We had that mired performance from, okay, let me just go ahead and introduce him. He wears many hats.  He is, he literally has, I don't know if it's a degree or a master's in aeronautical engineering. He's a songwriter, he's a rapper, he's a recording and performing artist from 254. Ladies and gentlemen, let's put our hands together and welcome on the Bounce Nation, Davuniku! That's what's up! All right, so he's Chris Barber, you can call him Davuniku. Is it Davuniku or Man Davuniku? Accu or lie? Accu or lie. Lovage! Oh my goodness, so good to have you. Bless you Chris. Thank you so much for making time. Thank you. My first time in KBC by the way. Right? For a lie. I mean, what took you so long though? It's been forever. When you hitambo, it's been... Yeah, my mom is watching, I made it. If you want to know, you've made it. The moment you step into KBC, you've made it because like everybody, like every great career, most great careers start here. Like a lot of the people who are doing it, who have already made it, most of them started in here. Right, so let me just take you back a little bit. I know you've talked about your story many times. You're not going to dwell or need a lot, but Najwa, your story, like you're joining music in the back in high school. Yeah, we were. And you're just by chance. So it happened that they're going to music festival.  So can you say like by you stepping in and playing this instrument, which only this one person could play, is how your journey in music started? I mean, as I said, it started way earlier. All my influences in music, since I was a kid, my dad loves music so much. Oh, yeah. My elder sister as well. So I feel... Oh, so you come from a musical family, basically? Yeah. People who love listening to music. So I feel the influences were there, peers, yeah. It just happened that your story and music in the Fania, gave me the responsibility to like take on music as something seriously. Yeah. And then first of all, let's just talk about your career in music. We came to know you with that, that's one song, Dovuniku, which is now actually your name. Like, massive, 30 million views on YouTube. When you did that song, did you ever think, even in your wildest dream, that it was going to blow up as much as it did? Not as much as it did, but I thank God and I thank my fans for holding it down. The Kenyan fans, even the aspirin, came through, always come through. Give thanks, yeah. You just hope, you put out something you hope for the best. If you put out a well, then you give thanks a lot. You give thanks, too. If it works out, you give thanks. If it works out, you give thanks. If it works out, you still give thanks. Right? I remember by the self-catchy shot, I remember the first time I heard Dovuniku, the song, it looked a freestyle. Yeah. I actually played it by the, hey, I'm scared. Who is it? I love it because you wish, it has a whole song. Yeah. Then boom, it's going to be a hit. It was a strategy, it just happened by chance. Yeah. When I was shooting the video, one of my fans asked me for a photo. I remember he came for a freestyle lap and told me to do it later. So, I put it out and the rest is history. Give thanks, give thanks. And it just came in, like everyone, everywhere, on social media in real life, everyone is just jamming to it. And you, like for your, okay, N8 was not your first project, but for a song that put you out there, kind of like the big names, like guys, Calligraph, of course, the OG is a big name, and then also... Butrus. Butrus, butrus is a big deal. So, just having the two of them together in that song, do you think that's also contributed to the success of the song? A lot, a lot. Yeah, yeah. So, I mean, these are people who have credible following. They had credible following prior to me even being known. So, yeah, it's a good thing. It's a good thing. And of course, with that also comes fame. Were you even prepared? Because you were prepared for that. I'm so confused. Because being a producer for like 10 years before people knew me, I used to put out artists and I don't know how they deal with fame. So, I was just like, come, I'm going to do this, I'm going to do this. I'm going to do blue print. Yeah, I'm going to do blue print at least. But at least, it's new to me. I don't know what to say. I don't know what to say and stuff. But we love it. I don't know what to say. So, in October, then people recognize you. Like, do you just go about your normal life like you don't know what to say? Or maybe you don't know what to say? It has its limitations. I don't know what to say. Actually, before I came here, I was at a restaurant somewhere with students. I was UN, I think it's around. So... They didn't make you pay the bill though. I'm going to be Amazon of what I'm saying. So, bill me. I think we get treated very well. Yeah. We keep our fake vibes. I get me, I move by respect. I respect everyone and I kind of get that a lot. You get it back. So, you receive what you get. Like, you get what you put out there. Right. And now, you've spoken about being a producer as well and for 10 years. So, is it hard when you're working with other producers? Because I can imagine, like, probably when you're working on your own project, you're sort of like a perfectionist. You want these to be like this and these to be... You know, everything has to go your way. Is it challenging when you're working with other producers? The challenge is not being a perfectionist. It's challenging your sensitivity too much about your craft. And I believe every musician out there has that sensitivity that you're always sensitive about what you love. But we always find a way to work together. See, I took Sema because I'm a producer. I can't work with any other producers. I mean, I know and I respect so many producers out there. And yeah, we can work together. We have worked together. You have worked together with many people. And I know a lot of people that inspired you in the industry, especially when you're still coming up, right now we're still coming anymore. So, like, when you're coming up, a lot of people that inspired you, like, Mika, like, of course, which is all you've worked with, B.A., like you and Nimbani. You've worked with the calligraphers, of course, on their own, on Dopuniku. So, among other people, you mentioned, like, Susanna, Oweo, or Susanna, you know? And there's also Shinski. So, have you been able to maybe talk to someone like the Shinski? I don't know if it's true or not.  So, it is more like that. So, have you ever been able, like, have you been able to talk to him and do we maybe expect something in future you and Nishinski? I mean, if the time is right, if the vibes are right, why not? But for sure, everybody you're always willing to work with as an up-and-coming, uprising artist, rather. It's a blessing when you get to work with them. I know, and for you, I feel like it was more of a manifestation because it's so like crazy. You talk about Sauti Soul and then like very early when you're just starting out, you have a song with them, with like the end. And then like also calligraph on like that project that put you out there. So, I felt like on that list, you know, Susan and Tuna and I didn't owe me back. Nishinski, and then we're good to go. I mean, lately I've been having so much inspiration from people who are not on the line. I mean, it's a journey as well. So, when you're not in the limelight, you are too known and you have to work with TV and stuff. But when you get there, you start now looking elsewhere. You find there's so much gem. I just kiss one. So, that's been my kind of... I'm not saying that I'm collaborating because I'm a Drake. It's like I'm really looking for gems in here because we have them and people need to listen. We do, we do, we do, we do, we do. And there's a lot of untapped talent, but I don't know, like for some reason, we still have like the same, like people always say, like we have the same people on rotation and everything. So, how do we find them? Like the social media, yes.  So, at some point you have to hit us up and everything. So, how are we going to discover them? What do you think is limiting them? Because we don't want to say much. We have the same names, we play the same songs, but they are these people that we do not know about.  Right. At the DJMIG, you know, it's a process for life. I'd say in every calling, there's the putting in work and nowadays when you're doing collaborations, you're not trying to feel like a pest to people. It's just like if I really like your vibe and you're a good person, we work either way. So, if I have a few numbers that can give you attention and people like you, you can continue with your brand. Just the same way Calligraph gave me, or Butrus gave me a platform, you know? And then in the same process, we've been bringing limelights to other people as well. Exactly. And aside from those two, who can you actually, like sitting here, can you say, have helped you in the industry? You know, you're like looking back, like sometimes it's good to give people their flowers when they're still here, right? And sometimes we often forget like who helped us along the way. So, who can you say, like genuinely in the industry for the time you've been here, have held your hand? Hmm. You have to think about it. No, no, no. It's how you put your question, you know? Yeah. Yeah, because it's not a physical holding your hand. Yeah, of course not. I mean, it depends with... Like vouching for you. If I would have... Vouching for me are a lot of people, you know? Even my fans, really. They're the ones who put me up there. When I drop music, they put the numbers up. But I would say I'd reverse that question in being who have I learnt so much from? Right. There's a couple of people. Right? I have a business aspect here. To come out and calligraph me in as well. Structural. Planning how they carry themselves. So, it's things I'm learning from every person that I love their music. Not necessarily close friends as in we chill together with Nini. But, you know, I get that. So, they have to hold my hand everywhere they go. Everywhere they go, yeah. You can learn and you can see how somebody's moving when you apply your calligraphy in a work. Or crafty or other. Right. And so, who can you say would be your dream collab? Like, Saman, like, if you want to do a song with them right now, you'd be like... Like, not that scene. Like, if I die right now, I'm happy. I'm a happy person. So, who's that one person? This is not playing psycho, but I don't know. No way. Or lie. You literally do not notice moving.  There was...  All I want to know is what's on the screen and stuff. Like, who doesn't know something? Papi, like, forget that. Exactly. But right now, you're seeing... You're getting surprised.  Right now, it's not happening. And go and meet somebody who's not known with the best song out there. And I'm like, please, can we work together? You know? You like...  So, you don't know. You don't know. There's that inspired collaboration to send you a message. I feel like I'm collaborating with you. You have the power of learning when you're coming, especially when you're coming. You have the remixes. Does that inspire more collaborations and becoming an artist? I'm a non-artist. But I'm a pop artist. Does that inspire the collaboration? If I'm trying to get you to say, the remixes I've been doing... Yeah. It's the little mix that I'm doing. I feel when you come on board, you prepare as I do. For example, when I'm in a wedding. Ah, at home. Yes, at home. Because it's a dope song, but when you came in, I get the stuff of your attention, you know? It's like right now, there's definitely... It's like I'm a trade. Music is a trade.  So, there was a time people were talking about me. They're still here, you know? So, when it definitely makes sense right now. If you... Like right now, the dollar thing is going on. Anything happens. President of a country... In Africa, there's a lot of money and stuff. It's going to be my home. So, it's like... It's only natural. I wouldn't say... I'm the aroma to say. I'm the aroma, you know? Because me, to work with an artist, I have first to believe in what they're doing. And I'm paying. They say, I don't want to jump on my side. You know, I have to love the gem. So, when I came in, I said, I feel... Mandy, actually, I knew her before. I told her, I love her. She's been pushing. Yeah, I love your music. And it so happened, the limelight came to me. You know, soon enough. So, it worked too. It is magic. And speaking of other artists, who can you say you're currently listening to right now? Like, for us to take this, you're please, Seizi, who would you say you're currently listening to? Two, five, four. There's a lot. There's this chick called Zaituni Wambui. There's Vijana Barubaru. Ah, yes. Yes, they were here. Like, they are pushing, I love Vijana Barubaru. Yeah, there's a certain guy, I don't remember, who has a playlist, I'm not sure. It's Wasekada. Yeah, Wasekada. And also, the Benzoll's new album. Yeah. It's Vibes. Benzoll has been that guy by the way. I don't know why, I think like, he's good, but I feel like he hasn't just, like, gotten that number one that he needs, no, I reckon. We are in global. Your album, if you launch it, that's it. That's it.  And we see a lot of people trying to do that. Like, they come up with something, a relationship, they come up with like, all these things, just to make sure that people are still talking about them. Are we going to see you do that? Like, maybe for your... I know you have like, projects coming up. Yeah. Would you ever got that root of I mean... We talk about you for a week, and then you listen. Even if I would, I wouldn't tell you right now. You're not going to spoil. But that's not my... What you take on that, though? I mean, if it works for them, let them do it. You know, I can't crucify anyone. You know, to the man who... But don't you think it's going to get to a point where a boy who cried wolf, though? Like, even if you are serious, people are like... This is what I've come to make peace with things that I don't subscribe to. Because everything. Today, I'm not going to say anything So, it's just like I think of a human being as a dot and you have your circle of influence and then the bigger circle of concern. It's going to change. But the more you grow your circle of concern, the more circle of influence is going to affect your circle of concern. So, to come up with a president is to make decisions what we make. A calligrapher is to make decisions what industries we see as we make things. That is true. I believe in that form of growth. It's easy. But I might say my opinion but I can't say it. I fight for it. Let them do what works for them. Everybody should do what works for them. Come on, push Goma, build a cloud and thank you. I know there are people who do not even post their own stuff. They just release and then they'll probably do one story or something and then they're done. But I saw Don Jazi the other day and there was a video where he was talking about it and he has a lot of artists with Marvin records and he pushes his artists. I do sometimes you see he has posts and everything. So, he was like, if Davido he's been there and he is here and Davido is pushing his album when he's 90. For sure. If Davido is sponsoring his album why wouldn't you do that? It's bigger than everything. But that's pushing. You don't necessarily have to do cloud even though it may work for you or not. But pushing is marketing. If you have a product you have to make it to get it in your client. I don't think it's a good idea to have a showroom or something so marketing is a part of it. What is that one that is called Inception People Have About You? Like what you're doing but then in real life that is not actually who I am. Do you ever get that? Do you have one thing people think that you actually do that you don't actually? Probably. For me people think apart from right now I'm not feeling 100 but most times I'm super loud and everything but when I'm home I do not even know how my neighbour is like I'm super chill. In security, hi, hi, what's up to my house and that's it. But like when I'm out hosting when I'm here and I'm just like so do you have that one thing that people think you say you're a girl Maybe you tell me. He's a ladies man, is it true? Are you a ladies man? No, but you know I have a perception about whoever and sometimes it's probably because of their portray. If I sing a song about ladies and it's trending most people take me as a ladies man. If I sing a song about gun violence and it trends what I do is I meet in person. So you know what I need to take to you. You know what I need to take to you. So I haven't got to I'm so fee and smug but yeah I have just a junior I'm in with ASAP shout out to Ndavu Koo a lot of but on this show a lot of people actually request your songs they actually listen to you a lot we have it's a Paranthetic and Ndavu Niku they are tuned in from Dandora basically they sing high Dandora is watching. So as we talk about that let's talk about your it's not your latest song though this song came out about a year ago it wasn't as in the last year but the video just came out so what took you so long for the video to come it was hiccups right we shot the video and then the director was working with them lost the footage hardest got corrupted you know something so yeah we chill we chill we chill and then my friend Ivan Ivan Odi he's a dope director he loves that song genuinely and I tend to say so even a video he did for Levy Kendra and that video was Ivan so Ivan reached out to me they have this page called Loki it's a company with I think it's Dom Nishanzai yeah so we thought about collaborating on the project and I was like I've been wanting to work with you so we took a few vibes that we Ivan Odi Ivan Odi it's worth it it's so so so so worth it so how would you work with him though he's a good guy chilled, humble for the work he's doing I think he's a good guy but you know Ivan is a dope guy and the team it's called Kalevan Creatives the company he works with the wife as well they're pretty chilled good creatives right so now we have Tetanus and one thing that is consistent about your songs like everyone who knows the record definitely knows Pamela so now in this song I'm like finally bro Pamela I know it's just started out as your ex but right now it is like a persona in your song sort of like you have like you talk it's not just about now one person it's like you talk generally about this in global everyone has a Pamela in their life right you know you look down on you people who put you down on you you are trying to so so tell us what is your name I don't know I don't know I don't know like I'm listening to the lyrics and I'm like y'all but did you guys ever like squash whatever that was did you ever like talk about it I talk about it in my songs that is how in real life you have in real life you have when you black you don't go back you don't go back when you go black come and gilly you move as you go that's fantastic and the song is doing pretty well though Tetanus is doing pretty amazing sorry to cut you short it's not on my page it's on lowkey page so if you're looking for Tetanus look for it at the lowkey youtube page right and as we wind up I want to ask you some quick questions but before you get there I want you to tell me about your creative process let's say for Tetanus when you're creating how do you go about it the whole creative process until the finished product how do you go about it like some people need to seek by themselves they need to maybe travel to a quiet place they need to go to a club loud and noise and all that so how about you when you're creating your creative process my name is Poradip so many times at night I'm just going to use my ideas and I use my phone to record so much because I record the beat idea and there's a beatbox and then now look for a cadence for a career topic and then start writing so you do that by yourself oh okay and even the songwriting like you write your own music yeah yeah I do write all my music oh you write all my music oh you write all my music but when it comes to penning down that is where the problem is I'm a songwriter oh so you can write for other people as well yeah that's something I'm doing and don't worry I'll never mention it so just hit up in the book studios for songwriting services we got you sorted alright so your studio your studio so you do songwriting you do like production and all that everything even doing commercial videos oh awesome alright so actually I'm thinking sort of quick fire why didn't you just do the accent challenge accent challenge I think that would be awesome I think the accent challenge would be great I think I don't know but let's try it so I'll give you a scenario and then you play it out how you will do it come out alright let's try it with the first one how you would behave as a customer how you would behave as a customer when I'm a customer when I'm serving I'm the customer lady and you're in a hurry hey you're a kissy with your head just try it what's inside there what's inside there it's a prano it's a prano it's a prano try it it's not a prano it's a prano next you have to know that I'm a customer but I'm a customer bro I don't know how you would behave as a customer I'm a customer you're a customer you're a customer you know I have a dilemma I want to give it a try words words I don't know I don't know how you would behave I'm jealous yeah yeah I don't know well done we're still going I think he will be a real man Violet TB I ran, I ran and I looked bad, no people Can you give me a benefits even if you won't buy me a drink He is funny. He is 12 years old. That is why he is tall. Come on lets try. He is so tall. Hey! I won't make it. What is this? I am a boy. I am a student. I am a good student. You are a good student? I am from New warriors. I agree. No, that is you I am asking you Okay, let me sit by the way Let me sit No, it is not coming I want to but it is not going to I will not fall for it I am not sure I am sitting in a garage and he is like story I am sitting in a car Where?  That is all you know That was really bad for all of us Next time we will try something different But do you prefer Do you prefer being called Kasper Like Crispar Do you prefer Crispar or Either but Dovuku is the widely known name Crispar is still my alias Crispar actually comes from my full names Chris Tandy, Chris Sparks And Tandy is a very very very unique name by the way By the way So I am going to contact some of my friends I am going to ask them for their request I will try to make a video on how to make it I am going to watch that You are going to watch the video? Yes I am going to watch the video I am not going to hold it I will make a video I will make a video I will do it Of course I know you have new projects maybe you want to tell us about that I'm giving you guys an exclusive We're doing a song with Jana Barbaro It's going to be the biggest song of the country This year, next year, next year, but one We love that It's a dope song, we ready When is it coming out? It's a two weeks time Jana, what's your name? You had it here first No, I didn't You came here Anyway, so go follow him He's a great killer Go stream His latest song It's not a latest song The video just came out It's called Tetanus Right here on Bounce Nation Keep it here We still have a lot more show for you Do you have any shout outs?


The Bemidji City Council is moving forward on the tobacco ordinance to raise the purchasing age. Council members met Monday at City Hall where they voted in favor of the tobacco ordinance. This will prevent stores from selling tobacco to people who are under the age of 21. Nancy Erickson was the only city council member who was not in favor of raising the tobacco purchasing age. I think it's a good idea. I think everybody in the council felt it was good. Some just thought maybe we should wait and let the state set the rules and maybe not be out in front of it. But I think everybody felt that it's probably a good thing. The city of Bemidji is now in line with Beltrami County. If you enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland PBS.


Taxation plays an increasing role in the decision-making processes of multinational enterprises where to invest and how. Therefore, these masters are perfect for those students who want to contribute to the enhancement of these decision-making processes as far as it concerns the level of multinational enterprises and governments, where it concerns at least the tax element. First of all, it focuses on tax systems and underlying principles as they are applied worldwide. So we are not focusing on one jurisdiction. Well, I think that's unique in this master's program, is that when you compare it to the different, the other tax programs, that this one focuses directly on international taxes and doesn't just focus on one tax system, but gives you a broader view of all systems around the world and how to compare them. What we did before we started the master, we did a survey amongst multinational companies, amongst governments, ministry, finance, big consulting firms, accounting firms, law firms. All those institutions and entities were involved and we made a survey. We asked them, would you be willing to hire graduates from our master and the response was really overwhelming, positive. Actually, the majority of those entities, bodies, they answered yes, we are very interested in hiring those people. And that's what we offer you, that holistic view to put it in an academic term, this helicopter view, that's the basic idea. How does taxation influence decision-making processes at the level of M&E's, multinational enterprises on the prices and at the level of governments? There are always two sides.


From mobile phones packing the power of a laptop computer to tiny MP3 players that let us carry our entertainment anywhere, the digital revolution is clearly underway. And nowhere is it more evident than along the paths and hallways of our college campuses. Using devices discreet enough to fit in their pockets, today's students chat with friends in far-flung networks, scroll through just-in-time news updates, and capture and share snapshots of the world as it unfolds around them. They catalog their lives in an ever-growing journal of tweets, blog posts, pictures, and videos, and they collaborate with little regard to time, place, or identity in an always-on connection to an expanding sea of information. If we follow their lead, if we watch the world through our learner's eyes, the blueprints for our campus learning environments might reveal a similar balance between physical collaboration and virtual interaction. If we designed our spaces with today's students in mind, they might blur the lines between time and place. They would be flexible, collaborative, focused on creation and sharing. In the labs and virtual spaces around the world, that vision is already underway. Join EDUCAUSE now as we take a brief look at the future of learning environments. By its very definition, the lecture hall once conjured images of a single lectern and a sea of bolted-down chairs. But today's formal classrooms put students at the center of knowledge building and content creation, encouraging learners to turn around in their chairs, discuss with their peers, or simply toss their own ideas onto a screen. The faculty member is no longer at the front of the room but walks between students, offering guidance or coaching through content. New classroom designs promote flexible furnishings, allowing single rooms to morph from lecture hall to small group discussion or seminar debate. They use seating that fosters rather than stifles discussion, encouraging teams to share ideas with each other and their classmates. Technology is not merely included but woven through the space, allowing uninterrupted access to rich media, social networks, and the vast resources of the Internet. And, in some cases, the classroom itself is part of the lesson, transporting students from reading about their disciplines to taking an active part in discovery. We're also learning more about when students learn, and it's not just during class time or within the four walls of the classroom. Our informal learning spaces, libraries, student unions, campus cafes are increasingly morphing into places for collaboration, discovery, and discussion. Attractive, comfortable furniture lures undergraduates to convene impromptu meetings in the hall. Pervasive technology gives students access to the cutting-edge tools they crave to create and build content. Projectors and alcoves create opportunities to test drive presentations and share ideas with peers. Informal spaces are no longer just about quiet contemplation and reflection. They often become sources of energy, creativity, and collaboration, places where students can connect to one another and to institutional resources in a single hub of learning. Taking flight to get a closer look at the Sistine Chapel's details, experiencing a hallway through the eyes of a schizophrenic patient, watching a tsunami crash on a nearby shore. Situations we once would never have dared to dream are now within our grasp through virtual environments. Online worlds, like Second Life, immerse students in discovery, allowing them to talk with classmates around the world from their desktop, assuming the role of travelers, doctors, journalists, or entrepreneurs in virtual space, or simply take field trips to see places and have experiences not possible within the physical realm. Any space, a bumper car, a pyramid, a virtual representation of Edgar Allan Poe's house becomes a meeting place, a classroom, or a space to discover. Using high-performance networks and cyber infrastructure, students can link in to the very tools that scientists use in the field, running their own experiments with nanotubes or simulating earthquakes for more than a thousand miles away. Or they can simply walk through experiments in a virtual setting, working their way through complex problems and scenarios. I think the essence of life is motion. I think what drives mobility is the same thing that drives our fascination with moving pictures. It drives our fascination with something as simple as travel. There is something in the essence of being an animal that etymologically means being able to move. It's what the poor turnips and radishes are unable to do, except in limited ways. So there's something, I think, essentially human at the heart of our experience of being embodied that has to do with motion. It's no longer about accessing information from a single place. It's about carrying that portal in your hand. Using mobile devices and location-aware technology, today's classrooms are not merely transcending the physical and virtual spaces. They are constantly in motion, relying on mobile phones, laptops, tablets, cameras, and MP3 players to take learning mobile. Books can be downloaded and browsed with the click of a button. Course content captured and consumed while sitting at the bus stop or waiting in line. It's not just about the ways we consume content on the go, but the new ways today's mobile environments are allowing students to create it. Pictures can be captured in the field and instantly geotagged, creating rich maps to uncover patterns. Audio and video can be gathered on the street or in the field, turning students into citizen journalists. And rich online data can be superimposed over the physical world, creating rich multimedia experiences that blur the lines between what we see and what we can learn. Content is no longer in a single place. It's accessible in any place.


Oh yeah, no, I just feel like we're all feeding off of one another. I feel like we're all just attacking right now and it's awesome to see how, like you said, everybody's making plays. And yeah, I mean, I just feel like we, like I said during camp, you know, all of us, we were just working every single day and I felt like we built that chemistry and now we're kind of just playing off of one another and just going out there eating as a group.   But yeah, no, I mean, like you said, I feel like we all bring something to the table. And I think the coaches do a great job putting us in positions to succeed for all of us to be out there. I mean, I feel like that's every game. Our position is like one of the most important for us to affect the game. But yeah, I mean, we didn't really care who was playing quarterback. We knew they were going to run their offense and him being banged up. I mean, every game we know we got to go out there and affect the game in our position room. So I mean, it didn't really matter. But I mean, it certainly helps. I just felt like there's no panic on the sideline from us. We just started to take it to play at a time, which is what we should be doing. But I mean, that stuff happens. But we bounced back and we did what we needed to do in the critical situations. Oh yeah, for sure. No doubt. I feel like I'm playing my best ball right now, to be honest. So I'm just doing my part to affect the game. You guys as a unit really tightened up in the Wetsong. How critical is that today? How much of a confidence is that going forward? Oh yeah, no. I mean, that's definitely a key for us on defense to force them to kick field goals in the red zone. And we know that in the red zone, it's a lot of scheme. But we all knew that if everybody just did their job in the red zone, that we have a chance to have a lot of success down there. And I just think that's what it, I think everybody was just focusing and taking it to play at a time. It led to us getting stops.


Have you ever wondered about EOS, the cryptocurrency designed for decentralized app creation? EOS is a unique digital asset crafted with the intention to foster and promote the creation of decentralized applications or DApps. As of now, it's sitting comfortably at rank 78 in the vast crypto market. EOS is more than just a token. It's a catalyst for innovation in the blockchain sphere. Now let's talk numbers. The current price of EOS hovers around 74 cents. With a trading volume that has been known to reach upwards of $87 million in just 24 hours. Quite impressive, isn't it? And when we consider the market cap, which is pushing past the $824 million mark and the circulating supply of over 1 billion EOS coins, we begin to grasp the sheer scale of this crypto asset. EOS is not just another cryptocurrency, it's a platform with a purpose, a token with a mission. It's showing signs of upward momentum and it's not slowing down, but what's next for EOS? EOS appears to be gaining momentum, but what might the future hold? Let's delve deeper. Like all cryptocurrencies, EOS has experienced its fair share of price fluctuations. To understand the dynamics of these fluctuations, let's delve into some recent trends. In the past 24 hours, the price of EOS has oscillated between .677 dollars and .743 dollars. This demonstrates the volatility inherent in the crypto market, where prices can swing up or down within a relatively short time frame. Now, let's talk about a couple of key indicators that can help us better understand these price fluctuations. The Relative Strength Index or RSI and Bollinger Bands. The RSI is a popular tool among traders and analysts providing insight into the momentum and sentiment of the market. An RSI value of 52.73, like we see with EOS currently, indicates a balanced market sentiment. In other words, the buying and selling pressures are roughly equal, giving neither the bulls nor the bears a definitive edge. On the other hand, Bollinger Bands are a type of statistical chart characterizing the prices and volatility over time. When the bands are narrow, as they are for EOS at present, it suggests a relatively stable trading range. However, this stability can be a precursor to significant price movement as periods of low volatility often precede periods of high volatility. So, while EOS is currently experiencing a balanced market sentiment, the narrow trading range suggests there could be some movement on the horizon. It's a fascinating world. The world of cryptocurrencies where a multitude of factors interact to drive price changes. And as always in this world, the only certainty is uncertainty itself. Did you know that EOS has a dedicated community working towards its technical advancement? This is where the EOS Node Operator Roundtable comes into play. This group is a collective of individuals who operate nodes, critical components in the EOS blockchain network. The Roundtable serves as a platform for these operators to discuss, debate, and brainstorm on developments in the EOS ecosystem. From optimizing network performance to enhancing security measures, the Roundtable is a hotbed of innovation and problem solving. Their discussions shape the path of EOS, influencing its adaptability, resilience, and future potential. The EOS Node Operator Roundtable is more than just a meeting of minds. It's a testament to the power of community involvement in blockchain technology. This active community involvement is a positive sign for the future of EOS. Now let's talk about future predictions for EOS. The future is always uncertain, especially in the world of cryptocurrencies. However, we can always look at expert predictions to get a glimpse of what could be in store. So let's dive into some of these predictions for EOS. Our first forecast comes from digital coin price. They foresee an impressive potential increase of 242.42% for EOS by 2026. This is a significant rise, and if it holds true, it could mean substantial returns for those invested in EOS. Next up, we have predictions from walletinvestor.com. They are a bit more conservative in their estimates, predicting an EOS price of $3.845 by 2025. While this is still a considerable increase, it's less than what digital coin price predicts. However, it's important to remember that these are just predictions, and the actual price may vary. Finally, we have coin codex's predictions. They foresee the EOS price reaching $0.75787 by 2025. This prediction is even more conservative than walletinvestor.com, quote, s, comma. But it's still an increase from the current price. Overall, these predictions paint an optimistic picture for the future of EOS. They suggest that EOS could experience significant growth in the coming years. However, as with all predictions, they should be taken with a grain of salt. Cryptocurrency markets are volatile and can be influenced by a multitude of factors. While these are just predictions and actual results may vary, it's clear that there's potential for significant growth in EOS. EOS is often compared to Ethereum, another major player in the world of smart contracts. On the surface, they share similarities both aimed at facilitating decentralized app creation, a revolutionary technology that's changing the way we interact with digital platforms. However, it's the differences that make the competition interesting. EOS, for instance, prioritizes scalability and boasts a high transaction speed, making it an appealing choice for developers who need to handle a large volume of interactions. Ethereum, on the other hand, is renowned for its security and robustness, having laid the groundwork for smart contract development. Yet, EOS is making strides. Its recent upward momentum in the market, coupled with the ongoing technical advancements discussed in the EOS node operator roundtable, indicates a promising trajectory. Moreover, EOS's potential growth in the long term, as predicted by various analysts, suggests it could become a formidable contender to Ethereum. Whether EOS will surpass Ethereum remains to be seen, but it's certainly a space to watch. So what have we learned about EOS today? Quite a bit, actually. We've dug into EOS, a crypto token designed to foster decentralized app creation, currently sitting snugly at rank 78. We've seen it flex its muscles with some recent upward price momentum, despite the inherent risks associated with crypto investments. We've also delved into the EOS node operator roundtable, shedding light on the technical advancements that are driving the EOS ecosystem forward. These advancements are crucial in understanding the future trajectory of EOS. We've explored a variety of price predictions, ranging from just under $1 to a whopping $37.58 by 2033. Some experts even predict an increase of 242.42% by 2026, and let's not forget the competition. EOS is stepping up to the plate to challenge Ethereum in the realm of smart contract development. It's a David and Goliath story, and we're all eager to see how it unfolds. While the future of EOS, like any cryptocurrency, is uncertain, the potential for growth is clear. As always, do your own research and make informed decisions about your investments.


All right. Our next speaker is not a newcomer to DEF CON. It sounds like this is his third time here. Give him a hand up. And we were talking. It sounds like we're going to hear some fun stories about OPSEC. We all love that, huh? All right. So big round of applause again for Tomer Barr. Hi, everybody. Who came here to have some fun? Yeah. So I'm going to give up this one, okay, for the one that will shout the loudest during the presentation. I will give you the sign when to shout. I will give you a sign. Okay. So let's begin. Okay. My name is Tomer Barr. I am currently leading a safe bridge labs as director of security research. And my main focus is on vulnerability research and nation state APT research. This is my third time in a row at DEF CON. So I'm so excited to be here. Thank you. Okay. So I will start by describing the research assumptions and approach. And then I will describe the operation security of our first APT threat actor and continue with several examples of large scale cyber crime threat actors. And then we'll turn to different state sponsored threat actors. So stay tuned. The research state of mind is focused on understanding the adversary, both the nation state and the cyber criminal that launch attacks on the western world. If we can win this mind game, we can understand their plans, motives, tactics, and techniques. So every research start with assumption, right? So let's describe them. The first assumption is that advanced threat actors is not necessarily the same as strong operation security. And you will see unbelievable mistake later on. The second assumption is that some threat actors are lazy and feel comfortable. Even after a research report was published about their specific activities. So they continue as usual. And last it will be a very good idea to study them in their backyards. So in order to understand their plans, their targets, to do damage control, and so on. And I developed this UPSEC meter. You can see it. And for comparing different threat actors operation security mistakes. And the grade is from zero bad points. It's the best to the 100 bad points. There are 10 categories. Each category can give 10 maximum points. And the categories measure how much data we can gather on victims. Attribute the attacker's identity and how much we can influence their campaign to do a take down, temporary take down, or a disinformation attack, and so on. So in the next hour, I will present those APTs. So whenever you see this symbol of the hour meter, just shout your grade from zero to 100. And at the end, you can get a flag. Okay. So our first threat actor is located in the Gaza Strip. It has been active since 2012. So they have a decade of malicious activity. Attacking both windows and Android targets. In 2017, it was first discovered. The threat actor has self developed a web panel with two-factor authentication login. The problem was that navigating directly to the inner pages resulted in full access to the system with no authentication required. So yeah, it's funny. On the right, you can see the exfiltrated keelogs of the victims. So it's blurred for privacy, right? Quantum leap to 2022, the threat actor is still active and masquerading as Google play up. And the malware was uploaded from Gaza by one of the victims or by the attacker themselves for testing purposes. And the certificate was also signed in Gaza. The malware has plenty of collection capabilities like SMS, call logs, contacts, record audio, and much more. And the exfiltration is done via HTTP post request. And the malware exfiltrated data to this URL via post. So the Laravel code, the backend code of the C2 server expects a post request. But when sending a get request instead, an error invokes and expose the MySQL DB credentials. So it's unbelievable, right? It's crazy. You should see me when I saw that. It was crazy. And all C2 servers are vulnerable. Here are the credentials of the Windows-based victim database. The former one was the Android victim database. So on 2017, the first stage malware code downloaded the second step malware. And the name was DDD.zip from the C2 server for U.net. And the name of the folder was five times the letter Z. On 2022, a sub-domain of the same domain was used. Up.palforU.net. And this time, the CCC directory holds all the victims exfiltrated data. So I will show a demo in a few moments how to download all the victims' data. I was able to map almost 8,000 victims. Most of them in the Gaza Strip, but others in other Middle Eastern countries. So the amount of exfiltrated data is huge. Almost 500 compressed megabytes is the average exfiltrated data for a day. And our estimation is that the total size of the exfiltrated data is between at least 2 terabytes to 3 terabytes. Another mistake which we will see it's very common among ultra-attractors is OpenDeer's C2 servers. So as we can see, the C2 server was updated at February 2022. Let's check if this is a one-time mistake. And of course not. The C2 server is OpenDeer and include a 12-megabyte file in the domain name of the C2 server called Tawaji or something like this .zip file, which includes the full backend logic. Because if you try to download the backend code from just by surfing, you cannot do it because it's a PHP or SPX or something like this. It's not downloadable. But when they leave a compressed folder of all of the stuff, all of the content in the website, I can download it. So I get the source code of the C2 server. Thank you, thank you. So the upload philogic is done well using a unique ID to randomize the uploaded file name and make it difficult for hackers to find a potential web shell they uploaded because you cannot predict the file name. And the upload itself is limited to a specific file type by a white list, which is good. But on the other end, the Node.js revealed the upload path of where the files will be uploaded to, which is bad practice eventually. Okay, so let's see a little demo. So we will serve to the CCC directory. You can see all of the files arranged by date, so it's very convenient. We will download one of them, the smallest one. It's like 150 megabytes. And then there is a password. I brute-force it. And it will extract all of the files. I will sort it and see the, I will show you the file types that are included. It's like screen captures and images from the phone, from the Android phone. And also a lot of voice recording using the microphone of the Android device. So you see a lot of files in just one day. I have like one ear of that stuff. And I will just open one of them and show you that it's working. Just a second. Is it moving on? Sorry. Never mind. Believe me, it's working. It's demo. Even if it's pre-recorded, it's not working. Okay, so that's your time to shout. What do you think the score should be? I give it 47. I see you, I see you. You are leading. You are leading. Okay, for now, for now. Okay, so as you can see, they failed because I was able to build a victim hit map, understand the attack vector, access the C2 backend code, and so on. Okay, so different retactors will do different mistakes. So we can compare them using the OPSEC meter. Okay, moving on to a different retactor. This time, it will be, I will focus on a threat attack or cyber crime activity in Iran. And I will describe the five steps that are required of the infection chain, one by one, and the OPSEC mistake they have made. But generally speaking, they are up to stealing credit cards.  And let's describe it. So on the left is a partial list of the C2 server that were alive at the time of the check. It was the middle of January this year. And one of them stored the entire code on the pay.zip file at the C2 server. So the same mistake like we saw earlier. So I downloaded the zip file. And the victims are found in different second hand online market sites. One of the sites is called divar.ir. And the left script extract phone numbers from published ads on divar. So if you want to sell something, I know your car or something like this, you just publish an ad with your phone number and they have an API to extract all of the phone numbers of victims in Iran. The script on the right will send them a threat phishing text message via telegram. Okay, this is funny. The full victim list is textual and downloadable. Phone numbers are available in the users.lst file which is downloadable. But even more funny, the C2 server internal files are exposed. Even the bash history command output is available to download. So I don't believe it. I found plenty of smishing glues. Threat of arrest in 72 hours and in Iran it's scary. COVID-19 payments and even dating site. When the victim tried to chat, he will be threatened to pay or his details will be sent to the government. And he is redirected to a payment site. And the sites are all open here. So the payment allegedly can only be done via an Android app. You can see it on the bottom left. It's done automatically. And it's a dual attack. So they spy on the SMS to get the two factor authentication codes and also redirect the payment on the attacker fake site to fish his victim credit card. So the malware, the Android malware just exfiltrate all the SMS messages. And decompiling the Android malware, we can see that the resource files hold the phishing URL back there. And here is the PHP page that uploads the victim SMS. This is the back end code to the server using out coded text file name. This is not a bad practice. And exfiltrated SMS are also textual, predictable and downloadable. So it's very convenient. And the file name here is Lydia team.txt. Please remember the Lydia, we'll come to it later. And we can also see, it's hard to see, I know, the incoming SMS messages. And in this case, they tried 16 different phishing glue messages in order to infect this specific victim. So it's crazy. And this is a fake payment site masquerading as a legit government pay site. So at the top, you can see the IP address, they even don't have the domain name for the C2 server. But below that, it's the URL of a real payment site in Iran. So the victim is allegedly redirected to a legit government site. But it's a fake page and the credit card is stolen. This is the back end code for stealing the credit card. The details are collected and sent to the attacker telegram group. And the subject of each exfiltration is new card received. I don't know if you can see it, but there is a typo there. And it will help us later. User credentials are exfiltrated as well. And querying the telegram group, this is where it becomes interesting, using the telegram bot API includes a valid invite. So it can see mark in blue. And just copy pasted and I'm a new member of their private groups. Yeah. It was very interesting. In this case, thank you. In this case, the victim SMS data and credit card are split into three groups. And they have all the data there. The data telegram group is misconfigured to display all group members and hackers without even joining the group. Thank you. The SMS and data group are not private. All members are administrators. Everybody is welcome to join. But without access to the messages themselves, so it's a problem. I joined with my real name, Tomer Bar, to all groups and stayed there for a while. But there was no access to the messages by new members. You can see my name here at the top. I used my real name, my real telegram account. And all of the other are Iranian hackers, right? So I didn't have access to the messages. But the card group is not private. And all data is accessible using the telegram bot API called get updates. I will use it a lot during this research. And then I found the group they called so good. And it is like the main group. And pay attention to the user, Babazor. Username is one of the threat actors. We will focus on it later on. And so good allows access to all messages without being required to join. So I was able to join, but I didn't need to. Hundreds of credit card details are listed. And on the left, we can see that one of the site was detected by Chrome to be a malicious site. And they exchanged messages between themselves. Let's do that. Let's do that. And on the right, we can see shared malware files. And even attackers' voice messages between themselves. I don't know if I'll see language, but it's interesting. And a deeper analysis, you can see it's amazing, revealed massive activity. Hundreds of malware samples and hundreds and thousands of C2 servers infrastructure. So it's kind of a big infrastructure, so I was curious. And believe me, this is just the tip of the iceberg. Let's continue. A simple Google search reveals that Lydia team, the name of the file that we mentioned before, is a user who is active in the professor phishing telegram group. So he has an academy degree. And which includes 15,000 members. Searching for new card received in Google with the intentional typo, seen before, returned with a second group, Zalem phishing. And the result includes stolen credit card. So in Google, you can get the stolen credit card, yeah? And Baba Zoro is our own so good team member, is the owner of Zalem phishing telegram group with 30,000 members. So it's a big shot there. And I found many Iranian phishing group. Some of them have a few members. And those was the most interesting group. But up to 80,000 members for just one group. And the large group are usually used for exchanging or selling phishing kits or stolen goods. And I was able to join all of this group. And much more. Like 20 groups. And I had like 100%. But there was just one group called the must leak, which requires approval by admin. So I said, I sent him a joint request with my real name, Israeli, and got an approval. So I have 100%. Okay, so let's go technical. Decompiling the malware. Focus on the Lydia TXT class. It's the Android malware with the name of Lydia. And the exfiltrated SMS data are messages, sorry, were uploaded to the C2 server. And the randomization of the name was done on the malware side. So no victim unique data was used. So if the malware upload the file name, victim.txt, it will be victim.txt on the C2 server. And the file name was a number with a five digit. So very hard to guess. And I developed a brute force tool to download all the exfiltrated files. The Android C2 server is based on a fire-based API and also telegram-based API developed in Python. And one of the attacker is, let's do attribution. We know it's Iranian. But who is it? One of them is called Amir Ranjabar. And his testing is on malware, on his own machine. So never do it. Never do it. And one of the SMS is from an Austin provider confirming his newly registered domain, which is the C2 server. And it's called sanayran.xyz. So now we know it's darker, right? Maybe it's in charge on the C2 server's infrastructure or maintenance, I don't know. But we have his name. But that's not it. I have his SMS's because he ran it on his Android device. So I have his account number, international bank of Iran. And his phone number. I have two phones. One ends with 85 if you can see it. And full address at home if you can want to visit him. And the attacker also offer hacking services in a, I don't know, like professional hackers. And using the same phone number. So we have a cross that it's a real phone number. It appears that leading team is selling and promoting their phishing and Android malware services with three possible plans. So you can choose from a basic plan to a full phishing as a service plan. And they offer dozens of phishing kits for customers. Let's say customers. For example, Instagram account phishing, but you can see a list of all the sites that they duplicate and are used as a phishing loose. And they use a pyramid structure. The bot is given for use in return for 20% of the collected credit card. So I Google translate it and this is the translation to English. And the SMS spy, I gave it a 65. What do you think? Save it. This one, this one. Yeah. Second. Okay. Okay, let's continue. So I ask myself if this telegram bot API is commonly used by other threat actors. And the reason and the answer is totally positive, right? So a simple pivoting on the API.telegram.org, the official site using virus total graph. Provide me with positive answer. We have found actually two types. Executable with hard coded telegram bot API tokens and chat IDs. And also C2 back end code kits that were uploaded to virus total by, I don't know who, but it's there. So it's easy to find it. And the second type is more, I found it more interesting and I developed an automated script to download all chat and check if they are still active because it can be like uploaded like six months ago or something like this. And I got a lot of active groups and I have their tokens so I can control some of their activity. And the first interesting case, this is a new threat actor. It's called, they call themselves Ukraine logs. So think about the former attack and this group used malware to steal cryptocurrency from Victor machines. And it's a very large scale operation. We'll see it in a minute. And they used dozens of malware and loaders. But one of the interesting one was a loader that download and execute Mars stealer, which is a fourth of a Vidaar stealer, if you know it. And Mars stealer actually steals two factor authentication and cryptocurrency. And the code is packed with unknown packer. And the main function was actually so complex and it was even too big to even been displayed in idograph. So it was a very sophisticated packer. But I just try it on and locating the correct address in which to place the break point was quite easy. It's like old school. And after that I have the unpacked version. So I started to analyze it and found that this info stealer is interesting because of three checks that is doing anti detection checks. First it uses anti-emulation against Windows Defender. I didn't know that at that time. But Windows Defender and they knew. Windows Defender is using a fixed computer name used by the emulator. So if they just check what is the computer name, if it's equal to HAL 90H, they know that they are in an emulator. So that's a good practice. But the second one is it's exit if it's being run from Russia and nearby countries. So we have a little bit of a tribution here. But trust me, we'll get much more info later. And so they just check their language and decide if it's Russian or not. And the third one was exploration check. So it was limited to one month from compile time. And if you try to run it as a researcher after this month, it won't do it. And it's packed. So it can be difficult for some. And the attack is still ongoing. This is a tool to de-obsticate strings that I wrote. And the sample is not public. And the C2 server was not known until now, but I will publish all the details today. Also found the telegram group API key used by this group to exfiltrate screen captures. The loader also downloads and executes the final GoLang info stealer from a legit site. And the GoLang malware is a cookie stealer. It's very complex. It steals off of the tokens. In fact, a lot of victims in large scale, mostly via YouTube links. So I will give some example. But let's first discuss the GoLang malware. So I don't know how much of you tried to reverse engineer GoLang malware, but it's a nightmare. And there are some tools. And Jags at recon presented one that is better than what I used here because it was before. But we can see that I used an IDA script. When running it, I had an 8300 unrecognized function. And after running it, the rename function button, the script was able to detect 2,000 of them. So it was very helpful, but still complex. And as I said, the infection vector is through publishing YouTube links to an encrypted executable. And as we can see, there were 20,000 results on the right, only for the 0909 password encrypted malware instance. So there were different instances. And only for that instance, there are 20,000 different YouTube links. And this detector also is smart. And it's published the link on a crypto app-related site. So it's logical because they want to steal cryptocurrency and wallets. So people that are interested in crypto movies, so probably they will have a better chance to have wallets on their computers. And also on video sharing platforms. So if you are using it, be careful. And back to the info stealer loader code. This is very interesting, I think. I used the Telegram API, a different one, GetChat, and got an invite link. I was able to join the attacker telegram group and become the 10th member for months. And I was able to download all past messages, even before I joined, and get in real-time all messages from now on. So I'm like in between. And on the left, you can see the configuration of the malware. We can see that it was configured to collect, it's hard to see, but it was configured to collect screen captures and victims environmental data such as OS, IP, and hardware ID. In the middle and on the right, you can see the exfiltrated victim screenshot and exfiltrated environmental data from the attacker telegram group. So we have a match. And using a simple tool to download all victim screen captures, and I have 35,000 script captures of different victims. So it's like open for almost everyone. We can see some example of the stolen data, which include both cryptocurrency and you can see also NFT theft, they like NFT a lot. And hundreds of wallets were exfiltrated and top balances can reach thousands of US dollars. And the attacker also exfiltrated the 12-word passphrase of wallets like MetaMask and the password. So from that point, the attacker can control the victim's wallet. 27% of the victims are located in the US. The exfiltrated cookies are for wide range of services like beginning with PayPal, Amazon, games, bank, cryptocurrency wallets, Google Pay, and stake.com which runs crypto betting platform. So let's speak about the attribution. The first indication of the attacker origin is that all C2 server were located in Russia. So it's not surprising, right? In addition, the spoken language of the attackers is Russian, and they tried to hide it by replacing it with English after a while, but I have all the messages so I know they are Russian. And I was able to discover the attacker's IP located in Russia, the exact IP. And the first 8,000 of the exfiltrated data messages originated from the same IP in Russia which was used by the attackers for testing purposes. Again, don't do it. And later as a C2 server. On the bottom, we can see that this is a red line info stealer that connects to the same IP address of the 8,000 messages. And it's also using the red line stealer bot ID Onyx 0.1. So I used another telegram bot API function. It's called get chat administrator. And we found that the group has six administrators. So nine hackers myself, but six of them are administrator. And one of them is Onyx 0.1. And the second is called P2 memory. And then I found that Onyx is a creator of threads for selling stolen tokens. And the second admin is P2 memory. And they are chatting with each other. And I don't know their real identity, but they are real people. So let's speak about a little bit about takedown. The bot is administrator. And I could create, edit or revoke the invite link so nobody can join. And I can also temporarily take it down by blocking all members. Or I can even set a web hook to automatically transfer all messages to savebridge.com, which you can see was done successfully. So all of the victim messages, I didn't try to catch them. Just stop them from reaching the real C2. And they temporarily lost all victims. But probably they could easily recover from this attack. So I gave them the same score. You know, don't need to shout anymore. We have different mistakes. Okay. This one is very, very interesting because I'm monitoring them for almost a year now. It's still going on. And those are Turkish threat actors. They call themselves Ekmek, Tekensi or something like this. In English it means the bread boat. And they're referring all the stolen cryptocurrency as bread. Bring me bread and so on. So the bread boat. And they steal cryptocurrency with a different approach from the Ukran log. Ukran logs try to infect machine and steal the cryptocurrency wallets. They are using zero infections techniques. So let's describe them. So the PHP code redirects the exfiltrated data from the C2 web server to a telegram group. In addition, the PHP code saves it to a local C2 server file named test.txt. And the victims clicks on the connect wallet button as you can see on the top left. And enter the metamask passphrase this time. And this is a phishing page which writes the passphrase to the test.txt local file. Okay. The attackers are working very hard to promote their phishing glues. So they are paying Google for advertising their phishing sites. And the C2 server is the third result in my Google search above. So they are doing good work. And they also target victims using telegram and other social networks via Twitter ads for example. As we can see on the right, the ads include a link to their metamask phishing site. So by now, you know the drill. I joined via the invite link and download all messages. But after a short while, they sent me a message in Turkish, which I don't understand. And I was immediately kicked out. So I thought, is this the end?  So I just wrote a script to automatically download updates using GetUpdates API and was able to monitor all the messages in the group until now for almost a year. And the script also transited the messages, the script that I wrote, transited the messages from Turkish to English, so it will be easier for me. And the bot API is probably revealing here the attackers ruining wallet address and passphrase. So I can control the wallet. And on the bottom, they are sharing additional wallet addresses. The main C2 server includes 1,400 phishing domain names. And from October 2021, and it's still active every day. Every day there are new domains. And the second phishing server, which is still active also, is implemented crypto scram with different techniques. The dumbest method is like promise to provide profit if you just send them your crypto. So don't do it. And the other C2 servers exfiltrate the passphrase to local files or to Google forms. I understand their attack in details. And the attacker's plans, the entire attack in details. They stole $30,000 in just two hours. And then the boss set a target of $100,000 for this day. And on the bottom we can see that they share the admin credentials to manage all their different C2 servers. But it's not legal to use it. And it's not required because they did a lot of mistakes. And all the Tractor Actors C2 servers reveals the stolen user passphrase. So this is just an example. But believe me. And this is another example of an unconfigured Laravel backend like we saw earlier. And exposing the db credentials and up key when the expected parameter is not provided. So they expected a special parameter. I didn't provide them that. And they just print the password. The same exposed data is accessible by a second method by browsing to the .env file which is textual and includes the same credentials. The Tractor Actors invested a lot of effort in phishing NFT and the attacker is bragging in telegram that he has stolen 25 Ethereum and at that time it was worth $75,000 using phishing glues on the famous NFT sites. As we can see the C2 server is open here and the main JavaScript includes the Tractor Actors wallet headers. They're using stolen credit cards in order to pay for the C2 server. And they also purchase stolen red line stealer credentials. They're also using different services in order to turn the stolen cryptocurrency into cash including virtual credit card and laundry sites. We can see the address here. We can see the attacker's wallet address and withdrawal operation. So I'm monitoring all of their activities. And they steal money directly from victim bank accounts in order to pay for Google hats to promote their phishing web like we saw earlier. Here is another example of their active phishing activity which is done a bit differently using additional telegram groups. They also build a pyramid scheme to recruit members. Each member is allegedly participating in mining cryptocurrency based on the Tron protocol but actually NFT and cryptocurrency is stolen. As we can see the print screen here demonstrates how the threat actor used public tools like SQL map to take over websites, legit websites. And they also upload web shares to different vulnerable sites. It was like a huge campaign. And the attacker shared the entire C2 server code using the telegram group that I am in. And I got all the databases. So the info table stores the victim private keys. And we can see that simple Google search is for what the admin hash reveals that it's the password 1, 2, 3, 4, 5, 6. Amazing. The login leads to a Chester Finish admin panel which is query the local collected victim wallets DB. The above cloud drive includes 300 gigabytes of victim exfiltrated data. It's not live anymore but I have all of it. I will give it to the proper relevant agencies to look up a little bit and report back to the victims. Let's speak about attribution. Believe me it will be funny. The entire conversation is telegram is Turkish so we know for sure they are Turkish. We can see that the attackers are not using VPNs to manage their C2 server and because they exchanged all of the C2 server code so I have it. So the C2, the C panel last login file includes the IP address from Turkey so that's the real address. But on 25 of June after more than eight months of monitoring, one of them published a competition at R10.net. It's a public site forum for the logo for the new site player.com which is just a phishing site and the username in the R10 forum is called Morat. Morat can attack. This led me to a bingo because I found a Twitter account with his photos and he tagged it as a blockchain account and a few days later he also got a message from his garage to collect his car with his real name and license plate number and so you can see that it's a real name and on the right when you surf on Chrome you can sign in with your account and you have the pictures of your account, right? So if you can see on the right it's the picture of the other attacker. I have it from the print screen that they share between themselves. So these two members joined the Telegram group for a short while and they are four members. One of them is a member of the two HAC forms and also register domains and sometimes you get to know your adversaries more than you ever expected. So that's it, that's it. So this is his Telegram account and I will skip and I will speak a little bit about Tunisian threat actor which got the worst grade, 78 bad points. I will skip it because we have only five minutes. I have more interesting stuff later. So they do the same mistake, open the here, compress the files, but what was very terrible is that I got all of his victims, victim data, they have 12,000 victims but he registered the Telegram group with his real name. So I have his real name, not a nickname and I was able to find his LinkedIn account is working as a security consultant by day in a legit company and by night he's doing attacks against victims and I also found his Google certificates both on sending it on the Telegram attackers group and it's the same certificate on his public LinkedIn account. So on the bottom you can see the tab with his real name of his Facebook account. So I have a lot of crossing and it's a verified data. So I will skip two different Iranian nation state threat actors. They did Apple bypass, two-factor authentication bypass for iCloud. It's a new technique. I got all of the source code because of their operation security mistake and I will share all the slides and all the details on the site and also other platforms but I don't have enough time to speak about it. I want to speak four minutes about this threat actor. This actually is a good, I don't know if it's a good but it's the best operation security threat actor that I've ever seen and it's an Iranian nation state threat actor is the most persistent ones that I know of. It's been acting, it's been active since 2007 so 15 years of operation. That's a lot and I am monitoring, I first discovered it in 2015 and wrote a lot of reports on it and also did a takedown on 2015 and they lost all of their very targeted victims. They were oppositioners to the Islamic regime and they were very targeted for seven years and they lost, the Iranian lost all of the access to all of their victims and returned in 2017 with the learn from the mistakes and they got with a very secure, upset infrastructure so they used two mechanisms. One is very common, the DGA which is a domain generation algorithm. Each week 100 different domain names were used as a C2 server so sync call is much difficult from the 2015 version where there were just like three outcoded domain names but most interestingly is the second mechanism which is they use C2 signature verification in order to verify that they are speaking with the real C2 server because I reverse engineer the DGA code, understand what will be the next domain name, purchase those domain names before them and all the victims connected to my site but when they, I have only their IPs because when they download the signature files which is encrypted with the private key which I don't have, only the attackers have, they can verify that I'm not, this is not a legit site and just move on to the next server which will be verified. So this means that it's very hard to take them down and from 2017 until 2022 you can see that there were some reports about this group but no one is able to do anything to arm their operation and I worked for it about three years, it was like a live mission and recently I found the weakest link in the infi chain, the transmission of files from the C2 server in Europe to their attackers in Iran. So to make things short, I developed a script, I connect to the C2 server and downloads all of the victims data and I also found that they encrypted it in asymmetric key so I cannot open it because I don't have the right key but some of it was not encrypted and I have some metadata that I was able to deosucate and I have the user name, the host name of the victim, the path to the store on the C2 server, the toner version which is toner is the second step tool, it's a very sophisticated tool which allows them to monitor and surveillance all of the victims data and toner in French is thunder and the first tool is called lightning, so just one minute. So the lightning, the thunder comes after the lightning so I'll just finish with a demo, it's 20 seconds and I release you. Okay so you can see that I'm downloading, I get a list of all the files in the C2 server in real time with their sizes and the URL to download them and then I will run the same script with the all parameter and it will start downloading, it's a little bit small but believe me it will download all of the files, I will skip because it will be short, so I have a directory which is sorted by all the victims IPs and we can see all the infiltration data. Okay I'm finished, so sorry for this blast and thank you.


Today I was going to buy this Tuko from Music IDTV and this is used the new so Apple has finished this $400 million acquisition of Shazam. Now Shazam has 1 billion downloads in the app store and it is also one of the top apps considered when radio promoters are trying to promote a new song to radio to try and get them put in a rotation. Reason being is because you can only Shazam one time when you Shazam a song it will stay in your records as one time it's been Shazam. So when you take the Shazam data of a song it's probably one of the truest untampered with pieces of data that the industry looks highly upon. So another cool thing about this is the fact that Apple has already had top billing on Shazam but now it will be even easier because I do believe that Apple will be going to integrate even more so with Shazam. Being able to convert Shazam discovery into a revenue generating stream even more so with this acquisition. Of course I feel like Apple is definitely trying to compete with Spotify. Doing everything it can to try and gain the lead on Spotify clearly we've talked about how Apple's growth rate is higher than Spotify right now so Apple is on the course to become the number one streaming service. If Spotify can hold its own I'm not too sure we shall see because Apple has made this acquisition and I think it's going to drive even more traffic to Apple meaning for you you might want to consider making sure your music is available on Shazam so you can make sure you get those conversions to revenue generating streams. The way you can make sure your music is on Shazam you have to go through a third party two of which being Tunecore and CD Baby amongst others like Ditto Music and a couple others but Tunecore and CD Baby are some of the most popular ones that a lot of us use out here in the US. I'd say you might want to consider marketing your Apple Music presence as well as your Spotify presence because now Apple Music has another lead in to get people to discover and listen to your music via the platform. Beyond that be sure to share with a friend like and subscribe for more videos once again my name is Tuko and this is you the new Sayonara people.