ShinyHunters Arrests, the Accenture Patch Failure, and a Rogue Engineer | Streaming Security EP4
Source: YouTube · Lawrence Systems · published Oct 7, 2026 · 30:32
Streaming Security ep. 4 covers insider threat defense, sparked by an engineer who locked 3,000+ employer devices, plus updates on the FBI breach and ShinyHunters arrests 1:20-1:45.
Key Takeaways:
• Daniel Ryan used an admin account to delete 13 domain admin accounts, change 301 passwords, and lock servers to extort 20 Bitcoin (~$750K) 3:22-3:50.
• Insiders already have legitimate access; defenses should "live compromised," using least privilege, segmentation, and limited blast radius 5:00-5:41.
• Microsoft separates who queues, scopes, and approves commands, forcing collusion among multiple people 5:58-6:21.
• CIS Controls 6 (just-in-time access) and 8 (centralized, tamper-proof logging) are key frameworks 9:06-11:04.
• Third-party RMM logging prevents insiders from destroying evidence, as in the Ubiquiti case 12:26-13:09.
• FBI breach: vendor Accenture's unpatching was the entry, but architecture merging applicant and employee data enlarged the blast radius 16:50-19:09.
• ShinyHunters arrests now at three, including a 16-year-old in Jordan now cooperating 19:42-21:22.
Legacy software will keep yielding vulnerabilities; vendors should aim AI/LLM tooling at their own code before attackers do 24:05-25:34.
Sources:
- 3:22-3:50 Daniel Ryan insider attack and extortion
- 5:00-5:41 Live compromised defense mindset
- 9:06-11:04 CIS Controls 6 and 8
- 16:50-19:09 FBI breach discussion
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Welcome to Streaming Security episode 4. Matt no longer has a laptop farm behind him. He's actually putting it to use. You're doing the boot camp, right? >> The laptop farm is actually live here. I'm with Jason and Oh no, it did capture Jason. >> It did it. >> [laughter] >> We got facial tracking and it it has two bearded guys. >> You're going to have to release it, Jason. >> [laughter] >> All right, well, that's on me, y'all. I'll just scoot over close to Jason. >> Yeah, eventually we got to get it to the other bearded guy. >> It's not transferring. It's [laughter] stuck on Jason. >> This is a fun technical challenge. >> I don't think there's a button I can press either. Jason, raise your hand and hold it for a few seconds. >> Yeah, we're going to we're going to get it focused back on the…