VB2016 paper: APT reports and OPSEC evolution, or: these are not the APT reports you are looking for

Posted by   Martijn Grooten on   Feb 17, 2017

Ever since Mandiant released its APT1 report four years ago, reports on advanced attack groups have been an important fixture in the security industry. These reports are great for gaining an understanding of how such groups operate and, as a not insignificant aside, a nice PR exercise for the companies that publish them.

However, one aspect may be overlooked: they also provide free QA for the threat actors, who often respond quickly and stop making the mistakes that led to their activities being discovered. This is what worried industry veterans Gadi Evron (Cymmetria) and Inbar Raz (Perimeter X), so they got together and wrote a paper on the subject, which they presented at VB2016 in Denver.

Today, we publish that paper, "APT reports and OPSEC evolution, or: these are not the APT reports you are looking for", in both HTML and PDF format. We have also uploaded the video to our YouTube channel.

Has your organization been attacked by an APT group? Of have you noticed how APT groups evolve because of reports detailing their activity? We'd like to hear from you. Submit an abstract for VB2017 (CFP deadline: 19 March) for a chance to present your research in Madrid, 4-6 October.

 

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

VB2017 paper: Walking in your enemy's shadow: when fourth-party collection becomes attribution hell

We publish the VB2017 paper and video by Kaspersky Lab researchers Juan Andres Guerrero-Saade and Costin Raiu, in which they look at fourth-party collection (spies spying on other spies' campaigns) and its implications for attribution.

Didn't come to VB2017? Tell us why!

Virus Bulletin is a company - and a conference - with a mission: to further the research in and facilitate the fight against digital threats. To help us in this mission, we want to hear from those who didn't come to Madrid. What is your impression of…

Montreal will host VB2018

Last week, we announced the full details of VB2018, which will take place 3-5 October 2018 at the Fairmont The Queen Elizabeth hotel in Montreal, Quebec, Canada.

VB2017 preview: Beyond lexical and PDNS (guest blog)

In a special guest blog post, VB2017 Silver sponsor Cisco Umbrella writes about a paper that researchers Dhia Mahjoub and David Rodriguez will present at the conference this Friday.

Avast to present technical details of CCleaner hack at VB2017

The recently discovered malicious CCleaner version has become one of the biggest security stories of 2017. Two researchers from Avast, the company that had recently acquired CCleaner developer Piriform, will share the results of their investigations…