SlideShare a Scribd company logo

APT 28 :Cyber Espionage and the Russian Government?

•Download as PPTX, PDF•
•
A
anupriti

Russia may be behind a long-standing, careful campaign designed to steal sensitive data relating to governments, militaries and security firms worldwide.This presentation based on a report made public by FireEye brings an over view of their opinion.....uploaded here just for general info to understand how its all happening!!!!

Internet
1 of 44
Combined null/OWASP Delhi Year End Meet By : Anupam Tiwari,CEH,CCCSP,PGDIS,GFSU Certified, B.Tech, M.Tech
The ppt is based on a report available at http://www.fireeye.com/resources/pdfs/apt28.pdf
Dr. Web Russia ESET Slovakia ESET Slovakia F-Secure Finland F-Secure Finland FRISK Software Iceland Fortinet United States G DATA Software Germany G DATA Software Germany GFI Software Malta Ikarus Australia IObit United States iolo technologies United States iS3 United States K7 Computing India K7 Computing India Kaspersky Lab Russia KingSoft China McAfee United States Microsoft United States NANO Security Russia Panda Security Spain PSafe Brazil Agnitu`m Russia Agnitum Russia AhnLab South Korea avast! Czech Republic avast! Czech Republic avast! Czech Republic AVG Technologies Czech Republic (Grisoft) Avira Germany Avira Germany Bitdefender Romania Bitdefender Romania Bitdefender Romania BullGuard United Kingdom BullGuard United Kingdom Check Point United States Check Point United States ClamWin Australia Comodo Group United States Comodo Group United States CYSEC United Kingdom Comodo Group United States Dr. Web Russia Qihoo 360 China Quick Heal India Scandium SecurityCyprus Sophos United Kingdom Cisco (originally Immunet) United States StraySpark Computing United Kingdom Symantec United States Symantec (originally PC United States Tools) TG Soft Italy TG Soft Italy Trend Micro Japan TrustPort Czech Republic VirusBlokAda Belarus Webroot United States Zemana Turkey
Moonlight Maze
APT Report gives Window into Russia's Cyber Espionage RUSSIA is "likely" sponsoring a hacking outfit that targets foreign governments and Security Agencies "APT28", a group operating for possibly more than a decade, has attacked governments in Georgia, Eastern Europe, as well as NATO and the Organization for Security and Co-operation in Europe The activity profile vide this paper appears to be the work of a skilled team of developers and operators collecting intelligence that would only be useful to a government
APT Targets insider information related to governments, militaries, and security organizations that would likely benefit the Russian government.
APT “APT28's characteristics — their targeting, malware, language and working hours — have led us to conclude that we are tracking a focused, long-standing espionage effort… sponsored by the Russian government."
APT The paper discusses a threat group whose malware is well-known in the Cyber Security community & unlike the China-based threat actors, it does not appear to conduct widespread intellectual property theft for economic gain. Nor observed to steal and profit from financial account information.
APT While there are no pictures of a building, personas to reveal, or a government agency to name, what is evident is of long-standing, focused operations that indicate a government sponsor – specifically, a government based in Moscow. This group is referred to as APT28
APT
GEORGIA RUSSIA EASTERN EUROPE
APT The group likely seeks to collect intelligence about Georgia’s security and political dynamics by targeting officials working for the Ministry of Internal Affairs and the Ministry of Defense.
APT Demonstrated interest in Eastern European governments and security organizations. These victims would provide the Russian government with an ability to predict policymaker intentions and gauge its ability to influence public opinion.
APT APT28 appeared to target individuals affiliated with European security organizations and global multilateral institutions. The Russian government has long cited European security organizations like NATO and the OSCE as existential threats, particularly during periods of increased tension in Europe.
APT Malware compile times suggest that APT28 developers have consistently updated their tools over the last seven years. Since 2007, APT28 has systematically evolved its malware, using flexible and lasting platforms indicative of plans for long-term use.
APT28 tailors implants for specific victim environments. They steal data by configuring their implants to send data out of the network using a victim network’s mail server. APT28’s malware samples contain counter-analysis capabilities including runtime checks to identify an analysis environment and the inclusion of unused machine instructions to slow analysis.
APT Over 96% of the malware samples attributed to APT28 were compiled between Monday and Friday. More than 89% were compiled between 8AM and 6PM in the UTC+4 time zone, which parallels the working hours in Moscow and St. Petersburg. These samples had compile dates ranging from mid-2007 to September 2014.
APT More than half of the malware samples with Portable Executable (PE) resources attributed to APT28 included Russian language settings
APT28 INTEREST IN THE CAUCASUS, PARTICULARLY GEORGIA
APT
APT28 uses spear phishing emails to target its victims, a common tactic in which the threat group crafts its emails to mention specific topics (lures) relevant to recipients
APT The group made specific attempts to target the MIA & MoD
In one case, APT28 lure from mid- 2013 was identified that referenced MIA-related topics and employed malware that attempted to disguise its activity as legitimate MIA email traffic. The lure consisted of a weaponized Excel file that presented a decoy document containing a list of Georgian driver’s license numbers. The backdoor attempted to establish a connection to a Georgian MIA mail server and communicate via MIA email addresses ending with “@mia.ge.gov”. Once connected to the mail server, APT28’s backdoor sent an email message using a subject line related to driver’s licenses (in Georgian), and attached a file containing system reconnaissance information. This tactic could allow APT28 to obtain data from the MIA’s network .
APT This tactic could allow APT28 to obtain data from the MIA’s network through a less-monitored route, limiting the MIA network security department’s abilities to detect the traffic.
APT28 also appeared to target Georgia’s MOD along with a U.S. defense contractor that was training the Georgian military. The U.S. contractor was involved in a working group to advise the MOD and Georgian Armed Forces, assess Georgia’s military capabilities, and develop a military training program for the country. APT28 used a lure document that installed a SOURFACE downloader and contained a listing of birthdays for members of a working group between the Georgian MOD and the U.S. defense contractor.
APT28 TARGETING OF EASTERN EUROPEAN GOVERNMENTS AND MILITARIES
APT28 has registered domains similar to those of legitimate Eastern European (next slide…) These domain registrations not only suggest that APT28 is interested in Eastern European political affairs, but also that the group targets Eastern European governments directly. In addition, APT28 used one domain for command and control sessions (baltichost[.]org) that was themed after the Baltic Host exercises. Baltic Host is a multinational logistics planning exercise, hosted annually since 2009 by one of the three Baltic States (Estonia, Latvia, and Lithuania, all three of which are on Russia’s border) on a rotational basis.
EXAMPLES OF APT28 DOMAINS IMITATING LEGITIMATE EASTERN EUROPEAN ORGANIZATION NAMES
APT28 TARGETING OF NATO AND OTHER EUROPEAN SECURITY ORGANIZATIONS
Russia regards NATO as a threat to Russia’s strategic stability. APT28 also registered a domain name imitating the Organization for Security and Cooperation in Europe (OSCE) APT28 used a lure that contained an apparent non-public listing of contact information for defense attachés in the “Ankara Military Attaché Corps (AMAC),” which appears to be a professional organization of defense attachés in Turkey.
APT28 MALWARE COMMONLY USED TOOLS
Typical Deployment Of SOURFACE
ECOSYSTEM!!!!
Malware ECOSYSTEM AAAAACNCSDN,SMDNFSNF,MSNDF,MSNDFSF
APT28 MALWARE SUMMARY OF AFFAIRS
APT
Contact me : Mail me at anupam605@gmail.com/anupam.tiwari@nic.in Blog at http://anupriti.blogspot.in/ http://about.me/anupam.tiwari

Recommended

Cyber espionage nation state-apt_attacks_on_the_rise
Cyber espionage nation state-apt_attacks_on_the_riseCyber espionage nation state-apt_attacks_on_the_rise
Cyber espionage nation state-apt_attacks_on_the_rise
Cyphort
 
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
Cyphort
 
Attack on Sony
Attack on SonyAttack on Sony
Attack on Sony
Nick Bilogorskiy
 
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOLMalware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Cyphort
 
Week12 final
Week12 finalWeek12 final
Week12 final
Irfan Ali Memon
 
Malware's Most Wanted: Financial Trojans
Malware's Most Wanted: Financial TrojansMalware's Most Wanted: Financial Trojans
Malware's Most Wanted: Financial Trojans
Cyphort
 
Most notable apt_ attacks_of_2015_and_2016 predictions
Most notable apt_ attacks_of_2015_and_2016 predictionsMost notable apt_ attacks_of_2015_and_2016 predictions
Most notable apt_ attacks_of_2015_and_2016 predictions
Cyphort
 
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Andrew Morris
 

Recommended

Cyber espionage nation state-apt_attacks_on_the_rise
Cyber espionage nation state-apt_attacks_on_the_riseCyber espionage nation state-apt_attacks_on_the_rise
Cyber espionage nation state-apt_attacks_on_the_rise
Cyphort
 
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
Cyphort
 
Attack on Sony
Attack on SonyAttack on Sony
Attack on Sony
Nick Bilogorskiy
 
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOLMalware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Cyphort
 
Week12 final
Week12 finalWeek12 final
Week12 final
Irfan Ali Memon
 
Malware's Most Wanted: Financial Trojans
Malware's Most Wanted: Financial TrojansMalware's Most Wanted: Financial Trojans
Malware's Most Wanted: Financial Trojans
Cyphort
 
Most notable apt_ attacks_of_2015_and_2016 predictions
Most notable apt_ attacks_of_2015_and_2016 predictionsMost notable apt_ attacks_of_2015_and_2016 predictions
Most notable apt_ attacks_of_2015_and_2016 predictions
Cyphort
 
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Andrew Morris
 
Hacking and Types of Hacker.
Hacking and Types of Hacker.Hacking and Types of Hacker.
Hacking and Types of Hacker.
Coder Tech
 
Cybersecurity 5 road_blocks
Cybersecurity 5 road_blocksCybersecurity 5 road_blocks
Cybersecurity 5 road_blocks
Cyphort
 
Target attack (hkust gold edition)(public version)
Target attack (hkust gold edition)(public version)Target attack (hkust gold edition)(public version)
Target attack (hkust gold edition)(public version)Anthony Lai
 
Operating Systems: Computer Security
Operating Systems: Computer SecurityOperating Systems: Computer Security
Operating Systems: Computer Security
Damian T. Gordon
 
Malware's Most Wanted: Linux and Internet of Things Malware
Malware's Most Wanted: Linux and Internet of Things MalwareMalware's Most Wanted: Linux and Internet of Things Malware
Malware's Most Wanted: Linux and Internet of Things Malware
Cyphort
 
Implementing a comprehensive application security progaram - Tawfiq
Implementing a comprehensive application security progaram - Tawfiq Implementing a comprehensive application security progaram - Tawfiq
Implementing a comprehensive application security progaram - Tawfiq
OWASP-Qatar Chapter
 
Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554TISA
 
MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence
Cyphort
 
Malware self protection-matrix
Malware self protection-matrixMalware self protection-matrix
Malware self protection-matrix
Cyphort
 
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Stefano Maccaglia
 
42 - Malware - Understand the Threat and How to Respond
42 - Malware - Understand the Threat and How to Respond42 - Malware - Understand the Threat and How to Respond
42 - Malware - Understand the Threat and How to Respond
Thomas Roccia
 
Understanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case StudyUnderstanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case Study
securityxploded
 
APT Malware & Media
APT Malware & MediaAPT Malware & Media
APT Malware & Media
3S Labs
 
Malware Most Wanted: Security Ecosystem
Malware Most Wanted: Security EcosystemMalware Most Wanted: Security Ecosystem
Malware Most Wanted: Security Ecosystem
Cyphort
 
Hacking
HackingHacking
Hacking
gvsai501
 
Ransomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionRansomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, Prevention
Mohammad Yahya
 
Network security
Network securityNetwork security
Network security
Akhilesh Jain
 
Visiting the Bear Den
Visiting the Bear DenVisiting the Bear Den
Visiting the Bear Den
ESET
 
Common Techniques To Identify Advanced Persistent Threat (APT)
Common Techniques To Identify Advanced Persistent Threat (APT)Common Techniques To Identify Advanced Persistent Threat (APT)
Common Techniques To Identify Advanced Persistent Threat (APT)
Yuval Sinay, CISSP, C|CISO
 
Hunting The Shadows: In Depth Analysis of Escalated APT Attacks
Hunting The Shadows: In Depth Analysis of Escalated APT AttacksHunting The Shadows: In Depth Analysis of Escalated APT Attacks
Hunting The Shadows: In Depth Analysis of Escalated APT Attacks
F _
 
NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...
NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...
NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...
North Texas Chapter of the ISSA
 
Introduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Introduction to Advanced Persistent Threats (APT) for Non-Security EngineersIntroduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Introduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Ollie Whitehouse
 

More Related Content

What's hot

Hacking and Types of Hacker.
Hacking and Types of Hacker.Hacking and Types of Hacker.
Hacking and Types of Hacker.
Coder Tech
 
Cybersecurity 5 road_blocks
Cybersecurity 5 road_blocksCybersecurity 5 road_blocks
Cybersecurity 5 road_blocks
Cyphort
 
Target attack (hkust gold edition)(public version)
Target attack (hkust gold edition)(public version)Target attack (hkust gold edition)(public version)
Target attack (hkust gold edition)(public version)Anthony Lai
 
Operating Systems: Computer Security
Operating Systems: Computer SecurityOperating Systems: Computer Security
Operating Systems: Computer Security
Damian T. Gordon
 
Malware's Most Wanted: Linux and Internet of Things Malware
Malware's Most Wanted: Linux and Internet of Things MalwareMalware's Most Wanted: Linux and Internet of Things Malware
Malware's Most Wanted: Linux and Internet of Things Malware
Cyphort
 
Implementing a comprehensive application security progaram - Tawfiq
Implementing a comprehensive application security progaram - Tawfiq Implementing a comprehensive application security progaram - Tawfiq
Implementing a comprehensive application security progaram - Tawfiq
OWASP-Qatar Chapter
 
Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554TISA
 
MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence
Cyphort
 
Malware self protection-matrix
Malware self protection-matrixMalware self protection-matrix
Malware self protection-matrix
Cyphort
 
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Stefano Maccaglia
 
42 - Malware - Understand the Threat and How to Respond
42 - Malware - Understand the Threat and How to Respond42 - Malware - Understand the Threat and How to Respond
42 - Malware - Understand the Threat and How to Respond
Thomas Roccia
 
Understanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case StudyUnderstanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case Study
securityxploded
 
APT Malware & Media
APT Malware & MediaAPT Malware & Media
APT Malware & Media
3S Labs
 
Malware Most Wanted: Security Ecosystem
Malware Most Wanted: Security EcosystemMalware Most Wanted: Security Ecosystem
Malware Most Wanted: Security Ecosystem
Cyphort
 
Hacking
HackingHacking
Hacking
gvsai501
 
Ransomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionRansomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, Prevention
Mohammad Yahya
 
Network security
Network securityNetwork security
Network security
Akhilesh Jain
 

What's hot (17)

Hacking and Types of Hacker.
Hacking and Types of Hacker.Hacking and Types of Hacker.
Hacking and Types of Hacker.
 
Cybersecurity 5 road_blocks
Cybersecurity 5 road_blocksCybersecurity 5 road_blocks
Cybersecurity 5 road_blocks
 
Target attack (hkust gold edition)(public version)
Target attack (hkust gold edition)(public version)Target attack (hkust gold edition)(public version)
Target attack (hkust gold edition)(public version)
 
Operating Systems: Computer Security
Operating Systems: Computer SecurityOperating Systems: Computer Security
Operating Systems: Computer Security
 
Malware's Most Wanted: Linux and Internet of Things Malware
Malware's Most Wanted: Linux and Internet of Things MalwareMalware's Most Wanted: Linux and Internet of Things Malware
Malware's Most Wanted: Linux and Internet of Things Malware
 
Implementing a comprehensive application security progaram - Tawfiq
Implementing a comprehensive application security progaram - Tawfiq Implementing a comprehensive application security progaram - Tawfiq
Implementing a comprehensive application security progaram - Tawfiq
 
Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554
 
MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence
 
Malware self protection-matrix
Malware self protection-matrixMalware self protection-matrix
Malware self protection-matrix
 
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
 
42 - Malware - Understand the Threat and How to Respond
42 - Malware - Understand the Threat and How to Respond42 - Malware - Understand the Threat and How to Respond
42 - Malware - Understand the Threat and How to Respond
 
Understanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case StudyUnderstanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case Study
 
APT Malware & Media
APT Malware & MediaAPT Malware & Media
APT Malware & Media
 
Malware Most Wanted: Security Ecosystem
Malware Most Wanted: Security EcosystemMalware Most Wanted: Security Ecosystem
Malware Most Wanted: Security Ecosystem
 
Hacking
HackingHacking
Hacking
 
Ransomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionRansomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, Prevention
 
Network security
Network securityNetwork security
Network security
 

Viewers also liked

Visiting the Bear Den
Visiting the Bear DenVisiting the Bear Den
Visiting the Bear Den
ESET
 
Common Techniques To Identify Advanced Persistent Threat (APT)
Common Techniques To Identify Advanced Persistent Threat (APT)Common Techniques To Identify Advanced Persistent Threat (APT)
Common Techniques To Identify Advanced Persistent Threat (APT)
Yuval Sinay, CISSP, C|CISO
 
Hunting The Shadows: In Depth Analysis of Escalated APT Attacks
Hunting The Shadows: In Depth Analysis of Escalated APT AttacksHunting The Shadows: In Depth Analysis of Escalated APT Attacks
Hunting The Shadows: In Depth Analysis of Escalated APT Attacks
F _
 
NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...
NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...
NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...
North Texas Chapter of the ISSA
 
Introduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Introduction to Advanced Persistent Threats (APT) for Non-Security EngineersIntroduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Introduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Ollie Whitehouse
 
Harden your LinkedIn Settings : A Necessity Now
Harden your LinkedIn Settings : A Necessity NowHarden your LinkedIn Settings : A Necessity Now
Harden your LinkedIn Settings : A Necessity Now
anupriti
 
Wirelurker
WirelurkerWirelurker
Wirelurker
anupriti
 
Regin
ReginRegin
Regin
anupriti
 
Presentatie Kaspersky over Malware trends en statistieken, 26062015
Presentatie Kaspersky over Malware trends en statistieken, 26062015Presentatie Kaspersky over Malware trends en statistieken, 26062015
Presentatie Kaspersky over Malware trends en statistieken, 26062015
SLBdiensten
 
Does a Bear Leak in the Woods?
Does a Bear Leak in the Woods?Does a Bear Leak in the Woods?
Does a Bear Leak in the Woods?
ThreatConnect
 
Advanced Persistent Threat: come muoversi tra il marketing e la realtà?
Advanced Persistent Threat: come muoversi tra il marketing e la realtà?Advanced Persistent Threat: come muoversi tra il marketing e la realtà?
Advanced Persistent Threat: come muoversi tra il marketing e la realtà?festival ICT 2016
 
Understanding advanced persistent threats (APT)
Understanding advanced persistent threats (APT)Understanding advanced persistent threats (APT)
Understanding advanced persistent threats (APT)
Dan Morrill
 
Introduction to the advanced persistent threat and hactivism
Introduction to the advanced persistent threat and hactivismIntroduction to the advanced persistent threat and hactivism
Introduction to the advanced persistent threat and hactivism
Global Micro Solutions
 
Amien Harisen - APT1 Attack
Amien Harisen - APT1 AttackAmien Harisen - APT1 Attack
Amien Harisen - APT1 Attack
Indonesia Honeynet Chapter
 
Toward revealing Advanced Persistence Threats in your organization - Public
Toward revealing Advanced Persistence Threats in your organization - PublicToward revealing Advanced Persistence Threats in your organization - Public
Toward revealing Advanced Persistence Threats in your organization - PublicCharles Lim
 
sebis research profile
sebis research profilesebis research profile
sebis research profile
sebistum
 
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
viaForensics
 
Hide Android applications in images
Hide Android applications in imagesHide Android applications in images
Hide Android applications in images
Ange Albertini
 
ToorCon 14 : Malandroid : The Crux of Android Infections
ToorCon 14 : Malandroid : The Crux of Android InfectionsToorCon 14 : Malandroid : The Crux of Android Infections
ToorCon 14 : Malandroid : The Crux of Android Infections
Aditya K Sood
 

Viewers also liked (20)

Visiting the Bear Den
Visiting the Bear DenVisiting the Bear Den
Visiting the Bear Den
 
Common Techniques To Identify Advanced Persistent Threat (APT)
Common Techniques To Identify Advanced Persistent Threat (APT)Common Techniques To Identify Advanced Persistent Threat (APT)
Common Techniques To Identify Advanced Persistent Threat (APT)
 
Hunting The Shadows: In Depth Analysis of Escalated APT Attacks
Hunting The Shadows: In Depth Analysis of Escalated APT AttacksHunting The Shadows: In Depth Analysis of Escalated APT Attacks
Hunting The Shadows: In Depth Analysis of Escalated APT Attacks
 
NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...
NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...
NTXISSACSC2 - Advanced Persistent Threat (APT) Life Cycle Management Monty Mc...
 
Introduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Introduction to Advanced Persistent Threats (APT) for Non-Security EngineersIntroduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Introduction to Advanced Persistent Threats (APT) for Non-Security Engineers
 
Harden your LinkedIn Settings : A Necessity Now
Harden your LinkedIn Settings : A Necessity NowHarden your LinkedIn Settings : A Necessity Now
Harden your LinkedIn Settings : A Necessity Now
 
Wirelurker
WirelurkerWirelurker
Wirelurker
 
Regin
ReginRegin
Regin
 
Presentatie Kaspersky over Malware trends en statistieken, 26062015
Presentatie Kaspersky over Malware trends en statistieken, 26062015Presentatie Kaspersky over Malware trends en statistieken, 26062015
Presentatie Kaspersky over Malware trends en statistieken, 26062015
 
Does a Bear Leak in the Woods?
Does a Bear Leak in the Woods?Does a Bear Leak in the Woods?
Does a Bear Leak in the Woods?
 
Advanced Persistent Threat: come muoversi tra il marketing e la realtà?
Advanced Persistent Threat: come muoversi tra il marketing e la realtà?Advanced Persistent Threat: come muoversi tra il marketing e la realtà?
Advanced Persistent Threat: come muoversi tra il marketing e la realtà?
 
Understanding advanced persistent threats (APT)
Understanding advanced persistent threats (APT)Understanding advanced persistent threats (APT)
Understanding advanced persistent threats (APT)
 
Virus&malware
Virus&malwareVirus&malware
Virus&malware
 
Introduction to the advanced persistent threat and hactivism
Introduction to the advanced persistent threat and hactivismIntroduction to the advanced persistent threat and hactivism
Introduction to the advanced persistent threat and hactivism
 
Amien Harisen - APT1 Attack
Amien Harisen - APT1 AttackAmien Harisen - APT1 Attack
Amien Harisen - APT1 Attack
 
Toward revealing Advanced Persistence Threats in your organization - Public
Toward revealing Advanced Persistence Threats in your organization - PublicToward revealing Advanced Persistence Threats in your organization - Public
Toward revealing Advanced Persistence Threats in your organization - Public
 
sebis research profile
sebis research profilesebis research profile
sebis research profile
 
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
 
Hide Android applications in images
Hide Android applications in imagesHide Android applications in images
Hide Android applications in images
 
ToorCon 14 : Malandroid : The Crux of Android Infections
ToorCon 14 : Malandroid : The Crux of Android InfectionsToorCon 14 : Malandroid : The Crux of Android Infections
ToorCon 14 : Malandroid : The Crux of Android Infections
 

Similar to APT 28 :Cyber Espionage and the Russian Government?

APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docxAPT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
festockton
 
APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docxAPT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
jewisonantone
 
Eu_Repo_C_APT_profile_APT_29_d9cee0efa4.pdf
Eu_Repo_C_APT_profile_APT_29_d9cee0efa4.pdfEu_Repo_C_APT_profile_APT_29_d9cee0efa4.pdf
Eu_Repo_C_APT_profile_APT_29_d9cee0efa4.pdf
TeabeAmet
 
Bitdefender in depth-analysis cyber espionage
Bitdefender in depth-analysis cyber espionageBitdefender in depth-analysis cyber espionage
Bitdefender in depth-analysis cyber espionage
Jacopo Maria Tavaroli
 
7122017 cyber espionage is alive and well apt32 and the thr
7122017 cyber espionage is alive and well apt32 and the thr7122017 cyber espionage is alive and well apt32 and the thr
7122017 cyber espionage is alive and well apt32 and the thr
smile790243
 
Threat Actors - Vietnam (OceansLotus).pptx
Threat Actors - Vietnam (OceansLotus).pptxThreat Actors - Vietnam (OceansLotus).pptx
Threat Actors - Vietnam (OceansLotus).pptx
MALCOMNORONHA1
 
APT Research Project.pptx
APT Research Project.pptxAPT Research Project.pptx
APT Research Project.pptx
UsamaAliLone3
 
Pegasus Spyware Presentation.pptx
Pegasus Spyware Presentation.pptxPegasus Spyware Presentation.pptx
Pegasus Spyware Presentation.pptx
02ckwani
 
TOTEM: Threat Observation, Tracking, and Evaluation Model
TOTEM: Threat Observation, Tracking, and Evaluation ModelTOTEM: Threat Observation, Tracking, and Evaluation Model
TOTEM: Threat Observation, Tracking, and Evaluation Model
John Gerber
 
Cybersecurity.pptx
Cybersecurity.pptxCybersecurity.pptx
Cybersecurity.pptx
Fwem
 
Albert Helps Protect from Hacking JRN 4.docx
Albert Helps Protect from Hacking JRN 4.docxAlbert Helps Protect from Hacking JRN 4.docx
Albert Helps Protect from Hacking JRN 4.docx
nettletondevon
 
ESSENTIALS OF Management Information Systems 12eKENNETH C..docx
ESSENTIALS OF Management Information Systems 12eKENNETH C..docxESSENTIALS OF Management Information Systems 12eKENNETH C..docx
ESSENTIALS OF Management Information Systems 12eKENNETH C..docx
debishakespeare
 
ESSENTIALS OF Management Information Systems 12eKENNETH C.
ESSENTIALS OF Management Information Systems 12eKENNETH C.ESSENTIALS OF Management Information Systems 12eKENNETH C.
ESSENTIALS OF Management Information Systems 12eKENNETH C.
ronnasleightholm
 
On How the Darknet and its Access to SCADA is a Threat to National Critical I...
On How the Darknet and its Access to SCADA is a Threat to National Critical I...On How the Darknet and its Access to SCADA is a Threat to National Critical I...
On How the Darknet and its Access to SCADA is a Threat to National Critical I...Matthew Kurnava
 
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCESA FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
ijmpict
 
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCESA FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
ijmpict
 
UN Presentation - 10-17-2018 - Maccaglia
UN Presentation - 10-17-2018 - MaccagliaUN Presentation - 10-17-2018 - Maccaglia
UN Presentation - 10-17-2018 - Maccaglia
Stefano Maccaglia
 
A comprehensive study on classification of passive intrusion and extrusion de...
A comprehensive study on classification of passive intrusion and extrusion de...A comprehensive study on classification of passive intrusion and extrusion de...
A comprehensive study on classification of passive intrusion and extrusion de...
csandit
 
A COMPREHENSIVE STUDY ON CLASSIFICATION OF PASSIVE INTRUSION AND EXTRUSION DE...
A COMPREHENSIVE STUDY ON CLASSIFICATION OF PASSIVE INTRUSION AND EXTRUSION DE...A COMPREHENSIVE STUDY ON CLASSIFICATION OF PASSIVE INTRUSION AND EXTRUSION DE...
A COMPREHENSIVE STUDY ON CLASSIFICATION OF PASSIVE INTRUSION AND EXTRUSION DE...
cscpconf
 
NACCTFO Cyber Security Presentation 2014 New Orleans
NACCTFO Cyber Security Presentation 2014 New OrleansNACCTFO Cyber Security Presentation 2014 New Orleans
NACCTFO Cyber Security Presentation 2014 New Orleans
Maurice Dawson
 

Similar to APT 28 :Cyber Espionage and the Russian Government? (20)

APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docxAPT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
 
APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docxAPT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
APT28 A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS.docx
 
Eu_Repo_C_APT_profile_APT_29_d9cee0efa4.pdf
Eu_Repo_C_APT_profile_APT_29_d9cee0efa4.pdfEu_Repo_C_APT_profile_APT_29_d9cee0efa4.pdf
Eu_Repo_C_APT_profile_APT_29_d9cee0efa4.pdf
 
Bitdefender in depth-analysis cyber espionage
Bitdefender in depth-analysis cyber espionageBitdefender in depth-analysis cyber espionage
Bitdefender in depth-analysis cyber espionage
 
7122017 cyber espionage is alive and well apt32 and the thr
7122017 cyber espionage is alive and well apt32 and the thr7122017 cyber espionage is alive and well apt32 and the thr
7122017 cyber espionage is alive and well apt32 and the thr
 
Threat Actors - Vietnam (OceansLotus).pptx
Threat Actors - Vietnam (OceansLotus).pptxThreat Actors - Vietnam (OceansLotus).pptx
Threat Actors - Vietnam (OceansLotus).pptx
 
APT Research Project.pptx
APT Research Project.pptxAPT Research Project.pptx
APT Research Project.pptx
 
Pegasus Spyware Presentation.pptx
Pegasus Spyware Presentation.pptxPegasus Spyware Presentation.pptx
Pegasus Spyware Presentation.pptx
 
TOTEM: Threat Observation, Tracking, and Evaluation Model
TOTEM: Threat Observation, Tracking, and Evaluation ModelTOTEM: Threat Observation, Tracking, and Evaluation Model
TOTEM: Threat Observation, Tracking, and Evaluation Model
 
Cybersecurity.pptx
Cybersecurity.pptxCybersecurity.pptx
Cybersecurity.pptx
 
Albert Helps Protect from Hacking JRN 4.docx
Albert Helps Protect from Hacking JRN 4.docxAlbert Helps Protect from Hacking JRN 4.docx
Albert Helps Protect from Hacking JRN 4.docx
 
ESSENTIALS OF Management Information Systems 12eKENNETH C..docx
ESSENTIALS OF Management Information Systems 12eKENNETH C..docxESSENTIALS OF Management Information Systems 12eKENNETH C..docx
ESSENTIALS OF Management Information Systems 12eKENNETH C..docx
 
ESSENTIALS OF Management Information Systems 12eKENNETH C.
ESSENTIALS OF Management Information Systems 12eKENNETH C.ESSENTIALS OF Management Information Systems 12eKENNETH C.
ESSENTIALS OF Management Information Systems 12eKENNETH C.
 
On How the Darknet and its Access to SCADA is a Threat to National Critical I...
On How the Darknet and its Access to SCADA is a Threat to National Critical I...On How the Darknet and its Access to SCADA is a Threat to National Critical I...
On How the Darknet and its Access to SCADA is a Threat to National Critical I...
 
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCESA FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
 
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCESA FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
A FRAMEWORK TO DEFENSE AGAINST INSIDER ATTACKS ON INFORMATION SOURCES
 
UN Presentation - 10-17-2018 - Maccaglia
UN Presentation - 10-17-2018 - MaccagliaUN Presentation - 10-17-2018 - Maccaglia
UN Presentation - 10-17-2018 - Maccaglia
 
A comprehensive study on classification of passive intrusion and extrusion de...
A comprehensive study on classification of passive intrusion and extrusion de...A comprehensive study on classification of passive intrusion and extrusion de...
A comprehensive study on classification of passive intrusion and extrusion de...
 
A COMPREHENSIVE STUDY ON CLASSIFICATION OF PASSIVE INTRUSION AND EXTRUSION DE...
A COMPREHENSIVE STUDY ON CLASSIFICATION OF PASSIVE INTRUSION AND EXTRUSION DE...A COMPREHENSIVE STUDY ON CLASSIFICATION OF PASSIVE INTRUSION AND EXTRUSION DE...
A COMPREHENSIVE STUDY ON CLASSIFICATION OF PASSIVE INTRUSION AND EXTRUSION DE...
 
NACCTFO Cyber Security Presentation 2014 New Orleans
NACCTFO Cyber Security Presentation 2014 New OrleansNACCTFO Cyber Security Presentation 2014 New Orleans
NACCTFO Cyber Security Presentation 2014 New Orleans
 

More from anupriti

TALLINN MANUAL & GLOBAL CYBER WARFARE POLICIES
TALLINN MANUAL & GLOBAL CYBER WARFARE POLICIESTALLINN MANUAL & GLOBAL CYBER WARFARE POLICIES
TALLINN MANUAL & GLOBAL CYBER WARFARE POLICIES
anupriti
 
Cyber Security : An attempt to assimilate and technically understand it
Cyber Security : An attempt to assimilate and technically understand itCyber Security : An attempt to assimilate and technically understand it
Cyber Security : An attempt to assimilate and technically understand it
anupriti
 
IETE mid-term symposium on digital forensics and information security : 23 M...
IETE mid-term symposium on digital forensics and information security : 23 M... IETE mid-term symposium on digital forensics and information security : 23 M...
IETE mid-term symposium on digital forensics and information security : 23 M...
anupriti
 
Coalition of IoT and Blockchain: Rewards and Challenges
Coalition of IoT and Blockchain: Rewards and ChallengesCoalition of IoT and Blockchain: Rewards and Challenges
Coalition of IoT and Blockchain: Rewards and Challenges
anupriti
 
Proof of Work and connect with BYZANTINE Generals
Proof of Work and connect with BYZANTINE GeneralsProof of Work and connect with BYZANTINE Generals
Proof of Work and connect with BYZANTINE Generals
anupriti
 
BLOCKCHAIN ,BITCOIN & CRYPTOCURRENCIES WORLD : MECHANICS AND CYBER CRIME
BLOCKCHAIN ,BITCOIN & CRYPTOCURRENCIES WORLD : MECHANICS AND CYBER CRIMEBLOCKCHAIN ,BITCOIN & CRYPTOCURRENCIES WORLD : MECHANICS AND CYBER CRIME
BLOCKCHAIN ,BITCOIN & CRYPTOCURRENCIES WORLD : MECHANICS AND CYBER CRIME
anupriti
 
Symposium on Legal Regulation of Bitcoin, Blockchain & Cryptocurrencies
Symposium on Legal Regulation of Bitcoin, Blockchain & Cryptocurrencies Symposium on Legal Regulation of Bitcoin, Blockchain & Cryptocurrencies
Symposium on Legal Regulation of Bitcoin, Blockchain & Cryptocurrencies
anupriti
 
BITCOIN FORENSICS : Bsides Delhi Conference
BITCOIN FORENSICS : Bsides Delhi ConferenceBITCOIN FORENSICS : Bsides Delhi Conference
BITCOIN FORENSICS : Bsides Delhi Conference
anupriti
 
Hashgraph : An over view with example
Hashgraph : An over view with exampleHashgraph : An over view with example
Hashgraph : An over view with example
anupriti
 
BITCOIN FORENSICS : HAKON-2017 CONFERENCE
BITCOIN FORENSICS : HAKON-2017 CONFERENCEBITCOIN FORENSICS : HAKON-2017 CONFERENCE
BITCOIN FORENSICS : HAKON-2017 CONFERENCE
anupriti
 
Webinar on BITCOIN FORENSICS : BRIGHTTALK
Webinar on BITCOIN FORENSICS : BRIGHTTALKWebinar on BITCOIN FORENSICS : BRIGHTTALK
Webinar on BITCOIN FORENSICS : BRIGHTTALK
anupriti
 
Bitcoin Forensics
Bitcoin ForensicsBitcoin Forensics
Bitcoin Forensics
anupriti
 
Blockchain and Bitcoin : A Technical Overview
Blockchain and Bitcoin : A Technical OverviewBlockchain and Bitcoin : A Technical Overview
Blockchain and Bitcoin : A Technical Overview
anupriti
 
Equation Group : Advanced Secretive Computer Espionage Group
Equation Group : Advanced Secretive Computer Espionage GroupEquation Group : Advanced Secretive Computer Espionage Group
Equation Group : Advanced Secretive Computer Espionage Group
anupriti
 
Quanity your Web Safety Score
Quanity your Web Safety ScoreQuanity your Web Safety Score
Quanity your Web Safety Score
anupriti
 
Android Device Hardening
Android Device HardeningAndroid Device Hardening
Android Device Hardening
anupriti
 
Cloud Computing and Virtualisation
Cloud Computing and VirtualisationCloud Computing and Virtualisation
Cloud Computing and Virtualisation
anupriti
 
Cloud-forensics
Cloud-forensicsCloud-forensics
Cloud-forensics
anupriti
 
BIG DATA AND SECURITY CHALLENGES
BIG DATA AND SECURITY CHALLENGESBIG DATA AND SECURITY CHALLENGES
BIG DATA AND SECURITY CHALLENGES
anupriti
 
E-governance-and-Security
E-governance-and-SecurityE-governance-and-Security
E-governance-and-Security
anupriti
 

More from anupriti (20)

TALLINN MANUAL & GLOBAL CYBER WARFARE POLICIES
TALLINN MANUAL & GLOBAL CYBER WARFARE POLICIESTALLINN MANUAL & GLOBAL CYBER WARFARE POLICIES
TALLINN MANUAL & GLOBAL CYBER WARFARE POLICIES
 
Cyber Security : An attempt to assimilate and technically understand it
Cyber Security : An attempt to assimilate and technically understand itCyber Security : An attempt to assimilate and technically understand it
Cyber Security : An attempt to assimilate and technically understand it
 
IETE mid-term symposium on digital forensics and information security : 23 M...
IETE mid-term symposium on digital forensics and information security : 23 M... IETE mid-term symposium on digital forensics and information security : 23 M...
IETE mid-term symposium on digital forensics and information security : 23 M...
 
Coalition of IoT and Blockchain: Rewards and Challenges
Coalition of IoT and Blockchain: Rewards and ChallengesCoalition of IoT and Blockchain: Rewards and Challenges
Coalition of IoT and Blockchain: Rewards and Challenges
 
Proof of Work and connect with BYZANTINE Generals
Proof of Work and connect with BYZANTINE GeneralsProof of Work and connect with BYZANTINE Generals
Proof of Work and connect with BYZANTINE Generals
 
BLOCKCHAIN ,BITCOIN & CRYPTOCURRENCIES WORLD : MECHANICS AND CYBER CRIME
BLOCKCHAIN ,BITCOIN & CRYPTOCURRENCIES WORLD : MECHANICS AND CYBER CRIMEBLOCKCHAIN ,BITCOIN & CRYPTOCURRENCIES WORLD : MECHANICS AND CYBER CRIME
BLOCKCHAIN ,BITCOIN & CRYPTOCURRENCIES WORLD : MECHANICS AND CYBER CRIME
 
Symposium on Legal Regulation of Bitcoin, Blockchain & Cryptocurrencies
Symposium on Legal Regulation of Bitcoin, Blockchain & Cryptocurrencies Symposium on Legal Regulation of Bitcoin, Blockchain & Cryptocurrencies
Symposium on Legal Regulation of Bitcoin, Blockchain & Cryptocurrencies
 
BITCOIN FORENSICS : Bsides Delhi Conference
BITCOIN FORENSICS : Bsides Delhi ConferenceBITCOIN FORENSICS : Bsides Delhi Conference
BITCOIN FORENSICS : Bsides Delhi Conference
 
Hashgraph : An over view with example
Hashgraph : An over view with exampleHashgraph : An over view with example
Hashgraph : An over view with example
 
BITCOIN FORENSICS : HAKON-2017 CONFERENCE
BITCOIN FORENSICS : HAKON-2017 CONFERENCEBITCOIN FORENSICS : HAKON-2017 CONFERENCE
BITCOIN FORENSICS : HAKON-2017 CONFERENCE
 
Webinar on BITCOIN FORENSICS : BRIGHTTALK
Webinar on BITCOIN FORENSICS : BRIGHTTALKWebinar on BITCOIN FORENSICS : BRIGHTTALK
Webinar on BITCOIN FORENSICS : BRIGHTTALK
 
Bitcoin Forensics
Bitcoin ForensicsBitcoin Forensics
Bitcoin Forensics
 
Blockchain and Bitcoin : A Technical Overview
Blockchain and Bitcoin : A Technical OverviewBlockchain and Bitcoin : A Technical Overview
Blockchain and Bitcoin : A Technical Overview
 
Equation Group : Advanced Secretive Computer Espionage Group
Equation Group : Advanced Secretive Computer Espionage GroupEquation Group : Advanced Secretive Computer Espionage Group
Equation Group : Advanced Secretive Computer Espionage Group
 
Quanity your Web Safety Score
Quanity your Web Safety ScoreQuanity your Web Safety Score
Quanity your Web Safety Score
 
Android Device Hardening
Android Device HardeningAndroid Device Hardening
Android Device Hardening
 
Cloud Computing and Virtualisation
Cloud Computing and VirtualisationCloud Computing and Virtualisation
Cloud Computing and Virtualisation
 
Cloud-forensics
Cloud-forensicsCloud-forensics
Cloud-forensics
 
BIG DATA AND SECURITY CHALLENGES
BIG DATA AND SECURITY CHALLENGESBIG DATA AND SECURITY CHALLENGES
BIG DATA AND SECURITY CHALLENGES
 
E-governance-and-Security
E-governance-and-SecurityE-governance-and-Security
E-governance-and-Security
 

Recently uploaded

一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
eutxy
 
test test test test testtest test testtest test testtest test testtest test ...
test test test test testtest test testtest test testtest test testtest test ...test test test test testtest test testtest test testtest test testtest test ...
test test test test testtest test testtest test testtest test testtest test ...
Arif0071
 
1.Wireless Communication System_Wireless communication is a broad term that i...
1.Wireless Communication System_Wireless communication is a broad term that i...1.Wireless Communication System_Wireless communication is a broad term that i...
1.Wireless Communication System_Wireless communication is a broad term that i...
JeyaPerumal1
 
guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...
Rogerio Filho
 
Comptia N+ Standard Networking lesson guide
Comptia N+ Standard Networking lesson guideComptia N+ Standard Networking lesson guide
Comptia N+ Standard Networking lesson guide
GTProductions1
 
Multi-cluster Kubernetes Networking- Patterns, Projects and Guidelines
Multi-cluster Kubernetes Networking- Patterns, Projects and GuidelinesMulti-cluster Kubernetes Networking- Patterns, Projects and Guidelines
Multi-cluster Kubernetes Networking- Patterns, Projects and Guidelines
Sanjeev Rampal
 
BASIC C++ lecture NOTE C++ lecture 3.pptx
BASIC C++ lecture NOTE C++ lecture 3.pptxBASIC C++ lecture NOTE C++ lecture 3.pptx
BASIC C++ lecture NOTE C++ lecture 3.pptx
natyesu
 
The+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptxThe+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptx
laozhuseo02
 
Latest trends in computer networking.pptx
Latest trends in computer networking.pptxLatest trends in computer networking.pptx
Latest trends in computer networking.pptx
JungkooksNonexistent
 
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdfJAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
Javier Lasa
 
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
ufdana
 
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
3ipehhoa
 
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
3ipehhoa
 
Internet-Security-Safeguarding-Your-Digital-World (1).pptx
Internet-Security-Safeguarding-Your-Digital-World (1).pptxInternet-Security-Safeguarding-Your-Digital-World (1).pptx
Internet-Security-Safeguarding-Your-Digital-World (1).pptx
VivekSinghShekhawat2
 
This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!
nirahealhty
 
APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
APNIC
 
一比一原版(SLU毕业证)圣路易斯大学毕业证成绩单专业办理
一比一原版(SLU毕业证)圣路易斯大学毕业证成绩单专业办理一比一原版(SLU毕业证)圣路易斯大学毕业证成绩单专业办理
一比一原版(SLU毕业证)圣路易斯大学毕业证成绩单专业办理
keoku
 
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
3ipehhoa
 
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptxBridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
Brad Spiegel Macon GA
 
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shopHistory+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
laozhuseo02
 

Recently uploaded (20)

一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
 
test test test test testtest test testtest test testtest test testtest test ...
test test test test testtest test testtest test testtest test testtest test ...test test test test testtest test testtest test testtest test testtest test ...
test test test test testtest test testtest test testtest test testtest test ...
 
1.Wireless Communication System_Wireless communication is a broad term that i...
1.Wireless Communication System_Wireless communication is a broad term that i...1.Wireless Communication System_Wireless communication is a broad term that i...
1.Wireless Communication System_Wireless communication is a broad term that i...
 
guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...
 
Comptia N+ Standard Networking lesson guide
Comptia N+ Standard Networking lesson guideComptia N+ Standard Networking lesson guide
Comptia N+ Standard Networking lesson guide
 
Multi-cluster Kubernetes Networking- Patterns, Projects and Guidelines
Multi-cluster Kubernetes Networking- Patterns, Projects and GuidelinesMulti-cluster Kubernetes Networking- Patterns, Projects and Guidelines
Multi-cluster Kubernetes Networking- Patterns, Projects and Guidelines
 
BASIC C++ lecture NOTE C++ lecture 3.pptx
BASIC C++ lecture NOTE C++ lecture 3.pptxBASIC C++ lecture NOTE C++ lecture 3.pptx
BASIC C++ lecture NOTE C++ lecture 3.pptx
 
The+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptxThe+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptx
 
Latest trends in computer networking.pptx
Latest trends in computer networking.pptxLatest trends in computer networking.pptx
Latest trends in computer networking.pptx
 
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdfJAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
 
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
 
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
 
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
 
Internet-Security-Safeguarding-Your-Digital-World (1).pptx
Internet-Security-Safeguarding-Your-Digital-World (1).pptxInternet-Security-Safeguarding-Your-Digital-World (1).pptx
Internet-Security-Safeguarding-Your-Digital-World (1).pptx
 
This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!
 
APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
 
一比一原版(SLU毕业证)圣路易斯大学毕业证成绩单专业办理
一比一原版(SLU毕业证)圣路易斯大学毕业证成绩单专业办理一比一原版(SLU毕业证)圣路易斯大学毕业证成绩单专业办理
一比一原版(SLU毕业证)圣路易斯大学毕业证成绩单专业办理
 
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
 
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptxBridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
 
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shopHistory+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
 

APT 28 :Cyber Espionage and the Russian Government?

  • 1. Combined null/OWASP Delhi Year End Meet By : Anupam Tiwari,CEH,CCCSP,PGDIS,GFSU Certified, B.Tech, M.Tech
  • 2. The ppt is based on a report available at http://www.fireeye.com/resources/pdfs/apt28.pdf
  • 3.
  • 4. Dr. Web Russia ESET Slovakia ESET Slovakia F-Secure Finland F-Secure Finland FRISK Software Iceland Fortinet United States G DATA Software Germany G DATA Software Germany GFI Software Malta Ikarus Australia IObit United States iolo technologies United States iS3 United States K7 Computing India K7 Computing India Kaspersky Lab Russia KingSoft China McAfee United States Microsoft United States NANO Security Russia Panda Security Spain PSafe Brazil Agnitu`m Russia Agnitum Russia AhnLab South Korea avast! Czech Republic avast! Czech Republic avast! Czech Republic AVG Technologies Czech Republic (Grisoft) Avira Germany Avira Germany Bitdefender Romania Bitdefender Romania Bitdefender Romania BullGuard United Kingdom BullGuard United Kingdom Check Point United States Check Point United States ClamWin Australia Comodo Group United States Comodo Group United States CYSEC United Kingdom Comodo Group United States Dr. Web Russia Qihoo 360 China Quick Heal India Scandium SecurityCyprus Sophos United Kingdom Cisco (originally Immunet) United States StraySpark Computing United Kingdom Symantec United States Symantec (originally PC United States Tools) TG Soft Italy TG Soft Italy Trend Micro Japan TrustPort Czech Republic VirusBlokAda Belarus Webroot United States Zemana Turkey
  • 6.
  • 7. APT Report gives Window into Russia's Cyber Espionage RUSSIA is "likely" sponsoring a hacking outfit that targets foreign governments and Security Agencies "APT28", a group operating for possibly more than a decade, has attacked governments in Georgia, Eastern Europe, as well as NATO and the Organization for Security and Co-operation in Europe The activity profile vide this paper appears to be the work of a skilled team of developers and operators collecting intelligence that would only be useful to a government
  • 8. APT Targets insider information related to governments, militaries, and security organizations that would likely benefit the Russian government.
  • 9. APT “APT28's characteristics — their targeting, malware, language and working hours — have led us to conclude that we are tracking a focused, long-standing espionage effort… sponsored by the Russian government."
  • 10. APT The paper discusses a threat group whose malware is well-known in the Cyber Security community & unlike the China-based threat actors, it does not appear to conduct widespread intellectual property theft for economic gain. Nor observed to steal and profit from financial account information.
  • 11. APT While there are no pictures of a building, personas to reveal, or a government agency to name, what is evident is of long-standing, focused operations that indicate a government sponsor – specifically, a government based in Moscow. This group is referred to as APT28
  • 12. APT
  • 14. APT The group likely seeks to collect intelligence about Georgia’s security and political dynamics by targeting officials working for the Ministry of Internal Affairs and the Ministry of Defense.
  • 15. APT Demonstrated interest in Eastern European governments and security organizations. These victims would provide the Russian government with an ability to predict policymaker intentions and gauge its ability to influence public opinion.
  • 16. APT APT28 appeared to target individuals affiliated with European security organizations and global multilateral institutions. The Russian government has long cited European security organizations like NATO and the OSCE as existential threats, particularly during periods of increased tension in Europe.
  • 17. APT Malware compile times suggest that APT28 developers have consistently updated their tools over the last seven years. Since 2007, APT28 has systematically evolved its malware, using flexible and lasting platforms indicative of plans for long-term use.
  • 18. APT28 tailors implants for specific victim environments. They steal data by configuring their implants to send data out of the network using a victim network’s mail server. APT28’s malware samples contain counter-analysis capabilities including runtime checks to identify an analysis environment and the inclusion of unused machine instructions to slow analysis.
  • 19. APT Over 96% of the malware samples attributed to APT28 were compiled between Monday and Friday. More than 89% were compiled between 8AM and 6PM in the UTC+4 time zone, which parallels the working hours in Moscow and St. Petersburg. These samples had compile dates ranging from mid-2007 to September 2014.
  • 20. APT More than half of the malware samples with Portable Executable (PE) resources attributed to APT28 included Russian language settings
  • 21. APT28 INTEREST IN THE CAUCASUS, PARTICULARLY GEORGIA
  • 22. APT
  • 23. APT28 uses spear phishing emails to target its victims, a common tactic in which the threat group crafts its emails to mention specific topics (lures) relevant to recipients
  • 24. APT The group made specific attempts to target the MIA & MoD
  • 25. In one case, APT28 lure from mid- 2013 was identified that referenced MIA-related topics and employed malware that attempted to disguise its activity as legitimate MIA email traffic. The lure consisted of a weaponized Excel file that presented a decoy document containing a list of Georgian driver’s license numbers. The backdoor attempted to establish a connection to a Georgian MIA mail server and communicate via MIA email addresses ending with “@mia.ge.gov”. Once connected to the mail server, APT28’s backdoor sent an email message using a subject line related to driver’s licenses (in Georgian), and attached a file containing system reconnaissance information. This tactic could allow APT28 to obtain data from the MIA’s network .
  • 26. APT This tactic could allow APT28 to obtain data from the MIA’s network through a less-monitored route, limiting the MIA network security department’s abilities to detect the traffic.
  • 27. APT28 also appeared to target Georgia’s MOD along with a U.S. defense contractor that was training the Georgian military. The U.S. contractor was involved in a working group to advise the MOD and Georgian Armed Forces, assess Georgia’s military capabilities, and develop a military training program for the country. APT28 used a lure document that installed a SOURFACE downloader and contained a listing of birthdays for members of a working group between the Georgian MOD and the U.S. defense contractor.
  • 28.
  • 29. APT28 TARGETING OF EASTERN EUROPEAN GOVERNMENTS AND MILITARIES
  • 30. APT28 has registered domains similar to those of legitimate Eastern European (next slide…) These domain registrations not only suggest that APT28 is interested in Eastern European political affairs, but also that the group targets Eastern European governments directly. In addition, APT28 used one domain for command and control sessions (baltichost[.]org) that was themed after the Baltic Host exercises. Baltic Host is a multinational logistics planning exercise, hosted annually since 2009 by one of the three Baltic States (Estonia, Latvia, and Lithuania, all three of which are on Russia’s border) on a rotational basis.
  • 31. EXAMPLES OF APT28 DOMAINS IMITATING LEGITIMATE EASTERN EUROPEAN ORGANIZATION NAMES
  • 32.
  • 33. APT28 TARGETING OF NATO AND OTHER EUROPEAN SECURITY ORGANIZATIONS
  • 34. Russia regards NATO as a threat to Russia’s strategic stability. APT28 also registered a domain name imitating the Organization for Security and Cooperation in Europe (OSCE) APT28 used a lure that contained an apparent non-public listing of contact information for defense attachés in the “Ankara Military Attaché Corps (AMAC),” which appears to be a professional organization of defense attachés in Turkey.
  • 36.
  • 40. APT28 MALWARE SUMMARY OF AFFAIRS
  • 41. APT
  • 42.
  • 43.
  • 44. Contact me : Mail me at anupam605@gmail.com/anupam.tiwari@nic.in Blog at http://anupriti.blogspot.in/ http://about.me/anupam.tiwari