DISCARDED: Tales From the Threat Research Trenches
DISCARDED: Tales from the Threat Research Trenches is a podcast for security practitioners, intelligence analysts, and threat hunters looking to learn more about the threat behaviors and attack patterns. Each episode you’ll hear real world insights from our researchers about the latest trends in malware, threat actors, TTPs, and more.
Welcome to DISCARDED
DISCARDED: Tales From the Threat Research Trenches
Half-Click is so Hot Right Now: How Russian and Chinese Attackers Exploit Mailservers
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Hello to all our cyber stars!
Host Selena Larson is joined by co-host Sarah Sabotka, along with returning guest Greg Lesnewich, Principal Threat Research Engineer, and Staff Threat Researcher Mark Kelly, for a follow-up to last episode's half-click deep dive — this time tracking how the technique is spreading beyond TA458 and TA488 into a brand-new Chinese cluster.
Greg picks up where last week left off with TA488 (aka Void Blizzard, aka Laundry Bear): after going quiet in February following exposure, the group resurfaced on July 22 — one day before Proofpoint's joint advisory with the NSA — with a new half-click exploit against Microsoft Outlook Web Access. The payload, a previously unseen browser-resident implant called OWAReaper, is built for persistence: it survives credential rotation, browser restarts, and even a full device reimage, and it phones home via GitHub commit messages and image requests proxied through legitimate CDNs like Slack and WordPress.
Mark then brings a new actor into the half-click conversation: UNK_MassTraction, a suspected China-aligned cluster exploiting a cross-site scripting flaw in Roundcube to target physics and engineering departments at North American universities — chosen, it turns out, specifically because they were running vulnerable Roundcube instances. The infection chain drops either a webshell or VShell, a Linux backdoor of murky, possibly commercially-developed origin that keeps popping up across Chinese state-sponsored intrusions.
The conversation covers:
- How OWAReaper's persistence differs from anything Greg's seen before — including "poisoning" a user's other emails to reinfect the browser on every new tab
- Why Greg's assessment of TA488 shifted from "less capable than TA458" to "neck and neck" after seeing this campaign
- How Mark and Greg discovered UNK_MassTraction independently, within hours of each other
- Why UNK_MassTraction's targets were all running vulnerable Roundcube — evidence of deliberate reconnaissance, not spray-and-pray
- IceCube, the Roundcube stealer with telltale signs of LLM-assisted development
- Why mail servers are functionally edge devices, and what that means for defenders who can't run EDR on them
- Whether AI is accelerating adversary tradecraft on both the Russian and Chinese sides
- The ethics of publishing offensive research on a live, evolving technique
- The funniest (and most unsettling) lure email of the year: "Hi fellow, I really liked your vibe..."
Plus: Gus the dog's podcast debut, security awareness training in a world where opening an email can be enough, and shoutouts to Tom Lancaster (Volexity) and Microsoft's patch team.
Resources Mentioned:
Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit
TA488 Targets Zimbra Mailservers with Half-Click Exploits
One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation
For more information about Proofpoint, check out our website.
Subscribe & Follow:
Stay ahead of emerging threats, and subscribe! Happy hunting!
You're listening to Discarded: Tales from the Threat Research Trenches, a podcast by Proof Point for security practitioners. Each episode, you'll hear from security researchers, malware analysts, threat hunters, and more as we dive into what's going on in the world of cyber attacks and how defenders safeguard us from threats. Let's get into the show.
SPEAKER_03I knew that was gonna happen. I saw him get up and I was like, damn it.
SPEAKER_02All right, Gus just wanted to make an appearance in the podcast. We're gonna we're gonna keep him in the intro. That's fine. Gus just wants to say hi because he has a lot of opinions on CVEs, I think. And maybe he could come back and tell us why CVEs are so hot right now. But before Sarah's dog Gus joins us on the podcast, we have two very special guests here today. Principal threat research engineer Greg Lesniwich is making a reappearance to explain to everybody the perils of analytical rigor. And we are also joined by staff threat researcher Mark Kelly, our amazing, wonderful vampiric espionage colleague here to also talk about the perils of intelligence analysis. Hey guys, welcome to the podcast.
SPEAKER_05Thank you for having us. Thanks, guys. Good to be here. I'm here to help you gang up on Greg.
SPEAKER_02Oh, yes. Amazing. That's the best job. That's the best part of our jobs here at Proof Point is cyberbullying Greg. Sarah, how are you today?
SPEAKER_03I'm good. It's a little warm, warm here. So I'm happy to be in a group of cool kids.
SPEAKER_02Well, we're off to a great start, everybody. Uh oh, I forgot. I forgot to say it again. Hello to all our cyber pals. All right. In this episode, if you tuned in to our last episode on half-click exploits, talking about two threat actors, TA458 and TA488, this is part two, where we learn more about how actually TA488 is the biggest baddie on the block following publication of Proof Point's latest research and some hot, fresh Outlook exploits. But Mark is also here because we talked a lot about Russian threat actors using half-click exploits, but we didn't talk very much about them throughout the landscape, including by Chinese associated espionage threat actors. So we are going to dive into all of that today. And I know we covered this before, but for any of our listeners who missed the last episode, Greg or Mark, let's start off with the concept before we get to into the activity of what exactly is a quote half-click exploit. And is it a shift from what defenders have been actually trained to watch out for?
SPEAKER_04I can take that. Yeah, this is definitely a shift both in what defenders have been tasked to look for as well as what we teach users to look out for. Historical kind of security awareness training tells you to assess if you know the sender, and then if you're suspicious at all about that, or the link or the attachment to not engage with any of those things. Where half-click exploits come in is that they are cross-site scripting exploits against the webmail provider. So in your browser pane, uh, where the HTML of the email will get rendered, a threat actor will write a bypass for that HTML sanitization, and JavaScript will execute. So all you have to do is open the email to get this JavaScript execution and get infected. And this is both really difficult to recover forensically if you're doing DFIR or uh hunting in sort of an EDR level, and it's really difficult for like a user to spot that something is malicious because uh these emails just kind of pass over and don't like or are tend to be relatively unremarkable, but all you have to do is open it. We call them half-click because in the sort of in the iPhone exploit space, there's a concept called zero click that a threat actor can send like an iMessage to a user that the user never sees, but it will silently pop the iPhone. This requires not that it's not that like elite to be like deliberate about it. It's not that sort of surreptitious in that like the user does have to see that an email came in and they have to open it, but they don't have to interact with any of the attacker content. The folks at NCSC in the U in the UK called it zero click. We use the term half click because we wanted to differentiate it from something that was completely silent in terms of visibility to the user, but also towed the line of them doing any sort of responding to any social engineering the actor did. So yeah, we just had to do it to be to be different and and put another fancy term out there that we could claim was our own.
SPEAKER_02Yeah, what's that X KCD comic about frameworks except uh hacking terms?
SPEAKER_04We had 15 hacking terms. Now we have 16 hacking terms.
SPEAKER_03So historically, organizations have thought about email as a delivery mechanism for malware, like initial access to complete other objectives. But these campaigns seem to treat the email platform itself as the attack surface. Mark, would you say we're seeing a broader shift toward adversaries targeting webmail infrastructure as a primary access factor? And if so, why? Why do you think that is?
SPEAKER_05Yeah, I think we have definitely seen quite a number of clusters doing this type of targeting. So TA488 and the group uh Greg spoke about last week as well, uh TA458, um, have been kind of two of the primary clusters that have been doing this, but it's not necessarily like a brand new thing over the past few months. TA458 in particular has been around for for kind of quite a few years now doing this type of activity. So for them, it's not it's not like a novel new concept. But in terms of the the number of new clusters that are popping up within our visibility doing that, that is pretty interesting for us. And and and an interesting aspect here too is that it's like a something you have to really actively look for, and and some, which is what Greg has been going really hard at for the last while, because it's not something that will just land on your lap or just surface within kind of standard triaging of um our hunting and and so on, because it's so different to malware delivery, typical malware delivery, to credential fishing activity and so on. It just is very, very different from and a lot of the hunting mechanisms you use for those types of threats just do not apply here at all. So going back to the previous question around the actual lures themselves are often not very kind of suspicious. They just are generic things that if you were to just look at the email, you're like, okay, this is weird, but I don't see anything. There's no attachments, there's no URLs. So it's it's it's something you can very easily gloss over unless you're inspecting the actual email body itself and looking for a suspicious kind of JavaScript within there. So that is, I think, a pretty important factor here is like it's something you really have to actively look for. But ultimately, yeah, it's something threat actors have been doing for a while. So I spoke about TA458, but even going back to the Barracuda exploitation um a couple of years back, and that one was a I think a true kind of zero-click one. I don't think the the target even had to had to open that one. So uh a little bit again more stealthy than than the half-click ones, but still kind of similar concept of exploiting these types of uh webmail providers by uh cross-site scripting type vulnerabilities. So yeah, something that's been been around for a while, but seems to be escalating.
SPEAKER_01And was that Barracuda one? That was I think you mentioned it was a couple of years ago. Was that also China? That was China, right?
SPEAKER_05That was China, yes. And there were there were they had two zero days, I believe. So there was one kind of discovered around mid-2023, and then there was another big one like towards the end of that year. It's pretty similar types of of vulnerabilities. Um but yeah, again, that was China.
SPEAKER_02So, Mark, are are you gonna have a fight with Greg over which is really the originator of the half-click session zero day exploits in web servers and why China is actually better than Russia?
SPEAKER_05I don't know. I think I have to give it to Russia. They just have been they've been doing it at a bigger scale for longer, I think, or at least they've been they've been going at it for for on a more consistent basis.
SPEAKER_02Okay, back to hacking though. So, Greg, you guys published a new TA488 campaign that you actually found on July 22nd, just one day before our proof point joint advisory with the NSA on the TA458 and TA488 activity with those exploits dropped. I'm a little bit curious about when was that stressful?
SPEAKER_04I feel like it might have been so I think that anyone that's ever published like research that has that's not only like beyond your team, but beyond like like other folks in your company care about it and are involved. There's always kind of like a sense of nervousness and anxiety that comes with it, like the week of like, is somebody gonna scoop us? Particularly like that, that's kind of a generalized anxiety among folks that do kind of the espionage research of like, are we gonna be the ones that found this first? And it's silly that we we buy into that like paradigm of we have to be first, um, which for the TA488 Zimber stuff, we weren't even the first. So that whole week is kind of like rife with like you want you want it to be published and you want it to be out there. Of course, you want to receive praise for it. And so this finding the OWA Reaper stuff, that's how we can choose to pronounce it. Behind the scenes, I privately say not a Ruper. Oh War Rupper. Oh uh Reaper. Like that our our team finding and working that the day before was like such a thrill and way to like it was it was like the best distraction you could ask for. And part of that was like anytime we're seeing something new in the space, you kind of have a like gut feeling after a certain amount of triage of this is oh, this thing is cool, like this is interesting, we should dig into this. Obviously, with like less than 24 hours of of like pre-publication time, that's not enough time to like really even get it through editing within our company, let alone going out jointly with other people. Instead of being anxious, I I think at least for me and and I think for a couple other people on the team, there was a sense of excitement of oh, this is cool. And it was kind of this not like I'm just gonna take this down the rabbit hole here for a second. It was a we've been chasing these exploits, like this exploit class for about a year and a half, and it was always kind of like cool and stealthy and interesting, and like the subtleness and cleverness with which how they operated was like cool, but you would get the the payload tended to be the least interesting part. It was like, okay, cool, like what are they doing after action? And then to see something that hit Outlook, which I would ascribe as like the hardest, one of the hardest targets to go after. It wasn't sort of this open source kit, it was you know the the the behemoth in the room, so to speak, to have it gain persistence in all these really different clever ways, and like it wasn't hard to analyze because it wasn't heavily obfuscated or anything like that, but like I dare use the word sophisticated for it because of how unless you're analyzing the email, finding this to do forensics on the host is like a nightmare because you're having to dig into a user's browser local storage, and a lot of those things aren't logged by EDRs or anything like that. And so to have like have all of like these, you know, you know, in I think particularly in the espionage space, you always wanna I I think that Mark would agree with the idea that you are always looking for something sophisticated to be like we like not even necessarily to publish, but like you want to work on something that is like analytically satisfying and and not even necessarily have to have all the answers. Like we don't have all the answers for OWA Reaper, and like that even more than like publishing that the week later or the joint advisory, like uh like our team finding and working that on that Wednesday was like I think that will be like my favorite work day that I've ever had because it was just so much like convergence of stuff that like all of our teams have been working on that had that kind of came together. So yeah, and then we got to bring in Stu from the Emerging Threat side to help with a lot of the uh the command and control side of it because it was pretty complex to try and figure out like how data was actually moving. Because you know, we can't sandbox something that is like this in in terms of like to get a good run the way you would with like an LNK or an executable. So it was a lot of static analysis and yeah, it's so to answer your question, it it didn't make me nervous, it made me excited that like we could be seeing more more stuff that was this analytically fascinating in this space going forward.
SPEAKER_02So you mentioned that you know, you you guys had some questions, you were kind of digging into it. It was an ongoing investigation, and one of the things that I thought was interesting and notable is that the previous advisories, like you were mentioning, oh, it outlook was a big deal because the previous uh research was looking at Zimbra, Round Cube, more open source uh mail servers, mail providers, and this one was targeting Outlook. And what was also pretty interesting, what we talked about previously on the last episode was that how you had an assessment of TA488, which is a contractor that operates on behalf of the Russian government versus uh TA458, which is Russian intelligence, GRU. And you kind of were dunking a little bit on TA488, uh being not as you know good or whatever as their intelligence counterparts, but now you publish the subsequent research, which you found literally the day before the blog was out, and that changed your assessment. How what happened there?
SPEAKER_04Yeah, so at least one assessment or there are there are a couple of like assessments and a couple of just like things that I'm feeling have changed. Initially, the a a company called Secrite published about TA a TA488 email they found, uh I think on Virus Total in February of last of this year. A couple days later, all the existing TA48 infrastructure burned down. And our assessment at the time was they got spooked. But now, if we trace back when how long the OWA Reaper infrastructure has been up, which is since March of 2026, and that Microsoft pushed a patch for this Outlook exploit out of band in May, there is like a spidey sense that I have that I I can't verify, of course, that maybe TA488 didn't get all that. Maybe they decided that getting burnt like that was the end of the op um on the Zimbra side, and they were ready or almost ready to go with the Outlook operation. And of course, we didn't see them in our data until late July, early August. But now my my assessment has kind of changed to like what about them being skittish and wanting to burn down the infrastructure if they got exposed. Because since we've published, we've seen them, I think, throwing email like wave after wave of email that they have been undeterred by our publication. So despite like a couple weeks of the the guy getting indicted and sentenced up in Boston to the joint advisory with NSA to then us finding the Outlook stuff, like none of that seems to have deterred them. And it's not like I I I I don't know anything about this company. Like I'm not tracking the humans, we're just tracking tracking the activity. But it's not like I I can't imagine it's not like they're not reading, but they they really like they really improve their operational security. So uh I previously the Zimbra activity, you could do some like target identification in DNS, like if you have a good passive DNS visibility, you could do that. And some other things, and they they've completely hardened it on the like how like even if you find uh one of the communications to issue a command to the implant now, like you couldn't decrypt it because you would have to be like decrypting it based off of a live existing session. So like operational security went up, like capability and sophistication of the backdoor went up, both in terms of like it's now like truly a backdoor in the way that the V Shell stuff that mass traction did where an operator can interact with it, issue commands, and do all that kind of stuff. And yeah, I think I said on the last episode that like TA458 was kind of the big dog in the space, and they don't have an they don't have an outlook exploit, and they certainly don't have anything that like can persist like this.
SPEAKER_01That you've seen.
SPEAKER_04Yes, correct, that I've seen. And it's it totally stands to reason that them or others could come along with an implant that is this this good. Um, like it's not like complex to implement something like that. But yeah, I think that I have them more as neck and neck now instead of one clearly kind of being better at the craft, excuse me, than the other.
SPEAKER_02The lesson here is to never dunk on threat actors on a podcast. I will not be following that rule though.
SPEAKER_03TA488 was like, they're like, hold my beer, except no, because they're in Russia, it would be hold my vodka. We've got this. And they came out with that look.
SPEAKER_05But in all seriousness, I was I was thinking about I was thinking about TA488 uh earlier as well, because the kind of genesis of that group when they became public was the Dutch military intelligence came out with like the laundry bearer stuff, right? And I was thinking about that, and it it's so different to what they're up to today. It was like pretty standard password spraying and like adversary in the middle phishing stuff, and then crazy pivot towards like the afterlick vulnerabilities with the Zimra activity, and then again a pretty significant step up here. So it's like rare that you see such a transformation in a threat actor over what, like a year and a half. So yeah, I just thought it was super interesting to see like how they've really matured quite significantly, and like it it makes me interested to see where what direction they're gonna go next, and particularly given the the changes over the last two months.
SPEAKER_02They're in their glow-up era. Do you think it's because of AI, Mark?
SPEAKER_05It's because CVs are back.
SPEAKER_02Well, yes, that makes sense, correct.
SPEAKER_04Yeah. I I I think that like one thing about this vector in particular is like it is super prone or or like AI would really and LLMs would really help with this, both on like the Volume Discovery and Exploit engineering side as well as on developing JavaScript to interact with those with like the to like build the implant, right? Even if you're not using like a um like necessarily one of these frontier models, hey, can you help me like asking a model, hey, could you help me write some JavaScript to like do a backup of the last 90 days of my emails because our server's been unreliable, like the you know, there there's it sort of stands to reason that you could you you'd have to do a lot of copy and pasting, but splice all these capabilities together in a way that isn't that like alarming potentially to especially to like a non-guardrailed model. So I think it definitely potentially would help. I have no idea if it if it actually is. I think that the for the last one, uh for the Zimbra piece, I think that we thought that there that there was. It's tough to tell with OWA Reaper, and part of that is just it is so complex, and it actually shares some tidbits from Zim Reaper that to Mark's point, like given how much this group has improved recently, like the most obvious answer is yes, LLMs, but I I think that like that is more I I think the the the importance of that has less to do with how good TA488 gets and has more to do with the fact that this vector will be relatively more easily weaponizable in the short term, as like the webmail providers, like I don't want to say play catch-up because the the folks at like Roundcube and Zimbrand obviously at Microsoft are really responsive to to threats like that. But I think that like um there there will probably be like a little bit of an arms race between actors that would want to access this type of information and the webmail providers as like you know the the coming months and probably year uh kind of look at. And I I think like to that same tune, one of the things like as I we got some space after the OWA Reaper piece went out was like did we do the wrong thing in publishing this because like is this going to highlight that like you can have a browser implant to people? I had never really heard of one. Like the closest thing I'd heard of was something our friend Tom Lancaster at Velexity blogged about. It was either Tom, Tom or Syeong Su Park, but talking about a Browser extension that one of the Kim Suki clusters had been using. And this felt kind of like a the the maturing evolution of that in terms of like let's live in the browser, let's do everything in the browser, and just operate from that space. And so I don't know how necessarily like weaponizable it is for the average actor, but I am like a little bit concerned might not be the right term, but like I am waiting to see, particularly if TA458 adopts this method or if any of the other kind of exploit unks adopt this one. And then I think even the thing that's even more nervous at scale is like if an IAB figures out using this to like paired with some sort of like sandbox escape to get onto the host. That would kind of be like a real nightmare. Like if the the scale of use goes up for like browser implants, it it's it you sort of question if you're doing the right thing by putting it out there, but I I think that we did the right thing just given the amount of folks that use Outlook that um we kind of had to to sound the alarm on it.
SPEAKER_02Right. Well, and I think that's interesting too, like thinking about when something's okay to publish versus when you might want to sit on it. I'm an I I have a very controversial opinion in that I think all information should be free. So I am happy, happy to provide and share as much as possible. But also I'm looking at stuff that's uh not always some sometimes it's it's a lot higher volume. Uh but sometimes we find cool stuff, and I'm like, well, if we blow it up, we blow it up. But there is that risk, especially when it comes to like red teaming tools, I feel like, and things that are like giving threat actors ideas versus publishing on things that have already been used. I feel like that's a little bit of a differentiator.
SPEAKER_04Yeah, there's a fine line there. And I will say that talking to one of um a red teaming friend of mine was he was like, it's the first time he's ever said anything that I've done was cool, which I was like, oh, okay. Like he's yeah, he's he's a he's a cool guy and he's legit, but it was also like, oh, like actors are doing things that are now like catching up to what our our like peers and friends in the red teaming space are doing, which is kind of like uh a funny way to say that they're like catching up to the sophistication of uh like the higher end red teams in in like a very narrow respect.
SPEAKER_02Our peers and enemies in the red teams, Greg. Our peers and enemies.
SPEAKER_04Yeah, your your words, my I I don't know what my feelings on our on it are today. Um but yeah, like like some of it is like waiting around to publish was was something that actually had come up because um we're recording this the week of Black Hat, and we have some research going out then. Our our teammate YNIV had some research going out last week, and there was like kind of a question of could we actually release this the following week? And there's some of it that is like from an actor perspective, we want to keep our foot on the throat of it. And our hope was that we were gonna, it was just they were gonna see the blogging get disrupted and say, okay, we're we're we're pulling off this vector, which hasn't happened. So putting the information out there actually has has wound up not scaring them as much, which isn't a bad thing because that means that other security entities can and you know, enterprises and consumers can all respond to this in it with a more informed view. Also, like we didn't want to get scooped and we wanted to be the ones that like talked about talked about this thing. And yeah, like like there's there's definitely like a um it because we're like in the initial access space in with being an email, it it's sometimes it's like well there's not it's not a luxury that we have because other people could potentially find find something like this, but also like to our users and users worldwide that could benefit from us putting it out, it's like I I think there are probably cases where we could publish something like a year later and it would still be like useful because we would talk about like something that has like installed like a long-term backdoor that would still have evidence on a host or an EBR, but in this case, it's like no, the sooner you're finding it after delivery, the theoretically better off you're gonna be to like disrupt any commands getting issued and stuff like that. So yeah, I I agree with you to to a given point about making sure that we publish when when it's timely and relevant.
SPEAKER_03Do you think that this was a zero day, that the outlook vulnerability was a zero day? Just given the timeline of infrastructure. Yes, you know, just every oh, okay. Just yes.
SPEAKER_04Yeah, so I I don't I don't know if if TA 488, yeah. I don't know if TA488 was the one um that was exploiting it at first. I think that that is something that like isn't isn't something that I'll ever know. Um the the folks at Microsoft might, but they s they patched it with an emergency patch in May. And so like I think I suspect somebody was using it as as an Oday, and I think that it might have been TA488, but I I can't prove it.
SPEAKER_02So I kind of want to talk a little bit about the capabilities of the malware. Um, you mentioned in our chat when we were prepping for this that O W A Reaper, all Reaper, is the best malware quote of the cluster that you found recently. It has pretty notable persistence, it survives credential rotation, browser restarts, full re-imaging. Can you talk a little bit about the malware? And also I'm curious about how it's using GitHub commit messages for command and control. Um, because the traffic is going through legitimate CDNs like Slack, WordPress, and from a detection standpoint, because you mentioned like the only way to sort of find this is to look for it. Um, so from a detection standpoint, like how do you distinguish like that traffic from normal user behavior if you are hunting for this in your own environment?
SPEAKER_04Yeah, so it's funny asking capabilities in that works. I'm like, where do we begin? So uh on the detection side, I'll kind of start there and work backwards. So OWA Reaper will do X fill via CDNs. And that's basically you can have like Slack or WordPress or one of these places basically like remotely fetch you an image with the attacker controlled um domain in the URI of um of that request. So from a detection standpoint, you could look for the the domains or the more specifically the acocdn.com domain in the URI of any outbound requests in your network, and theoretically that that should detect it, even if they go and update um what hosts they're using to sort of proxy that traffic. And yeah, so they that all the XFIL is done through this like image proxying, and there's a DNS-based fallback for it. But to your point about commands, so they will there's basically like what what we hypothesize is a is a structure that is stored somewhere in a GitHub commit message or in an email that they send the user. So they can like send what we assume are follow-up spam-ish emails that as long as they OWA Reaper will basically like re-index all the emails in an inbox and scan them for this pattern of basically like a generated victim ID and then base 64-ish blob that it will then decrypt to then run whatever commands are kind of inside it. And there's there's I think three different styles of commands it can run. It'll do the same thing from GitHub, but instead of it instead of like parse trying to parse all of GitHub, it'll just query GitHub for the 10 digit um victim ID string, whatever the most recent one, it'll it'll hash the content that follows that. And if if it's something that hasn't hashed before, um, it will then decrypt that and run it. And it's like I think for both of all all of those things, like even ignoring like all of the stealing aspects for it, it was just such a reflection of like interest and stealth and like doing things that will appear relatively normal to a user, like like feasibly, if you started getting like a like similarly structured emails where of course you don't see the JavaScript or you don't see like an encrypted command inside of it because it could theoretically be anywhere inside of the message body, like you might just think, oh, the spam filter that my company is using is off right now, like it's it's missing these. Um, but because none of them are going to be require any user interaction for for anything to happen, it's like, well, like you're not gonna call it about like, hey, an extra an extra singular spam email got in today. At least I don't think anybody would. And so unless you work at Proof Point, in which case it's like a big deal, like, hey, this is our job. So, like, all of the the communications and command issuance and all that was was really dedicated to stealth, um, as was the persistence, which it would, it would basically write into um local local storage, which is like a concept inside of the browser, so that effectively the OWA Reaper would run every time you would reload an Outlook web web application tab. It would do something similar where it would it would set up this like indexing and offline storage um of your other emails so that instead of querying like the exchange server or wherever those emails are remotely hosted, uh it would it would store them locally and it would poison them effectively with another OWA Reaper instance. And so it was it was kind of like a persistence that I've never even considered before, right? Like when I think about persistence.
SPEAKER_02Is it like like Russian nesting dolls of uh web server actually?
SPEAKER_04Yeah, I like it, it's they're definitely like r nesting doll twins. I don't know if if one is necessarily like encompassing the other. I think I think they're all kind of fallback of each other. But but like I think that like normally when I look at malware, I'm thinking about persistence of like a registry key or something like that rather than or a scheduled task, not like you know, like po virusing almost like uh your other emails to infect them with this thing. And so all the like the persistence and the stealth, I think were really the things that stood out. And then obviously like the the stealing capabilities were actually were were really clever in what they were able to actually go after to get like the OWA and exchange like auth tokens and browser autofill stuff. But I think they learned a lesson from the Zimbra campaign where they were exfiltrating the last 90 days worth of emails directly in a post request to their server, and I think that they realized that that was just too noisy and they were better off having like an interactive endpoint that was only exfiltrating credentials kind of when they needed them. And yeah, I I just like yeah, it was overall just like uh an impressive thing that like I I think when I sent it for Mark to look at it, like I it was either Mark or Nick, and I was like, What they responded with like, oh damn, this is cool, and then Sahar said that, and then Alexi said that, and I was like, okay, I'm not hallucinating the fact that I like want desperately want this thing to be to be to be cool, and it and it ended up being that. So yeah, I I I think that's enough of me fanboying about about over yourself, yeah. Um I hey, I like like this is like uh on the fanboying side sorry Sarah, only to defend myself for a little bit, like the I I forget I I I think I said something to this effect somewhere else, and I'm blanking on where it was if it was the last podcast or not, but like there's an amount of this that is like luck-driven of I can't coerce the adversary to a target my customers or b do something interesting. And so this like this happening in kind of the way that it did was like you know, kind of right place, right time for for our team. Yeah.
SPEAKER_02Well, I do have to I do have to say, I don't know about you guys, but I do feel like there was like a little bit of a lull in interesting things for a bit. And anytime that there's something interesting, you just want to share it with everyone. And you're like, wait, is this really interesting? Can you confirm that this is interesting? Because I desperately want it to be interesting. Yeah, so I'm glad I'm glad Mark was able to fact check your excitement and confirm that it was 100% warranted.
SPEAKER_04Yeah, and like these things kind of come in waves, right? Like the we don't decide what the adversary is gonna do. I think that we can make we can take things off the table for them, like with macros going away, or like I I I have it, I think it's like a personal goal of mine that if an ABT resolves the MX for somebody and saves proof point, they decide that they have to go with another option that that going after going after us is too hard of a target.
SPEAKER_02But that's great. That's a good goal.
SPEAKER_04Yeah, it's it's yeah, it's it's my my personal goal for all of TR.
SPEAKER_02So let's pivot a little bit. Speaking of how amazing and wonderful Mark is confirming your cool hypotheses. Mark, you also work on some pretty cool stuff. And one of the things that you recently published on, in addition to TA488, was um mass traction. I had to get the had to get the mass traction correct. This is a China-affiliated espionage group, and this report came out before you guys actually published on the term half click, but it was the same technique. And I thought it was a really interesting campaign and kind of comparing and contrasting the two because both campaigns targeted webmail platforms similar to um the TA458 and TA488 uh reporting, it was not Outlook. In the case of Mass Action, it was round cube. And I'm I'm curious, you know, what either what these two platforms have in common architecturally that makes them attractive targets for this specific technique, but also is your are the are are the threat actors conducting reconnaissance initially to figure out what webmail platforms their targets are using, or are they just sort of like blasting and hoping that, you know, is mass traction just like I hope all these universities are using ground cube. Send.
SPEAKER_05Yeah. So so the the just kind of start off at this actual research because it was a funny one because Greg and I found it from like completely independent, different angles around the same time, which is quite funny because um I was tracking some infrastructure that we associate with a Chinese cover network that was actually used to stend some of the exploits. And then Greg all had a bunch of signatures for exploits in Round Cube that also fired on this stuff, and we kind of arrived at the same place. Well, Greg had already found it because they had conducted a campaign a couple of weeks prior to them using the the cover network. Then I found that found the kind of latest wave when I was looking at it, and I was like, oh, this is so cool. Uh and then had the creeping realization that it was the actor Greg had already been looking at.
SPEAKER_04So for the listener to understand something though, this happens to me like twice a week, where I will like uh obviously Mark and I don't work in the same time zone, and I will wake up, I'll have I'll have my my morning caffeine and food, and I will like start my like daily triage and hunting stuff. And like, I kid you not, like twice a week, I will think that I've found something interesting, and Mark has already like bagged and tagged it and put it like campaign did, has all the notes written, like and all that stuff. It's like, oh well, like at least I know that I'm on the right track because Mark is finding the same things.
SPEAKER_05Uh so yeah, this is like a five-hour head start.
SPEAKER_02So you know what though? This is so funny because I feel like for people that don't work, like don't have our jobs, they're probably like, okay, that's such a weird like thing. But this happens all the time. I feel like this happens to me and Joe too. I'm always like, oh my gosh, Joe, or like Rob. I'm like, Rob, I found you know, not more Windows four. And he's just like, yeah, it's already on my list of hashes. Like, I'm like, well, okay, sorry. New fun China malware. Just kidding. It's not like it's it's none. God dang it, Greg.
SPEAKER_04For reference, our team's uh motto is shut up, Mark.
SPEAKER_02So we could never say that here on the discarded podcast. That is not the discarded podcast. Get out.
SPEAKER_04I I can't I can't think of four or five people that would say that.
SPEAKER_02Okay, so keep telling us about the wonderful thing that you found independently of Greg, Mark.
SPEAKER_05Yeah, it's so coming back to the original question around the kind of commonalities between the T488 stuff. So Ramcube, again, is a like webmail client, so it's similar concept to the O do OWA, Zimbra, all that kind of stuff, place where you read your emails essentially. So it has to have HTML rendering, it has to uh be kind of JavaScript capable and so on. So it has to do some sort of sanitization of HTML so that it doesn't accidentally oopsie execute stuff, which is what happens with these half-tech exploits. So yeah, kind of at a conceptual level, it's all the same. But of course, round tube is not necessarily as widespread as uh OWA, but it is still used by a lot of kind of smaller governments, um, university departments and so on that are looking to get a kind of more cost-effective option. And so they will they will use those kind of software or those kind of uh clients. And in terms of the spraying and whether they're doing research, we do actually see a kind of mixture of this. So sometimes they just seem to spray stuff everywhere, and there's not really much consideration into whether the target is actually running the particular client or if they're vulnerable to it. So, but in in the case of the Young MAC traction rastraction stuff, we kind of initially assumed that that was the case. But then when we researched the targets, so there was a pretty small number of them. And as the blog talks about, they were all North American universities, mostly physics departments. Um and they were all running, not only were they running Round Cube, uh, but they were running vulnerable instances of it. So if that email was opened by the target, they would have been exploited successfully. So in that case, they were definitely putting in research and ensuring that they were actually going to gain access if if if uh someone opened the email.
SPEAKER_01That's so interesting. And but it was on a vulnerable server, right? Opened it on a vulnerable server.
SPEAKER_05Or just correct. But but I meant the all of all of the targets that we saw did actually were running, yeah, vulnerable instances. So they if they were.
SPEAKER_02Oh, so they would have. And I think it's also important to note here too, we mentioned this on the last podcast. If you are a proof point customer that has been targeted by any of these threats that Greg and Mark are looking at, um you guys do notify them and will alert the customers when this does happen. So I just want to, yeah, if you're if you're a proof point customer listening, these guys got your back. But I do have a request, Mark, next time you find a uh sort of mass spray and pray campaign that needs an unk. Can you do unk yeet?
SPEAKER_05We have worse.
SPEAKER_02I mean, it's just it's just yeeting, yeeting emails into the ether and hoping, hoping something works.
SPEAKER_05Okay, we'll put it on the list. It's it's definitely, yeah. It'll it'll be like mid-tier. We have much, much worse ones, though, right?
SPEAKER_03So that mass traction campaign, as you mentioned, targeted or was mentioned it was targeting physics and engineering departments at US and Canadian universities. And then you also mentioned that this was a spray and pray campaign. Do you think that because of the heavy use of round cube at the at this in this type of like organization at a university, and that was was because the targeting was like that? Or is the targeting, is this normal targeting for this actor? Do they normally target education higher ed?
SPEAKER_05Yeah, so this is actually kind of the first time we saw this actor uh over the I guess month and a half period of of when we talk about it in the blog. So we don't we don't really have a good understanding of their typical targeting remit. But I think more generally, as I said, like they they did scope out these targets, so they were very deliberately going after organizations running these vulnerable servers that were North American universities. Whether they had other exploits that they were sending to other North American universities outside of revisibility that were running different software, uh that is also a possibility. Um, or perhaps they just had this particular exploit for RoundCube and they knew where they wanted to go after, so they were kind of naturally confined by that. But in terms of generally it it aligns with typical kind of Chinese cyber espionage activity, we see a lot of uh and historically have seen a lot of like STEM research targeting within um globally really, but within the United States, uh particularly around like dual use or other technologies that might have national security implications. So yeah, more generally, definitely not an unusual thing for them to target.
SPEAKER_03Aaron Powell We all have a really good idea, right, of what why China targets certain things. But just for the audience, Mark, are they targeting that those kind of studies, those areas of expertise to disrupt our progress in those areas or to steal it so they can use it themselves?
SPEAKER_05Just to Yeah, typically not to kind of destroy to conduct any like sabotage or anything like that. It's typically traditional espionage, so looking to steal information, understand technologies better, so that either they have a better understanding of the US's capabilities or that they can implement that into their Equivalent programs within China. So yeah, very much like a an esphénage type motivation versus anything destructive.
SPEAKER_02I can't think of any piece of technology that the US and China would both be interested in that would be a high priority of research for top universities. No idea. No one knows.
SPEAKER_03What could they possibly be after? Many things. I asked I asked Mark that question to validate my capstone because I wrote my graduate um my graduate school capstone on how China is the best, most skilled in the espionage space. So that's Mark's just validating the thing that I wrote 15 years ago.
SPEAKER_04I mean, I I think I think that one of the the things that was like Mark, I'd be I'd be curious to hear like your your thought on I I think we in the in the blog we initially talked about how they were just dropping a web shell from that the second exploit that they use in the chain. Uh but then later on we saw them using an elf script um to or a shell script to install an elf backdoor. Was that kind of like the for you, was that like the nail in the coffin that they were using? This v shell uh chain that was kind of pretty prevalent out there?
SPEAKER_05Yeah, I think so. So a combination of like targeting the there was some artifacts that we saw in the email that were like Chinese language, there was the use of the cover network, and then the use of V Shell was the other kind of nail in the coffin from an attribution standpoint. Um and just V Shell is a really interesting one because it's like it's this malware that uh appeared on GitHub like a few years back, and then it was suddenly removed back in like 2023, I think. But then the community continued to see Chinese state-sponsored actors, like a bunch of them, using it, and it was clear that it was continuing to be developed. So the kind of theory is that there's a company actually actively developing this, still providing it on a commercial basis to state-sponsored threat actors within China that are using it. But it's just interesting that originally they were like, Okay, here's this thing for everyone, and they're like, actually, nope.
SPEAKER_02It wasn't it is v Shell wasn't in the iTunes leaks, was it? They're not those guys.
SPEAKER_05Not those guys, not yet.
SPEAKER_04Intrusion Truth will be publishing about them soon. It did did you feel like that like included with the rest of your peers that track China that, like, hey, we saw V Shell too, guys, like it really is everywhere.
SPEAKER_05Yeah, because it's not something we see super often. And like, I think it's most of it mostly like post-exploitation that gets dropped, or like it it's uh obviously this is a a Linux backdoor, so we don't see a whole lot of those. But there is a there is like a Windows version of it, but even that we don't see very often because it's yeah, it seems to be like mostly something they'll drop after they've already gained initial access, which is kind of outside of our scope. And so yeah, it was fun to to feel part of the gang.
SPEAKER_02So before V Shell, there was uh Ice Cube in the attack chain. And I think it's kind of interesting because it's chaining multiple CVEs, gets out of the iframe sandbox, and has some things to sort of cover up its tracks, it cleans up after itself. And you mentioned in the report that it appears to have been written with LLM assistance, which I do know that you have a history of China actors using LLMs and some of them really truly terribly. So I'm curious what does this level of development tell you about this particular actor's maturity or available resources?
SPEAKER_05Yeah, we've seen a real a real mixed bag of of LMLM usage across Chinese actors. Uh, this is probably uh a decently or an actor who kind of knows what they're doing and is using the LLM for kind of assistance versus just letting it run wild, which is what we've seen in some cases. Um but yeah.
SPEAKER_02You say that so begrudgingly, Mark.
SPEAKER_05Yeah, it made my life hell for a while. Um but no, these guys, yeah, they seem to kind of have a pretty good understanding of of what they're doing. The so interesting infection chain because it had, as you mentioned, the Ice Cube backdoor, which is a JavaScript backdoor. That was the one we were like, this looks very LLM generated. It had lots of comments and just structurally was kind of very obviously something that was built with the assistance of an LLM. Uh that is basically a stealer, it takes like authentication data and so on, and then it attempts to conduct that secondary exploit you talked about. That secondary one then attempts to drop a web shell on the actual server. The cool thing here was that it had like a redundant in a redundant infection chain. So if the web shell was not written to disk, it then was like, hey, okay, we still need persistent access. So that is when it tries to install V Shell. So you only get V Shell if the web shell installation fails, otherwise you just get that uh web shell dropped on the server, which is like internet accessible. Anyone, or not anyone, but uh the threat actor can come along and let you issue um commands to it. So yeah, it's it's kind of pretty unusual and not something I've seen before where they've accounted for like a failure mode to ensure that they still have some form of remote access to the to the target.
SPEAKER_02I think though you mentioned anyone can come through and do commands, but then you very quickly corrected it to anyone that is the threat actor. But I do think it's important to note though that there are sometimes web shells that are established um by various threat actors where anyone could theoretically go on there and make some modifications.
SPEAKER_05So Yeah, I mean the the nature of them is that if you know, if you know what the web shell is and how they work, then you can kind of do that. So that's I'm where it is.
SPEAKER_03Okay. Your assessment is that the end goal is to use the mail server as an edge device to pivot into the targeted network. And this is similar to how Chinese actors have treated VPNs and network appliances. How does that framing change how defenders should think about their webmail infrastructure?
SPEAKER_05Yeah, so I think when we compare like a mail server to another edge device, they are kind of functionally very similar from a threat actor's perspective. So other edge devices actors or Chinese actors typically target not because they care about the specific device necessarily. Sometimes they may, but typically it's because they're facing the internet, they are network connected, they're outside of EDR visibility a lot of the time, and they are vulnerable to some vulnerability that they have an exploit for. So in that way, it ticks the box. Um, and they are kind of architecturally very similar to that from a high level. And I think that is a useful kind of foray into a network and somewhere that they can then use to pivot internally within that network should they should they choose to do so by kind of mapping that out a little bit more. But in terms of how the framing changes how defenders should think about things, I think it it's difficult. These types of servers are hard to defend, particularly you can't have like modern security solutions or ODRs in many cases. So things like file integrity monitoring, looking for things like a web shell being dropped, so is is is one approach they can take. Looking for kind of network anomaly detections for inbound or outbound uh network communication that is kind of anomalous, particularly like a V shell implant uh beaking towards outwards is gonna is going to have a distinctive network communications. So something like that is equivalent to what you'll see, like an endpoint doing and the kind of hunting at a network level is similar there. Um and it's probably easier in many ways because it that will look more anomalous um than some others. But ultimately ultimately as well, this was a two-year-old vulnerability, so patching the device is is a good idea um and ensuring you are not uh yeah, running something that's vulnerable to like a publicly available exploit, which is was the case here. Um that is yeah, a very important lesson for this one, I think.
SPEAKER_04There's that word again, anomaly, anomalous. You're it's haunting my dreams. Yeah, I I think w one thing that I'm not sure if we were aware of during the blog um for that one, that both the cross-site scripting and the RCE were uh had POCs available for them. But I think that like I look at the capability that we are seeing of China targeting edge devices with with Zero Day, and like I I think that Mark and I will be busy with this kind of threat for years to come because sort of two of the more formidable sponsors in our space in Russia and China are interested in these devices for various reasons. So I think that these things are gonna kind of keep coming hot and heavy. I realize that sounded like a conclusion and we're still in the middle of the episode, but um we're reaching the end.
SPEAKER_02We're reaching the end.
SPEAKER_04Yeah, like like i it was one of those things that like just because these were old vulnerabilities doesn't to me. I think I wanted to make sure it was reflected that like both China and or mass traction, it it's like it's not outside the realm of possibility that they could come up with their own O days for these things. Because I I think that we've seen at least uh another Tom Lancaster shout out on this podcast. Uh he's um my my fee this month is gonna be higher, Tom. That uh I I think I think they called Tempheretic, um, that them over at Vlexity found doing uh Zimbra exploitation a couple years back was also doing this. So it's definitely like it it's increased it's um like how much it's getting used like across the landscape, but that could also be my me caring about it is much higher. So I think that it's more prevalent than it actually is.
SPEAKER_01Visibility bias, ding ding ding.
SPEAKER_04I have so many biases. Mo mostly, mostly they are harmless though, but they're like guys, this thing is this thing is it it's everywhere, and it's like no dude, it's like six people, but yeah.
SPEAKER_03We've talked a lot about the sophistication, right, of all of this stuff, even though Greg used that word reluctantly, I think, and the forensic challenges of detections and hunting and looking for these types of things. And then, of course, with you know, Mark's answer with looking at kind of how to protect, right? What should defenders do? But I want to ask my my favorite question, right, about security awareness and the human element, right? Um, oftentimes I'm I'm the one to get on my soapbox and say humans aren't the weakest link in the attack chain, we are the most unpredictable. And in terms of these types of threats, we've talked about the lures, right? The the very first stop of this threat are the lures. And they were kind of simple, right, in these campaigns and all these campaigns. They had no suspicious links, no attachments, nothing a user could flag. Just kind of very simple. So, what does that mean for organizations that rely heavily on security awareness training and phishing simulations as a defense? And what would you advise? I mean, these half-click threats are kind of scary. And in the back of my mind, I I think how long until e-crime actors pick up on this, right?
SPEAKER_04So for security awareness, I would say prey uh and patch. Right?
SPEAKER_02Like, like there there is keep calm and patch on.
SPEAKER_04Yeah, it's um Sarah, I think one of the things that I would like temper your any anxiety with it over is because we haven't seen the um like mass use of it. And like it's not really mass. Like I think the biggest that we see in a given wave on like a given day is like under a hundred emails. So it's definitely not like we we have campaigns that are touching um like uh from our crime friends that are touching like millions of of messages sent on a on a given day. So it's not it's not anywhere near that volume.
SPEAKER_03Yet we know that that's how it starts, right? Device code phishing started with smaller, you know. So yet Sarah, are you manifesting? I'm not. I'm just I'm just setting expectations. I mean, we've we've studied this, right? We've studied it with clickfix and how quickly things get picked up and they're shared across different, you know, the spectrum of threat actors. We've studied this with device code phishing, and there's multiple, right? Multiple techniques. So um, for our listeners, I'm maybe being a little little you know snarky on this, but I mean I think it's not out of the realm of possibility. But sorry.
SPEAKER_04Yeah, and I think that like if there are one of the things that's difficult about this is that the surface itself is not purely half-click. And what I mean by that is we have seen like I I don't want to like give away too much stuff, but one of the peers that we worked with to get a vulnerability patched patched a similar cross-site scripting vulnerability that was actually zero click because it was based on the subject line getting rendered in the webmail viewer. So it wasn't you didn't have to open the email, but if it was like at all in your inbox and it was like up high enough at the top of unread that if as long as it rendered, it would execute. Thankfully, I like I think we figured out that it was a security researcher that patched that. And thankfully, like I don't think that it it really ever got used. Um but I think one of the things that's challenging about it is like what do you what do you do with that? Is that some like I don't know if the webmail viewers can like set firmer browser protections? I'm not sure if the browsers can vice versa like be like, hey, you have like we have like I don't want to say like a lockdown mode, but like if you're in a webmail viewer, we are going to like have stricter JavaScript execution parameters um or or environment. On the awareness side, it's tough because like we we basically have told people that like opening an email is safe, which just like in this in this narrow instance isn't the case. And I don't think that's a good reason to like throw the baby out with the bath water, um, of like, well, let's scrap everything that we've been doing. More I think moreover, that like, hey, if you see a subject line that like is suspicious of you, like you don't have to open it. You can move on and hit the hit the like little button that deletes it instead of opening it. But yeah, I I think in terms of awareness, I'm I'm still a little bit lost on like best guidance to give people. Um, especially if this like like does spread to the crime space. I will like I don't want to say I'd be vindicated, but I I'd feel I'd feel some amount of like guys, see, I told you that this was a problem if that happens. But I I think that like as we kind of talked about on the last episode with that with you guys that like it might not be the right thing at the right time for some of the IABs, and if it's not, then it it might not get picked up in the same way. That being said, we put out four blogs in July about it, so maybe we are like putting it out there for for people to use, but since then, the only one that we've observed is TA48 still doing the Outlook targeting.
SPEAKER_02So Yeah, I would I would actually be surprised if this gets mass pickup, only because so much of the activity that we've seen so far is using old vulnerabilities and in less popular webmail instances. So that's I mean, to Mark's point with the with the round cube stuff, like looking at like the China mass traction, they were doing, you know, investigations into whether this would actually work first. And you know, cyber criminals aren't known for their preparation, I would say.
SPEAKER_05Uh yeah, it narrows the food a lot for them.
SPEAKER_04Yeah. When I I think that like my sense on it maybe getting used, like Outlook made it potentially a little bit more appealing. I think the thing that seems potentially more likely of if they were to learn anything from this is like the browser style implant and having something on like an attacker-controlled server or an iframe somewhere that instruments that instead of like it being uh cross-site scripting in a webmail provider.
SPEAKER_02Well, I just want you guys to know that today I found one of my threat actors that was using JavaScript and an HTML embed in an email that they clearly only tested in their web browser and not an email, and so it totally didn't work. So we're really operating on different uh Wait, can you send can you send that to me when when we're done here? It was it was not that interesting. Don't worry.
SPEAKER_04Well, I just want to make sure our SIGs are working if it's something that we can disrupt as soon as Yes, yeah, no problem.
SPEAKER_02On that note, uh before we wrap up, Mark, you did provide some wonderful recommendations for what organizations can do to hunt for this, to defend against this. Anything else that you'd like to add before we close out?
SPEAKER_05I don't think so. The only thing I'd like to add was around the previous question of the email lures being generic and to highlight the funniest email I've ever seen um at Proof Point, which is the one from the Monk Master Action blog, where they had a compromised university account um and they used that to kind of conduct the targeting. And the email was as follows Hi, fellow, hope you don't mind the random email. I saw your profile online recently and really liked your vibe, and so on. And it closes with, would love to be friends if you are open to it. Best regards.
SPEAKER_02Hi, fellow. I really like your vibe.
SPEAKER_03Sounds like modern LinkedIn connection messages.
SPEAKER_05Yeah. But like when you think about it, nobody is gonna open that and be like, oh, this is this is malicious. I'm gonna send it to security. They're just gonna be like, who is this freak emailing me?
SPEAKER_04Making making friends as an adult is hard. So like I don't know.
SPEAKER_05I got I have their email, Greg, if you want to want to chat to them.
SPEAKER_03That's a good lore though, too, because somebody, to your point, Mark, somebody might open it, think it's funny, and forward it to like their friends and be like, look at how dark, like, look at this. This is silly, you know.
SPEAKER_05That's true. I didn't think about that.
SPEAKER_03And then there you go, spreading it.
SPEAKER_04With the worm.
SPEAKER_03It is. Accidentally.
SPEAKER_04It's a worm, it's it's like a meme via like worming via meme.
SPEAKER_02Okay, we really can't give third actors any more ideas. There's been so many on this podcast so far. Meme worms. That's it. I draw the line. Well, this has been super duper fun. I know it's a long one. So if you have stuck through till the very end with us, all our listeners, thank you so much. Um, this was great. We are very, very lucky to work with Greg and Mark here on the Proof Points. I am quite sure that they have more cool stuff coming for us in the very near future. And we would love to have you guys back. Thank you so much for coming on.
SPEAKER_04Thank you for having us. And to all our cyberstars, happy hunting.
SPEAKER_02What? No, that's my job.
SPEAKER_04My line.
SPEAKER_03Greg's trying out for co-host.
SPEAKER_04Line, line, what's my line?
SPEAKER_02Line? To all our listeners, happy hunting. You've been listening to Discarded Tales from the Threat Research Trenches, a podcast by Proof Point. Never miss an episode by subscribing to the show in your favorite podcast player. Happy hunting.