Paper: Wave your false flags! Deception tactics muddying attribution in targeted attacks

This is an 11 page white paper that goes through the current challenges faced by researchers to attribute cyber attacks. It goes through the current techniques such as, Timestamps Strings, debug and metadata Malware families, code reuse Threat infrastructure used It also present some of the most advance APT's and their potential origin and techniques believed … Continue reading Paper: Wave your false flags! Deception tactics muddying attribution in targeted attacks

The Project Sauron APT

Key takeaways, DNS keeps being an important protocol for exfiltration Process Injection, Memory Persistence, no file trace in disk Living of the land techniques to move laterally They thwarted the attribution process not using twice the same threat infrastructure https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf  

Battlefield Digital Forensics

In a quick break this weekend I had a chance to read this new paper developed by NATO to explain and train special forces in the art of digital intelligence and evidence collection. It is clear from this publication how rapidly the world around us is transforming, special forces from now on will be trained … Continue reading Battlefield Digital Forensics

The Most Dangerous Town on the Internet

A couple of days ago I was recommended these 2 documentaries, they are short but concise and they show how cyber criminality is on the rise. In the first documentary they explain how Romania as a result of its history is seeing a surge in cyber criminal activities. It is an excellent testimony from some … Continue reading The Most Dangerous Town on the Internet

Cyber Threat Hunting (3): Hunting in the perimeter

In this third post we are going to see what we need to look at when hunting and detecting adversaries in the perimeter. We are also going to look at some of the firewall technologies and their log formats in order to detect anomalies in the inbound and outbound traffic in your network.     … Continue reading Cyber Threat Hunting (3): Hunting in the perimeter

Cyber Threat Hunting (1): Intro

After some long months debating whether to write a white paper, and what potential topics I could write about - I just decided that I do not have enough time to go through the process of writing a research paper for the next 6 to 12 months. Instead, I am taking some of my research and current … Continue reading Cyber Threat Hunting (1): Intro

Active Cyber Defense Tactics

Active cyber defense (ACD) is the concept of proactively opposing an attack in computers and networks. There are a series of tactics that can be applied in order to mitigate risk or detect adversaries inside the network. Active Hunting Security operations team focuses on reactive detection mainly based on signatures. In this scenario advanced attackers … Continue reading Active Cyber Defense Tactics