A tiny 12 KB Windows backdoor, one victim, and a dead domain

(Presented by State of Statecraft: A security and intelligence conference that brings together multiple disciplines, backgrounds, and nationalities to share research into the covert activities of nation-states and other malign actors.)

Three Buddy Problem – Episode 109: The buddies dig into a new White House memo handing vetted private companies real offensive cyber authorities, and Costin explains why a stack of ransomware takedown cases has been sitting on a shelf waiting for exactly this.

Plus, a tiny 12 KB Windows backdoor found on one machine with a dead C2, the mercenary outfits quietly living inside telcos, and why Google continues to flounder in the race for AI dominance.

Cast: Costin Raiu, Ryan Naraine and Juan Andres Guerrero-Saade

Timestamps:
0:00 Introductory banter
0:58 State of Statecraft, and a late CFP window
3:24 The White House offensive hacking memo
6:37 “Hack back” is the wrong frame for what’s being authorized
11:20 Ransomware cases sitting on the shelf
17:01 The million-dollar bond and who can realistically play
22:29 Where DPRK crypto theft falls under the new definitions
28:15 Would TLP Black take a contract?
36:55 Gen Digital’s 12 KB backdoor hiding its C2 in desktop.ini whitespace
46:57 Passive DNS, registration patterns, and pivoting on a dead domain
57:32 Feeding a one-off find back into detection engineering
1:02:14 Metador, Mafalda, and the mercenaries who love telcos
1:17:07 Armored Likho and what “Western APT” really means
1:28:16 The IOC market, private reporting, and CTI’s matching problem
1:58:10 Google’s culture problem, the weekly model churn, and Patch Tuesday math

Links:

• Transcript
  
• White House memo on private sector offensive operations
  
• Trump admin wants to allow companies to hack cybercriminals
  
• Custom Windows backdoor found on a single corporate machine
  
• New Armored Likho tools target Telegram and eavesdropping
  
• Multi-Agent AI Framework Used to Compromise Government Entities in Asia
  
• Anthropic Risk Report – August 2026
  
• The Metador Enigma: Unveiling an Unattributed Threat
  
• Report | The Mystery of Metador
  
• Armored Likho’s new weapon: BusySnake Stealer
  
• How We Caught Lazarus’s IT Workers Scheme Live on Camera
  
• Behind the exit of Google’s DeepMind CEO
  
• US to tell partners they must pick sides in AI race with China
  
• Microsoft Patch Tuesday 422 CVEs
  
• CVE Attribution & MSRC Reporting Dashboard
  
• State of Statecraft (Brussels)