The invisible candidate: tracking the evolution of 'Un-tracked' GRITCASPIAN

Thursday 15 October 16:30 - 17:00, Green room   

Asli Koksal (Google)

Imagine a high-value target in the defence sector receiving a personalized outreach from a "recruiter" at a major global contractor. The offer is simple: "Use our custom application to build your CV or take our personality assessment for our elite projects." This session uncovers GRITCASPIAN, a long-forgotten Iranian espionage cluster operating under the radar since at least 2021. Specializing in high-stakes social engineering, GRITCASPIAN targets the aerospace, defence, and logistics sectors across the US and Middle East.

This session provides the first comprehensive analysis of GRITCASPIAN's custom toolkit – including the CARSEAT dropper and the SUPERSEDAN and ERIESNAKE backdoors – delivered via functional "Resume Builders". We will expose their ingenious exfiltration method: "The Invisible Candidate". We will demonstrate how these functional "CV Builder" applications silently perform system reconnaissance and then hide the stolen data in plain sight by encoding encrypted system metadata into the final PDF document using small white font, allowing the victim to unknowingly "leak" their own data via a standard-looking file.

We will detail the group's operational evolution – from their initial "loud" mistakes, such as leaving C2 directories open and exposing Django debug logs, to their recent shift toward Google Cloud infrastructure and advanced obfuscation. By analysing their TTPs, including the clever exfiltration of victim data via invisible white text in generated PDFs, attendees will gain a comprehensive understanding of how to hunt and mitigate this persistent threat.

Back to VB2026 Programme page

Back to VB2026 conference page

Register your interest for VB2026

Other VB2026 papers