SANS Threat Analysis Rundown in Review: Takedowns Are Not Kills

This month's SANS Threat Analysis Rundown went beneath the intrusions, the ransomware crews, and the malware families to the layer they all depend on: infrastructure. Bulletproof hosting, residential proxy networks, and AI-native attack tooling operate as a supply chain that threat actors rent instead of build, and that supply chain has absorbed a remarkable amount of enforcement pressure. In the past year, OFAC and its UK and Australian counterparts sanctioned Media Land and the front companies behind Aeza Group (November 2025), Google and partners disrupted the IPIDEA residential proxy network (January 2026), and the FBI, Google, and Lumen went after NetNut (July 2026). Every one of those actions mattered. None of them removed the capability.

To trace how that supply chain works and why it keeps surviving, I was joined by Will Thomas (@BushidoToken), Senior Threat Intelligence Advisor at Team Cymru, co-founder of the Curated Intelligence trust group, and my co-author on FOR589: Cybercrime Investigations, where he built the Cybercrime Underground day and the course's deep dive into infrastructure. Will is also a former colleague, so this was a conversation between two people who have spent years chasing this infrastructure side by side.

STAR stays practitioner-first: no vendor pitches and no recycled headlines, just a working-level conversation about what is happening and what defenders can do about it. Will works at a company with network visibility most of us will never have, so throughout the hour I kept pulling the conversation back to the version of the method you can run without a commercial NetFlow contract. You can catch the full replay of this episode on the SANS DFIR YouTube channel.

One note before the recap. We opened the stream with a look at the SANS DFIR Summit & Training 2026 in Arlington, Virginia (Summit October 15 to 16, training October 17 to 22). Heather Barnhart and Jason Higley are delivering back-to-back keynotes on the digital evidence behind two high-profile investigations, then returning to the stage together to compare what that evidence actually proved in each case. That portion is in-person only and will not show up in a recording, which is a good reason to be in the room.

What a Bulletproof Host Actually Sells

I started with the plain question: what does a bulletproof hosting (BPH) provider sell that a normal VPS provider does not? Will's answer is that BPH is the foundational layer of the cybercriminal ecosystem. It is what lets operations last longer and resist the standard takedown attempts that companies and law enforcement rely on.

• The product is a safe haven. Command and control panels, malware distribution, spam infrastructure, forums, and darknet markets all need somewhere to live. Will noted that the backend IPs of Tor hidden services often sit on bulletproof hosts.
• "Bulletproof" is a policy, not a technology. A DMCA request gets ignored. A data preservation request gets ignored. A request for the identity of the server's owner gets ignored. Providers that stuck to those core tenets for years are the ones ransomware operators kept coming back to.
• IP space is the capital asset. Will's rough figure was that leasing a single /24 can run four to five thousand dollars, so a provider sitting on tens of thousands of addresses is a large player by definition. Providers resell space, buy two or three /24s outright, and fold them into the service.
• They expect enforcement. These operators rotate and move their IP addresses, they rebrand, and they are hyper-aware that coordinated action is always being planned against them.

Law enforcement can and does take offensive action against these providers. The point is that the traditional, paperwork-driven takedown path does not work here, and that is exactly what customers of bulletproof hosting are paying for.

Media Land, Aeza, and the Rebrand Cycle

The Treasury designation from November 2025 is the cleanest public case study of how this layer behaves under pressure. OFAC, alongside Australia and the United Kingdom, sanctioned Media Land, a Russia-based BPH provider, along with members of its leadership and several sister companies. In the same action, OFAC and the UK designated Hypercore Ltd., which Treasury describes as a front company for Aeza Group, a BPH provider that had already been sanctioned in July 2025.

That second half is the lesson. Aeza was designated, and then it rebranded, stood up new infrastructure through a front company, and kept operating until the front company was designated too. We see the same move on the ransomware side, where sanctioned crews rebrand to put distance between themselves and the designated entity. Sanctions raise the cost of doing business. They do not end the business.

Media Land is the long-running example. Will described it as one of the longest-running BPH services there is, run for years as a business by an individual known by the handle Yalishanda. Intel 471 has tracked that actor for the better part of a decade, and the Yalishanda case study is one of the labs we teach in FOR589. Will's point was that without this class of provider, operations like LockBit and BlackSuit could not stage and exfiltrate stolen data to their own servers without losing those servers. Both names line up with the ransomware operations officials cited when the sanctions were announced.

From IOCs to Fingerprints: Tracking Ransomware Infrastructure

Two days before the stream, Will published From the Disk to the Flows: Ransomware Infrastructure Analysis, and we walked through it on screen. Over roughly a year, Team Cymru worked with a DFIR partner across more than twenty ransomware investigations, covering Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, and Lynx, in cases where network IOCs were actually recoverable. As anyone who has worked a ransomware incident knows, that is not a given. Everything gets encrypted, firewalls get turned off, and you are left assembling a puzzle out of scraps.

The part I wanted the audience to notice is what the post does not contain: IOCs. Because the indicators came from a partner's live engagements, they were not published. What Will shared instead is a set of queries that describe behavior, and that is the more useful artifact anyway. A few of the ideas translate directly to tooling you already have:

• Score the neighborhood, not just the house. Team Cymru statistically scores an ASN or CIDR range by how much malicious and suspicious activity is already tagged on it: malware hosting, scanning, or brute forcing. If ten addresses in a /24 are already serving malware, the rest of the range deserves suspicion. Will runs the no-budget version of this himself: a honeypot at home, where the ASNs sending the most exploit and SSH brute-force attempts identify themselves quickly.
• Fingerprint the tool, then go find every server running it. In one engagement the partner observed an operator using the leaked version of LockBit 3 to abuse SimpleHelp, a legitimate remote monitoring and management tool. Instead of collecting the one IP, the team fingerprinted the HTTP response header (the published query is openports.banner = "*Server: SimpleHelp*") and enumerated every SimpleHelp server live on the internet. The hunting question writes itself: Should any endpoint in your environment be beaconing to a SimpleHelp server you do not run?
• One tag, many fingerprints. A mature Cobalt Strike detection is not a single signature. Will described ten to twenty fingerprints feeding that one tag, such as a JARM TLS handshake hash, a port banner, or a certificate subject common name.
• The tooling is boring, and that is the finding. Across these cases there was a notable absence of custom malware for lateral movement or C2. It was dual-use software like AnyDesk, Rclone, and FileZilla, plus commercial VPNs and Tor, which is why context about infrastructure matters more than another hash feed.
• VPNs are fingerprintable. One of the services in the post, tagged 1VPN and used in a Lynx intrusion, is the criminal VPN known as First VPN, which French and Dutch authorities dismantled with Europol's support in May 2026. Will also noted that North Korean IT workers have leaned heavily on Astrill VPN to reach laptop farms from where they are physically located, something Team Cymru has written about publicly. Many VPN endpoints can be identified with passive DNS and WHOIS data alone.

Where do you start without a commercial platform? Will's answer was Shodan and urlscan.io, which is how he got started tracking ransomware infrastructure, building fingerprints, and finding C2 panels, many of which still have static tells in an HTTP title or a certificate. We teach both in the course. One caution he raised about a popular alternative, FOFA: Know who develops the tools you query, and think about who can see those queries.

The ASN Question: Blocking Without Breaking the Business

This is the question the STAR audience always asks, so we gave it room: If the guidance is to pay attention to the network an IP belongs to, should you just block bad ASNs?

Here is Will's answer:

• Do not build your view of "bad networks" from the IOCs in threat reports. That sample is skewed. You need a holistic look at where malicious infrastructure is hosted across the internet today, and only then can you ask where the concentration is highest.
• There is a threshold where blocking is reasonable. Past a certain density of malicious hosting, an endpoint inside your network holding sustained communications with that range is, at minimum, suspicious and risky. The same networks hosting malware and scanners tend to host piracy and cracked software too. The common factor is a provider with loose rules.
• The gray zone is the hard part. Between the hyperscalers and the true bulletproof hosts sits a middle tier of small VPS providers that struggle to detect and prevent abuse. Your users may have legitimate reasons to reach sites hosted there, even while ten percent of the provider's addresses are scanning and brute forcing.
• Reputation is not permanent. A small provider can invest in security and clean up. If your block is static, you are now blocking legitimate traffic based on old behavior. At ISP or broadband scale, a block can quietly kill that provider's business, which is why Will argues small hosts need to know the reputation of their own ASN and work to improve it.

The takeaway is to treat network-level blocks like any other indicator with a shelf life. Tie them to current behavior, review them, and age them out.

Residential Proxies: Your Living Room as an Exit Node

Residential proxy networks solve the same problem for an attacker as bulletproof hosting, which is hiding where traffic really comes from, but they are built in a completely different way. A bulletproof host is an actual hosting service. A residential proxy network is closer to a botnet assembled through the app economy.

Will walked through the model using IPIDEA and NetNut (also tracked as Popa), the two networks Google has gone after this year:

• The SDK is the infection vector. Proxy operators pay app developers to bundle their SDK. Any Android-based smart device that installs the app becomes a node, and that device's home IP address becomes an exit point someone else can rent.
• They piggyback on trust. The cleverest part is reputation laundering. An app that has been legitimate for five years gets paid to add one more SDK. Automated store scanning is looking for overt malware, not a networking library inside a trusted app.
• Many operators present as legitimate companies, and a great deal of the demand is mundane: scalper bots buying sneakers, tickets, and consoles. Anti-bot systems do not want to block real customers on home connections, and that is precisely the cover the malicious minority hides in. The abuse that matters to us is DDoS, brute forcing, credential stuffing, and account takeover.
• Why not just use a VPN? I asked Will to sell me on it as if I were the criminal. VPN endpoints are fingerprintable: look at passive DNS, certificates, or WHOIS for a Mullvad or Proton node and it is obvious what it is. A residential proxy in the UK just looks like a customer of Vodafone, BT, or Sky. Filtering and anti-bot systems will not block that by default.

Remediation is close to impossible from the outside. You cannot submit a takedown request for a television, and you cannot seize millions of consumer devices. Will's view is that Google is one of the only organizations positioned to act, because it owns Android and the Play Store. That is what the IPIDEA and NetNut actions did: identify the SDKs, take down control domains, and use Play Protect to warn users and disable the offending apps. The scale of the cleanup problem is the catch. It can mean tens of thousands of legitimate apps with hundreds of millions of users.

Google itself described the results as degrading these networks, reducing the available device pool by millions, not eliminating them. I called it whack-a-mole on the stream and Will agreed. For a threat that can rotate through something like a million IPs a day, static IOC blocking is simply the wrong tool.

Why This Is Hard, and What to Do Anyway

We looked at the difficulty from both sides.

For law enforcement, the old playbook was to find the criminal server, seize and preserve it, watch who connects to it, and work back to an arrest. With CDNs and residential proxies in the path, investigators now have to serve legal process on a provider, and there may be a thousand users behind that one IP at the same moment. Miss a single detail, such as the client port or a timestamp accurate to the second, and the trail ends. Will compared it to tracing cryptocurrency through mixers layered on mixers. It is the same obfuscation and layering, applied to network traffic.

For defenders, Will pointed to three log sources where this matters most: SSO sign-ins, Microsoft Entra ID sign-ins, and the login logs for your SaaS applications. We have watched plenty of SaaS compromises that came down to infostealer credentials and a successful login. If you are not recording who logs into what, with context on whether the source IP is a VPN or a proxy, criminals could be logging in every day without your knowledge.

The maturity path he described is practical:

1. Start with WHOIS enrichment on authentication source IPs.
2. Add certificates and passive DNS to identify VPN and hosting infrastructure.
3. Get to an IP context feed that is updated daily and tells you what an address is, including whether it is tagged as a specific commercial proxy service. That converts "a login from a residential IP" into a lead an analyst can actually run down.

I framed it this way on the stream: Most threat intel feeds are tuned to malware and intrusion activity. There is a whole layer underneath—the infrastructure supporting the campaign—that those feeds do not describe. Not getting hits is not the same as not having the activity. Will added the mistake he sees most often, which is organizations assuming they are covered because EDR is blocking the malware. The share of attacks that use malware at all is far lower than it used to be. As we said in our first episode, it is all about identity.

Should you hard-block logins from residential proxies? I asked directly whether an automatic lockout rule is too extreme. Will's personal view: Automate the lockout when the proxy tag is combined with other behavioral anomalies, such as an unusual time of day or a geography that account never uses. Otherwise, keep it as a critical alert that a SOC analyst verifies before locking the account. Do not act on the atomic indicator alone. Look at the behavior around it.

That is also the answer to the executive who wants to geo-block all of Eastern Europe. Geo-blocking has narrow uses, but as Will put it, most threat actors are proxying every single connection anyway, through a residential proxy, a VPS, or something else. The work of enrichment and filtering cannot be skipped.

The Nation-State Cousin: ORB Networks and Project ORBITAL

A categorization note first, because Will is careful about it and so am I: Operational relay box (ORB) networks are primarily a China-nexus espionage phenomenon, not cybercrime. They belong in this episode because they do the same job as a residential proxy network, laundering the origin of a connection, just built by a different kind of operator with a different skill set.

Will's Project ORBITAL exists because he saw a gap: Plenty of CTI researchers know the term, but few grasp the scale. So he did what he has done before and built an open knowledge base, available on GitHub, assembled entirely from open source intelligence so that every claim can be verified. It catalogs which ORB networks exist, which adversaries have been reported using them, what devices they are built from, and what exploits are used to build them. Every entry cites its source, including research from Sekoia, Microsoft, Cisco Talos, SecurityScorecard, GreyNoise, Lumen, and Team Cymru. As I said on the stream, the project is a testament to what the community produces when people publish their work.

• The shift is structural. Five to ten years ago, China-nexus operators leaned on rented VPS infrastructure. They have moved steadily toward mass compromise of IoT and edge devices. Some of these networks are hundreds of thousands of devices strong, and others are only five hundred to a thousand.
• ORBs are multi-hop by design. A consumer VPN is one hop between you and the destination. ORB operators put something like five tiers of compromised devices between themselves and the target. You might block the first tier, and there are four more behind it. It is the same graph problem as tracing funds with Chainalysis or TRM Labs, and flow records behave a lot like transactions.
• LapDogs is a good example. SecurityScorecard first reported the network, and Cisco Talos followed this summer with research that separates the actor assessed to be building and maintaining the network from a second actor using it for intrusions. Elsewhere in the project, reporting ties three groups to two ORB networks. It is not one group, one botnet, or one victim set.
• The fingerprints are public. For anyone who wants to try ORB hunting, Will pointed to the fingerprints tab of the repository. Many entries are JARM fingerprints: Scan a node and the TLS handshake is identical every time, so searching scan data by JARM hash shows how many candidate nodes are live at once. LapDogs is even simpler. Its nodes present an X.509 certificate with "LAPD" in the organization field, which is where the name comes from. Will also recalled credential stuffing sources from our earlier work together that shared a telltale banner, "xlogin" with port 7777 open, which marked them as one coordinated botnet.

The honest limits are worth stating. Banners and certificates can tell you a device is probably part of a network. They cannot tell you whether an APT is actively routing through it right now. That takes flow visibility, which is a genuine commercial advantage. Historical lookups will also require some kind of service, whether that is Shodan or a platform like Team Cymru's. But the fingerprinting itself is work any team can start on today.

The AI Pivot: CyberStrikeAI and AI-Native Tooling

I asked Will how AI is disrupting this space, and his answer was stronger than I expected. In all the years Team Cymru has tracked criminal and nation-state infrastructure, he called this one of the largest trend changes they have seen: a meaningful share of the C2 servers they track suddenly running AI-related software, including agents, LLM front ends, and automated penetration testing tools. The tools are free, they are easy to use, and criminals will happily run them on stolen API keys.

The discovery story behind Tracking CyberStrikeAI Usage is a good lesson in pivoting. Amazon's threat intelligence team published research on an AI-augmented actor compromising FortiGate devices at scale and shared a handful of IP addresses. Will looked at the open ports on one of them and found a banner reading CyberStrikeAI, which the Amazon post had not mentioned. He built a fingerprint from that banner and went looking.

• What the tool is. CyberStrikeAI is a free, open source, Chinese-language platform on GitHub that wraps more than a hundred security tools in an AI orchestration engine.
• Adoption, stated carefully. Team Cymru's published figure is 21 unique IP addresses running it between January 20 and February 26, 2026. On the stream, Will said the number of servers observed has since grown past a thousand. Read that as unique IPs observed carrying the fingerprint, not as a count of distinct operators. He assesses the users include both cybercriminals and nation-state actors.
• The developer, stated carefully. Team Cymru assesses that the tool's China-based developer has some ties to the Chinese government. The basis is public: repositories associated with Knownsec, which published reporting describes as a contractor for the Ministry of State Security (MSS) and the PLA, and a contribution award from the CNNVD vulnerability program, which falls under MSS oversight. That reference was removed from the developer's profile after it was added. That is an assessment about the tool's author. The operator in Amazon's FortiGate research is a separate party, and the two should not be collapsed into one story.
• It is not one tool. Will said Team Cymru is now tracking around twenty-five generative AI services in use by threat actors, and nearly all of them are public GitHub projects. Asked what share of malicious infrastructure this represents, he gave a rough, off-the-cuff estimate: Of the fifteen to twenty thousand C2 servers they track on a given day, perhaps ten percent have some AI-related service running. He was explicit that he would need to confirm the number. The part he was certain about is the direction. Not long ago it was zero.
• The fingerprinting is the same craft. Detection is mostly banner-based and X.509 certificate-based, the same techniques used for everything else in this episode.

Will also pointed to the Team Cymru Threat Research account on X, which posts short intel drops. One recent thread used flow data to identify routing and proxy services that relay traffic between users in China and frontier AI models, the network-side view of activity Anthropic has described in its reporting on illicit distillation, where requests were relayed to Claude through networks of fraudulent accounts. As Will put it, AI tokens are becoming a currency, and there is now infrastructure built to farm them.

For defenders, the implication is volume. The barrier to running a competent, multi-stage attack chain against exposed edge devices just dropped, and what arrives at your perimeter will scale accordingly.

What Defenders Should Do Monday

We closed by bringing it back to the spine of the episode. Takedowns matter. They are also hard, and the evidence of the past year is that they rarely remove a capability outright. Defending against this layer is hard too, especially when the traffic comes from someone's living room. That is not a reason to skip the work. It is the work.

If you take one thing from each pillar:

• Tag residential proxy logins in your identity provider. Enrich SSO, Entra ID, and SaaS sign-in logs with IP context. Alert on successful authentication from an address tagged as a proxy, and reserve automated lockout for cases where other behavioral signals agree.
• Build one certificate-based fingerprint. Open the fingerprints tab in Project ORBITAL, pick one, and reproduce it in whatever scan data you have access to. Start with JARM if that is easier. The goal is to get one repetition of turning an indicator into a pattern.
• Check what your blocklist does when an ASN changes hands. If your network-level blocks have no review cycle and no expiry, you are either blocking something legitimate or trusting something you should not.
• Will's addition: Do not sleep on Tor. It sounds basic, but the nodes rotate and a very large number of threat actors use it. Confirm there is no outbound egress from your environment to Tor relays, using the relay data published by Tor Metrics, and use the bulk exit list to enrich the inbound side, such as logins and RDP attempts arriving from exit nodes. It is a simple win that gets forgotten.

Infrastructure is the one thing an attack cannot skip. Every operation has to cross it somewhere, and that makes tracking it one of the most durable investments a defender can make.

Links and Resources Shared During the Livestream

The Episode

• SANS Threat Analysis Rundown (STAR) Livestream Series (SANS)
• SANS DFIR on YouTube (replay channel)
• LinkedIn Live event page for this episode (SANS DFIR)

Will Thomas, Team Cymru, and Curated Intelligence

• Will Thomas on X (@BushidoToken)
• Will Thomas on GitHub (BushidoUK)
• BushidoToken Threat Intel blog
• Will Thomas, SANS instructor profile
• Curated Intelligence trust group
• Team Cymru blog
• Team Cymru Threat Research on X (@teamcymru_S2)

Bulletproof Hosting and Ransomware Infrastructure

• United States, Australia, and United Kingdom Sanction Russian Cybercrime Infrastructure Supporting Ransomware (U.S. Department of the Treasury)
• From the Disk to the Flows: Ransomware Infrastructure Analysis (Team Cymru)
• Actor yalishanda: A snapshot of a prolific bulletproof hoster (Intel 471)
• Cybercriminal VPN used by ransomware actors dismantled in global crackdown, the First VPN takedown (Europol)
• Unmasking DPRK Cyber Threat Actors: Fake IT Worker Infrastructure (Team Cymru)

Residential Proxy Networks

• No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network, IPIDEA (Google Threat Intelligence Group)
• Google's Continued Disruption of Malicious Residential Proxy Networks, NetNut and Popa (Google Threat Intelligence Group)

ORB Networks and Project ORBITAL

• Project ORBITAL write-up (BushidoToken Threat Intel)
• Project ORBITAL repository, including the fingerprints tab (GitHub)
• Unmasking a New China-Linked Covert ORB Network: Inside the LapDogs Campaign (SecurityScorecard)
• UAT-7810 continues building ORB networks using new malware (Cisco Talos)

AI-Native Offensive Tooling

• Tracking CyberStrikeAI Usage (Team Cymru)
• AI-augmented threat actor accesses FortiGate devices at scale (Amazon Threat Intelligence)
• Detecting and countering misuse of AI: September 2026 (Anthropic)

Free Tools Named on the Stream

• Shodan, internet scan data and banner search
• urlscan.io, website scanning and pivoting
• JARM, active TLS server fingerprinting (Salesforce on GitHub)
• Tor Metrics, relay data for egress checks (The Tor Project)
• Tor bulk exit list, for inbound enrichment (The Tor Project)

SANS Resources Shared in Chat

• SANS DFIR Summit & Training 2026 (SANS)
• FOR589: Cybercrime Investigations (SANS)

Bonus Resources

These were not called out by name during the livestream, but they sit directly behind the research we discussed and are worth your time if you want to go a level deeper:

• A New Era of Bulletproof Hosting Providers Emerge (Intel 471): Published in August 2026 and the best current companion to this episode's thesis. Intel 471 found that most of the infrastructure it had tied to yalishanda kept operating after the actor dropped out of sight this spring, and that demand moved to newer providers and former resellers instead of disappearing.
• Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft (U.S. Department of the Treasury): The original July 2025 designation of Aeza Group. Read it next to the November action to see the rebrand cycle play out in the government's own words.
• Ransomware Tool Matrix (BushidoUK on GitHub): Will's open catalog of the tools ransomware crews use, referenced in his infrastructure analysis. A useful reference for the dual-use tooling we discussed, such as Rclone, FileZilla, and AnyDesk.
• FBI Seizes NetNut Proxy Platform, Popa Botnet (KrebsOnSecurity): Independent reporting on the NetNut action, including how disrupted proxy operators rebuild by reselling other networks' capacity.
• The Knownsec Leak: Yet Another Leak of China's Contractor-Driven Cyber-Espionage Ecosystem (DomainTools): The public reporting Team Cymru cites for Knownsec's government work, which is part of the basis for the CyberStrikeAI developer assessment.
• Chinese Vulnerability Database Analysis: CNVD and CNNVD (Bitsight): Background on the vulnerability program referenced in the developer's profile and why that affiliation is notable.
• Detecting and preventing distillation attacks (Anthropic): The earlier February 2026 post on the proxy services and fraudulent account networks used to reach frontier models from restricted regions.

Going Deeper with SANS

If you want to keep building on what we covered this month:

• FOR589: Cybercrime Investigations: The course Will and I co-authored, and the most direct path into this episode's material. The Cybercrime Underground day, the Yalishanda bulletproof hosting lab, and hands-on infrastructure pivoting with tools like Shodan and urlscan.io are the same tradecraft we walked through on the stream.
• FOR578: Cyber Threat Intelligence: Receiving a major update this year. Turning a single indicator into a fingerprint, clustering infrastructure, and tracking it across rebrands is campaign analysis, and this course covers the structured approach behind it.
• SANS DFIR Summit & Training 2026: October 15 to 16 in Arlington, Virginia, with training October 17 to 22. The Summit brings digital forensics, incident response, ransomware, and threat hunting together in one event, and the joint keynote segment is in-person only.
• Recent cyber threats that defenders should pay attention to (SANS Blog): Will's previous STAR appearance with Katie Nickels, which also dug into a wave of infrastructure takedowns. Reading the two recaps together is a good measure of how much this layer has industrialized.

Coming Up Next

Next month on STAR, we will be back with another guest and another working-level conversation on what is actually moving in the threat landscape. Catch the replay of this episode and register for upcoming livestreams at the SANS Threat Analysis Rundown page.

Thanks to everyone who joined live or is catching the replay, and a special thanks to Will Thomas for showing his work. Publishing the queries, the fingerprints, and the sources so that other defenders can reproduce them is what makes this community better. See you next time.