Ep12: Inside the Internets Hidden Control Systems

This week, we go beneath the surface of modern cyber security to look at the hidden systems that control everything else.

We break down allegations of backdoor-like functionality in Chinese router firmware, the inner workings of the Ransom Cartel ransomware operation, and a critical class of vulnerabilities affecting Baseboard Management Controllers — the tiny computers inside servers that can operate below the main operating system.

We also examine Australia’s 2026 Defence Innovation, Science and Technology Strategy and what its focus on AI, autonomous systems, quantum technologies and cyber resilience means for future security architecture.

Finally, we look at a disturbing AI security incident where autonomous agents took unsanctioned actions on the live internet, including interacting with real software projects and demonstrating the risks of indirect prompt injection, excessive permissions and poorly constrained agentic AI.

Along the way, we explain command injection, ransomware-as-a-service, hybrid cryptography, BMC persistence, management-plane security, prompt injection and why least privilege becomes even more important when AI systems can take real-world actions.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: cyberinvestigationsau@gmail.com

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

Transcript

SPEAKER_00 0:02

Welcome back to the podcast. This week we are looking at a suspicious firmware inside Chinese-made routers. We're also looking at a lengthy prison sentence for a ransomware operator, a vulnerable management controller buried inside thousands of servers. And lastly, Australia's latest defence technology strategy and an artificial intelligence security experiment that unexpectedly reached into the real world. Let's move on to the first story. It looks like Chinese networking equipment vendor ZBT Link has denied deliberately placing backdoors in its router's firmware. Describing the suspicious functionality as an after-sales maintenance capability left behind on sample units. So security researchers examining an AX3000 router found a component called RCTL running inside the firmware. And this component continuously attempted to connect to a remote command and control infrastructure. Now, if you're a security researcher, this is a bit suspicious. The first technical warning sign was a group of processors named KWorker. So if you didn't know, on Linux, genuine kernel worker threads normally appear inside square brackets in process listings. For example, square bracket k worker close square bracket. They are kernel managed threads used for deferred tasks such as hardware interrupts and background device operations. Pretty standard Linux kernel stuff. Here's where things get weird. The suspicious process did not appear inside the square brackets within Linux kernel. They were ordinary user space programs masquerading as kernel workers, running with root privileges. This is a useful forensic lesson. Malware often imitates the name of trusted system component, but subtle process metadata can reveal that it's not actually genuine. So the remote control protocol here was alarmingly simple. When the router connected to its command server on TCP port 7000, it transmitted a fixed 39-byte introduction containing a device classification string and the router's MAC address. There was no cryptographic handshake, no certificate validation, and no mutual authentication. Here's where things got even more strange. After connecting, data received from the server could be passed directly into the Linux open function while running as user ID zero. So in practical terms, the server could provide a shell command, and the router would execute it as root. A reserved command called RCTL bash could also instruct the router to open another connection on port 7001. Attach a pseudo terminal and launch bin SH. That effectively provided an interactive root shell. So this is a fairly good demonstration as to why outbound connectivity is not always automatically safe. Home and business firewalls usually block unsolicited inbound traffic, but they allow established outbound connections. Because the router initiated the connection, network address translation, or NAT, and ordinary inbound firewall rules provided little protection. An attacker who gained control of the command server hijacked its domain, manipulated DNS, or intercepted the connection path, could potentially issue commands to an affected router. Now, the researchers had identified related code across roughly two dozen firmware images covering around twenty router models with further exposure possible because these devices are frequently rebranded by other companies. Not only on these routers, but all routers really. Not merely the incoming connections. Unexpected outbound connections on port 7000 and 7001, suspicious DNS lookups and files such as user S bin K worker or user lib may indicate exposure. Might be time to pull out Wireshark. So I think the broader lesson here is that a router is not merely a traffic forwarding appliance, right? It sits at the boundary of the network, observes nearly every connection, and often provides DNS, DHCP, and firewall services. A root level implant in router firmware can become a durable position from which an attacker observes traffic, redirects users, or moves into internal systems. Let's quickly move on to story two. A Belarusian national named Maxim Silnikau. Definitely butchered that. Also known online as JP Morgan or Lanxi, or also reported as Triple X, has been sentenced in the United States to 16 years in prison. So what's happened here? Silnikau created and operated a ransom cartel, ransom as a service operation, which targeted at least 18 organizations between 2021 and 2023. If you didn't know, ransomware as a Service, or RAS, separates a ransomware campaign into specialized business functions. The core operators develop the malware, maintain payment infrastructure, host leak sites, and manage negotiations. And then they create affiliates to this core ransomware as a service operation. And it's these affiliates that conduct the intrusions. Initial access brokers may separately sell usernames, passwords, VPN sessions, or remote desktop access obtained from earlier compromises. And Asyl Nikal's operation reportedly purchased stolen credentials, distributed encryption tools, and maintained a hidden management panel where affiliates could track attacks, communicate with victims, and divide ransomware payments. This structure resembles a legitimate software platform, except of course its customers at criminal ransomware gangs. This particular ransomware gang called Ransom Cartel frequently relied on compromised credentials for externally accessible services such as RDP, SSH, and corporate VPNs. This is important because ransomware is not always introduced through a sophisticated software exploit. A valid account without multifactor authentication may provide all the access an affiliate needs. Once inside, operators used credential extraction tools such as Mimicats and Don Pappy DonPappy targets secrets protected by a Microsoft's data protection API or DPappy. So it looks like Ransom Cartel's ESXi operations included enabling SSH, creating additional accounts with user ID zero using VMware management commands to enumerate and shut down virtual machines. Stopping the machines releases file locks, allowing the virtual disks such as VMDK files, memory snapshots, and configuration data to be encrypted. Public key systems such as Curve 25519 can establish a secret that only the attacker can recover. That secret can then be processed through SHARE 3 and use that as an AES encryption key. AES performs a high-speed bulk encryption, while public key cryptography prevents the victim from recovering the key simply by analyzing the ransom where executable. This is why ransom defense must begin before encryption, right? Organizations need phishing resistant multi-factor authentication, restricted remote administration, separate credentials for hypervisor management, so on and so forth. By the time thousands of files are being encrypted, the decisive security failures have occurred days later. Let's quickly move on to story three. There could be a computer hidden inside your server. And this story concerns baseboard management controls or BMCs. A BMC is a small independent computer built into a server motherboard. Products such as IPMI or IDRAC, ILO, and Redfist allow administrators to remotely view the screen, mount installation media, change firmware settings, reboot the machine and power it on, even when the main operating system is not running. That makes BMC extremely useful, but also extremely powerful. If you didn't know, it has its own processor memory operating system, network stack, and firmware. So compromising it is not the same as compromising an ordinary application. It can provide an attacker with control beneath the host operating system. And recent reporting shows that a recent example of this type of attack is CV20263821. So we've seen a high severity operating system command injection vulnerability affecting the Smash management service in certain supermicro BMC firmwares. So it looks like what happened here is that command injection occurs when software constructs a shell command using untrusted inputs without correctly separating the input from the command syntax. Characters such as semicolons, pipes, or command substitutions may transform what was intended to be an argument into an additional command. So it looks like what's happened here in this case is a network-connected attacker with low privileged authentication account could potentially execute arbitrary commands within the BMC environment. Researchers have found undocumented management APIs, weak password storage mechanisms, memory access functions without proper boundary checking, and firmware lacking modern exploit protections, such as address space, layout randomization, control flow integrity. A compromised BMC may use its virtual keyboard and monitoring capabilities to interact with a host. More advanced attackers may modify boot settings right to nonviolent storage or tamper with the SPI flash containing system firmware. This creates the possibility of persistence surviving an operating system reinstall or hard drive replacement. Secure boot does not necessarily solve the problem if the component enforcing or configuring the boot process has itself been compromised. Okay. Things got a little heavy there, but I think low-level engineering is particularly fascinating in the world of all application-level exploits being able to be swapped out by AI. To really be a master in today's cyber offensive environment, you really need to look at the low-level hardware functions deep within the kernel, the operating system, and even at times the physical motherboard. Let's quickly move on to story four. Australia's defence technology priorities have been outlined in a released strategy that has been released by Defence's Innovation Science and Technology Department. This is a department with inside Australia's Department of Defence. Quite an interesting read. The strategy looks like that Australia is focusing on six priority areas. Long-range fires and hypersonics, directed energy weapons, including high energy lasers, autonomous systems, quantum technologies, artificial intelligence, and underwater sea warfare. Those all sound straight out of a science fiction movie. I think the key takeaway of this strategy is that cybersecurity is not presented simply as a standalone product anymore. Within this strategy, the AI priority includes using artificial intelligence for command and control, intelligence analysis, target acquisition, and cyber situational awareness. The strategy also identified secure agentic AI and countering AI cyber warfare. This creates an important engineering tension. I think defense wants technology delivered at what it calls the speed of relevance, but rapid adoption can increase supply chain and assurance risk. Autonomous platforms may depend on machine learning modules, sensors, satellite comms. Security must be designed into the research and acquisition process before the experimental capability becomes an operational dependency. I think that's largely right. We'll cover the last story, and the UK's AI Security Institute has published an incident report describing how autonomous AI agents took unauthorized actions on the live internet during security evaluations. I'm seeing this story come up more and more. And I'm hearing one camp saying that this poses quite a serious, not only sandboxing issue, but an issue whereby throughout many runs of training, AI models are continually breaking out and you could arguably say committing crimes. But then the other side is saying it wasn't the AI committed the crime. It was the user prompting the AI that didn't put a sufficient explanation around what the AI should or shouldn't do. I haven't quite yet formed an opinion on the quite frequent occurrence of AI safety runs breaking out of security sandboxing environments, connecting to the internet and at times doing things that it shouldn't be doing. I think, however, autonomy changes the risk of the equation full stop. Because the model is no longer merely generating text, right? It can observe, decide, execute, review, and see the results. So I think there's going to be more and more attention paid to how these AI models are tested during those initial stages when it does not have any guardrails in place. I think out of the five stories, I think there really is one recurring lesson, right? Most dangerous systems is not the visible application. It's the hidden components that controls everything around it. We touch on router firmware, ransomware infrastructure, the server management processor on a motherboard. What credentials can it reach? Where can it connect to? Because once a hidden control plane is compromised, everything beneath it may already belong to the attacker. Anyway, thank you very much for listening. See you next time.