John Hammond on What It Actually Takes to Hunt Cyber Criminals
September 17, 2026
AI Summary
5 min readThe VOA Korea Phish: Inside a North Korean APT Operation
John Hammond, a threat hunter at Huntress, recounts a chilling investigation that began with what looked like a routine alert and ended with the discovery of a state-sponsored espionage campaign targeting a high-ranking official at a sensitive organization. The story reveals just how sophisticated—and deceptively human—cyber attacks have become.
The Google Update That Wasn't
The investigation started when a Huntress researcher spotted something odd: a scheduled task named "Google Update" that was actually a Visual Basic script. The script pulled data from a Google Drive document—a document that appeared empty to anyone who looked at it directly. But the filename itself was a long string of gibberish, and that gibberish turned out to be encrypted code. When the script decrypted it, the document became a "stager" designed to download and detonate additional malware.
Following the breadcrumbs, Hammond's team found more implants, persistence mechanisms, and eventually a full remote access trojan with command-and-control capabilities. Cross-referencing the tradecraft with published research, they identified the adversary as Kimsuky—a North Korean advanced persistent threat (APT) group. "Stakes are a little bit high," Hammond says dryly.
The Alice Guardrails
Continue reading the full summary in the app — free to try.
Read Full Summary →Free • No credit card required
Never miss an episode of Cyber Crime Junkies
Get every new episode summarized in your inbox — free, ~5 minutes to read.
No spam. Unsubscribe anytime.
What you'll learn
- 1 (03:56) **Huntress Discovers a North Korean APT Attack** - John Hammond recounts a real-world investigation where a scheduled task named "Google Update" turned out to be a malicious Visual Basic script.
- 2 (06:57) **The Malware Had a "Guardrail" - It Only Targeted One Specific User** - The attacker's code checked the computer's hostname and username before executing the next stage, ensuring it only detonated if the user matched a specific target.
- 3 (08:14) **Full Toolset Found: Keylogger & Browser Sniffer** - The investigation of EDR alerts uncovered a PowerShell-based keylogger and a C#-based browser sniffer designed to steal text from open web pages.
- 4 (08:54) **The Big Question: How Did They Get In?** - The team traced the initial access back to a phishing email, but needed the victim's permission to look through their email and downloads folder.
- 5 (10:19) **The Smart Trick: A Password-Protected Zip File** - The antivirus had scanned the zip file but failed to analyze it because it was password-protected, a clever way to evade detection.
- 6 (11:11) **Inside the Zip: A Macro-Enabled Word Document** - The zip file contained a Microsoft Word document with macros that checked for endpoint protection software before executing.
- 7 (12:06) **The Social Engineering Masterpiece: A Multi-Email Conversation** - The attacker, impersonating a real Voice of America reporter, built trust over several emails before sending the malicious document.
+ Full timestamped outline available in the app
Show Notes
John Hammond interview.
Topics: experts who hunt cyber criminals, behind scenes cyber criminals, behind the mask cyber crime gangs, best ways to limit cyber attack liability, breaking cyber crime news, breaking cyber crime stories we need to know, cyber crime gang discussions, cyber crime gang under cover, cyber crime gangs under cover, cyber crime news we all need to know, examples of cyber crime gang activities, exposed secrets of cyber crime gangs, exposing cyber crime gangs.
Come join us this year as we celebrate the 20th anniversary of the importance of cybersecurity awareness month!
Subscribe to our YouTube Channel for FREE: @Cybercrimejunkiespodcast https://www.youtube.com/channel/UCNrU8kX3b4M8ZiQ-GW7Z1yg
For more real cybercrime stories, visit our website at https://cybercrimejunkies.com.
True crime enters our homes and businesses daily. Learn from actual people who fight it daily and show you how in a thriller story. The Moving Target Trilogy. Book 3 to be released September 22nd, 2026. Start with any of them. Be a Moving Target.
Special Author pricing (30% off)
The Moving Target Trilogy. Book 3 to be released September 22nd, 2026. Start with any of them. Be a Moving Target.
Special Author pricing (30% off)
Growth without Interruption. Get peace of mind. Stay Competitive-Get NetGain. Contact NetGain today at 844-777-6278 or reach out at [email protected] or find more at www.NETGAINIT.com
Want to Watch?
Subscribe and stop reading about it after it happens: https://www.youtube.com/@CyberCrimeJunkies?sub_confirmation=1
Hosted by David Dean Mauro. Former trial lawyer, AI Security Advisor, FBI InfraGard member, VP of Strategic Growth at NetGain Technologies, and author of the Moving Target Trilogy (#1 Amazon Hot New Release, 2026).
MOVING TARGET TRILOGY. Nonfiction cybercrime thrillers. 🔥 4 years. 400+ interviews.
Book 1, Art of Online Camouflage: https://shop.ingramspark.com/b/084?params=d0YQ1pYtxeBRmSQLHLb9uT4aOliPrEuDSfOjQgpXQP9
Book 2, Obedient Machine: