in the DNC Hack

More documents

Recommendations

Info

Document Metadata (C) 2016 Rendition Infosec - Jake Williams
False Flag Opportunities • Copying Powershell from other reports • Planting malware artifacts • Using compromised C2 servers from multiple countries rather than registering domains • Planting document metadata • Use of social media puppet with broken English • Publicly discrediting the work of researchers (C) 2016 Rendition Infosec - Jake Williams
Page 1 and 2: Potential for false flag operations
Page 3 and 4: Agenda • Why do we care? • Over
Page 5 and 6: Attack Timeline • 14JUN - DNC hac
Page 7 and 8: CrowdStrike Stands by Analysis (C)
Page 9 and 10: On Validating Attribution Observabl
Page 11 and 12: Our Diamond Model Russia??? Other a
Page 13 and 14: Infrastructure • Quickly pivoted
Page 15 and 16: Infrastructure • Being from Roman
Page 17 and 18: Let’s try another IP • Looks li
Page 19 and 20: Why the focus on C2? • The attack
Page 21 and 22: Malware Artifacts of Interest • T
Page 23: Document Metadata (C) 2016 Renditio
Page 27 and 28: False Flag Puppet Blogs • I went
Page 29 and 30: So Whodunnit? • With the data pub

in the DNC Hack

Create successful ePaper yourself

Delete template?

Save as template?