VB2017 paper: The life story of an IPT - Inept Persistent Threat actor

Posted by   Martijn Grooten on   Mar 19, 2018

Last Wednesday, Belgium-based Polish hacker Thomasz T. was arrested during a visit to his home country. Thomasz is believed to be the author of the Polski, Vortex, and Flotera ransomware families.

Though this may look impressive on one's cybercrime CV, it turns out that Thomasz may not be the most skilled of hackers. At VB2017 in Madrid, Polish security researcher and journalist Adam Haertlé presented a paper about him, the title of which is quite telling: "The life story of an IPT - Inept Persistent Threat actor".

01 bot_screen.jpg

Botnet C&C traffic.

Following Thomasz's arrest, we have published Adam's paper on our website in both HTML and PDF format, and we have uploaded the video of his presentation to our YouTube channel. We have also published Adam's slides (pdf), for anyone who wants to look at Thomasz's online adventures in a bit more detail.

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

New paper: Powering the distribution of Tesla stealer with PowerShell and VBA macros

Since their return four years ago, Office macros have been one of the most common ways to spread malware. Today, we publish a research paper which looks in detail at a campaign in which VBA macros are used to execute PowerShell code, which in turn…

VB2017 paper: Android reverse engineering tools: not the usual suspects

Within a few years, Android malware has grown from a relatively small threat to a huge problem involving more than three million new malware samples a year. Axelle Apvrille, one of the world's leading Android malware researchers, will deliver a…

Patch early, patch often, but don't blindly trust every 'patch'

Compromised websites are being used to serve fake Flash Player uploads that come with a malicious payload.

Virus Bulletin at RSA

Next week, VB Editor Martijn Grooten will be at the RSA Conference in San Francisco.

Broad-ranging and international VB2018 programme announced

VB is excited to reveal the details of an interesting and diverse programme for VB2018, the 28th Virus Bulletin International Conference, which takes place 3-5 October in Montreal, Canada.