dissection of a Cyber- Espionage attack

More documents

Recommendations

Info

Zero Trust Below zero trust… Following our advice to bring a network forensic tool in their environment (RSA Security Analytics) we have been able to ensure that, even after the «apparent» expulsion of the attacker, several machines were still infected. #RSAC Successful communication recorded after expulsion/triage… The «network visibility» has offered also the chance to proactively monitor the occurrence of other malicious attacks.
Our investigation Our approach tailored to the case • We have rebuilt the investigation process from the scratch aiming to identify malicious behavior from the already collected samples to build optimal Network Forensic IOC and to apply them as a base to highlight further machines infected. #RSAC Integrated a Network Forensic Tool: RSA SA Redefined Actionable IOCs at Network, System and Log level for different platforms and systems. Refocused the malware analysis on all identified samples to identify Actionable IOCs. Improved the triage strategy by moving from °seek & destroy° to a more strategic approach. • Thanks to that we have been able to enumerate remaining infected machines and to unearth the “missing piece”: the Chopstick RAT that the original IR team was not capable of identify. We know, from experience, that APT28 uses Chopstick RAT for most interesting targets.
Page 1 and 2: SESSION ID: CTT-W08 Evolving Threat
Page 3 and 4: Agenda What we discuss today Today
Page 5 and 6: The target: the moat without water
Page 7 and 8: The target: the moat without water
Page 9 and 10: The attack strategy How they break-
Page 11 and 12: Attack Overview: End of First Wave
Page 13 and 14: Attack Overview: End of Second Wave
Page 15 and 16: The attack strategy The infection p
Page 17 and 18: Pwning the core: CVE-2015-1701 AKA
Page 19 and 20: Patient Zero How the victim discove
Page 21 and 22: Patient Zero consequences How the a
Page 23 and 24: What we can bring to the table? #RS
Page 25 and 26: Actionable IoCs What our methodolog
Page 27: Investigation: first step The Custo
Page 31 and 32: APT 28 Tools APT 28 Tools seen in t
Page 33 and 34: APT 28 Tools CORESHELL ATTRIBUTION
Page 35 and 36: APT 28 Tools EVILTOSS ATTRIBUTION B
Page 37 and 38: APT 28 Tools CHOPSTICK CHOPSTICK i
Page 39 and 40: The attack strategy IOC: C2 list T
Page 41 and 42: Conclusion What I can suggest It i
Page 43 and 44: #RSAC

dissection of a Cyber- Espionage attack

Create successful ePaper yourself

Delete template?

Save as template?