Modern reconnaissance phase on APT – protection layer

Wednesday 4 October 14:00 - 14:30, Green room

Paul Rascagneres (Cisco Talos)
Warren Mercer (Cisco Talos)

The Talos researchers are no strangers to APT attacks. During recent research, we observed how APT actors are evolving and how the reconnaissance phase is changing to protect valuable 0-day exploit or malware frameworks. During this presentation, rather than concentrating on a specific malware actor, we will use various different cases to illustrate how the reconnaissance phase is becoming more important and more complex.

The talk will focus mainly on the usage of malicious documents (Microsoft Office and Hangul Word Processor) and watering hole attacks designed to establish whether a target is the intended one. We will mention campaigns against political and/or military organizations targeting the USA, Europe and Asia. The techniques and the obfuscation put in place by these actors will be described in detail. We will explain how macros are used and how to desobfuscate them; how JavaScript and PowerShell are becoming unmissable languages, and how to analyse them using a standard debugger such as WinDbg or x64dbg; how APT actors include Flash objects in documents to bypass protection and perform reconnaissance on the target; and finally, we will see how the Python language is used by malware to execute code on MacOS.

In some cases, the reconnaissance is performed directly by a first-stage malware (PE32) and not directly by the infection vector; we will see an example of the approach that was used to target South Korean public sectors at the end of December. At the end of the presentation, we will describe different mitigation techniques in applications (for example in Microsoft Office and Hangul Word Processor) and in the Microsoft Windows OS to help attendees protect their users against the threats described during the talk.


Click here for more details about the conference