start	end	text
0	4580	Hello everyone. Today I'm going to talk about Russian cyber threats in the pandemic era,
4580	9860	how actually Russia has seized upon the global COVID-19 pandemic as an opportunity
10270	16020	to launch its multi-faceted, multi-directional information warfare strategy against its
16020	24160	prospective enemies, how they used their APT groups, criminal groups, to attack healthcare
24160	34140	organization, research institutes, and hospitals in the United States and in European countries.
34140	42060	So before I talk about the hacking and actual disruption, I would like to give you a kind of
42060	50420	an overview how Russia sees information warfare strategy, which kind of agencies are in charge,
50420	59000	and actually what is their doctrine of information warfare, how actually they're
59000	67260	using APT groups and criminal syndicates to achieve their mission. Let me just give you
67380	73500	a kind of an overview how Russian information warfare doctrine works. It is kind of an integrated
73500	78940	system of system that works together. Everything is one under one umbrella, whether it is an
78940	84840	intelligence, counterintelligence, masking something, attacking computer net enemies,
84840	94280	computer networks, and software application. So now, kind of a few years ago, 2018,
94280	100000	artificial intelligence elements was added to its information warfare doctrine. It actually
100000	107800	contains two elements, using artificial intelligence technology in military field
107800	116220	and in non-military field. For example, using AI technology to advance their military capabilities
116220	123040	and using AI technology to advance their capability in the medical field, biotechnology
123040	132000	field, manufacturing, and energy field. So they actually see artificial intelligence as an emerging
132000	138660	tool to secure their strategic interests inside the country and outside the country. Some historical
138660	144540	background, how actually information warfare doctrine was formed. Just I'm going to give you
144940	150140	a short overview. The doctrinal and strategic thinking actually still is rooted in the teaching
150140	158000	of the Russian, of the Marshal of the Soviet Union, Nikolai Ogarko, in what he referred to
158000	164240	as the military technical revolution. A brief restatement of his thesis is that computers with
164240	169220	accuracy and miniaturization were about to transform the modern battlefield, and that's Americans are
169220	175760	ahead in this respect, and we really have to do something about it because we're falling behind.
175760	182140	So another also event affected the formation of the Russian information warfare doctrine
182140	187740	and its subset of cyber warfare. They declared the first and second Gulf War as a war on
188460	195200	military technical revolution. But then fast forward, there was the Alsin's year, and in this
195200	201340	year's theories actually developed theories rather than building machines, writing softwares,
201340	207660	and running operations. And fast forward, there were a couple of other events, but a couple of
207660	215380	years ago, Chief of the General Staff, current Chief of the General Staff, Valery Gerasimov,
215380	222140	published an article in one of the military newspapers that actually was dubbed as the
223940	228960	Gerasimov Doctrine in the Western press, but actually he's saying that in a matter of months,
229000	237340	a perfectly thriving state can be turned into a web of chaos. So they see information warfare
237340	243160	and its subset of cyber warfare to achieve their objective in a various direction, whether it's a
243160	256020	political direction, or in the military direction, or in any other field. So let me just give you
257000	267860	a couple of kind of example, which are major players in this respect, which organizations
267860	276960	are having major, having upper hands actually, in information warfare, and in subset of cyber
276960	285740	warfare. I'm going to give you a small historical overview about this. Actually in 2003,
286620	293540	when since Putin came to power in a couple of years, he actually disbanded the FOPC, Federal
293540	298220	Agency for Government Communication and Information. This agency was in charge of
298220	303900	the military intelligence code cracking, cryptographic security, technical intelligence,
303900	311550	counterintelligence. And once it was disbanded, so some of its functions went to those organizations,
312080	318880	Federal Protective Service, FSO, Federal Security Service, FSB, MVDK, there is a Ministry of
318880	323840	Internal Affairs of Russia, SVR, Foreign Intelligence, and GRU, Russian Military
324520	329540	Intelligence. What is also very important here is that a large portion of the FOPC that was
329540	335420	left after the organization was renamed the Special Communication and Information Services,
335420	341900	was folded into the FSB. So all of those organizations have their part in information
341900	346720	warfare doctrine. What is also very important here is that the leading role in this respect
346720	354640	has a Russian military GRU, and the Russian Federal Security Service, FSB. So here is a kind
354640	362740	of a, you know, structured Jerry's research, how actually Jerry's research institutes and units
363600	370960	are participating in an information warfare, cyber warfare efforts. Let me just give you
371380	378900	kind of an overview about those central research institutes and units.
378900	385400	So Defense Ministry's 45th Center, Central Research Institute, it's a military unit
385400	394140	54726. Those units actually are in charge of the fighting, finding intelligence about the
394140	403920	military potentials of the foreign countries. Another unit here is the MOD Centers, Ministry
403920	413760	of Defense Center for Special Studies. Those centers, they are hiring students from engineering
413760	420120	schools, they are in charge of analyzing, exploiting, finding vulnerabilities in the
420120	425720	computer system. By the way, what is also very important is Evgeny Serebryakov, who was actually
426700	435380	was expelled from Netherlands in 2018. He, because he was trying to hack into the OPCW,
435380	440780	OPCW is Organization for Prohibition of Chemical Weapons. It's a UN chemical
440780	447220	watchdog organization. They were about to craft a report about the poisoning substance that was used
447940	455060	against double agent Sergey Kripal and her daughter Yulia, as well as we were about to
455060	463680	craft a report on the chemical substance that was used in Duomo, Syria.
464060	470660	So we actually wanted to find out what this report was about before its release. Another also
470660	478760	major player is MOD's Division, 12th B Division that is in charge of the cyber operation and
478760	485760	psychological operation. Let me just talk a little bit about 18 Central Research Institute and its
485760	495700	unit, 11135. Those folks are in charge of the signals intelligence. They are also in charge
495700	502360	of development of wireless devices, SCADA system, or electromagnetic protection system.
502660	510500	And what is also very important, that's 85 Central Research Institute, it's unit 26165,
510500	519120	main center for special technology, and it's unit 7445. Those two units are the major,
519120	526440	biggest repository of hacker talents. And those units together, all of them together,
526440	531460	actually formed APT28. This is the most persistent threat group. There is also
532200	540800	known as a fancy beer and has also other names. And they are using, of course, the hackers or
540800	547740	forces for their hacking activities. I'm going to talk a little bit later about the GUNID
547740	552440	and the Technopolis era, what kind of laboratories they have, including the
552440	556380	biotech labs and what kind of projects actually they're implementing.
557600	562240	So another also kind of the development that's happened in the Russian military
562240	570000	is that in 2017, they officially announced about the formation of the military scientific units,
570000	575100	also called information warfare troops. And what is also important, that's the
575100	585940	Ministry of Defense of Russia officially made a statement about the formation of this unit.
585940	593740	And he made openly or said that those units not only will be in charge of the securing command
593740	599660	and control and communication of the Russian military, or building, developing software for
599660	605620	the National Defense Control Center, there is the high supreme body that's responsible for
605620	612940	Defense Ministry's supervision and management, but those guys also will be in charge of the
612940	617680	psychological operation. That's once again, illustrates how actually Russia sees this
617680	622900	information warfare doctrine, the concept of the security, a concept of the compartmentalization
622900	628840	and the idea of the cyber as a separate domain, I mean, doesn't exist in the Russian concept.
629660	634880	What is also very important, that's so new warriors of this military scientific units,
634880	641060	about 1,000 personnel are incorporated those units. So they are the engineers,
641060	646920	they are cryptographers, they are signalers, they are linguists, they are doctors, they are scientists.
647240	655380	So let me just move a little bit and I'll just talk about the Technopolis era.
655380	667020	Technopolis era was opened in 2018. And according to the official sources, they want to make it
667020	675540	fully operational by the end of 2020. Era stands as a little Russian armies. And now they are
675540	682860	planning actually, to move these military scientific units, the 12th of those units that
682860	689980	was created in 2018 on the permanent basis at Technopolis era. It is also believed that
689980	696760	those military scientific units are the arms of the GRU Russian military, Russian military
696760	703420	intelligence. So eight major directions that they are working, information telecommunication,
703420	708840	supercomputers, information in the cyber security, technical visions, energy technology,
708840	712580	nanotechnologies, nanomaterials. But what is also very important, they're putting a lot of
712580	720700	efforts, financial resources, and human resources into the field of bioengineering, biosynthetic,
720700	728040	biosensor technologies. What is also one of the major mission of the Technopolis era is actually
728040	734220	finding information about other countries, what other countries actually countries are doing
734220	744900	in this respect in this field in this direction. So another, let me just talk a little bit about
744900	756400	the kind of who is coordinating the Technopolis era, I mean, officially is coordinated by GUNID.
756400	760680	This is the General Directorate for Research and Development and Technological Support of
760680	765940	Advanced Technologies. They are cooperating with defense-related enterprises and over
765940	772400	200 scientific organizations, universities, Russian Academy of Science have agreement with
772400	777900	the Technopolis era. Some of those and many actually not some quite, you know, over 40,
777900	786000	45 scientific organization and defense-related enterprises, they have permanent representation
786000	792520	at the Technopolis era. Let me just talk about a little bit about the labs. They have 18 labs
792520	800460	there and they're working actually about, and I'm going to talk about the projects in tech,
800460	808160	in terms of the field of biotech. They are working in a 3D bioprinting,
809040	815120	lab-growing leading tissues and bone tissues. They are working on the machine learning
815120	822460	technologies in their healthcare for the diagnosing and treatment of illness.
822540	828820	Telesurgeries, working on the medical robotics and multimedia image communication
828820	835680	in silico clinical trials and drug testing is one of their major direction using
836540	840820	computer models and simulation to develop and assess drugs and
842160	849120	devices. What is also very important that they are putting a lot of effort on the portable
849120	857420	biological reconnaissance device. This is, they're working a lot of efforts about biosensor device
857420	865800	designed to detect pathogens of dangerous infections, diseases, and viruses. And one
865800	870560	of the major direction of the Technopolis era is the biological intelligence. They are developing
870560	883720	devices, biosensor devices, and they are also putting a lot of efforts about biological
883720	891100	intelligence. Actually, they are concerned about the research activities conducted by foreign
891100	898960	research institutions because they kind of feel that a problem needs on appropriate reconnaissance
899600	906480	in this respect, according to the statement of various government officials in Russia.
906540	912820	So, the kind of, you know, the hallmark stealing the intellectual properties
914380	924660	from, that was the signature of the Chinese APD groups, now we'll see that's what this will be
924660	930860	incorporated by the Russian APD groups. And we see already some science, actually,
930860	936760	in this respect. So, kind of interesting information. It's kind of a breaking news.
936760	943760	Just recently, a few days ago, the Russian Ministry of Defense actually made a statement,
943760	948480	where it's also, you know, very important to underline here is that together with the Gamaley
948480	954540	Scientific Research Institute of Epidemiology and Microbiology, they said that they successfully
954540	964380	completed the trial of the COVID-19 vaccine. And, by the way, the First Minister of the...
965300	972300	Deputy Minister of the Defense made a statement about this, that vaccine is actually ready and
972300	980360	ready for distribution. Interesting information. Let me just talk a little bit about the
981440	989700	about the FSB's role in this respect in the field of the information warfare and its subset of the
989700	994580	cyber warfare. There are a lot of scientific and technical centers here in the units, but I'm
994580	999920	going to, you know, talk about two major units that are in charge of the cyber operation. So,
999920	1013500	one is the unit of 7-1-1-3-3-0 and 7-6-4-8-2-9. They are under 2nd Directorate and 16th Directorate.
1013580	1023780	So, those two centers are in charge, these units are in charge of the cyber. They are,
1023780	1028280	they have a very high cyber intelligence capabilities, and they're in charge of
1028280	1035320	offensive information operation outside of Russia. So, and inside of Russia. So, unit
1037760	1045500	of 18th Information Center, also in charge of the SORM system. Let me just give you kind of a
1045500	1051160	overview about the SORM system. SORM is a System of Operating Investigative Measures,
1051160	1057240	the kind of a surveillance system that's now all the ISPs are required legally to install the
1057240	1063440	system. This is a very sophisticated system that captures all the digital and mobile communication
1063440	1073060	and captures online communication, full recording of conversation, and as well as the content of
1073060	1079700	email, text, and the communication. So, for online communication, for example, it taps to
1079700	1087340	the network of the internet service providers through a rerouting devices called black boxes
1087340	1094180	and high-speed communication lines. And by the way, it has a real-time monitoring capabilities.
1094620	1101060	So, here is a couple of examples of what kind of the projects they are implementing,
1101060	1105460	on which I'm going to talk on my next slides. They're also actually in charge of the hacker
1105460	1112700	resolve forces. Imagine having resolve forces that you don't pay anything, you don't train,
1112700	1119840	they train themselves, they pay themselves, and they do business for the intelligence services
1120330	1130440	in Russia. And of course, they form IPD-29 group, also hacking group, nation-sponsored group.
1130440	1137520	There is... has also different names, Kozytuk and Miniduk, et cetera, et cetera.
1137520	1147940	Let me just talk about this project that's the Siloviki, the people of power,
1147940	1155840	Russian intelligence services that are in charge. For example, the contracting organizations
1156740	1163800	that were outsourced by the security services in Russia, were hacked a couple of years ago,
1163800	1169980	and the last year as well. And all those projects, actually, they revealed on the net.
1170180	1177520	One is an Otillus project that was about to collect information on social media about users.
1177520	1183300	Another is an Otillus S, that was about the de-anonymizing toward traffic using rogue
1183300	1190300	servers. By the way, a couple of years ago, I mean, one or two years ago, 25 of those kind
1190300	1196700	of rogue servers was identified, and 18 of which actually were located in Russia.
1197460	1204060	They are also using the so-called scientific institute think tanks for their project.
1204060	1215500	One of the think tank, a pretty well-known think tank in Russia is called Quantis FSB
1215500	1221680	think tank, and they also were in charge of developing software to detect protest mode
1221680	1229500	among the population. Just a year ago, there was another leak that they were, that was
1229500	1239580	hackers exposed, that's FSB IoT botnet project called Fronton. And so, leak document actually
1239580	1249720	showed that the procurement order actually was placed by the FSB unit 64829. So,
1251360	1258940	and let me just give you kind of a quick overview about the growing complexity of outsourcing and
1258940	1268380	why Russia used very sophisticated outsourcing strategy. Because it's confound attribution,
1268380	1275780	and it's also very cost effective for them. And so, let me just see, give you the whole
1275780	1285360	scenario how it works. The idea actually comes from the government. And so, then the government
1285360	1291060	actually is in charge from the beginning of the whole commanding control process. Then the project
1291060	1298780	manager is assigned, and project management does the compartmentalization process. So, tasks are
1298780	1308480	broken into pieces. And so, then people in the middle, they are also outsourcing hackers from
1308480	1316420	other countries, and subcontracting those hackers from, you know, Ukraine, from the United States,
1316420	1323720	from China, and from other countries. So, people here, third parties, they actually don't know
1323720	1331580	from there the original order actually comes. Then money changes hands, and this is how the
1331580	1337140	whole operation does. So, if you want to just find out who is behind this or that project,
1337140	1344600	it's very, very hard to just solve the attribution problem actually in this respect.
1345560	1354680	So, what we saw during this pandemic time, the Kremlin information warfare was used with full
1354680	1361180	its capacity. They use the cyber elements, they use their disinformation elements, and
1362320	1371320	they use all the components of the information warfare. So, they spread the malicious content,
1371320	1378240	malicious information, they used the conventional media outlets, they used their scientists,
1378240	1384960	they used trolls, they used the channels, non-conventional channels, for example, to
1384960	1393020	spread this information, not only in English and in Russian, but in various languages.
1393760	1400440	And by the way, when I just did research about this, the views and shares of those information,
1400440	1407660	it was into hundreds of thousands and into millions. But it's nothing new. So, this kind
1407660	1414720	of spreading false narratives, I mean, it's all tactics, this Russian military, and not only
1414720	1420620	Russian military, FSB and general intelligence organizations were using in the past. For
1420620	1430700	example, in the 1950s, the Soviet military intelligence created this rogue fake reports
1430700	1436800	that the US used biological weapons in Korea, supposedly dropping bombs filled with insects and
1436800	1445540	rats infected with cholera and plague. As well as, for example, in the later 1980s,
1445540	1449860	Soviet spies spread false narratives that AIDS epidemic started from an experiment
1450330	1457140	at a secret military biological lab in the US. They're also spreading the false narratives about
1458420	1467640	scientific institutions and labs in other countries. Supposedly, they are creating
1468180	1477840	biological weapons or something like this. So, in March and April, there was a couple of
1477840	1485820	reports published in this respect, how Russians were using APT groups, cyber criminal syndicates
1485820	1497080	to hack into the research facilities, hospitals, and what kind of strategies,
1497080	1504560	methodologies and TTPs were they're using. Now, just recently was published UK's National
1504560	1511280	Cyber Security Advisory Stats. They openly said that APT29 group that is associated with
1512000	1523680	FSB, Russian Federal Security Service, that APT29 is attempting to steal information on
1523680	1529160	coronavirus research, targeting pharmaceutical companies, healthcare, academic research
1530080	1538500	centers. So, all aspects, actually, of information warfare elements was used. As I mentioned,
1538500	1544550	they used the conventional media, anonymous outlets, the cyber components, they tried to...
1545520	1551600	they created a fake coronavirus tracking web, fake coronavirus application,
1551600	1557800	ransomware targeting the healthcare system, on which I'm going to talk in detail in my
1559860	1566980	next slides, targeting the VPN system, remote working tools and softwares.
1567530	1576240	So, here is actually a couple of examples. Now, what kind of fake bogus emails they are crafting,
1576240	1582690	mimicking, that's the legit organizations such as the World Health Organization, CDC,
1583340	1590660	and other government agencies, and the government agencies as well. For example,
1590660	1596180	cyber criminals in UK also use the SMS phishing strategy. Here is a screen.
1597960	1604780	They're sending to the UK resident that UK government has issued a payment of over 400
1604780	1611480	pounds to a resident, and you have to just click to this link. And once you click to this link,
1611480	1617300	it actually asks you the national registration number, as well as other information,
1617300	1624220	banking information. The fake Android application also was created, was removed from the Google
1624220	1629820	Play. So, what actually, I'm going to talk about the fake life map that resembles Johns Hopkins
1630720	1638640	University tracking coronavirus infographic map. I'm going to talk about this in more detail
1638640	1646800	in my next slides. So, what we also saw during this period, that's over the 1.2 million newly
1646800	1657200	registered domains were created, and over 85,000 domains were classified as risky or malicious.
1657200	1668040	Okay, here is the one of the criminal group called Sarin RPB, as well as Ravel. This group
1668540	1680840	has a very heavy presence on XSS forum. This group launches, actually,
1682900	1691800	competition for developing exploits for zero days, writing crypto algorithms, and other kind
1691800	1696580	of a task that they post on this website, and they pay money. For example, the one of the competition
1696580	1706980	was about $15,000. This, what is also very important, that they are also in,
1706980	1713320	someone in February, we're already discussing the methods to deliver malware, where an email
1713320	1721400	attachment then later was embedded into the COVID-19 Johns Hopkins infographic map. They
1721400	1731200	also were selling the variants of malwares that later was embedded into the fake map.
1731200	1737880	And for example, if you just opened it, it downloaded malicious code into your system.
1737880	1743040	It collected information from the infected computer and send this information to the
1745440	1753140	command and control server. By the way, this group is a human-operated ransomware group.
1753140	1759400	What actually does it mean? The attack doesn't happen in an automated fashion, but instead,
1759400	1764180	they are compromising internet-facing devices in order to establish presence in a vulnerable
1764180	1770600	system, and later then execute attacks, steal information, and encrypt information on the
1771160	1778020	victim's data. They were exploiting vulnerabilities in remote desktop protocols,
1778020	1786140	vulnerabilities in the operating soundpatch operating system, misconfigured servers,
1786140	1792580	as well as the electronic health record software. What is also important is for their operation,
1792580	1797660	they use the Mimikatz. Mimikatz is a leading exploitation tool that actually dumps the
1797660	1803620	passports from memory. This organization, this criminal organization actually also
1803620	1808160	attacks one of the biotech companies that is based in California.
1809340	1815160	What is also very important here is that they are not only interested in stealing
1815160	1821300	intellectual properties from the biotech companies in the United States or in European countries,
1821300	1828100	but also they were trying to gain some financial... they are launching cyberattacks for this
1828100	1834940	financial gain, pure financial gains. For example, they attacked a New York law firm,
1834940	1843720	and this is one of the prominent, very well-known law firm that has a very high level clientele,
1843720	1852320	and asked for a ransom. So, I already said that Russian
1854620	1860440	DeepWebForum, DocWebForum, HackerForum were very busy during this time period. A lot of
1860440	1869740	discussions were going on on those forums, even selling the variants of malwares, discussing the
1869740	1878560	methodologies about how to embed malicious code into the email, and some other... and the COVID-19
1879170	1888960	issue was very highly discussed, and all of these TTPs and methodologies on those forums. As I
1888960	1895640	mentioned, that's already in one of those forums, we were offering malware for sale that later was
1895640	1908020	inserted into email attachment, resembling the fake COVID-19 map. So, those DarkWebForum are
1911900	1919180	also... there are a lot of other, you know, DarkForum and HackerForum, actually, that are
1919180	1923360	on the Ru domains and the Su domains. If you don't know what is a Su domain, it's an old Soviet Union
1923360	1932540	domain, it actually has over 120,000 registered domains there. So, yeah, a lot of interesting
1934860	1942800	information could have been... you could... one can gather from those forums, and it gives you
1942800	1948500	kind of a good understanding of what they are up to, what they are planning, what kind of strategies
1948500	1950660	they are discussing
1953220	1955340	for future attacks.
1956740	1962880	So, another also group that was very active during this period was a HADES group.
1962880	1967540	This group is associated with the Russian military...
1970260	1977780	Russian military GRU with APT28 group, also called Defense CBSN, or Voodoo Beer Telebot,
1977780	1982900	and it has also some other names as well. So, those... they were using the phishing email
1983980	1988160	campaign, mimicking World Health Organization and the
1989400	1995960	Ministry of Health of Ukraine. They were sending... here is a, you know, example what kind of
1997760	2003460	emails they were sending to the organizations
2004020	2010780	in Ukraine, and not only in Ukraine, where most of this group was active in European countries,
2010780	2016920	in particular, heavily active in Ukraine. And once you, you know, open this file, it's
2016920	2022340	downloaded malicious macro code to perform the remote control.
2023260	2030920	Another also group that was very active during this time was a Gamma Radon. This is the FSB group.
2032000	2043230	This... they also targeted the organization, you know, they targeted scientific research centers,
2043580	2051120	hospitals, all over the Western countries. This group is associated with FSB 16th and
2051120	2058660	18th Centers as the under second and 16th Directorate of FSB, active since 2013,
2058660	2068140	attacking Ukraine since 2014. So once you actually open the document, it started a
2068140	2074440	template injection technique, so for the... for loading the document templates from the internet.
2074440	2079600	And once the document was downloaded, it executed that malicious macro code,
2079600	2087980	code which executed the VBS... VBS scripts. So here is actually
2088660	2096400	a... IP addresses are from the Russian hosting companies. Those IP addresses that's... this group
2096400	2104620	is used for network destination or template injection and network destination for VBS script.
2105920	2113140	So another also organization that was a cyber criminal group that was very active during this
2113140	2119680	time, but that was group Russian ransomware group called MACE. This group used a variety
2119680	2127440	of techniques by exploiting known vulnerabilities that was not... haven't been patched, remote
2127930	2134360	desktop connection with a weak password. They used malicious emails or the links.
2134800	2137980	They attacked not only the
2140500	2147960	research institutes, scientific centers, but as well as they also attacked, for example,
2147960	2156820	IT service providers company that does provide this kind of services for the healthcare industries
2156820	2162480	and manufacturing. And in March, they attacked the Hammersmith
2164240	2172120	Medicines Research Center in UK. So this center was before involved with an Ebola solution and
2172120	2180000	working with COVID-19 vaccine. So what is also very important about this ransomware group that
2180000	2189980	this group is as not kind of typical data encrypting ransomware. So it doesn't infect
2189980	2199040	and encrypt computers in every computer that is in its path, but also it is extracting
2199040	2208260	information and data to the attacker servers. So let me just talk a little bit about the
2208260	2216440	RealWeek. This is another Russian hacking group. This hacking group also attacked hospitals
2216440	2223920	and in Europe and the United States, for example, they attacked the second largest hospital in
2223920	2231160	Czech Republic in Brno. They, before the pandemic, they actually attacked the hospitals in Alabama
2231160	2241700	and they asked for the big ransom to decrypt them and unlock medical data. This ransomware is
2241700	2254920	typically, you know, they actually already get into the compromise system. For example,
2255380	2259220	they used, in this respect, the Immortal and TrickBot. The Immortal is a model that
2259220	2265720	originally actually was created for the banking trojan designed to steal information. And once
2265720	2275020	the system was infected, then their payload was dropped into the system and executed. And
2275020	2281860	it's actually an encryption process actually started and they were asking the ransom
2282600	2289520	for, to decrypt the data back. So for attack factors, they are trying to find vulnerabilities
2289520	2295940	into the system, remote desktop protocol and poorly secured RDP ports. They use the phishing
2295940	2302800	email, sending a malicious bugless email to trick legit organizations to download these emails
2302800	2314900	in open and download documents from this organization, tricking actually
2314900	2326400	legitimate organizations. So this is actually what I wanted to talk, how actually Russians use
2326400	2332360	their information warfare strategy. It's elements of cyber warfare during this pandemic
2332360	2336680	time. Of course, I just would like to talk to you a little bit about the mitigation strategy. And we
2336680	2345220	also talk a lot of countermeasures, our community, how actually what kind of steps should be taken
2345220	2350740	in order to secure system, to diminish risk, to decrease risk in this respect. Of course,
2350740	2356500	important factor is that to assess the supply chain. That's a supply chain contamination is
2356560	2365600	a big problem in this respect. Unpatched system was exploited by those hackers. Of course, it's
2366440	2372620	very important having them to implement a multi-factor authentication methods,
2372620	2377960	as well as train the staff in this respect. But what is also very important here, and in most
2377960	2385080	cases, nobody talks about putting the threat intelligence into the mitigation strategy.
2385080	2391100	For example, before the pandemic, all of those Russian forums were discussed,
2391100	2396500	all of those methodologies and selling the malwares on those forums. I think that's
2396500	2404080	observing what's going on, on a dark web, deep web, Russian hacking forums. It must be
2404080	2407960	included in a mitigation strategy, because it gives you a pretty good understanding what we
2407960	2415800	are up to and what we are planning in the future. So, thank you very much. I hope you'll find this
2416880	2424160	presentation very interesting, and I'm looking forward to a Q&A section. Thank you.