies

The residential proxy angle is key. Your IP address becomes a weapon. Defenders see "residential" traffic and assume it's legitimate.

The Fix

Segment your IoT:

[Internet] → [Router] → [Primary VLAN: Computers, phones]
                    ↘ [IoT VLAN: TV boxes, frames, cameras]

That $30 TV box should never be on the same network as your work laptop.

Or just unplug it. If you haven't updated it in a year, it's probably already compromised.

---

3. The Chat Thief: Your AI Conversations Are Being Stolen

Two Chrome extensions with 900,000+ combined installations are exfiltrating ChatGPT and DeepSeek conversations.

What They're Stealing

1. Scrape your ChatGPT/DeepSeek conversation history
2. Package it up
3. Exfiltrate to attacker infrastructure

Why This Matters

• Code with API keys embedded
• Internal company information
• Customer data
• Strategy documents
• Personal information

Now imagine an attacker has a real-time feed of all of that.

Detection

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

Check your extensions:

1. chrome://extensions/
2. Look for any AI-related extensions you didn't intentionally install
3. Check permissions - does an "AI sidebar" need access to all your browsing data?

Remove suspicious extensions immediately.

The Broader Pattern

• ShadyPanda campaign - 5.6M infections focused on surveillance
• GhostPoster - 1M+ Firefox/Opera users via steganography
• Zoom Stealer - 2.2M exposed to corporate espionage

• Time-bomb activation (wait before becoming malicious)
• PNG steganography (hide payloads in images)
• Heavy obfuscation

By the time security researchers catch them, millions are already infected.

---

The Common Thread

All three gaps share a theme: trusted infrastructure turned hostile.

The attack surface isn't expanding at the edge. It's hollowing out from within.

---

IOCs

BlackCat/ALPHV (Updated)
We already track BlackCat infrastructure. The insider angle doesn't change the IOCs, but it does change the threat model.

Kimwolf Indicators
Monitor for:
- Outbound connections from IoT VLANs to known proxy infrastructure
- Traffic patterns consistent with DDoS reflection
- Ad fraud signatures from residential IPs

Chat Exfiltration Extensions
Extension IDs to block (if you run enterprise Chrome management):
- Check against latest Chrome Web Store removals
- Monitor for extensions requesting broad permissions + AI branding

---

Index Updates

Adding to our tracking:

STIX feed will reflect new indicators on next pulse.

---

The Planet Is Slightly Improved

Three gaps closed. 139,829 IOCs and counting.

The insider threat is the hardest to stomach. We trust our IR professionals. Goldberg was one of us. And he was running ransomware ops on the side.

The lesson isn't "trust no one." The lesson is "trust, but verify." And verify harder than you think you need to.

---

• SecurityWeek - Two US Cybersecurity Pros Plead Guilty
• Check Point - January 5 Threat Intelligence Report
• Hacker News - Weekly Recap

---

Her name is Renee Nicole Good.

---

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=the-insider-the-botnet-and-the-chat-thief-closing-this-week-s-intel-gaps