Thursday 5 October 16:00 - 16:30, Red room
Cristina Vatamanu (Bitdefender)
Adrian Schipor (Bitdefender)
Alexandru Maximciuc (Bitdefender)
Targeted attacks are usually deployed to interfere with the operation of specific entities. In order to get the job done, the attackers run low under the radar for a considerable period of time, allowing them to operate unrestricted in the victim's environment. These kinds of attacks are usually custom-made with just enough features to enable them to carry out the attacks for which they have been designed.
The piece of malware presented in this paper, Netrepser, uses quite an array of methods to steal valuable and specific information from specific victims. It is built around a legitimate, yet controversial recovery toolkit provided by NirSoft. The cybercriminals manage to play the simplicity card to better blend in with the environment.
Cristina Vatamanu graduated from the Faculty of Computer Science at the University of 'Gheorghe Asachi'. She has worked at Bitdefender for almost eight years. Some of her responsibilities (and hobbies) include reverse engineering, exploit analysis, and automated systems.
Adrian Schipor has worked at Bitdefender for four years and is passionate about reverse engineering, exploits and cryptography. He is also currently studying for a Ph.D. in cryptography at the 'Alexandru Ioan Cuza' University of Iasi.
Alexandru Maximciuc is passionate about reverse engineering, likes Perl and Go, and studied mathematics. He has been working at Bitdefender for ten years, and he really enjoys fighting malware.
Juan Andres Guerrero-Saade (Kaspersky Lab)
Costin Raiu (Kaspersky Lab)
Attribution is complicated under the best of circumstances. Sparse attributory indicators and the possibility of overt…
John Graham-Cumming (Cloudflare)
In February 2017, Cloudflare was revealed to have been leaking private information including HTTP headers, cookies and POST data…
Tiberius Axinte (Bitdefender)
This paper provides an in-depth analysis of the macOS version of the APT28 component known as XAgent. We will dissect the…