War of the worlds: a study in a ransomware IR learnings & victories

Thursday 29 September 2022, 11:00 - 11:30

Peter Kruse (CSIS Security Group)
Jan Kaastrup (CSIS Security Group)

Not so often do the good guys win the battle, when damage has already been done and bad guys have conquered the AD. But it does happen sometimes. This is a story about a forensic/incident case, with all the details, that every security researcher would love to get insight into – a case when we won the battle, and how we did it.

In late 2021, a fairly well-known company in Denmark was compromised and threatened by a double extortion ransomware group known to the community.

This is a war story about how we managed to stay in control of the IR case and stay on top of things. From the attack vector, gathering data, damage control, hostage negotiations to kicking the bad guys out.

In addition to telling the story, we will also provide analysis of the binary code and infrastructure that leveraged the attack.


silhouette.jpg

Peter Kruse

CSIS founder and head of its eCrime Unit, Peter Kruse is a leading expert on financially motivated crimeware. He has, in cooperation with the likes of Microsoft and various LEOs, been involved in the investigation and takedown of several criminal operations, giving Kruse a unique vantage point on the evolution of cybercrime’s MO and motivations.

 

silhouette.jpg

Jan Kaastrup

Jan is the CTO and head of the CSIS IR team.

Back to VB2022 Programme page

Other VB2022 papers

The threat is stronger than the execution: realities of hacktivism in the 2020s

VB2022 paper: The threat is stronger than the execution: the realities of hacktivism in the 2020s

Uncovering a broad criminal ecosystem powered by one of the largest botnets, Glupteba

VB2022 paper: Uncovering a broad criminal ecosystem powered by one of the largest botnets, Glupteba

Zeroing in on XENOTIME: analysis of the entities responsible for the Triton event

VB2022 paper: Zeroing in on XENOTIME: analysis of the entities responsible for the Triton event

Prilex: the pricey prickle credit card complex

VB2022 paper: Prilex: the pricey prickle credit card complex

Exploit archaeology: a forensic history of in-the-wild NSO Group exploits

VB2022 paper: Exploit archaeology: a forensic history of in-the-wild NSO Group exploits

Hunting the Android/BianLian botnet

VB2022 paper: Hunting the Android/BianLian botnet

EvilPlayout: attack against Iran’s state TV and radio broadcaster

VB2022 paper: EvilPlayout: attack against Iran’s state TV and radio broadcaster

Russian wipers in the cyberwar against Ukraine

VB2022 paper: Russian wipers in the cyberwar against Ukraine

Legal premise to kill cyber intelligence: a case study of the defence by escape incident management approach

VB2022 paper: Legal premise to kill cyber intelligence: a case study of the defence by escape incident management approach

War of the worlds: a study in a ransomware IR learnings & victories

VB2022 paper: War of the worlds: a study in a ransomware IR learnings & victories

Script kiddy on the deep & dark web: looks serious? But empty suit!

VB2022 presentation: Script kiddy on the deep & dark web: looks serious? But empty suit!

SHAREM: shellcode analysis framework with emulation, a disassember, and timeless debugging

VB2022 paper: SHAREM: shellcode analysis framework with emulation, a disassember, and timeless debugging

Combating control flow flattening in .NET malware

VB2022 paper: Combating control flow flattening in .NET malware

(Encryption) time flies when you're having fun: the case of the exotic BlackCat ransomware

VB2022 paper: (Encryption) time flies when you're having fun: the case of the exotic BlackCat ransomware

Sha Zhu Pan: cocktail of cryptocurrency, social engineering and fake apps targeting Android and iPhone users

VB2022 paper: Sha Zhu Pan: cocktail of cryptocurrency, social engineering and fake apps targeting Android and iPhone users

Web3 + scams = it's a match!

VB2022 paper: Web3 + scams = it's a match!

Operation Dragon Castling: suspected APT group hijacks WPS Office updater to target East Asian betting companies

VB2022 paper: Operation Dragon Castling: suspected APT group hijacks WPS Office updater to target East Asian betting companies

Scarcuft's information-gathering activities

VB2022 paper: Scarcuft's information-gathering activities

Unmasking WindTape

VB2022 paper: Unmasking WindTape

Tracking the entire iceberg - long-term APT malware C2 protocol emulation and scanning

VB2022 paper: Tracking the entire iceberg - long-term APT malware C2 protocol emulation and scanning

Lazarus & BYOVD: evil to the Windows core

VB2022 paper: Lazarus & BYOVD: evil to the Windows core

Keeping up with the Emotets: configuration extraction and analysis

VB2022 paper: Keeping up with the Emotets: configuration extraction and analysis

Exploiting COVID-19: how threat actors hijacked a pandemic

VB2022 paper: Exploiting COVID-19: how threat actors hijacked a pandemic

The long arm of the prisoner: social engineering from Kenyan prisons

VB2022 paper: The long arm of the prisoner: social engineering from Kenyan prisons

CTA TIPS "What if"

VB2022 CTA Threat Intelligence Practitioners' Summit presentation: "What if"

CTA TIPS Finding IOCs in unexpected places

VB2022 CTA Threat Intelligence Practitioners' Summit presentation: Finding IOCs in unexpected places

CTA TIPS Threat intelligence sharing in practice – lessons learned from the Cyber Threat Alliance

VB2022 CTA Threat Intelligence Practitioners' Summit presentation: Threat intelligence sharing in practice – lessons learned…

CTA TIPS A Vulcan mindmeld: from your mind to my mind

VB2022 CTA Threat Intelligence Practitioners' Summit presentation: A Vulcan mindmeld: from your mind to my mind

CTA TIPS From threat intelligence to active defence based on Industroyer.V2

VB2022 CTA Threat Intelligence Practitioners' Summit presentation: From threat intelligence to active defence based on…

CTA TIPS Fireside chat: IMAGINE - changing the narrative in threat intelligence collaboration

VB2022 CTA Threat Intelligence Practitioners' Summit presentation: Fireside chat: IMAGINE - changing the narrative in threat…

CTA TIPS Enhanced threat intelligence for runtime detection

VB2022 CTA Threat Intelligence Practitioners' Summit presentation: Enhanced threat intelligence for runtime detection

CTA TIPS Tips for vetting and generating value in automated TI

VB2022 CTA Threat Intelligence Practitioners' Summit presentation: Tips for vetting and generating value in automated TI

CTA TIPS Closing keynote

VB2022 CTA Threat Intelligence Practitioners' Summit presentation: Closing keynote

CTA TIPS TBA

The ATT&CK DarkHotel playbook: hunt and breach & attack simulation

VB2022 paper: The ATT&CK DarkHotel playbook: hunt and breach & attack simulation

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.