Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Russia the threat landscape
Similar to Russia the threat landscape (20)
More from Альбина Минуллина
More from Альбина Минуллина (20)
Recently uploaded
Recently uploaded (20)
Russia the threat landscape
- 1. RUSSIA: THE THREAT LANDSCAPE Sergey Gordeychik Targeted Attack Discovery APT Advanced threats Intelligence Abnormal Behavior Threat Hunting
- 2. THE THREAT LANDSCAPE 2 Government Financial organizationsTelecommunications Utilities Transport Citizens
- 3. The case of the CRYPTOBANK
- 4. INVESTIGATION RESULTS 4 1000 workstations, 200 servers 2 weeks of unsuccessful encryption attempts Backups servers hacked also FDE tool/unique encryption key for each device PowerShell scripts…
- 5. TTP 5 Enterprise wipers/cryptors Black Energy HDDCryptor Shamoon 2 Wannacrypt Full disk encryption Malware-less “Tailored” encryption https://kas.pr/aAg2
- 7. 14 OF MARCH Microsoft publish MS17-010 critical security update
- 8. 14 OF APRIL WikiLeaks publish Vault 7 from Shadow Brokers Exploit EternalBlue Backdoor DoublePulsar
- 9. 23 OF APRIL Warning: Drop everything and patch all the Windows things now! DoublePulsar via EternalBlue MS17-010 3% of Internet faced Windows was hacked
- 10. 12 OF MAY Wannacry Russia, Ukraine, India, Taiwan
- 11. 25 OF MAY
- 14. INVESTIGATION RESULTS 14 The initial breach occurred 6 months before Spear phishing “from” jd@wincor-nixdorf.net Cobalt Strike beacon Privilege escalation (Mimikatz, Pass-the-Hash) Access to ATM management station Silence…
- 15. 15 countries Near East Asia East/West Europe Russia 40+ banks XFS ATM withdraw sdelete.exe wipe “Offensive Security Certified” hacking
- 17. COBALT: MAY 2017
- 18. TECHNIQUES, TACTICS AND PROCEDURES 18 Pentest-style attack Massive breach post processing Targets selection and profiling Black market Remote access Insiders Passwords Drops Organized activity
- 19. The case of the https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx
- 20. OOPS, THEY DID IT AGAIN 22 Domain controllers under control since 2013 psexec for lateral movement Steganography for C2 communications Checks for (only) Qihoo 360 AV 3 days for ”do it again” after cleanup • Trusted domain in daughter company • Overseas branch • Backdoor VPN channel
- 21. THEY NETHER GIVE UP 23 You don't have to be a target to be a victim Supply chain attack Multiple C2 channel Malware-less attacks Server side implants Taidoor/ Whitewhile Poisoned Flight/Elirks PlugX/ ZeroT TropicTrooper
- 22. KATA IMPLEMENTATION STATISTICS 24 78 installations in critical infrastructure Government FSI Media Utilities Active targeted attacks Espionage 55% Criminal 45% 0,00% 20,00% 40,00% 60,00% 80,00% 100,00% 120,00% Espionage Criminal Random
- 26. November 2, 1988
- 28. ICS/SCADA
- 30. 2016 VS 2017 China:1380 -> 469 Russia: 2302 -> 3637
- 31. A THOUSAND BATTLES, A THOUSAND VICTORIES
- 32. THREAT HUNTING 34 https://sqrrl.com/solutions/cyber-threat-hunting/ Cyber threat hunting is the practice of searching iteratively through data to detect advanced threats that evade traditional security solutions. SecurityToolsMonitoringHunting Prevention Threat hunting SOC Alerting Risks
- 33. http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf https://www.sans.org/reading-room/whitepapers/analyst/who-what-where-when-effective-threat-hunting-36785 http://info.isightpartners.com/definitive-guide Eric M. Hutchins∗ , Michael J. Cloppert† , Rohan M. Amin, Ph.D.‡ Lockheed Martin Corporation
- 34. http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf https://www.sans.org/reading-room/whitepapers/analyst/who-what-where-when-effective-threat-hunting-36785 http://info.isightpartners.com/definitive-guide Eric M. Hutchins∗ , Michael J. Cloppert† , Rohan M. Amin, Ph.D.‡ Lockheed Martin Corporation
- 35. FROM THE OTHER SIDE OF THE FENCES https://securelist.com/blog/virus-watch/74150/plugx-malware-a-good-hacker-is-an-apologetic- hacker/http://blog.ptsecurity.com/2016/12/cobalt-how-criminals-hacked-`atms.html
- 36. THE THREAT LANDSCAPE 38 Government Critical Financial organizations High Telecommunications High Utilities High Transport High Citizens
- 37. 39 Know the enemy Know you self Follow tends Use what you have Looks forward Remember the past Hunt the hunters
- 38. SILENCE IS A SCARY SOUND
- 39. BE SAFE! Sergey Gordeychik 1337@kaspersky.com @scadasl Targeted Attack Discovery APT Advanced threats IT issues Abnormal Behavior Internal threats