Matt Suiche
Hacker · Founder of OnDB
Hello! My name is Matt Suiche. I am the founder of OnDB Inc., a data infrastructure startup for the agentic economy. I recently discussed cyberwar in the age of AI, Iran’s cyber capabilities, and how AI is reshaping hacking on Bloomberg’s Odd Lots and the National Security Lab podcast.
Previously, I co-founded CloudVolumes (acquired by VMware in 2014) and Comae Technologies (acquired by Magnet Forensics in 2022), where I later served as Head of Detection Engineering. I also founded the cybersecurity community project OPCDE.
My path into technology started in reverse engineering as a teenager, and has since spanned memory forensics, operating systems, virtualization, blockchain, and now AI infrastructure.
Latest
One new wave stopped today but the worse is yet to come 🔗Read More: Part 1 — Part 2 — Part 3 — Part 4 @msuiche (Twitter)
UPDATE: Latest development (15May): Attribution and links to Lazarus Group
UPDATE2: — Decrypting files
As a follow-up article on WannaCry, I will give a short brief about the new variants found in the wild, not for experimentation but on infected machines today.
In short, one is a false positive some researchers uploaded to virustotal.com and the other is legit but we stopped it when I registered the new kill-switch domain name.
More than 70 countries are reported to be infected. 🔗Read More: Part 1 — Part 2 — Part 3 — Part 4 — @msuiche (Twitter)
UPDATE: Latest development (15May): Links to Lazarus Group
UPDATE2: — Decrypting files
IMPORTANT NOTE: Microsoft released an emergency patch (KB4012598)for unsupported version of Windows (Windows XP, 2003, Vista, 2008). APPLY NOW!
NOTE2: On Sunday 14 May, We just stopped the second wave of attack by registering a second killswitch but this is temporary. Read more.
On 14 April, the mysterious group ShadowBrokers released an archive containing several exploits, tools and operational notes on one of the most complex cyber-attack in History: JEEPFLEA. Main function which redirects the logic based on the target Oracle server version
Among those tools Windows exploits but also tools, to compromise SWIFT Service Alliance servers. One of this tool, PASSFREELY, enable the bypass of the authentication process of Oracle Database servers, and the second ones, initial_oracle_exploit.sqI & swift_msg_queries_all.sql, are Oracle Database scripts to backup the entire transactions stored in the Oracle databases as explained in last week’s post, all the Oracle administrators accounts including their credentials — and also internal undocumented structures on the schema tables of the SWIFT Messaging tables.