S1E03: Hunting Targeted Attackers @ Scale, Live-ish from RSA

In episode 3, we were joined by Alex Lanstein (@alex_lanstein) - one of the first employees at FireEye who hunts through product telemetry data to identify new targeted campaigns. During the RSA conference, and with so many others referencing breaches and hunting from the periphery, we thought it would be good to chat about primary source data from our on-going APT and FIN attack investigations and how to identify anomalies the way Alex does.

We live streamed this episode from the RSA Conference 2018 expo floor. In an unforeseen twist of events, the sheer number of cyber threat maps on the conference floor degraded the bandwidth and video quality. We re-recorded the episode the next day from an undisclosed location with a better connection.

“Community Protection: Southeast Asian Campaign”: We discuss our on-going Community Protection Event (CPE) where we’ve pulled together teams within the company to identify and protect against a suspected Chinese attack group using new methods to compromise Southeast Asian entities. We explore how it was found with custom passwords to decrypt phishing docs as well as the unique PowerShell-laden shortcut (.LNK) builder that was last seen with APT29 campaign around the 2016 U.S. election.

“APT19 and RepeaTTPs”: We chat about APT19 resuming their targeting of law firms this month using many of the exact same techniques as our 2017 blog post on the activity. Alex shares some insight into interesting APT19 phishing lure choices. • 2017 TTPs: https://www.fireeye.com/blog/threat-r...

“RO-BORAT Kazakhstani Attribution”: #ThreatIntel attribution can be difficult, but not always. We chat about the level of rigor we applied to analyzing some recent activity that we attributed to Kazakhstan. Very nice! • Related reading - https://www.eff.org/press/releases/ma...

“What’s M-Trending”: We close out the show by some round-robin discussion of evolving attacker methods and what we found most interesting within our M-Trends 2018 report released in April, which compiled technical intelligence and #DFIR breach data from our 500+ Mandiant investigations in 2017. • https://www.fireeye.com/content/dam/c...

State of the Hack is FireEye’s monthly live broadcast series, hosted by Christopher Glyer (@cglyer) and Nick Carr (@itsreallynick), that discusses the latest in information security, cyber espionage, attack trends, and tales from the front lines of responding to targeted intrusions. You can catch it live each month on FireEye's Twitter account: https://twitter.com/fireeye