John Hammond on What It Actually Takes to Hunt Cyber Criminals
September 17, 2026
AI Summary
5 min readThe VOA Korea Phish: Inside a North Korean APT Operation
John Hammond, a threat hunter at Huntress, recounts a chilling investigation that began with what looked like a routine alert and ended with the discovery of a state-sponsored espionage campaign targeting a high-ranking official at a sensitive organization. The story reveals just how sophisticated—and deceptively human—cyber attacks have become.
The Google Update That Wasn't
The investigation started when a Huntress researcher spotted something odd: a scheduled task named "Google Update" that was actually a Visual Basic script. The script pulled data from a Google Drive document—a document that appeared empty to anyone who looked at it directly. But the filename itself was a long string of gibberish, and that gibberish turned out to be encrypted code. When the script decrypted it, the document became a "stager" designed to download and detonate additional malware.
Following the breadcrumbs, Hammond's team found more implants, persistence mechanisms, and eventually a full remote access trojan with command-and-control capabilities. Cross-referencing the tradecraft with published research, they identified the adversary as Kimsuky—a North Korean advanced persistent threat (APT) group. "Stakes are a little bit high," Hammond says dryly.
The Alice Guardrails
Continue reading the full summary in the app — free to try.
Read Full Summary →Free • No credit card required
Never miss an episode of Cyber Crime Junkies
Get every new episode summarized in your inbox — free, ~5 minutes to read.
No spam. Unsubscribe anytime.
What you'll learn
- 1 (03:56) **Huntress Discovers a North Korean APT Attack** - John Hammond recounts a real-world investigation where a scheduled task named "Google Update" turned out to be a malicious Visual Basic script.
- 2 (06:57) **The Malware Had a "Guardrail" - It Only Targeted One Specific User** - The attacker's code checked the computer's hostname and username before executing the next stage, ensuring it only detonated if the user matched a specific target.
- 3 (08:14) **Full Toolset Found: Keylogger & Browser Sniffer** - The investigation of EDR alerts uncovered a PowerShell-based keylogger and a C#-based browser sniffer designed to steal text from open web pages.
- 4 (08:54) **The Big Question: How Did They Get In?** - The team traced the initial access back to a phishing email, but needed the victim's permission to look through their email and downloads folder.
- 5 (10:19) **The Smart Trick: A Password-Protected Zip File** - The antivirus had scanned the zip file but failed to analyze it because it was password-protected, a clever way to evade detection.
- 6 (11:11) **Inside the Zip: A Macro-Enabled Word Document** - The zip file contained a Microsoft Word document with macros that checked for endpoint protection software before executing.
- 7 (12:06) **The Social Engineering Masterpiece: A Multi-Email Conversation** - The attacker, impersonating a real Voice of America reporter, built trust over several emails before sending the malicious document.
+ Full timestamped outline available in the app
Show Notes
John Hammond interview.
Topics: experts who hunt cyber criminals, behind scenes cyber criminals, behind the mask cyber crime gangs, best ways to limit cyber attack liability, breaking cyber crime news, breaking cyber crime stories we need to know, cyber crime gang discussions, cyber crime gang under cover, cyber crime gangs under cover, cyber crime news we all need to know, examples of cyber crime gang activities, exposed secrets of cyber crime gangs, exposing cyber crime gangs.
Come join us this year as we celebrate the 20th anniversary of the importance of cybersecurity awareness month!
Subscribe to our YouTube Channel for FREE: @Cybercrimejunkiespodcast https://www.youtube.com/channel/UCNrU8kX3b4M8ZiQ-GW7Z1yg
For more real cybercrime stories, visit our website at https://cybercrimejunkies.com.
True crime enters our homes and businesses daily. Learn from actual people who fight it daily and show you how in a thriller story. The Moving Target Trilogy. Book 3 to be released September 22nd, 2026. Start with any of them. Be a Moving Target.
Special Author pricing (30% off)
The Moving Target Trilogy. Book 3 to be released September 22nd, 2026. Start with any of them. Be a Moving Target.
Special Author pricing (30% off)
Growth without Interruption. Get peace of mind. Stay Competitive-Get NetGain. Contact NetGain today at 844-777-6278 or reach out at [email protected] or find more at www.NETGAINIT.com
Want to Watch?
Subscribe and stop reading about it after it happens: https://www.youtube.com/@CyberCrimeJunkies?sub_confirmation=1
Hosted by David Dean Mauro. Former trial lawyer, AI Security Advisor, FBI InfraGard member, VP of Strategic Growth at NetGain Technologies, and author of the Moving Target Trilogy (#1 Amazon Hot New Release, 2026).
MOVING TARGET TRILOGY. Nonfiction cybercrime thrillers. 🔥 4 years. 400+ interviews.
Book 1, Art of Online Camouflage: https://shop.ingramspark.com/b/084?params=d0YQ1pYtxeBRmSQLHLb9uT4aOliPrEuDSfOjQgpXQP9
![](https://shop.ingramspark.com/b/084?params=S3F9zWWMC2y2eYiTmUGP91Owy9AUVG4zbLa6NwuX3cl</div> </section> <section class="bg-white rounded-2xl p-6 border border-gray-100 flex items-center gap-4"> <img src="https://storage.buzzsprout.com/jhn4d6a0qfm43bytkm4q4zmsgp88?.jpg" alt="Cyber Crime Junkies" class="w-12 h-12 rounded-lg object-cover shrink-0"> <div class="min-w-0 flex-1"> <p class="text-xs text-gray-400 font-sans mb-0.5">More from this podcast</p> <a href="/podcasts/cyber-crime-junkies" class="font-display text-charcoal hover:text-sage transition-colors"> Cyber Crime Junkies →
</a> </div> </section> </div> </main> <script type="application/ld+json">{"@context":"https://schema.org","@type":"PodcastEpisode","name":"John Hammond on What It Actually Takes to Hunt Cyber Criminals","description":"John Hammond, a threat hunter at Huntress, recounts a chilling investigation that began with what looked like a routine… 5-min read of a 29-min episode.","datePublished":"2026-09-17T16:00:00+00:00","url":"https://podsized.io/podcasts/cyber-crime-junkies/episodes/john-hammond-on-what-it-actually-takes-to-hunt-cyber-crimina-46e87b4e-e536-4092-ad3b-68069af278d3","partOfSeries":{"@type":"PodcastSeries","name":"Cyber Crime Junkies","url":"https://podsized.io/podcasts/cyber-crime-junkies","image":"https://storage.buzzsprout.com/jhn4d6a0qfm43bytkm4q4zmsgp88?.jpg"},"potentialAction":{"@type":"ListenAction","target":"https://app.podsized.io/episode/37215015557"}}</script> <script type="application/ld+json">{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://podsized.io"},{"@type":"ListItem","position":2,"name":"Podcasts","item":"https://podsized.io/podcasts"},{"@type":"ListItem","position":3,"name":"Cyber Crime Junkies","item":"https://podsized.io/podcasts/cyber-crime-junkies"},{"@type":"ListItem","position":4,"name":"John Hammond on What It Actually Takes to Hunt Cyber Criminals","item":"https://podsized.io/podcasts/cyber-crime-junkies/episodes/john-hammond-on-what-it-actually-takes-to-hunt-cyber-crimina-46e87b4e-e536-4092-ad3b-68069af278d3"}]}</script> <footer class="bg-charcoal text-white mt-20"> <div class="max-w-6xl mx-auto px-4 sm:px-6 py-12"> <div class="grid md:grid-cols-5 gap-8 mb-12"> <!-- Brand --> <div class="md:col-span-2"> <a href="/" class="font-display text-xl text-white mb-3 block">PodSized</a> <p class="text-gray-400 text-sm leading-relaxed max-w-xs">
5-minute AI summaries of your favorite podcasts. Skip the filler, keep the insights.
</p> <!-- App Store Badge --> <div class="flex gap-3 mt-5"> <a href="https://apps.apple.com/us/app/podsized-podcast-summaries/id6737673525" data-cta-id="footer-app-store" aria-label="Download on the App Store" class="flex items-center gap-2 bg-white/10 hover:bg-white/20 transition-colors rounded-lg px-4 py-2.5 text-sm font-sans"> <svg width="16" height="20" viewBox="0 0 814 1000" fill="white" aria-hidden="true"> <path d="M788.1 340.9c-5.8 4.5-108.2 62.2-108.2 190.5 0 148.4 130.3 200.9 134.2 202.2-.6 3.2-20.7 71.9-68.7 141.9-42.8 61.6-87.5 123.1-155.5 123.1s-85.5-39.5-164-39.5c-76 0-103.7 40.8-165.9 40.8s-105-57.8-155.5-127.4C46 790.7 0 663 0 541.8c0-207.1 134.8-316.7 267.3-316.7 100.5 0 184.2 67.1 243.9 67.1 56.7 0 145.2-71.9 259.7-71.9zM527.8 31.8C556.4-8.4 576.8-56.7 576.8-105.8c0-5.8-.4-11.6-.8-17.4-51.6 2-112.2 34.5-148.9 78.4-33.6 39.5-61.5 97.6-61.5 156.3 0 6.4.8 12.8 1.2 15.3 3.6.6 9.6 1.2 15.6 1.2 45.6 0 102.4-29.8 144.4-96.2z"></path> </svg>
Download on the App Store
</a> <a href="https://play.google.com/store/apps/details?id=io.podsized.android&referrer=utm_source%3Dpodsized.io%26utm_medium%3Dweb" data-cta-id="footer-play-store" aria-label="Get it on Google Play" class="flex items-center gap-2 bg-white/10 hover:bg-white/20 transition-colors rounded-lg px-4 py-2.5 text-sm font-sans"> <svg width="16" height="18" viewBox="0 0 24 24" fill="white" aria-hidden="true"> <path d="M3.609 1.814L13.792 12 3.609 22.186a.996.996 0 0 1-.61-.92V2.734a1 1 0 0 1 .61-.92zm10.89 10.893l2.302 2.302-10.937 6.333 8.635-8.635zm3.199-3.198l2.807 1.626a1 1 0 0 1 0 1.73l-2.808 1.626L15.39 12l2.308-2.491zM5.864 2.658L16.802 8.99l-2.303 2.303-8.635-8.635z"></path> </svg>
Get it on Google Play
</a> </div> </div> <!-- Product --> <div> <h3 class="font-sans font-semibold text-sm text-gray-300 uppercase tracking-wider mb-4">Product</h3> <ul class="space-y-2.5"> <li><a href="/podcasts" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">Browse Podcasts</a></li> <li><a href="/guests" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">Guests</a></li> <li><a href="/topics" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">Topics</a></li> <li><a href="/pricing" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">Pricing</a></li> <li><a href="/about" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">About</a></li> <li><a href="/listen-to-podcast-summaries" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">Audio Summaries</a></li> <li><a href="/how-to-summarize-a-podcast" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">How To Summarize</a></li> </ul> </div> <!-- Compare --> <div> <h3 class="font-sans font-semibold text-sm text-gray-300 uppercase tracking-wider mb-4">Compare</h3> <ul class="space-y-2.5"> <li><a href="/best-ai-podcast-summary-tools" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">Best AI Podcast Tools</a></li> <li><a href="/compare/podsized-vs-snipd" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">vs Snipd</a></li> <li><a href="/compare/podsized-vs-podwise" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">vs Podwise</a></li> <li><a href="/compare/podsized-vs-snipcast" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">vs Snipcast</a></li> <li><a href="/alternatives/snipd-alternatives" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">Snipd Alternatives</a></li> <li><a href="/alternatives/snipcast-alternatives" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">Snipcast Alternatives</a></li> </ul> </div> <!-- Legal --> <div> <h3 class="font-sans font-semibold text-sm text-gray-300 uppercase tracking-wider mb-4">Legal</h3> <ul class="space-y-2.5"> <li><a href="/privacy" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">Privacy Policy</a></li> <li><a href="/terms" class="text-gray-400 hover:text-white text-sm font-sans transition-colors">Terms of Service</a></li> </ul> </div> </div> <div class="border-t border-white/10 pt-6 flex flex-col sm:flex-row justify-between items-center gap-3"> <p class="text-gray-500 text-sm font-sans">
© 2026 PodSized. All rights reserved.
</p> <p class="text-gray-600 text-xs font-sans">
AI-powered podcast summaries
</p> </div> </div> </footer> <script type="module" src="/_astro/BaseLayout.astro_astro_type_script_index_1_lang.AnAT6gMV.js"></script> </body> </html><script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4bc70e2c01a94c73b74392e4234840661791215815920" integrity="sha512-L0ha0OXavK/8okipN9F8BtP84dg9DUhPERbBXzwI6dgTA55d2+yweo3pn5CSFYs45/r8md2+xvUPtTdvTNRfjA==" data-cf-beacon=){kind=link}