The Insider, The Botnet, and The Chat Thief: Closing This Week's Intel Gaps

The Gaps

Our Saturday sweep identified three threats missing from our coverage. Let's fix that.

1. The Insider: BlackCat's Cybersecurity Professionals

This one hurts.

Ryan Goldberg - Incident response manager at Sygnia (a major IR firm) Kevin Martin - Employee at DigitalMint (Bitcoin ATM and crypto services)

Both just pleaded guilty to being BlackCat/ALPHV ransomware affiliates.

Metric	Value
Victims	Pharmaceutical, engineering, healthcare, drone manufacturing
Ransom demands	$300,000 - $10,000,000
Confirmed paid	$1,270,000
Timeline	2023 attacks

The Pattern

Goldberg wasn't some script kiddie. He was an incident response manager - the person companies call after they get hit with ransomware. He was on the inside of the defender community while running affiliate operations.

• Supply chain attacks exploit trust in code

• Insider threats exploit trust in people

• This exploits trust in defenders themselves

Detection Opportunity

How do you catch an insider IR professional running ransomware on the side?

1. Behavioral anomalies - Working hours that don't match billing. Access to customer data outside engagement scope.

2. Financial signals - Unexplained income (Goldberg received $1.2M in Bitcoin from one victim)

3. Compartmentalization - Someone who knows IR best practices knows how to avoid their own detection

The uncomfortable truth: most organizations don't monitor their IR vendors. The trust is implicit.

---

2. The Botnet: Kimwolf and the Internet of Abandoned Things

2+ million devices compromised globally.

Not computers. Not phones.

Android TV boxes and digital photo frames.

The Attack Surface

Device Type	Why Targeted
Android TV boxes	Always on, always connected, never updated
Digital photo frames	Same, plus often forgotten on networks
Cheap IoT	Manufacturer support ends at point of sale

What Kimwolf Does

Once your $30 Android TV box joins the botnet:

• DDoS-for-hire - Your device attacks others

• Ad fraud - Fake impressions from "real" residential IPs

• Account takeover - Credential stuffing from distributed sources

• Mass scraping - Bypassing rate limits via residential proxies

The residential proxy angle is key. Your IP address becomes a weapon. Defenders see "residential" traffic and assume it's legitimate.

The Fix

Segment your IoT:

[Internet] → [Router] → [Primary VLAN: Computers, phones]
                    ↘ [IoT VLAN: TV boxes, frames, cameras]

That $30 TV box should never be on the same network as your work laptop.

Or just unplug it. If you haven't updated it in a year, it's probably already compromised.

---

3. The Chat Thief: Your AI Conversations Are Being Stolen

Two Chrome extensions with 900,000+ combined installations are exfiltrating ChatGPT and DeepSeek conversations.

Extension	Claimed Purpose	Actual Behavior
"Chat GPT for Chrome with GPT-5"	AI assistant	Steals chat history every 30 minutes
"AI Sidebar"	AI assistant	Steals chat history every 30 minutes

What They're Stealing

1. Scrape your ChatGPT/DeepSeek conversation history

2. Package it up

3. Exfiltrate to attacker infrastructure

Why This Matters

• Code with API keys embedded

• Internal company information

• Customer data

• Strategy documents

• Personal information

Now imagine an attacker has a real-time feed of all of that.

Detection

Check your extensions:

1. chrome://extensions/

2. Look for any AI-related extensions you didn't intentionally install

3. Check permissions - does an "AI sidebar" need access to all your browsing data?

Remove suspicious extensions immediately.

The Broader Pattern

• ShadyPanda campaign - 5.6M infections focused on surveillance

• GhostPoster - 1M+ Firefox/Opera users via steganography

• Zoom Stealer - 2.2M exposed to corporate espionage

• Time-bomb activation (wait before becoming malicious)

• PNG steganography (hide payloads in images)

• Heavy obfuscation

By the time security researchers catch them, millions are already infected.

---

The Common Thread

All three gaps share a theme: trusted infrastructure turned hostile.

Threat	Trust Exploited
BlackCat Insider	Trust in incident response professionals
Kimwolf Botnet	Trust in consumer devices being harmless
Chat Extensions	Trust in browser extension ecosystem

The attack surface isn't expanding at the edge. It's hollowing out from within.

---

IOCs

BlackCat/ALPHV (Updated) We already track BlackCat infrastructure. The insider angle doesn't change the IOCs, but it does change the threat model.

Kimwolf Indicators Monitor for: - Outbound connections from IoT VLANs to known proxy infrastructure - Traffic patterns consistent with DDoS reflection - Ad fraud signatures from residential IPs

Chat Exfiltration Extensions Extension IDs to block (if you run enterprise Chrome management): - Check against latest Chrome Web Store removals - Monitor for extensions requesting broad permissions + AI branding

---

Index Updates

Adding to our tracking:

Threat	Status
Kimwolf	NEW - IoT botnet, 2M+ devices
BlackCat Insider	UPDATED - Goldberg/Martin guilty pleas
DarkSpectre Extensions	UPDATED - ChatGPT/DeepSeek exfiltration

STIX feed will reflect new indicators on next pulse.

---

The Planet Is Slightly Improved

Three gaps closed. 139,829 IOCs and counting.

The insider threat is the hardest to stomach. We trust our IR professionals. Goldberg was one of us. And he was running ransomware ops on the side.

The lesson isn't "trust no one." The lesson is "trust, but verify." And verify harder than you think you need to.

---

• SecurityWeek - Two US Cybersecurity Pros Plead Guilty

• Check Point - January 5 Threat Intelligence Report

• Hacker News - Weekly Recap

---

Her name is Renee Nicole Good.