Ep.

42: ENCORE: North Korea’s Monster Fake Out

[OMINOUS MUSIC]

DINA TEMPLE-RASTON: North Korea began this November in an unusual way: by launching
nearly two dozen missiles in a single day.

[MISSILE SOUNDS]

TEMPLE-RASTON: And then, just weeks later…The big one.

[MISSILE]

ABC NEWS: Breaking news overnight, North Korea test fired an intercontinental ballistic
missile.
LA LOCAL NEWS: The ballistic missile launch today landed near Japanese waters…
NBC: …But experts say the missile had ranged to strike the entire US mainland and US
officials were quick to respond.

TEMPLE-RASTON: That missile landed in the sea, just 130 miles west of Japan. And clearly
North Korean leader Kim Jong-un wanted people to know this launch was special, so he
brought along an unexpected guest.

CNN: The North Korean leader was there with his wife and, for the first time, his daughter —
believed to be around nine years old.
CNN: These images appear to show them holding hands as they inspect a powerful
intercontinental ballistic missile.

TEMPLE-RASTON: Maybe it was “bring your daughter to work” day in North Korea or maybe
she was there so he could send the message that he had finally launched the missile he’d
been hoping for. Something called the Hwasong-17 missile, which is thought to be able to
carry multiple warheads all the way to the U.S. Kim has been trying to get that one off the
ground for years.

A team of open-source researchers we talked to earlier this year are skeptical that the
November launch was successful. You see, they’ve been analyzing North Korean missile
launches for years, and when the country claimed to have successfully launched this
monster missile back in March, they had some doubts.

1
So, we thought, while we’re on a short holiday hiatus so we can work on new episodes for
next year, we’d replay our chat with the team over at the Middlebury Institute in Monterey,
California, to put this latest launch into context.

As always, thanks for listening.

TEMPLE-RASTON: Okay, so, so why are we talking to you today?

JEFFREY LEWIS: I have no earthly idea why you want to talk to me, but if you make me
guess I would imagine it is some combination of being interested in all the horrific and
terrifying things that North Korea is doing and being interested in the interesting ways that
we go about tracking that.

TEMPLE-RASTON: That is exactly right. That is why we want to talk to you.

[MUSIC]

TEMPLE-RASTON: Jeffrey Lewis is an arms control policy expert and the director of the East
Asia Nonproliferation Project at the Middlebury Institute of International Studies at
Monterey.

Back in March, North Korea did one of those terrifying things.

NBC NEWS: We begin with breaking news, North Korea has launched a suspected long
range ballistic missile toward the sea this morning, the first time since 2017.

RTE NEWS: Japanese officials said it flew 1,100 kilometers and fell in Japanese waters.

NBC NEWS: Officials say the launch suggests that North Korean leader Kim Jong-un may be
creating a missile system capable of striking the U.S.

TEMPLE-RASTON: North Korea has been testing two kinds of ballistic missiles:

A short-range one they say they’d use on U.S. forces should they ever invade from South
Korea or Japan, and another long-range missile they call the Hwasong-17…

2
People in the nonproliferation community, like Jeffrey, have a nickname for it: the “Monster
Missile.”

LEWIS: This is a missile that can take not just one, but many warheads, all the way from
North Korea to the United States.

TEMPLE-RASTON: So back on March 24th, the North Koreans announced that they’d
successfully test launched the big one.

And they were so giddy about it, they released this video, and this is the actual music from
it.

[MUSIC]

LEWIS: They released this crazy video, um, that had Kim Jong-un, like, looking dramatically
at his watch, wearing crazy sunglasses. You know, it was this really over-produced video to
say that the missile had worked.

TEMPLE-RASTON: The video is unintentionally hilarious. Kim Jong-un is wearing a Top

Gun-like leather jacket, and he’s walking in slow motion.

He’s flanked on either side by two generals.

An enormous mobile launch vehicle is slowly trailing along behind them.

The video shows the missile powering up, and then about four minutes in, lift off.

[EXPLOSION SOUND]

There’s smoke, the missile rises into the air, the music swells, and then the camera cuts to
Kim and a bunch of generals punching the air and applauding.

The whole production suggests that the Great Leader has created a missile that will allow
him to threaten – really threaten – the U.S. with nuclear war.

But Jeffrey Lewis and his team of satellite analysts aren’t so sure everything is as it first
appears.

3
LEWIS: Yeah, I know, this is so confusing.
BEN MUELLER: Does this look right?
JOHN FORD: It’s very difficult to verify anything.
MUELLER: This is sparking our interest.
LEWIS: I don’t think this matches.

[MUSIC]

TEMPLE-RASTON: I’m Dina Temple-Raston and this is Click Here, a podcast about all things
cyber and intelligence.

Today, a story about a North Korean missile launch, a team of satellite image specialists,
and a painstaking search for the truth.

For the first time, Jeffrey’s team will publicly reveal why they believe that North Korea’s
monster missile launch in March was an elaborate ruse.

And what they found may surprise you…

TEMPLE-RASTON: So how do you, how did you catch this?

LEWIS: It's a really good question. How, when one goes about noticing something like this, I
think there probably has to be something slightly wrong with you. [LAUGHS]

Stay with us.

[BREAK]

[MUSIC]

LEWIS (PODCAST): You are listening to the Arms Control Wonk podcast, a podcast on arms
control, disarmament and nonproliferation. I’m Dr. Jeffrey Lewis, a professor at the
Middlebury Institute…

TEMPLE-RASTON: The audience for Jeffrey’s podcast is a bit self-selecting.

4
He has experts and grad students talk about the secret doings of nuclear states, and North
Korea is a perennial topic.

They chat about the latest missile launches…

LEWIS (PODCAST): This ended up being f***** missile week.

TEMPLE-RASTON: …Joke about the Great Leader’s smoking habits.

LEWIS (PODCAST): Well he was smoking again, too. Yeah, he’s back to smoking.

TEMPLE-RASTON: And the continuous theme running through it all?

LEWIS: We know that North Korea doesn't always tell us the truth.

TEMPLE-RASTON: What may be more surprising is that Jeffrey views these propaganda
films, like the one that came out at the end of March, as incredibly instructive. Because…

LEWIS: When you catch someone in a lie, then you've learned something really interesting
about what they care about, you know, what they want you to think and you know, what
they want you to not know.

[MUSIC]

TEMPLE-RASTON: Like, for example, Korean leader Kim Jong-un’s preoccupation with a
particular part of his anatomy.

LEWIS: My favorite thing that North Korea loves to lie about — which they've stopped doing,
so I'm a little disappointed — but they always used to adjust the size of Kim Jong-un's ears.
Apparently the man thinks his ears are too big, or at least he did. Um, they've given up on
doing that, but we would just see image after image after image when they had made his
ears a little bit smaller. I don't know why you would do that, but they did.

TEMPLE-RASTON: So he clearly cares about his ears.

LEWIS: He clearly cares about his ears, yes.

TEMPLE-RASTON: It seems Kim wants the world to think he has delicate little ears.

5
LEWIS: His ears look totally normal to me. I don’t see what the problem is. But, you know,
maybe you should see a therapist about that. [LAUGHS]

[MUSIC]

TEMPLE-RASTON: Kim’s latest video does tell us one thing about the Great Leader: he is still
incredibly focused on missiles — and their size.

Though those productions only reveal so much.

So to see what’s really going on, Jeffery and his team zoom out, and turn to satellites to
help fill in the blanks.

PLANET LABS VIDEO: Tiny inexpensive earth imaging powerhouses, delivering data on
demand.

TEMPLE-RASTON: That’s a promotional video from Planet Labs, one of the hundreds of
satellite companies now offering clients snapshots and panoramas of Earth.

PLANET LABS: Our constellation of nearly 200 earth observation satellites currently orbiting
earth is the largest ever.

TEMPLE-RASTON: Right behind Planet in terms of sheer coverage is the Chinese Ministry of
Defense.

Satellite reconnaissance can today offer everything from a glimpse into the black boxes of
reclusive regimes to the strength of an enemy force.

Satellites were once only the purview of governments and spy agencies, but now business
people, environmentalists and researchers like Jeffrey can look at imagery of the past to
inform the future.

LEWIS: One of the things that's changed about satellite imagery over the past decade or two
is now there is so much of it. And with so much of it, you actually kind of get some choices.

TEMPLE-RASTON: You can choose from high-resolution images to make out cars and even
individuals.

6
Or moderate resolution – so a building shows up, but a car would look like a smudge.

But these choices have trade-offs. High-resolution images only give you a picture of a very
small area…

LEWIS: It is like looking at the earth through a drinking straw.

TEMPLE-RASTON: So you need to know exactly what you’re looking for, and exactly where to
look.

Moderate resolution is a little more forgiving. For example a satellite company like Planet…

LEWIS: They try to take a picture of the whole earth every day at about three meters in
resolution. And so that gives you a ton of coverage.

TEMPLE-RASTON: It becomes like a kind of time-lapse photography.

LEWIS: You try to watch all the moderate resolution stuff all the time, so that, you know, to
say, Oh, hey look. Something interesting is happening here.

TEMPLE-RASTON: And then you ask the satellite company to take a high-resolution picture
there.

That’s what happened a couple of years ago when pictures came out of Kim Jong-un touring
this factory where it was believed North Korea was making crucial parts for short-range
ballistic missiles.

One of the images had Kim looking at this map that suggested the plant was about to
undergo a huge expansion.

So Jeffrey and the Middlebury team now had a place to look.

A huge expansion of the plant – if it were true – would be an important thing for the world
to know. It would mean that North Korea was stepping up its short- and medium-range
ballistic missile program.

But what if it was a head fake – like Kim’s ears?

7
So Jeffrey and the team started to dig.

LEWIS: When we found the place he visited, they had not started the expansion yet. So it was
just this tiny, tiny, tiny little facility.

TEMPLE-RASTON: So they tasked a high resolution satellite, with that soda straw view, to
take some pictures – over the course of several months – of North Korea knocking down
buildings at the plant and building new ones…

And then Jeffrey and his team told the world:

LEWIS: Uh, this expansion is happening.

[MUSIC]

TEMPLE-RASTON: When he’s at the Institute in Monterey, Jeffrey tends to sit in the graduate
research assistant room.

LEWIS: I don't work in my office. I have a very nice office. Um, it has a lot of books in it. The
one thing it does not have, or the other human beings that I need to be successful and feel
fulfilled at work.

[MUSIC]

TEMPLE-RASTON: And he’s put together a kind of super smart Team America.

LISA LEVINA:​My name is Lisa Levina. I’m a graduate student researcher…

STEVEN DE LA FUENTE: Steven De La Fuente…

JOHN FORD: John Ford….

TRICIA WHITE: Tricia White…

MICHAEL DUITSMAN: Michael Duitsman…

TEMPLE-RASTON: And you're Ben, right?

8
BEN MUELLER: Yes.

TEMPLE-RASTON: And they called you Mr. Computer?

MUELLER: Walking computer, I think Tricia said. [LAUGHS]

TEMPLE-RASTON: Their superpower is microanalysis: the uncanny ability to see those little
things – the incremental changes – and give them meaning.

And like Team America, they specialize.

Lisa Levina speaks Korean and models rockets.

Tricia White among other things finds clues in social media.

John Ford has this incredible ability to remember if he’s seen something before and actually
place it.

MUELLER: Something that just came out earlier today to John...Kim Jong-un is sitting at a
really big table. And [John] is like, Oh, is that in this place? And I'm like, yes it is. He knows the
exact table. He knows what places in North Korea where they would meet to have a certain
type of meeting and have a really big table and what those pictures kind of look like.

TEMPLE-RASTON: Pretty cool ability. And they’re always asking questions like…

BEN: What is normal? What is expected? What is weird?

TEMPLE-RASTON: When we come back, how Lewis and his team caught Kim Jong-un in a big
lie.

Stay with us.

[BREAK]

9
MUELLER: My name is Ben. Um, my background is actually a little bit weird in some ways for
a lot of people in this field because I come from more of a STEM engineering background.

TEMPLE-RASTON: Do you have a last name Ben?

MUELLER: Mueller. Ben Mueller. yeah. Sorry. [LAUGHS]

TEMPLE-RASTON: That’s Ben Mueller, the so-called human computer, and he’s one of the
researchers at the Middlebury Institute in Monterey.

He and his colleagues are constantly looking at satellite imagery and then cross referencing
it with lots of open source information.

MUELLER: A lot of the long-term projects, we note down sites that we want to pay attention
to, and we might go back to it and look at what's the new satellite imagery every few weeks.

TEMPLE-RASTON: How did you know where to look?

MUELLER: That’s a really good question because if you don't know what you're looking for
and you're just open to whatever is happening, you can interpret things that are just normal
as being wrong.

TEMPLE-RASTON: So the team makes a point of looking at regularly updated satellite

images over extended periods so they can see changes over time.

MUELLER: Like, let's go not just look at it now. Let's look at five years ago, let's look at it 10
years ago. Let's look at it, um, from whatever information we can get available. And that's
where as well, like working together as a team and bouncing ideas off each other, like, does
this look weird or is this something that makes sense? Or am I just reading into it? A lot of
that is where the collaborative part of open source really matters.

[MUSIC]

TEMPLE-RASTON: When Jeffrey first started watching North Korea, back in the 90s, its
nuclear ambitions were a bit of a joke.

10
LEWIS: We thought they wanted a nuclear weapon, but it wasn't all that clear that they
could actually get to the point of having one. It was a threat that we kind of thought of as
being abstract and a thing we'd like to prevent, but not something that felt pressing.

TEMPLE-RASTON: Turns out a lot of people were wrong about that. It was pressing.

And today North Korea has an extremely large and well-developed missile program.

LEWIS: They used to name the missiles after local places. Pretty soon they ran out of towns
and just started numbering them. Uh, and we're up into the thirties now. And North Korea
has done six nuclear tests. And so, uh, at least for someone like me, there is no doubt that
North Korea can put a nuclear warhead on a missile and send it all the way to the United
States.

TEMPLE-RASTON: But the U.S. can deal with that, it gets more complicated if there is more
than one warhead on a missile, which is exactly what North Korea is working on.

LEWIS: What they really want to do is put multiple warheads in the missile so they can
overwhelm our missile defenses.

TEMPLE-RASTON: And the Hwasong-17 Monster Missile was designed to do that, except…

LEWIS: So this guy, Colin Zwirko was the first person who said, I don’t think this is right.

TEMPLE-RASTON: Zwirko is a senior correspondent for NK News based in Seoul.

LEWIS: And that's music to our ears because that is like waving a red flag at a bull. And my
whole team was like, well, let's check that out.

DUITSMAN: There are tools online that you can use to measure the angle of the sun at a
particular time of day and determine which direction the shadow should fall.

TEMPLE-RASTON: That’s Michael Duitsman.

He kind of specializes in measuring shadows, so he looked at another North Korean missile

launch, just days before, on March 16.

11
DUITSMAN: We could compare the direction the shadow would fall at the two different
launch times and determine how that compared with what was seen in the video.

TEMPLE-RASTON: They realized the video was made using footage from two different
launches

SPEAKER: I do remember being in the office and Jeffrey slamming his hand on the desk and
thinking this was like a really big deal.

TEMPLE-RASTON: Is that true? Does he slam his hand on the desk a lot?

MUELLER: Well, occasionally in a good excitement, right? Yeah. [LAUGHS]

TEMPLE-RASTON: Jeffrey pulled up an image from the North Korean video to give me an
idea of how they’d pieced it together.

It’s a wide angle shot from above, a few scattered buildings, some trees, a road, and a long,
dark blob – which looks like that launch truck in the propaganda film.

LEWIS: The first image the truck is sitting at kind of a funny angle. And if you look really
closely, you can see this white spot and that's the missile standing up on end.

TEMPLE-RASTON: Yes. It almost looks like a microphone lying on its side with a little sort of
white at the end.

LEWIS: That's right. Yes. You should be in radio. And what's notable about this is there's
enough detail in this drone image that you can tell exactly where on the road this truck is.
And you can see that it — again — it's at this kind of slightly funny angle.

TEMPLE-RASTON: Then he shows me the second image from Planet Labs. It’s a satellite
picture from March 16, almost ten days before the Hwasong-17 launch was supposed to
have happened.

LEWIS: it's a very high-resolution image, and it's exactly the same spot. You can see all the
same buildings. You can see the same fields. The road looks the same, even the damage to
the road is identical. And you can really see that detail and the truck is gone, but there's a
black kind of smear. And that smear is the burn scar.

12
TEMPLE-RASTON: The kind of burn scar you get from a fiery missile launch.

LEWIS: It's kind of half a rectangle because the burn mark traces the outline of the truck. It's
almost like you went and looked at Kim Jong-un and, and you asked him like, Hey, did you eat
those brownies? And he says, No, I don't know who did it. But he's got chocolate smeared all
over his face. I mean, it's just such a perfect giveaway.

TEMPLE-RASTON: Here’s the thing: When Jeffrey and his team go back to the satellite
images from March 24th, the day the North Koreans say they successfully launched the
Monster Missile, those burn marks aren’t there.

LEWIS: And I don't see any evidence that it was launched.

TEMPLE-RASTON: No evidence of a launch either that day or in that place.

So how do you launch a monster missile without leaving a trace? Well, that started them
thinking.

LEWIS: We had already looked at the position of the sun in the video.

TEMPLE-RASTON: That didn’t add up either.

The launch on the 24th was supposed to be in the afternoon, but the position of the sun in
the video suggested it was filmed in the morning.

And then there was the issue of the way the Monster Missile was actually flying – nothing
like the team had expected.

DUITSMAN: We had built a model of the Hwasong-17.

TEMPLE-RASTON: That’s Micheal Duitsman again.

DUITSMAN: A numerical model and knowing what we did about the engine and the
propellant and everything else, we expected it to accelerate at a certain rate. And it did not.
It accelerated slower than that, which was kind of a red flag.

[MISSILE SOUND]

13
DUITSMAN: Which meant that either our model was wrong or there was something wrong
with the missile.

LEWIS: It's really this kind of really chaotic iterative process, where what you're trying to do
is pull in all this data and compare it, organize it, try to make it, make some sense, realize
what you're missing, and then go get that data. And you just kind of do it over and over and
over again.

TEMPLE-RASTON: Jeffrey says while he may be pounding his fist on the desk at various
times in the process, there’s rarely an “a-ha” moment.

LEWIS: What more likely happens is you start to realize what the answer is. You know,
there's almost a kind of gravity that the truth has where it's clear that one answer is simpler
than the other is one answer explains all the evidence pretty well.

TEMPLE-RASTON: So the results of the team’s investigation – revealed here for the first time
– pointed to this:

LEWIS: They tested two missiles in March. One that worked and one that didn’t. The simplest
answer is that they launched the big one on the 16th. They filmed it. Kim Jong-un was there.
But it blew up so they couldn't announce it. So they came back a few days later, they
launched a different missile that they were pretty sure would work.

TEMPLE-RASTON: Then they release a big, splashy video.

LEWIS: In order to imply it had worked.

TEMPLE-RASTON: Lewis said he doesn’t know where exactly they launched that second
smaller missile from, but it obviously wasn’t from the same spot of the airfield with the
burn marks that the satellite images captured.

JOHN LAUDER: The secret sauce in looking at imagery are the signatures. It’s one thing to
say, okay, Here's a picture or a video of a missile launch. But it's all the little things to go with it,
like burn marks and the trailers in the background and the vehicles that are in the back
that help over time to offer a real sense about what's going on.

TEMPLE-RASTON: That’s John Lauder. He used to serve as director of the CIA’s

Nonproliferation Center.

14
LAUDER: I'm a believer in those capabilities and what folks like Jeffrey Lewis are doing. The
downside is of course, well, it starts to reveal a bit about how one goes about looking at
imagery. Maybe the North Koreans are a little smarter next time putting together videos
that might give something away.

TEMPLE-RASTON: Lauder says next time around, Kim’s team of propagandists might be a
bit smarter.

And there will be a next time. This particular failure to launch doesn’t mean North Korea
has given up trying.

LEWIS: And what worries me is if you talk to South Koreans, when you ask them about these
tactical nuclear weapons, they say well South Korea has conventional missiles. And so the
best thing to do is before Kim Jong-un uses his tactical nuclear weapons, we can use our
conventional missiles to kill him.

TEMPLE-RASTON: But of course that logic has an inherent flaw.

LEWIS: So we are in a situation where North Korea looks at security and its nuclear weapons
and say, in a crisis, we have to go first. And the South Koreans look at their conventional
missiles and the North Korean nuclear threat. And they say in a crisis, we have to go first.
They both plan on going first. And one of them is wrong about that.

TEMPLE-RASTON: Kim Jong-Un may have given up on making his ears look smaller…

He’s unlikely to shake his obsession with the Hwasong-17.

Jeffrey says eventually, he’s going to get that missile to succeed.

LEWIS: And one of the things I'm concerned about is we're not really emotionally ready to
have that conversation.

[MUSIC]

This is Click Here.

[MUSIC]

15
[B SEG MUSIC]

TEMPLE-RASTON: Yanluowang is a name from Chinese mythology. He was the ruler of hell,
and it also happens to be the name of a ransomware group. They broke into CISCO and
Walmart last year. But the group ran into a little trouble recently: someone leaked some of
their chat logs to the world.

Jambul Tologonov, a cybersecurity researcher over at Trellix, took a deep dive into the
messages and said they revealed some very interesting things.

TOLOGONOV: And the first thing I noticed is that their conversations were all in Russian.

TEMPLE-RASTON: Which is kind of weird if your name is Yanluowang. Though Jambul said
cyber security researchers had pretty much already decided they were Russian hackers who
were just pretending to be Chinese.

TOLOGONOV: Yanluowang was discovered last year around October by Symantec. Um, and
they were involved in mainly hacking high profiled western organizations.

TEMPLE-RASTON: It turns out these kinds of chat logs are a goldmine. Earlier this year the
chat logs from a ransomware group named Conti were leaked, and it provided all kinds of
clues about how they were organized, what kinds of hacking tools they used, and how they
interact with other ransomware groups.

Jambul figured this latest bunch of chat logs, leaked via Twitter in late October, could
provide the same sort of intelligence on Yanlouwang. And I asked him how this kind of
research works.

TOLOGONOV: The first thing is to download the original messages. And then I usually write a
Python script because then it's easier to read for me in Russian messages.

TEMPLE-RASTON: Jambul is originally from Kazakhstan.

TOLOGONOV: I try to put them in a chronological order to have a good understanding who's
talking with whom.

16
TEMPLE-RASTON: And after he does this with the Yanlouwang chats, it very quickly becomes
clear that a key guy in the group is someone who goes by the name “Saint.”

TOLOGONOV: We don't know who his Saint is, but based on what I observed, he seems to
be.. he's a lead or boss.

TEMPLE-RASTON: What gave him that idea? Because Saint talks about paying someone’s
salary, and he’s telling someone else how they should design the page where the group
posts information they’ve stolen. And Saint isn’t just a Yanluowang guy.

TOLOGONOV: We've managed to actually locate other monikers or nicknames of his. So one
of them is, uh, “sailormorgan32.” That was a very interesting discovery because we knew
that sailormorgan32, last year, he posted on the Dark Web that they've managed to hack
Sonic Wall.

TEMPLE-RASTON: SonicWall, that’s a big hack from last year. SonicWall specializes in
firewalls for Virtual Private Network. Basically security for your VPN. And cracking into them
means that hackers were able to break into all kinds of organizations that used their
security products. Saint said in the chats that the SonicWall hack made them lots of money.

TOLOGONOV: He claimed they managed to get 5 million from the organization. We don't
know, obviously, if the claim is true or not.

TEMPLE-RASTON: Researchers like Jambul love to analyze these kinds of leaked chats
because it allows them to observe hackers with their guard down, and it gives a view of how
these ransomware groups not just work internally, but how various groups fit together.
Jambul said that the pool of hackers isn’t huge and they seem to know each other.

TOLOGONOV: They have good channels of talking with each other, communicating and
finding the way of, uh, exchanging some intelligence like that is, that was quite fascinating
for me.

TEMPLE-RASTON: What always strikes me as crazy about these leaks is that these hackers
don’t encrypt their messages, which, you’d think, is Hacker 101.

TOLOGONOV: That was quite also an interesting thing for me, um, that in that way, at least
some part of the messages would've been encrypted, and then it, for me, as a security

17
researcher, would've been very difficult to construct the context. What was the conversation
about? And here it was, just as soon as you pre-process the messages and put them in
chronological order, as a Russian speaker, you can easily read it.

TEMPLE-RASTON: When the Conti leaks came out earlier this year, everyone said it would
spell the end of the group. And that isn’t exactly what happened. There’s an assumption the
group just broke apart and found other people and other ways to continue with operations.

Jambul says he doesn’t think these leaks will put much of a dent into Yanluowang’s core
operation either.

TOLOGONOV: Their operation halted and their leak page is, uh, not available at the
moment. They'll probably just join other ransomware groups.

TEMPLE-RASTON: And live to hack another day. This is Click Here.

[HEADLINES MUSIC]

TEMPLE-RASTON: Here are some of top cyber and intelligence stories of the past week:

Hackers are taking advantage of all the turmoil at Twitter, according to new research from
cybersecurity company ProofPoint. One of the new Elon Musk features is having user pay a
monthly $8 fee to receive a blue “verification” check. So allegedly it shows you are who you
say you are. A short time later, researchers saw a huge increase in phishing campaigns
targeting media and entertainment groups, celebrities, journalists and other notable users.

The phishing campaigns tried to entice users to enter their username and password as part
of a billing regime for the new service. The report was released shortly after Twitter’s
engineer team was gutted and the platform’s multi-factor authentication systems has been
on the fritz.

18
The Record reported this week that the Civil Contingencies Committee, the cabinet
committee that is supposed to deal with major crises, has been snowed under with
ransomware incidents.
This year ransomware accounted for 18 nationally coordinated responses because, among
other things, hackers targeted a water utilities company and a software supplier for the
National Health Service. Sources told The Record it shows how little progress has been
made on ransomware prevention in the U.K..

And finally, a small island country in the South Pacific has been scrambling to respond to a
cyber attack that’s knocked out email and government services for more than a week.
Vanuatu is home to some 300,000 people and is considered one of the happiest countries
on Earth according to the Happy Planet index, though it was made decidedly less so when a
cyber attack hit in early November.

The hackers decided to strike less than a month after the election of a new government. A
favorite time for hackers. The Sydney Morning Herald reported that Vanuatu refused to pay
a ransom so hackers responded by disrupting essential services including tax collection,
police, hospitals and schools. Australian cyber police are helping Vanuatu rebuild its
networks. It’s still unclear who took aim at such a happy place.

[THEME MUSIC]

TEMPLE-RASTON: Click Here is a production of The Record by Recorded Future. I’m Dina
Temple-Raston, your host, writer and executive producer. Sean Powers is our senior
producer and marketing director. Will Jarvis is our producer and helps with writing. And
Karen Duffin and Lu Olkowski are our editors.

Darren Ankrom is our fact checker. Ben Levingston composes our theme, and our other
music is from Blue Dot Sessions.

And we want to hear from you. Please leave us a review and rating wherever you get your
podcasts, and connect with us by email: Click Here [at] Recorded Future [dot] com or on our

19
website at ClickHereshow [dot] com. I’m Dina Temple-Raston. And we’ll have something a
little different for you next Tuesday. We’ll see you then.

20