It’s getting cloudy – peering into the recent APT29 activities Botconf 2024 Wednesday2024-04-24 | 11:45 – 12:05 CERT Polska 🗣 As a national CERT, we come across many intriguing malware campaigns targeting Polish organizations and institutions. Last year, we have seen several threat actors targeting a number of European embassies and MFAs, but one group […]
It’s getting cloudy – peering into the recent APT29 activities Read More »
BYOVD Unveiled: Hunting and Exploring Vulnerabilities in Device Drivers Botconf 2024 Wednesday2024-04-24 | 12:10 – 12:40 Nirmal Singh 🗣 | Rajdeepsinh Dodia 🗣 Malicious program authors often exploit vulnerabilities in popular software programs and employ various methods to circumvent security measures such as antivirus software, sandboxing, and intrusion detection systems. Precisely, threat actors have begun using vulnerable
BYOVD Unveiled: Hunting and Exploring Vulnerabilities in Device Drivers Read More »
Opera1er: from tracking the threat actor to detaining a criminal behind Botconf 2024 Wednesday2024-04-24 | 14:00 – 14:40 Anton Ushakov 🗣 | Hugo Rifflet 🗣 The topic of this talk covers technical description of tactics, techniques, and procedures (TTPs) of the French-speaking financially motivated threat actor, codenamed OPERA1ER (NXSMS) as well as the details of the threat
Opera1er: from tracking the threat actor to detaining a criminal behind Read More »
New Modular Malware RatelS: Shades of PlugX Botconf 2024 Wednesday2024-04-24 | 14:45 – 15:15 Yoshihiro Ishikawa 🗣 | Takuma Matsumoto 🗣 In March 2023, we have observed a new APT malware used by an unknown APT actor in several Japanese companies. The malware is a modular remote access trojan (RAT) like PlugX or ShadowPad which have been
New Modular Malware RatelS: Shades of PlugX Read More »
Parsing the Unparsable: Turning Analyzers into Victims Botconf 2024 Wednesday2024-04-24 | 15:20 – 15:50 Yusuf Kocadas 🗣 | Furkan Er 🗣 While thinking about how to prevent statical analysis on our customers’ applications. I have found myself analyzing publicly available apk parsers on github. I have walked through a bunch of issues to see which apps have
Parsing the Unparsable: Turning Analyzers into Victims Read More »
Everyone Gets a Webshell! Or, Backdooring Web Hosting Companies in Scale Botconf 2024 Wednesday2024-04-24 | 16:20 – 17:00 Daniel Frank 🗣 What happened when a flying-under-the-radar threat actor decided to directly go after web-hosting providers who host thousands of legitimate websites? How and why did they do it? These questions stand at the heart of
Everyone Gets a Webshell! Or, Backdooring Web Hosting Companies in Scale Read More »
Warp’s Enigma: Unraveling a Sophisticated Golang Malware Ecosystem that drops modified Stealerium Botconf 2024 Wednesday2024-04-24 | 17:05 – 17:45 Sathwik Ram Prakki 🗣 | Rayapati Lakshmi Prasanna Sai The surge in cybercrime ecosystems and underground forums has led to a substantial increase in stealer malware variants, facilitated by Malware-as-a-Service (MaaS) platforms addressing specific needs and vulnerabilities. This
I’m a Bad Noodle!: An Analysis of Noodle RAT Shared among China-nexus Groups Botconf 2024 Wednesday2024-04-24 | 17:50 – 18:30 Hiroaki Hara 🗣 While investigating several incidents, we encountered the undocumented Linux-based backdoor, we dubbed “Noodle RAT”. This backdoor shares some part of code with “Rekoobe”, which is a Linux-based backdoor widely used by multiple
I’m a Bad Noodle!: An Analysis of Noodle RAT Shared among China-nexus Groups Read More »
WS2 – Teams is for C2: Building and Reversing a Teams RAT (5h) Botconf 2024 Tuesday2024-04-23 | 13:00 – 18:30 Randy Pargman 🗣 | Kyle Cucci 🗣 This workshop consists of two parts: First, we will build a Remote Access Tool with indirect syscalls, shellcode running and COFF running capabilities, and other common features that uses Microsoft
WS2 – Teams is for C2: Building and Reversing a Teams RAT (5h) Read More »
WS3 – DotNet Malware Analysis (4h) Botconf 2024 Tuesday2024-04-23 | 13:30 – 18:00 Max ‘Libra’ Kersten 🗣 Understanding DotNet malware can be daunting at first, but not so much with a solid knowledge of its fundamentals. The goal of this workshop is to teach the required concepts, as these can be transferred into any language
WS3 – DotNet Malware Analysis (4h) Read More »