in the DNC Hack

More documents

Recommendations

Info

Let’s try another IP (2) • No info in mnemonic or virustotal for 58.49.58.58 either (C) 2016 Rendition Infosec - Jake Williams
Why the focus on C2? • The attackers either have to purchase or compromise C2 • If purchased, there may be links we can follow – Registration email – Where is the domain parked • If compromised, there may be something common in the targets that suggests a particular capability – Perhaps all compromised domains are running Drupal or Wordpress (C) 2016 Rendition Infosec - Jake Williams
Page 1 and 2: Potential for false flag operations
Page 3 and 4: Agenda • Why do we care? • Over
Page 5 and 6: Attack Timeline • 14JUN - DNC hac
Page 7 and 8: CrowdStrike Stands by Analysis (C)
Page 9 and 10: On Validating Attribution Observabl
Page 11 and 12: Our Diamond Model Russia??? Other a
Page 13 and 14: Infrastructure • Quickly pivoted
Page 15 and 16: Infrastructure • Being from Roman
Page 17: Let’s try another IP • Looks li
Page 21 and 22: Malware Artifacts of Interest • T
Page 23 and 24: Document Metadata (C) 2016 Renditio
Page 25 and 26: False Flag Opportunities • Copyin
Page 27 and 28: False Flag Puppet Blogs • I went
Page 29 and 30: So Whodunnit? • With the data pub

in the DNC Hack

Create successful ePaper yourself

Delete template?

Save as template?