Russia the threat landscape
- 1. RUSSIA: THE THREAT LANDSCAPE Sergey Gordeychik Targeted Attack Discovery APT Advanced threats Intelligence Abnormal Behavior Threat Hunting
- 2. THE THREAT LANDSCAPE 2 Government Financial organizationsTelecommunications Utilities Transport Citizens
- 3. The case of the CRYPTOBANK
- 4. INVESTIGATION RESULTS 4 1000 workstations, 200 servers 2 weeks of unsuccessful encryption attempts Backups servers hacked also FDE tool/unique encryption key for each device PowerShell scripts…
- 5. TTP 5 Enterprise wipers/cryptors Black Energy HDDCryptor Shamoon 2 Wannacrypt Full disk encryption Malware-less “Tailored” encryption https://kas.pr/aAg2
- 7. 14 OF MARCH Microsoft publish MS17-010 critical security update
- 8. 14 OF APRIL WikiLeaks publish Vault 7 from Shadow Brokers Exploit EternalBlue Backdoor DoublePulsar
- 9. 23 OF APRIL Warning: Drop everything and patch all the Windows things now! DoublePulsar via EternalBlue MS17-010 3% of Internet faced Windows was hacked
- 10. 12 OF MAY Wannacry Russia, Ukraine, India, Taiwan
- 11. 25 OF MAY
- 14. INVESTIGATION RESULTS 14 The initial breach occurred 6 months before Spear phishing “from” [email protected] Cobalt Strike beacon Privilege escalation (Mimikatz, Pass-the-Hash) Access to ATM management station Silence…
- 15. 15 countries Near East Asia East/West Europe Russia 40+ banks XFS ATM withdraw sdelete.exe wipe “Offensive Security Certified” hacking
- 17. COBALT: MAY 2017
- 18. TECHNIQUES, TACTICS AND PROCEDURES 18 Pentest-style attack Massive breach post processing Targets selection and profiling Black market Remote access Insiders Passwords Drops Organized activity
- 19. The case of the https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx
- 20. OOPS, THEY DID IT AGAIN 22 Domain controllers under control since 2013 psexec for lateral movement Steganography for C2 communications Checks for (only) Qihoo 360 AV 3 days for ”do it again” after cleanup • Trusted domain in daughter company • Overseas branch • Backdoor VPN channel
- 21. THEY NETHER GIVE UP 23 You don't have to be a target to be a victim Supply chain attack Multiple C2 channel Malware-less attacks Server side implants Taidoor/ Whitewhile Poisoned Flight/Elirks PlugX/ ZeroT TropicTrooper
- 22. KATA IMPLEMENTATION STATISTICS 24 78 installations in critical infrastructure Government FSI Media Utilities Active targeted attacks Espionage 55% Criminal 45% 0,00% 20,00% 40,00% 60,00% 80,00% 100,00% 120,00% Espionage Criminal Random
- 26. November 2, 1988
- 27. https://www.slideshare.net/dleyanlin/5- worms-and-other-malware-14762181
- 28. ICS/SCADA
- 30. 2016 VS 2017 China:1380 -> 469 Russia: 2302 -> 3637
- 31. A THOUSAND BATTLES, A THOUSAND VICTORIES
- 32. THREAT HUNTING 34 https://sqrrl.com/solutions/cyber-threat-hunting/ Cyber threat hunting is the practice of searching iteratively through data to detect advanced threats that evade traditional security solutions. SecurityToolsMonitoringHunting Prevention Threat hunting SOC Alerting Risks
- 33. http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf https://www.sans.org/reading-room/whitepapers/analyst/who-what-where-when-effective-threat-hunting-36785 http://info.isightpartners.com/definitive-guide Eric M. Hutchins∗ , Michael J. Cloppert† , Rohan M. Amin, Ph.D.‡ Lockheed Martin Corporation
- 34. http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf https://www.sans.org/reading-room/whitepapers/analyst/who-what-where-when-effective-threat-hunting-36785 http://info.isightpartners.com/definitive-guide Eric M. Hutchins∗ , Michael J. Cloppert† , Rohan M. Amin, Ph.D.‡ Lockheed Martin Corporation
- 35. FROM THE OTHER SIDE OF THE FENCES https://securelist.com/blog/virus-watch/74150/plugx-malware-a-good-hacker-is-an-apologetic- hacker/http://blog.ptsecurity.com/2016/12/cobalt-how-criminals-hacked-`atms.html
- 36. THE THREAT LANDSCAPE 38 Government Critical Financial organizations High Telecommunications High Utilities High Transport High Citizens
- 37. 39 Know the enemy Know you self Follow tends Use what you have Looks forward Remember the past Hunt the hunters
- 38. SILENCE IS A SCARY SOUND
- 39. BE SAFE! Sergey Gordeychik [email protected] @scadasl Targeted Attack Discovery APT Advanced threats IT issues Abnormal Behavior Internal threats