Show Notes
Today we have Damon Rouse, Threat Intelligence from Lumen's Black Lotus Labs, discussing their work on "The infrastructure quartermaster: inside a China-nexus state enablement model." Black Lotus Labs identified a China-nexus cyber infrastructure provider, dubbed a “quartermaster,” that supplies reconnaissance, proxy routing, and obfuscation services to Chinese cyber espionage actors.
Its interconnected systems, including QScan and Fast Labyrinth, help identify high-value targets, conceal malicious traffic, and support potential exploitation of government, military, research, and critical infrastructure networks. Researchers warn that this shared infrastructure makes traditional IP-based defenses less effective and recommend following CISA and NCSC guidance, reducing external attack surfaces, and keeping routers, firewalls, and IoT devices updated.
The research and executive brief can be found here:
The infrastructure quartermaster: inside a China-nexus state enablement model
Learn more about your ad choices. Visit megaphone.fm/adchoices
More from Research Saturday
Dan Lisichkin, AI Security Researcher from Pillar Security, discussing their work on "A WIF Of Fresh Access, How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise." Researchers at Pillar Security uncovered a vulnerability in Google’s Gemini CLI workflows that could allow an attacker to turn a malicious GitHub issue into remote code execution and gain elevated access to a Google Cloud Platform (GCP) project.
Adam Meyers, Head of Counter Adversary Operations at CrowdStrike, is discussing their work on "PhantomRaven, An LLM-Generated Information Stealer Developed for Bug Bounty Hunting." PhantomRaven, a JavaScript-based information stealer distributed through malicious npm packages by a financially motivated threat actor posing as a bug bounty hunter.
Today we are joined by Jean-Pierre Mouton, Senior Threat Intelligence Consultant at GuidePoint Security, discussing their work on "How Play Achieves Encryption." Play ransomware, also known as PlayCrypt, continues to target organizations across multiple sectors using a consistent double-extortion playbook that combines data theft with widespread encryption. A recent investigation details how the group gained access through a SonicWall VPN, moved laterally using tools such as Mimikatz and PsExec, exfiltrated sensitive data, and used the victim’s own SentinelOne uninstallation utility to disable endpoint protection. The findings highlight several behavioral indicators defenders can monitor, including tool staging through SYSVOL and SystemBC for command and control, event log clearing, and suspicious WinSCP activity.
Today we are joined by Ensar Seker, VP of Research and CISO at SOCRadar, discussing their work on "Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain." An investigation into AnonyMousKIT reveals an AI-powered Phishing-as-a-Service platform designed to steal Apple credentials and disable Activation Lock on stolen devices.
Today we are joined by Dr. Renée Burton, VP of Threat Intelligence at Infoblox, discussing their work on Lurking Lizard, "Fake Installers, Fake Reviews, Fake Services – Real Proxies, Real." The research uncovers Lurking Lizard, a threat actor that has operated since at least 2022 by using fake software installers, VPNs, and lookalike domains to secretly turn victims’ devices into residential proxy nodes.