1 00:00:00,300 --> 00:00:02,280 - All right, our next speaker 2 00:00:02,280 --> 00:00:05,280 is not a newcomer to Def Con. 3 00:00:05,280 --> 00:00:07,470 Sounds like this is his third time here. 4 00:00:07,470 --> 00:00:09,265 Give him a hands up. 5 00:00:09,265 --> 00:00:12,432 (audience applauding) 6 00:00:15,330 --> 00:00:16,899 When we were talking, 7 00:00:16,899 --> 00:00:18,960 sounds like we're gonna hear some fun stories about OopsSec. 8 00:00:18,960 --> 00:00:20,790 We all love that. 9 00:00:20,790 --> 00:00:25,023 All right, so big round of applause again for Tomer Bar. 10 00:00:25,023 --> 00:00:28,190 (audience applauding) 11 00:00:30,270 --> 00:00:31,530 - Hi, everybody. 12 00:00:31,530 --> 00:00:33,393 Who come here to have some fun? 13 00:00:34,566 --> 00:00:35,836 (audience applauding) 14 00:00:35,836 --> 00:00:36,669 Yeah. 15 00:00:36,669 --> 00:00:39,234 So I'm going to give up this one 16 00:00:39,234 --> 00:00:41,174 (air whooshing) 17 00:00:41,174 --> 00:00:43,870 for the one that will shout 18 00:00:45,330 --> 00:00:47,580 the loudest during the presentation, 19 00:00:47,580 --> 00:00:49,983 I will give you the assignment to shout. 20 00:00:49,983 --> 00:00:51,251 (audience laughing) 21 00:00:51,251 --> 00:00:52,700 I will give you a sign. 22 00:00:52,700 --> 00:00:54,360 Okay, so let's begin. 23 00:00:54,360 --> 00:00:55,680 My name is Tomer Bar. 24 00:00:55,680 --> 00:00:58,110 I am currently leading SafeBridge Labs 25 00:00:58,110 --> 00:01:00,420 as the director of security research. 26 00:01:00,420 --> 00:01:03,220 And my main focus is on vulnerability research 27 00:01:04,128 --> 00:01:05,730 and nation state APT research. 28 00:01:05,730 --> 00:01:08,494 This is my third time in a row at DEFCON, 29 00:01:08,494 --> 00:01:09,993 so I'm so excited to be here. 30 00:01:11,173 --> 00:01:12,006 (audience applauding) 31 00:01:12,006 --> 00:01:12,839 Thank you. 32 00:01:16,440 --> 00:01:19,170 Okay, so I will start by describing 33 00:01:19,170 --> 00:01:22,230 the research assumptions and approach. 34 00:01:22,230 --> 00:01:25,320 And then I will describe the operation security 35 00:01:25,320 --> 00:01:27,930 of first APT threat actor, 36 00:01:27,930 --> 00:01:30,660 and continue with several example 37 00:01:30,660 --> 00:01:33,300 of large scale cyber crime threat actors. 38 00:01:33,300 --> 00:01:34,530 And then we'll turn 39 00:01:34,530 --> 00:01:37,110 to different state sponsored threat actors. 40 00:01:37,110 --> 00:01:38,970 So, stay tuned. 41 00:01:38,970 --> 00:01:40,320 The research state of mind 42 00:01:40,320 --> 00:01:43,860 is focused on understanding the adversary, 43 00:01:43,860 --> 00:01:46,413 both the nation state and the cyber criminal, 44 00:01:47,556 --> 00:01:50,070 that launch attacks on the western world. 45 00:01:50,070 --> 00:01:54,030 If we can win this mind game, we can understand their plans, 46 00:01:54,030 --> 00:01:56,403 motives, tactics and techniques. 47 00:01:57,510 --> 00:02:00,900 So, every research start with assumption, right? 48 00:02:00,900 --> 00:02:02,730 So let's describe them. 49 00:02:02,730 --> 00:02:06,120 The first assumption is that advanced threat actors 50 00:02:06,120 --> 00:02:10,050 is not necessarily the same as strong operations security. 51 00:02:10,050 --> 00:02:13,053 And you will see unbelievable mistake later on. 52 00:02:14,041 --> 00:02:17,430 The second assumption is that some threat actors are lazy 53 00:02:17,430 --> 00:02:19,530 and feel comfortable 54 00:02:19,530 --> 00:02:23,310 even after research report was published 55 00:02:23,310 --> 00:02:25,830 about their specific activities. 56 00:02:25,830 --> 00:02:27,813 So they continue as usual. 57 00:02:29,070 --> 00:02:32,170 And last, it'll be a very good idea to study them 58 00:02:33,060 --> 00:02:34,383 in their backyards, 59 00:02:35,573 --> 00:02:38,790 so in order to understand their plans, their targets, 60 00:02:38,790 --> 00:02:41,313 to do damage control and so on. 61 00:02:43,647 --> 00:02:48,647 And I developed this OopsSec meter, you can see it, 62 00:02:48,750 --> 00:02:50,160 and for comparing 63 00:02:50,160 --> 00:02:53,400 different threat actors operations security mistakes. 64 00:02:53,400 --> 00:02:57,420 And the grade is from zero bad points, it's the best, 65 00:02:57,420 --> 00:02:59,640 to the 100 bad points. 66 00:02:59,640 --> 00:03:01,020 There are 10 categories. 67 00:03:01,020 --> 00:03:03,810 Each category can give 10 maximum points 68 00:03:03,810 --> 00:03:06,030 and the categories merge, 69 00:03:06,030 --> 00:03:09,810 measure how much data we can gather on victims, 70 00:03:09,810 --> 00:03:11,850 attribute the attacker's identity 71 00:03:11,850 --> 00:03:14,640 and how much we can influence their campaign 72 00:03:14,640 --> 00:03:17,760 to do a temporary take down 73 00:03:17,760 --> 00:03:20,700 or disinformation attack and so on. 74 00:03:20,700 --> 00:03:24,810 So in the next hour, I will present those APTs, 75 00:03:24,810 --> 00:03:29,520 so whenever you see this symbol of the hour meter, 76 00:03:29,520 --> 00:03:32,880 just shout your grade from zero to 100. 77 00:03:32,880 --> 00:03:34,983 And at the end you can get a flag. 78 00:03:36,300 --> 00:03:39,540 Okay, so our first threat actor 79 00:03:39,540 --> 00:03:41,940 is located in the Gaza strip. 80 00:03:41,940 --> 00:03:44,760 It has been active since 2012, 81 00:03:44,760 --> 00:03:48,060 so they have a decade of malicious activity 82 00:03:48,060 --> 00:03:51,873 attacking both Windows and Android targets. 83 00:03:53,340 --> 00:03:56,910 In 2017, it was first discovered, 84 00:03:56,910 --> 00:04:00,450 the threat actor as self developed a web panel 85 00:04:00,450 --> 00:04:02,703 with two factor authentication login. 86 00:04:04,057 --> 00:04:07,920 The problem was that navigating directly to the inner pages 87 00:04:07,920 --> 00:04:10,440 resulted in full access to the system 88 00:04:10,440 --> 00:04:12,123 with no authentication required. 89 00:04:12,990 --> 00:04:14,820 So, yeah, it's funny. 90 00:04:14,820 --> 00:04:17,760 On the right, you can see the exfiltrated keylogs 91 00:04:17,760 --> 00:04:18,990 of the victims. 92 00:04:18,990 --> 00:04:21,273 So it's blurred for privacy, right? 93 00:04:22,980 --> 00:04:25,950 Quantum leap to 2022, 94 00:04:25,950 --> 00:04:28,800 the threat actor is still active and masquerading 95 00:04:28,800 --> 00:04:31,290 as Google Play app. 96 00:04:31,290 --> 00:04:35,790 And the malware was uploaded from Gaza by one of the victims 97 00:04:35,790 --> 00:04:39,090 or by the attacker themselves for testing purposes. 98 00:04:39,090 --> 00:04:41,613 And the certificate was also signed in Gaza. 99 00:04:43,080 --> 00:04:46,980 The malware has plenty of collection capabilities like SMS, 100 00:04:46,980 --> 00:04:50,103 call logs, contacts, record audio, and much more. 101 00:04:51,465 --> 00:04:54,693 And the exfiltration is done via HTP post request. 102 00:04:55,710 --> 00:05:00,393 And the malware exfiltrated data to this URL via POST. 103 00:05:01,414 --> 00:05:03,120 So the Laravel code, the backend code 104 00:05:03,120 --> 00:05:06,660 of the C2 server expects a POST request, 105 00:05:06,660 --> 00:05:08,880 but when sending a GET request instead, 106 00:05:08,880 --> 00:05:13,468 an error invokes and exposed the my SQL DB credentials. 107 00:05:13,468 --> 00:05:15,390 So it's unbelievable, right? 108 00:05:15,390 --> 00:05:16,353 It's crazy. 109 00:05:18,810 --> 00:05:20,720 You should see me when I saw that. 110 00:05:20,720 --> 00:05:21,663 It was crazy. 111 00:05:23,471 --> 00:05:26,310 All C2 servers are vulnerable. 112 00:05:26,310 --> 00:05:27,420 Here are the credentials 113 00:05:27,420 --> 00:05:29,370 of the Windows based victim database. 114 00:05:29,370 --> 00:05:33,420 The former one was the Android victim database. 115 00:05:33,420 --> 00:05:35,106 So on 2017, 116 00:05:35,106 --> 00:05:37,350 the first stage malware code 117 00:05:37,350 --> 00:05:39,570 downloaded the second step malware. 118 00:05:39,570 --> 00:05:44,570 And the name was ddd.zip from the C2 server pal4u.net. 119 00:05:46,140 --> 00:05:49,830 And the name of the folder was five time letter Z. 120 00:05:49,830 --> 00:05:51,300 On 2022, 121 00:05:51,300 --> 00:05:56,300 a sub domain of the same domain was used, app.pal4u.net. 122 00:05:57,601 --> 00:05:59,280 And this time the CCC directory, 123 00:05:59,280 --> 00:06:02,460 holds all the victims' exfiltrated to data. 124 00:06:02,460 --> 00:06:05,190 So I will show a demo in a few moments 125 00:06:05,190 --> 00:06:07,263 how to download all of the victims' data. 126 00:06:09,150 --> 00:06:12,660 I was able to map almost 8,000 victims. 127 00:06:12,660 --> 00:06:15,210 Most of them in the Gaza strip, 128 00:06:15,210 --> 00:06:17,970 but others in other middle-eastern countries. 129 00:06:17,970 --> 00:06:22,350 So the amount of exfiltrated data is huge. 130 00:06:22,350 --> 00:06:25,080 Almost 500 compressed megabytes 131 00:06:25,080 --> 00:06:27,333 is the average exfiltrated data for day. 132 00:06:28,502 --> 00:06:30,270 And our estimation is that the total size 133 00:06:30,270 --> 00:06:31,470 of the exfiltrated data 134 00:06:31,470 --> 00:06:34,233 is between at least two tera to three terabytes. 135 00:06:35,940 --> 00:06:37,560 Another OopsSec mistake, 136 00:06:37,560 --> 00:06:39,570 which we'll see it's very common 137 00:06:39,570 --> 00:06:43,560 among all threat actors is open dirs C2 servers. 138 00:06:43,560 --> 00:06:45,030 So as we can see, 139 00:06:45,030 --> 00:06:49,590 the C2 server was updated at February, 2022. 140 00:06:49,590 --> 00:06:51,720 Let's check if this is a one time mistake. 141 00:06:51,720 --> 00:06:53,220 And of course not. 142 00:06:53,220 --> 00:06:55,050 The C2 server is open dir 143 00:06:55,050 --> 00:06:57,780 and include 12 megabyte file 144 00:06:57,780 --> 00:07:00,690 in the name of the domain name of the C2 server 145 00:07:00,690 --> 00:07:03,720 called Tawjihi or something like this, dot zip file, 146 00:07:03,720 --> 00:07:05,760 which include the full backend logic. 147 00:07:05,760 --> 00:07:09,330 Because if you try to download the backend code 148 00:07:09,330 --> 00:07:10,680 from just by surfing, 149 00:07:10,680 --> 00:07:13,170 you cannot do it because it's a PHP or SPX 150 00:07:13,170 --> 00:07:15,390 or something like this. It's not a downloadable. 151 00:07:15,390 --> 00:07:18,929 But when they leave a compressed folder of all of the stuff, 152 00:07:18,929 --> 00:07:21,750 all of the content in the website, I can download it. 153 00:07:21,750 --> 00:07:25,040 So I got the source code of the C2 server. 154 00:07:25,040 --> 00:07:25,920 (audience applauding) 155 00:07:25,920 --> 00:07:26,970 Thank you. Thank you. 156 00:07:31,222 --> 00:07:33,813 So the upload file logic is done well, 157 00:07:34,740 --> 00:07:38,790 using a unique ID to randomize the uploaded file name 158 00:07:38,790 --> 00:07:42,030 and make it difficult for hackers to find 159 00:07:42,030 --> 00:07:44,670 a potential web shell they uploaded. 160 00:07:44,670 --> 00:07:46,890 Because you cannot predict the file name. 161 00:07:46,890 --> 00:07:50,370 And the upload itself is limited to a specific file type 162 00:07:50,370 --> 00:07:52,620 by a white list, which is good. 163 00:07:52,620 --> 00:07:55,350 But on the other end, the no JS revealed 164 00:07:55,350 --> 00:07:59,310 the upload path of where the files will be uploaded to, 165 00:07:59,310 --> 00:08:03,630 which is, which is bad practice eventually. 166 00:08:03,630 --> 00:08:06,153 Okay. So let's see a little demo, 167 00:08:14,190 --> 00:08:15,023 No demo. 168 00:08:21,309 --> 00:08:22,142 Oh, okay. 169 00:08:23,370 --> 00:08:25,890 So we will serve to the CCC directory. 170 00:08:25,890 --> 00:08:28,230 You can see all of the files arranged by date, 171 00:08:28,230 --> 00:08:29,760 so it's very convenient. 172 00:08:29,760 --> 00:08:33,090 We will download one of them, the smallest one, 173 00:08:33,090 --> 00:08:35,370 it's like 150 megabytes. 174 00:08:35,370 --> 00:08:38,110 And then there is a password, I brought frost it 175 00:08:40,524 --> 00:08:42,374 and it will extract all of the files. 176 00:08:44,049 --> 00:08:46,110 We'll sort it and see the, 177 00:08:46,110 --> 00:08:50,070 I will show you the file types that are included, 178 00:08:50,070 --> 00:08:54,900 like the it's screen captures and images from the phone 179 00:08:54,900 --> 00:08:56,310 from the Android phone. 180 00:08:56,310 --> 00:09:00,360 And also a lot of voice recording during the 181 00:09:00,360 --> 00:09:04,440 using the microphone of the Android device. 182 00:09:04,440 --> 00:09:07,225 So you see a lot of files in just one day 183 00:09:07,225 --> 00:09:10,530 I have one year of that stuff 184 00:09:10,530 --> 00:09:13,350 and I will just open one of them and see, 185 00:09:13,350 --> 00:09:15,510 I'll show you that it's working, 186 00:09:15,510 --> 00:09:16,353 just a second. 187 00:09:20,403 --> 00:09:21,660 Is it moving on? 188 00:09:21,660 --> 00:09:22,620 Oh, sorry. 189 00:09:22,620 --> 00:09:23,453 I will. 190 00:09:26,610 --> 00:09:28,410 Nevermind. Believe me, it's working. 191 00:09:29,760 --> 00:09:31,710 It's demo. Even if it's prerecorded, 192 00:09:31,710 --> 00:09:32,730 it's not working. 193 00:09:32,730 --> 00:09:36,546 Okay. So that's your time to shout? 194 00:09:36,546 --> 00:09:39,146 What do you think the score should be? I give it 47. 195 00:09:40,478 --> 00:09:41,928 I see you. I see you. 196 00:09:41,928 --> 00:09:43,589 (audience shouting) 197 00:09:43,589 --> 00:09:45,139 You are leading. You are leading. 198 00:09:45,139 --> 00:09:46,680 Okay. For now, for now. 199 00:09:46,680 --> 00:09:48,990 Okay. So as you can see, 200 00:09:48,990 --> 00:09:53,990 they felt because I was able to build a victim hit map, 201 00:09:54,150 --> 00:09:55,440 understand their attack vector, 202 00:09:55,440 --> 00:09:58,500 access the C2 backend code and so on. 203 00:09:58,500 --> 00:10:00,600 Okay. So different threat actors 204 00:10:00,600 --> 00:10:01,680 will do different mistakes 205 00:10:01,680 --> 00:10:04,083 and we can compare them using the OopsSec meter. 206 00:10:05,467 --> 00:10:08,190 Okay. Moving on to a different threat actor. 207 00:10:08,190 --> 00:10:10,260 This time, it will be, 208 00:10:10,260 --> 00:10:11,580 I will focus on a threat actor 209 00:10:11,580 --> 00:10:13,890 cyber crime activity in Iran. 210 00:10:13,890 --> 00:10:16,530 And I will describe the five steps 211 00:10:16,530 --> 00:10:19,170 of the infection chain one by one 212 00:10:19,170 --> 00:10:21,540 and the OopsSec mistake they have made. 213 00:10:21,540 --> 00:10:23,310 But generally speaking, 214 00:10:23,310 --> 00:10:26,520 they are up to stealing credit cards. 215 00:10:26,520 --> 00:10:29,793 It's a large scheme scale cyber crime, 216 00:10:30,675 --> 00:10:31,613 and let's describe it. 217 00:10:32,456 --> 00:10:35,160 So on the left is a partial list of the C2 server 218 00:10:35,160 --> 00:10:38,280 that were alive at the moment, at the time of the check. 219 00:10:38,280 --> 00:10:40,230 It was the middle of January this year. 220 00:10:41,384 --> 00:10:42,870 And one of them stored the entire code 221 00:10:42,870 --> 00:10:45,660 on the pay.zip file at the C2 server. 222 00:10:45,660 --> 00:10:48,630 So the same mistake like we saw earlier. 223 00:10:48,630 --> 00:10:51,390 So I download the zip file 224 00:10:51,390 --> 00:10:52,950 and the victims are found 225 00:10:52,950 --> 00:10:56,520 in different secondhand online market sites. 226 00:10:56,520 --> 00:10:59,290 One of the site is called divar.ir 227 00:11:00,300 --> 00:11:04,019 and the left script extract phone numbers 228 00:11:04,019 --> 00:11:05,070 from published ads on Divar. 229 00:11:05,070 --> 00:11:06,600 So if you want to sell something, 230 00:11:06,600 --> 00:11:08,650 you know your car or something like this, 231 00:11:09,712 --> 00:11:11,895 you just publish an ad with your phone number 232 00:11:11,895 --> 00:11:13,770 and they have an API to extract all of the phone numbers 233 00:11:13,770 --> 00:11:15,390 of victims in Iran. 234 00:11:15,390 --> 00:11:17,843 The script on the right will send them 235 00:11:17,843 --> 00:11:20,043 a threat phishing text message via Telegram. 236 00:11:21,300 --> 00:11:23,670 Okay. This is funny. 237 00:11:23,670 --> 00:11:26,733 The full victim list is textual and downloadable. 238 00:11:27,725 --> 00:11:31,260 Phone numbers are available in the users.lst file, 239 00:11:31,260 --> 00:11:32,360 which is downloadable. 240 00:11:33,730 --> 00:11:35,085 But even more funny, 241 00:11:35,085 --> 00:11:37,135 the C2 server internal files are exposed. 242 00:11:38,196 --> 00:11:40,470 Even the bash history command output 243 00:11:40,470 --> 00:11:41,793 is available to download. 244 00:11:43,049 --> 00:11:44,149 So I don't believe it. 245 00:11:45,750 --> 00:11:48,930 I found plenty of SMiShing lures 246 00:11:48,930 --> 00:11:52,200 threat of arrest in 72 hours. 247 00:11:52,200 --> 00:11:53,823 And in Iran, it's scary. 248 00:11:54,840 --> 00:11:56,250 COVID 19 payments. 249 00:11:56,250 --> 00:11:58,020 And even dating site. 250 00:11:58,020 --> 00:12:01,320 When the victim tried to chat, he will be threatened to pay 251 00:12:01,320 --> 00:12:03,693 or his details will be sent to the government. 252 00:12:04,911 --> 00:12:06,711 And he is directed to a payment site 253 00:12:08,451 --> 00:12:10,001 and the sites are all open dir. 254 00:12:11,111 --> 00:12:13,350 So the payment allegedly can only be done 255 00:12:13,350 --> 00:12:14,580 via an Android app. 256 00:12:14,580 --> 00:12:16,413 You can see it on the bottom left, 257 00:12:17,370 --> 00:12:19,530 it's done automatically, 258 00:12:19,530 --> 00:12:21,063 and it's a dual attack. 259 00:12:22,036 --> 00:12:23,250 So they spy on the SMS to get 260 00:12:23,250 --> 00:12:25,030 the two-factor authentication codes 261 00:12:26,346 --> 00:12:28,800 and also redirect the payment on the attacker fake site 262 00:12:28,800 --> 00:12:30,603 to phish his victim credit card. 263 00:12:31,770 --> 00:12:36,770 So the Android malware just exfiltrate all the SMS messages. 264 00:12:37,050 --> 00:12:39,210 And decompiling the Android malware, 265 00:12:39,210 --> 00:12:41,520 we can see that the resource files 266 00:12:41,520 --> 00:12:43,953 all the phishing URL back there. 267 00:12:45,510 --> 00:12:49,290 And here is the PHP page that uploads the victim SMS. 268 00:12:49,290 --> 00:12:51,393 This is the backend code to the C2 server 269 00:12:52,932 --> 00:12:55,050 using hardcoded text file name. 270 00:12:55,050 --> 00:12:57,270 This is not a good practice. 271 00:12:57,270 --> 00:12:59,430 And the exfiltrated SMS are also textual, 272 00:12:59,430 --> 00:13:01,860 predictable, and downloadable. 273 00:13:01,860 --> 00:13:03,153 So it's very convenient. 274 00:13:04,382 --> 00:13:07,830 And the file name here is LydiaTeam.txt. 275 00:13:07,830 --> 00:13:11,640 Please remember the Lydia, we come to it later. 276 00:13:11,640 --> 00:13:14,193 And we can also see, it's hard to see I know, 277 00:13:15,413 --> 00:13:16,743 the incoming SMS messages. 278 00:13:17,621 --> 00:13:19,250 And in this case they tried 279 00:13:19,250 --> 00:13:21,090 16 different phishing lure messages 280 00:13:21,090 --> 00:13:23,850 in order to infect this specific victim. 281 00:13:23,850 --> 00:13:24,723 So it's crazy. 282 00:13:25,954 --> 00:13:27,990 And this is a fake payment site masquerading 283 00:13:27,990 --> 00:13:30,150 as a legit government pay site. 284 00:13:30,150 --> 00:13:34,080 So at the top, you can see the IP address. 285 00:13:34,080 --> 00:13:37,983 They even don't have the domain name for the C2 server, 286 00:13:37,983 --> 00:13:42,193 but below that, it's the URL of a real payment site in Iran. 287 00:13:43,980 --> 00:13:46,440 So the victim is allegedly redirected 288 00:13:46,440 --> 00:13:48,063 to legit government site, 289 00:13:49,088 --> 00:13:51,638 but it's a fake page and the credit card is stolen. 290 00:13:52,530 --> 00:13:55,290 This is the backend code for storing 291 00:13:55,290 --> 00:13:56,673 stealing the credit card. 292 00:13:58,333 --> 00:13:59,166 The details are collected and sent 293 00:13:59,166 --> 00:14:00,880 to the attacker Telegram group 294 00:14:02,034 --> 00:14:05,850 and the subject of each exfiltration is new card received. 295 00:14:05,850 --> 00:14:06,840 I don't know if you can see it, 296 00:14:06,840 --> 00:14:09,993 but there is a typo there and it will help us later. 297 00:14:11,370 --> 00:14:14,493 User credentials are exfiltrated as well. 298 00:14:15,660 --> 00:14:17,580 And query the Telegram group. 299 00:14:17,580 --> 00:14:20,336 This is where they become interesting. 300 00:14:20,336 --> 00:14:24,483 Using the Telegram bot API includes a valid invite. 301 00:14:26,001 --> 00:14:27,960 So you can see it mark in blue, 302 00:14:27,960 --> 00:14:30,030 and just copy paste it, 303 00:14:30,030 --> 00:14:35,030 and I'm a new member of their private groups. 304 00:14:35,250 --> 00:14:38,220 Yeah, it was very interesting. 305 00:14:38,220 --> 00:14:39,053 In this case, 306 00:14:39,053 --> 00:14:40,590 Thank you. 307 00:14:40,590 --> 00:14:43,950 In this case, the victim SMS data and credit card 308 00:14:43,950 --> 00:14:45,550 are splitted into three groups 309 00:14:46,797 --> 00:14:49,320 and they have all the data there. 310 00:14:49,320 --> 00:14:52,230 The data Telegram group is misconfigured 311 00:14:52,230 --> 00:14:54,760 to display all group members and hackers 312 00:14:55,716 --> 00:14:57,266 without even joining the group. 313 00:14:58,301 --> 00:14:59,959 (audience laughing) 314 00:14:59,959 --> 00:15:01,470 (audience applauding) 315 00:15:01,470 --> 00:15:02,303 Thank you. 316 00:15:04,892 --> 00:15:08,055 The SMS and data group are not private. 317 00:15:08,055 --> 00:15:10,380 All members are administrators. 318 00:15:10,380 --> 00:15:11,543 Everybody is welcome to join, 319 00:15:12,738 --> 00:15:15,722 but without access to the messages themself. 320 00:15:15,722 --> 00:15:16,680 So it's a problem. 321 00:15:16,680 --> 00:15:19,020 I joined with my real name, Tomer Bar, 322 00:15:19,020 --> 00:15:22,530 to all groups and stayed there for a while, 323 00:15:22,530 --> 00:15:25,890 but there was no access to the messages by new members. 324 00:15:25,890 --> 00:15:28,320 You can see my name here at the top. 325 00:15:28,320 --> 00:15:31,080 I used my real name, my real Telegram account. 326 00:15:31,080 --> 00:15:33,843 And all of the other are Iranian hackers, right? 327 00:15:35,490 --> 00:15:40,263 So I didn't have access to the messages, 328 00:15:41,430 --> 00:15:43,680 but the card group is not private, 329 00:15:43,680 --> 00:15:48,210 and all that is accessible during using the Telegram bot API 330 00:15:48,210 --> 00:15:49,830 called getUpdates. 331 00:15:49,830 --> 00:15:53,973 I will use it a lot during this research. 332 00:15:54,953 --> 00:15:58,170 And then I found the group they called So...Good 333 00:15:58,170 --> 00:16:00,920 and indeed they know what they are doing, it's so good, 334 00:16:01,795 --> 00:16:04,170 which it's like the main group. 335 00:16:04,170 --> 00:16:07,980 And pay attention to the user, @baba_zorro username. 336 00:16:07,980 --> 00:16:09,530 He's one of that threat actors. 337 00:16:10,551 --> 00:16:11,843 We will focus on it later on. 338 00:16:12,852 --> 00:16:15,150 And So Good allows access to all messages 339 00:16:15,150 --> 00:16:16,773 without being required to join. 340 00:16:18,153 --> 00:16:20,322 So hundreds of credit card, I was able to join, 341 00:16:20,322 --> 00:16:21,155 but didn't need to. 342 00:16:21,155 --> 00:16:23,937 Hundreds of credit card details are listed. 343 00:16:23,937 --> 00:16:25,320 And on the left, 344 00:16:25,320 --> 00:16:29,520 we can see that one of the site was detected by Chrome 345 00:16:29,520 --> 00:16:30,990 to be a malicious site. 346 00:16:30,990 --> 00:16:33,300 And they exchange messages between themself. 347 00:16:33,300 --> 00:16:34,750 Let's do that. Let's do that. 348 00:16:35,606 --> 00:16:38,106 And on the right, you can see shared malware files 349 00:16:39,075 --> 00:16:41,973 and even attacker's voice messages between themself. 350 00:16:42,990 --> 00:16:44,820 I don't know of all C language, 351 00:16:44,820 --> 00:16:45,870 but it's interesting. 352 00:16:46,950 --> 00:16:49,080 On a deeper analysis, you can see 353 00:16:49,080 --> 00:16:52,200 it's amazing, revealed massive activity, 354 00:16:52,200 --> 00:16:54,240 hundreds of malware samples 355 00:16:54,240 --> 00:16:57,360 and hundreds and thousands of C2 servers infrastructure. 356 00:16:57,360 --> 00:16:59,160 So it's kind of a big infrastructure. 357 00:16:59,160 --> 00:17:00,663 So I was curious, 358 00:17:01,845 --> 00:17:04,803 and believe me, this is just the tip of the iceberg. 359 00:17:05,641 --> 00:17:07,267 Let's continue. 360 00:17:07,267 --> 00:17:10,110 A simple Google search reveals that Lydia team, 361 00:17:10,110 --> 00:17:12,030 the name of the file that we mentioned before 362 00:17:12,030 --> 00:17:14,240 is a user who is active 363 00:17:14,240 --> 00:17:16,980 in the Professor Phishing Telegram group, 364 00:17:16,980 --> 00:17:19,080 so he has a academic degree, 365 00:17:19,080 --> 00:17:22,360 and which includes 15,000 members 366 00:17:23,310 --> 00:17:26,490 searching for new card received in Google 367 00:17:26,490 --> 00:17:30,390 with the intentional typo seen before 368 00:17:30,390 --> 00:17:34,170 returned with a second group, Zalem Phishing 369 00:17:34,170 --> 00:17:37,080 and the result includes stolen credit card. 370 00:17:37,080 --> 00:17:38,107 So in Google, 371 00:17:38,107 --> 00:17:39,773 in Google, you can get the stolen credit card. 372 00:17:40,950 --> 00:17:44,973 And Baba Zorro is our own So Good team member, 373 00:17:44,973 --> 00:17:47,970 he's the owner of Zalem Phishing Telegram group 374 00:17:47,970 --> 00:17:49,800 with 30,000 members. 375 00:17:49,800 --> 00:17:51,183 So he's a big shot there. 376 00:17:52,633 --> 00:17:55,843 And I found many Iranian phishing group. 377 00:17:55,843 --> 00:17:57,600 Some of them has a few members, 378 00:17:57,600 --> 00:17:59,880 and those was the most interesting group, 379 00:17:59,880 --> 00:18:03,333 but up to 80,000 members for just one group. 380 00:18:04,287 --> 00:18:06,220 And the large group are usually used 381 00:18:06,220 --> 00:18:10,170 for exchanging or selling phishing kits or stolen goods. 382 00:18:10,170 --> 00:18:14,430 And I was able to join all of these group and much more, 383 00:18:14,430 --> 00:18:15,960 like 20 groups. 384 00:18:15,960 --> 00:18:18,780 And I added like 100%, 385 00:18:18,780 --> 00:18:22,410 but there was just one group called Must Click, 386 00:18:22,410 --> 00:18:24,450 which requires approval by admin. 387 00:18:24,450 --> 00:18:26,269 So I said, what the heck? 388 00:18:26,269 --> 00:18:29,117 I sent him a join request with my real name. 389 00:18:29,117 --> 00:18:32,273 I am Israeli and got an approval. So I have 100%. 390 00:18:33,638 --> 00:18:36,805 (audience applauding) 391 00:18:38,997 --> 00:18:42,095 Okay. So let's go technical, decompiling the malware. 392 00:18:42,095 --> 00:18:43,545 Focus on the Lydia TXT class. 393 00:18:44,402 --> 00:18:45,930 It's the Android malware with the name of Lydia 394 00:18:46,914 --> 00:18:49,650 and the exfiltrated SMS data are, messages sorry, 395 00:18:49,650 --> 00:18:52,320 were uploaded to the C2 server. 396 00:18:52,320 --> 00:18:54,750 And the randomization of the name 397 00:18:54,750 --> 00:18:56,463 was done on the malware side. 398 00:18:57,898 --> 00:18:59,598 So no victim unique data was used. 399 00:19:00,782 --> 00:19:04,290 So if the malware upload a file name, victim.txt, 400 00:19:04,290 --> 00:19:06,723 it will be victim.txt on the C2 server. 401 00:19:07,903 --> 00:19:10,293 The file name was a number with five digit. 402 00:19:11,225 --> 00:19:13,017 So very hard to guess. 403 00:19:13,017 --> 00:19:15,225 And I developed a brute force tool 404 00:19:15,225 --> 00:19:17,125 to download all the exfiltrated files. 405 00:19:18,570 --> 00:19:23,181 The Android C2 server is based on a fire based API 406 00:19:23,181 --> 00:19:26,790 and also Telegram based API, developed in Python. 407 00:19:26,790 --> 00:19:30,750 And one of the attacker is, let's do attribution. 408 00:19:30,750 --> 00:19:33,180 We know it's Iranian, but who is it? 409 00:19:33,180 --> 00:19:36,450 One of them is called Amin Ranjbar 410 00:19:36,450 --> 00:19:40,447 and he's testing his own malware on his own machine. 411 00:19:40,447 --> 00:19:42,360 So never do it, never do it. 412 00:19:42,360 --> 00:19:47,360 And one of the SMS is from a hosting provider, 413 00:19:47,850 --> 00:19:50,610 confirming his newly registered domain, 414 00:19:50,610 --> 00:19:51,903 which is the C2 server. 415 00:19:52,807 --> 00:19:55,230 And it's called sana-iran.xyz. 416 00:19:55,230 --> 00:19:58,350 So now we know it's the hacker, right? 417 00:19:58,350 --> 00:20:00,910 Maybe he's in charge on the C2 servers 418 00:20:01,776 --> 00:20:03,150 infrastructure or maintenance. I don't know. 419 00:20:03,150 --> 00:20:05,673 But we have his name. But that's not it. 420 00:20:07,395 --> 00:20:10,195 I have his SMSs because he ran it on his Android device. 421 00:20:11,453 --> 00:20:14,100 So I have his account number in the National Bank of Iran 422 00:20:15,262 --> 00:20:17,603 and his phone number. I have two phones, 423 00:20:17,603 --> 00:20:19,980 one ends with eight five if you can see it, 424 00:20:19,980 --> 00:20:21,720 and full address at home, 425 00:20:21,720 --> 00:20:23,283 if you want to visit him. 426 00:20:24,727 --> 00:20:28,603 And the attacker also offer hacking services in, 427 00:20:29,460 --> 00:20:31,446 I don't know, this site, 428 00:20:31,446 --> 00:20:34,443 like professional hackers, and using the same phone number. 429 00:20:35,663 --> 00:20:38,113 So we have a cross that it's a real phone number. 430 00:20:40,358 --> 00:20:42,780 It appears that Lydia Team is selling and promoting 431 00:20:42,780 --> 00:20:45,630 their phishing and Android malware services 432 00:20:45,630 --> 00:20:47,925 with three possible plans. 433 00:20:47,925 --> 00:20:49,680 So you can choose from a basic plan 434 00:20:49,680 --> 00:20:52,323 to a full phishing as a service plan. 435 00:20:53,918 --> 00:20:57,060 And they offer dozens of phishing kits for customers. 436 00:20:57,060 --> 00:20:58,983 Let's say customers, for example, 437 00:20:59,929 --> 00:21:00,762 Instagram account phishing, 438 00:21:00,762 --> 00:21:03,370 but you can see a list of all the sites that they duplicate 439 00:21:04,235 --> 00:21:06,630 and are used as a phishing lures. 440 00:21:06,630 --> 00:21:10,200 And they use a pyramid structure. 441 00:21:10,200 --> 00:21:13,590 The bot is given for use in return for 20% 442 00:21:13,590 --> 00:21:15,063 of the collected credit card. 443 00:21:16,418 --> 00:21:19,530 So I Google it, Google translate, 444 00:21:19,530 --> 00:21:23,490 and this is the translation to English 445 00:21:23,490 --> 00:21:28,293 and the SMSspy, I gave it a 65. What do you think? 446 00:21:29,157 --> 00:21:31,039 (audience members shouting) 447 00:21:31,039 --> 00:21:34,440 Save it. Whoa, this is, this one! This one. 448 00:21:34,440 --> 00:21:36,240 Yeah. Second. 449 00:21:36,240 --> 00:21:37,830 Okay. 450 00:21:37,830 --> 00:21:39,756 Okay. Let's continue. 451 00:21:39,756 --> 00:21:42,810 So I ask myself if this Telegram bot API 452 00:21:42,810 --> 00:21:45,360 is commonly used by other threat actors 453 00:21:45,360 --> 00:21:50,280 and the reason, the answer is totally positive, right? 454 00:21:50,280 --> 00:21:54,510 So a simple pivoting on the API.Telegram.org, 455 00:21:54,510 --> 00:21:58,380 the official site using VirusTotal Graph 456 00:21:58,380 --> 00:22:00,420 provide me with a positive answer. 457 00:22:00,420 --> 00:22:04,740 We have found actually two types executable with hard coded 458 00:22:04,740 --> 00:22:08,550 Telegram BOT API tokens and chat IDs, 459 00:22:08,550 --> 00:22:12,240 and also C2 backend code kits that were uploaded 460 00:22:12,240 --> 00:22:16,598 to VirusTotal by I don't know who, but it's there. 461 00:22:16,598 --> 00:22:17,543 So it's easy to find there. 462 00:22:18,917 --> 00:22:20,640 And the second type is more, 463 00:22:20,640 --> 00:22:22,050 I found it more interesting 464 00:22:22,050 --> 00:22:25,020 and I developed an automated script to download all chat 465 00:22:25,020 --> 00:22:26,610 and check if they are still active, 466 00:22:26,610 --> 00:22:29,760 because it can be uploaded like six months ago 467 00:22:29,760 --> 00:22:31,023 or something like this. 468 00:22:31,907 --> 00:22:34,440 And I got a lot of active groups 469 00:22:34,440 --> 00:22:35,400 and I have their token 470 00:22:35,400 --> 00:22:38,223 so I can control some of their activity. 471 00:22:39,600 --> 00:22:41,610 And the first interesting case, 472 00:22:41,610 --> 00:22:43,113 this is a new threat actor, 473 00:22:44,292 --> 00:22:46,758 it's called, they call themself UkraineLogs 474 00:22:46,758 --> 00:22:49,623 so think about the former talk. 475 00:22:50,661 --> 00:22:53,580 And this group used malware to steal cryptocurrency 476 00:22:53,580 --> 00:22:54,933 from victim machines. 477 00:22:56,228 --> 00:22:57,061 And it's a very large scale operation, 478 00:22:57,061 --> 00:22:58,510 and we'll see it in a minute, 479 00:22:59,997 --> 00:23:02,313 and they used dozens of malwares and loaders. 480 00:23:03,357 --> 00:23:06,840 But one of the interesting one was a loader 481 00:23:06,840 --> 00:23:09,060 that download and execute Mal Stealer, 482 00:23:09,060 --> 00:23:11,853 which is a fault of Vidal Stealer if you don't know it. 483 00:23:12,912 --> 00:23:13,860 And Mal Stealer actually steals 484 00:23:13,860 --> 00:23:17,100 two factor authentication and cryptocurrency, 485 00:23:17,100 --> 00:23:20,163 and the code is packed with unknown packer. 486 00:23:21,245 --> 00:23:23,580 And the main function was actually so complex 487 00:23:23,580 --> 00:23:27,300 and it was even too big to even been displayed in IDA graph. 488 00:23:27,300 --> 00:23:29,943 So it was a very sophisticated packer, 489 00:23:30,935 --> 00:23:35,935 but I just try it on, and locating the correct address 490 00:23:36,131 --> 00:23:39,690 in which to place the break point was quite easy. 491 00:23:39,690 --> 00:23:40,743 It's like old school. 492 00:23:41,911 --> 00:23:43,800 And after that I have the unpacked version. 493 00:23:43,800 --> 00:23:45,840 So I started to analyze it 494 00:23:45,840 --> 00:23:48,120 and found that this info stealer 495 00:23:48,120 --> 00:23:51,897 interesting because of three checks that is doing 496 00:23:51,897 --> 00:23:55,260 anti detection checks. 497 00:23:55,260 --> 00:24:00,000 First, it uses anti emulation against Windows Defender. 498 00:24:00,000 --> 00:24:01,320 I didn't know that at that time, 499 00:24:01,320 --> 00:24:03,510 but Windows Defender they knew. 500 00:24:03,510 --> 00:24:04,830 Windows Defender is using 501 00:24:04,830 --> 00:24:08,253 a fixed computer name used by the emulator. 502 00:24:09,290 --> 00:24:11,430 So if they just check, what is the computer name? 503 00:24:11,430 --> 00:24:15,690 If it's equal to HAL9TH they know that they are 504 00:24:15,690 --> 00:24:19,410 in an emulator. So what's so good about this? 505 00:24:19,410 --> 00:24:21,900 But the second one is its exit, 506 00:24:21,900 --> 00:24:26,257 if it's being run from Russia and nearby countries. 507 00:24:26,257 --> 00:24:27,630 So we have a little bit of attribution here, 508 00:24:27,630 --> 00:24:31,470 but we'll, trust me, we'll get much more info later. 509 00:24:31,470 --> 00:24:34,710 And so they just check their language 510 00:24:34,710 --> 00:24:37,590 and decide if it's Russian or not. 511 00:24:37,590 --> 00:24:40,980 And the third one was the expiration check. 512 00:24:40,980 --> 00:24:45,315 It was limited to one month from compile time. 513 00:24:45,315 --> 00:24:46,980 And if you try to run it as a researcher, 514 00:24:46,980 --> 00:24:48,930 after this month, it won't do anything. 515 00:24:50,160 --> 00:24:51,794 And it's packed. 516 00:24:51,794 --> 00:24:54,480 So it can be difficult for some. 517 00:24:54,480 --> 00:24:57,210 And the attack is still ongoing. 518 00:24:57,210 --> 00:24:59,940 This is a tool to the deobfuscated strings that I wrote 519 00:24:59,940 --> 00:25:01,890 and the sample is not public. 520 00:25:01,890 --> 00:25:03,510 And the C2 server was not known until now, 521 00:25:03,510 --> 00:25:07,350 but I will publish all the details today. 522 00:25:07,350 --> 00:25:11,119 Also found the Telegram group API key used by this group 523 00:25:11,119 --> 00:25:14,370 to exfiltrated, to exfiltrate, sorry, screen captures. 524 00:25:14,370 --> 00:25:16,620 The loader also downloads and execute the 525 00:25:16,620 --> 00:25:20,283 final GoLang infostealer from a legit site. 526 00:25:21,510 --> 00:25:23,310 And the GoLang malware is a cookie stealer. 527 00:25:23,310 --> 00:25:24,603 It's very complex. 528 00:25:25,479 --> 00:25:27,090 It steals OAuth tokens, 529 00:25:27,090 --> 00:25:30,450 infect a lot of victims in large scale, 530 00:25:30,450 --> 00:25:32,760 mostly via YouTube links. 531 00:25:32,760 --> 00:25:35,250 So I will give some example, 532 00:25:35,250 --> 00:25:38,193 but let's first discuss the GoLang malware. 533 00:25:39,039 --> 00:25:41,250 So I don't know how much of you try to reverse engineer 534 00:25:41,250 --> 00:25:43,983 GoLang malwares, but it's a nightmare. 535 00:25:46,060 --> 00:25:47,590 And there are some tools 536 00:25:49,825 --> 00:25:53,670 and JAGS at REcon presented one that is better 537 00:25:53,670 --> 00:25:56,640 than what I used here because it was before. 538 00:25:56,640 --> 00:26:00,390 But we can see that I used an IDA script when running it. 539 00:26:00,390 --> 00:26:04,020 I had 83 hundred unrecognized function. 540 00:26:04,020 --> 00:26:07,307 And after running it, the renamed function button, 541 00:26:07,307 --> 00:26:08,820 the script was able to detect 2000 of them. 542 00:26:08,820 --> 00:26:11,163 So it was very helpful, but still complex. 543 00:26:12,617 --> 00:26:13,650 And as I said, the infection vector 544 00:26:13,650 --> 00:26:16,110 is through publishing YouTube links 545 00:26:16,110 --> 00:26:18,123 to an encrypted executable. 546 00:26:19,247 --> 00:26:20,719 And as we can see, 547 00:26:20,719 --> 00:26:22,710 there were 20,000 results on the right 548 00:26:22,710 --> 00:26:26,610 only for the 0909 password encrypted model instance. 549 00:26:26,610 --> 00:26:28,503 So there were different instances. 550 00:26:29,854 --> 00:26:30,840 And only for that instance, 551 00:26:30,840 --> 00:26:34,323 there are 20,000 different YouTube links. 552 00:26:35,611 --> 00:26:36,780 And this threat actor also is smart 553 00:26:36,780 --> 00:26:40,350 and it's published the link on a crypto app related site. 554 00:26:40,350 --> 00:26:42,030 So it's logical because they want to 555 00:26:42,030 --> 00:26:43,680 steal cryptocurrency and wallets. 556 00:26:44,718 --> 00:26:47,900 So people that are interested in crypto movies. 557 00:26:47,900 --> 00:26:50,957 So probably they will have a better chance to have wallets 558 00:26:50,957 --> 00:26:53,280 on their computers. 559 00:26:53,280 --> 00:26:55,793 And also on video sharing platforms. 560 00:26:55,793 --> 00:26:56,982 So if you are using it, 561 00:26:56,982 --> 00:26:57,930 be careful. 562 00:26:57,930 --> 00:27:00,090 And back to the infostealer loader code, 563 00:27:00,090 --> 00:27:02,400 this is very interesting, I think. 564 00:27:02,400 --> 00:27:05,790 I use the Telegram API, a different one, getChat, 565 00:27:05,790 --> 00:27:07,380 and got an invite link. 566 00:27:07,380 --> 00:27:09,660 I was able to join the attacker Telegram group 567 00:27:09,660 --> 00:27:12,333 and become the 10th member for months. 568 00:27:14,256 --> 00:27:16,710 And I was able to download all past messages, 569 00:27:16,710 --> 00:27:19,560 even before I joined, and get in real time, 570 00:27:19,560 --> 00:27:21,123 all messages from now on. 571 00:27:22,262 --> 00:27:24,240 So I'm like in between. 572 00:27:24,240 --> 00:27:26,100 And on the left, you can see 573 00:27:26,100 --> 00:27:28,260 the configuration of the malware. 574 00:27:28,260 --> 00:27:30,330 We can see that it was configured to collect, 575 00:27:30,330 --> 00:27:32,070 it's hard to see, but it was configured 576 00:27:32,070 --> 00:27:35,610 to collect screen captures and victims environmental data, 577 00:27:35,610 --> 00:27:38,460 such as OS, IP, and hardware ID. 578 00:27:38,460 --> 00:27:40,924 In the middle and on the right, you can see 579 00:27:40,924 --> 00:27:43,085 the exfiltrated victim screenshot 580 00:27:43,085 --> 00:27:44,700 and exfiltrated environmental data 581 00:27:44,700 --> 00:27:46,350 from the attacker Telegram group. 582 00:27:47,852 --> 00:27:49,451 So we have a match 583 00:27:49,451 --> 00:27:51,870 and using a simple tool to download 584 00:27:51,870 --> 00:27:53,523 all victims screen captures, 585 00:27:54,709 --> 00:27:58,672 and I have 35,000 script captures of different victims. 586 00:27:58,672 --> 00:28:01,383 So it's like open for almost everyone. 587 00:28:02,250 --> 00:28:05,550 We can see some example of the stolen data, 588 00:28:05,550 --> 00:28:07,560 which include both cryptocurrency, 589 00:28:07,560 --> 00:28:09,180 and you can see also NFT theft. 590 00:28:09,180 --> 00:28:10,473 They like NFT a lot. 591 00:28:12,462 --> 00:28:14,796 And hundred of wallets were exfiltrated 592 00:28:14,796 --> 00:28:17,273 and top balances can reach thousands of years dollars. 593 00:28:18,339 --> 00:28:21,720 And the attack also exfiltrate the 12 word passphrase 594 00:28:21,720 --> 00:28:24,990 of wallets like Metamask and the password. 595 00:28:24,990 --> 00:28:27,360 So from, at that point, the attacker 596 00:28:27,360 --> 00:28:30,240 can control the victim's wallet. 597 00:28:30,240 --> 00:28:33,873 27% of the victims are located in the US. 598 00:28:34,740 --> 00:28:38,610 The exfiltrated cookies are for wide range of services like 599 00:28:38,610 --> 00:28:41,760 beginning with PayPal, Amazon, games, bank, 600 00:28:41,760 --> 00:28:45,120 cryptocurrency wallets, Google pay, and stack.com, 601 00:28:45,120 --> 00:28:47,463 which runs crypto betting platform. 602 00:28:48,690 --> 00:28:50,340 So let's speak about attribution. 603 00:28:51,232 --> 00:28:52,560 The first indication of the attacker origin is that 604 00:28:52,560 --> 00:28:55,233 all C2 server were located in Russia. 605 00:28:56,350 --> 00:28:57,850 So it's not surprising, right? 606 00:28:58,950 --> 00:29:01,590 In addition, the spoken language of the attackers 607 00:29:01,590 --> 00:29:04,740 is Russian, and they tried to hide it 608 00:29:04,740 --> 00:29:07,353 by replacing it with English after a while, 609 00:29:08,228 --> 00:29:09,512 but I have all the messages. 610 00:29:09,512 --> 00:29:10,463 So I know they are Russian. 611 00:29:11,545 --> 00:29:14,109 And I was able to discover the attacker's IP 612 00:29:14,109 --> 00:29:16,110 located in Russia, the exact attack IP 613 00:29:16,110 --> 00:29:19,950 and the first 8,000 of the exfiltrated data messages 614 00:29:19,950 --> 00:29:23,400 originated from the same IP in Russia, 615 00:29:23,400 --> 00:29:26,220 which was used by the attackers for testing purposes. 616 00:29:26,220 --> 00:29:27,183 Again, don't do it. 617 00:29:28,139 --> 00:29:29,389 And later as a C2 server. 618 00:29:30,588 --> 00:29:34,710 On the bottom, we can see that this red, 619 00:29:34,710 --> 00:29:38,317 this is a redline infostealer that connects to the same 620 00:29:38,317 --> 00:29:40,323 IP address of the 8,000 messages. 621 00:29:41,469 --> 00:29:45,243 And it's also using the redline stealer bot ID onyxx0.1. 622 00:29:47,580 --> 00:29:50,460 So I use another Telegram bot API function, 623 00:29:50,460 --> 00:29:53,010 it's called getchatadministrator. 624 00:29:53,010 --> 00:29:56,240 And we found that the group has six administrators. 625 00:29:56,240 --> 00:30:00,150 So nine hackers, myself, but six of them are administrator. 626 00:30:00,150 --> 00:30:04,500 And one of them is onyxx0. So onyxx0, onyxx0.1. 627 00:30:04,500 --> 00:30:07,320 And the second is called p2Mmemory. 628 00:30:07,320 --> 00:30:10,170 And then I found that Onyx is a creator of threads 629 00:30:10,170 --> 00:30:11,910 for selling stolen tokens. 630 00:30:11,910 --> 00:30:14,430 And the second admin is p2Memory 631 00:30:14,430 --> 00:30:16,280 and they are chatting with each other 632 00:30:17,925 --> 00:30:19,968 and I don't know their real identity, 633 00:30:19,968 --> 00:30:21,780 but they are real people. 634 00:30:21,780 --> 00:30:25,474 So let's speak a little bit about Take Down. 635 00:30:25,474 --> 00:30:28,770 The bot is administrator and I could create, edit, 636 00:30:28,770 --> 00:30:31,893 or revoke the invite link so nobody can join. 637 00:30:33,231 --> 00:30:34,170 And I can also temporarily take it down 638 00:30:34,170 --> 00:30:35,910 by blocking all members, 639 00:30:35,910 --> 00:30:39,630 or I can even set a web hook to automatically transfer 640 00:30:39,630 --> 00:30:42,840 all messages to safebreach.com, 641 00:30:42,840 --> 00:30:44,840 which you can see was done successfully. 642 00:30:45,780 --> 00:30:47,373 So all of the victim messages, 643 00:30:48,253 --> 00:30:50,415 just I didn't try to catch them, 644 00:30:50,415 --> 00:30:53,610 just stop them from reaching the real estate too. 645 00:30:53,610 --> 00:30:55,833 And they temporarily lost all victims, 646 00:30:57,060 --> 00:31:01,023 but probably they could easily recover from this attack. 647 00:31:02,340 --> 00:31:04,860 So I gave them the same score. 648 00:31:04,860 --> 00:31:06,483 You don't need to shout anymore. 649 00:31:08,040 --> 00:31:08,913 We have a winner. 650 00:31:12,781 --> 00:31:13,614 Woo! 651 00:31:15,022 --> 00:31:18,189 (audience applauding) 652 00:31:21,108 --> 00:31:23,941 But with different mistakes. Okay. 653 00:31:25,110 --> 00:31:26,760 This one is very, very interesting 654 00:31:26,760 --> 00:31:31,760 because I was I'm monitoring them for almost a year now. 655 00:31:31,800 --> 00:31:32,800 It's still going on. 656 00:31:33,738 --> 00:31:35,643 And those are Turkish threat actors. 657 00:31:36,721 --> 00:31:40,110 They call themself Ekmek Tekensi or something like this 658 00:31:40,110 --> 00:31:43,140 In Turkish, in English it means the bread boat. 659 00:31:43,140 --> 00:31:46,320 And they're referring all the stolen cryptocurrency NFT 660 00:31:46,320 --> 00:31:49,550 as bread, bringing bread and so on. 661 00:31:49,550 --> 00:31:51,450 So the Bread Boat. 662 00:31:51,450 --> 00:31:53,590 And they steal cryptocurrency with a 663 00:31:54,472 --> 00:31:56,876 different approach from the UkraineLog. 664 00:31:56,876 --> 00:31:59,010 UkraineLogs try to infect machine and steal 665 00:31:59,010 --> 00:32:00,990 the cryptocurrency wallets. 666 00:32:00,990 --> 00:32:03,933 They are using zero infections techniques. 667 00:32:04,788 --> 00:32:05,621 So let's describe them. 668 00:32:05,621 --> 00:32:08,790 So the PHP code redirects the exfiltrated data 669 00:32:08,790 --> 00:32:11,640 from the C2 web server to a Telegram group. 670 00:32:11,640 --> 00:32:13,500 In addition, the PHP code save its 671 00:32:13,500 --> 00:32:18,500 to a local C2 server, file named file test.txt. 672 00:32:18,510 --> 00:32:21,510 And the victims clicks on the connect wallet button, 673 00:32:21,510 --> 00:32:23,820 as you can see on the top left 674 00:32:23,820 --> 00:32:26,520 and enter the Metamask passphrase this time. 675 00:32:26,520 --> 00:32:28,170 And this is a phishing page, 676 00:32:28,170 --> 00:32:32,073 which writes the passphrase to the test.txt local file. 677 00:32:33,750 --> 00:32:37,380 Okay. The attackers are working very hard 678 00:32:37,380 --> 00:32:39,690 to promote the phishing lures. 679 00:32:39,690 --> 00:32:42,360 So they're paying Google for advertising 680 00:32:42,360 --> 00:32:44,280 their phishing sites. 681 00:32:44,280 --> 00:32:46,680 And the C2 server is the third result 682 00:32:46,680 --> 00:32:49,320 in my Google search above. 683 00:32:49,320 --> 00:32:50,670 So they're doing good work. 684 00:32:50,670 --> 00:32:53,610 And they also target victims using Telegram 685 00:32:53,610 --> 00:32:57,690 and other social networks via Twitter ads, for example. 686 00:32:57,690 --> 00:32:59,373 As we can see on the right, 687 00:33:00,690 --> 00:33:03,693 the ads include a link to their Metamask phishing site. 688 00:33:05,010 --> 00:33:07,650 So by now you know the drill. 689 00:33:07,650 --> 00:33:10,743 I joined via the invite link and download all messages. 690 00:33:11,584 --> 00:33:14,850 But after a short while they sent me a message in Turkish, 691 00:33:14,850 --> 00:33:16,350 which I don't understand. 692 00:33:16,350 --> 00:33:18,333 And I was immediately kicked out. 693 00:33:19,795 --> 00:33:21,955 So I thought, is this the end? 694 00:33:21,955 --> 00:33:25,590 And then I figure out that they kick out Tomer Bar, my user, 695 00:33:25,590 --> 00:33:27,750 but they don't kick out their bot. 696 00:33:27,750 --> 00:33:31,740 So I just wrote a script to automatically download updates, 697 00:33:31,740 --> 00:33:33,660 using GetUpdates API, 698 00:33:33,660 --> 00:33:37,530 and was able to monitor all the messages in the group 699 00:33:37,530 --> 00:33:39,990 until now for almost a year. 700 00:33:39,990 --> 00:33:42,210 And the script also transferred the messages, 701 00:33:42,210 --> 00:33:44,040 the script that I wrote to transfer the messages 702 00:33:44,040 --> 00:33:46,830 from Turkish to English so it will be easier for me. 703 00:33:46,830 --> 00:33:49,680 And the bot API is probably revealing here 704 00:33:49,680 --> 00:33:52,620 the attacker's Ronin wallet address and passphrase, 705 00:33:52,620 --> 00:33:55,350 so I can control the wallet. 706 00:33:55,350 --> 00:33:56,183 And on the bottom, 707 00:33:56,183 --> 00:33:58,920 they are sharing additional wallet addresses. 708 00:33:58,920 --> 00:34:00,660 The main C2 server include 709 00:34:00,660 --> 00:34:03,990 more than 400 phishing domain names 710 00:34:03,990 --> 00:34:07,470 added daily and from October, 2021. 711 00:34:07,470 --> 00:34:09,180 And it's still active every day, 712 00:34:09,180 --> 00:34:11,430 every day, there are new domains. 713 00:34:11,430 --> 00:34:13,230 And the second phishing server, 714 00:34:13,230 --> 00:34:15,455 which is still active also, 715 00:34:15,455 --> 00:34:18,810 is implemented crypto scam with different techniques. 716 00:34:18,810 --> 00:34:23,340 The dumbest method is that promise to provide profit 717 00:34:23,340 --> 00:34:26,160 if you just send them your crypto. 718 00:34:26,160 --> 00:34:27,213 So don't do it. 719 00:34:29,554 --> 00:34:31,980 And the other C2 servers exfiltrate the passphrase 720 00:34:31,980 --> 00:34:34,413 to local files or to Google forms. 721 00:34:38,981 --> 00:34:40,800 I understand their attack in details 722 00:34:40,800 --> 00:34:42,600 and the attacker's plans, 723 00:34:42,600 --> 00:34:44,803 the entire attack in details. 724 00:34:44,803 --> 00:34:47,790 They stole $30,000 in just two hours. 725 00:34:47,790 --> 00:34:51,810 And then the boss set a target of $100,000 for this day. 726 00:34:51,810 --> 00:34:52,643 And on the bottom, 727 00:34:52,643 --> 00:34:55,200 we can see that they share the admin credentials to manage 728 00:34:55,200 --> 00:34:57,153 all the different C2 servers. 729 00:34:58,232 --> 00:34:59,823 But it's not legal to use it, 730 00:35:00,990 --> 00:35:02,700 and it's not required because they did 731 00:35:02,700 --> 00:35:04,590 a lot of OopsSec mistakes. 732 00:35:04,590 --> 00:35:06,813 And all the threat actors, C2 servers, 733 00:35:08,310 --> 00:35:10,803 reveals the stolen user passphrase. 734 00:35:11,782 --> 00:35:13,932 So this is just an example, but believe me. 735 00:35:15,912 --> 00:35:18,925 And this is another example of a unconfigured 736 00:35:18,925 --> 00:35:21,330 Laravel backend like we saw earlier 737 00:35:21,330 --> 00:35:24,870 and exposing the DB credentials and app key 738 00:35:24,870 --> 00:35:27,273 when the expected parameter is not provided. 739 00:35:28,296 --> 00:35:30,720 So they expected a special parameter. 740 00:35:30,720 --> 00:35:31,770 I didn't provide them that, 741 00:35:31,770 --> 00:35:34,863 and they just print the password. 742 00:35:36,210 --> 00:35:39,660 The same exposed data is accessible by a second method 743 00:35:39,660 --> 00:35:42,960 by browsing to the .env file, 744 00:35:42,960 --> 00:35:47,043 which is textual and includes the same credentials. 745 00:35:47,880 --> 00:35:51,721 The threat actor invested a lot of effort in phishing NFT, 746 00:35:51,721 --> 00:35:53,490 and the attacker is bragging in Telegram 747 00:35:53,490 --> 00:35:56,262 that he has stolen 25 ethereum. 748 00:35:56,262 --> 00:35:59,353 At that time it was worth $75,000 749 00:36:00,829 --> 00:36:03,600 using phishing lures on the famous NFT sites. 750 00:36:03,600 --> 00:36:06,030 As we can see, the C2 server is open dir 751 00:36:06,030 --> 00:36:07,410 and the main j script includes 752 00:36:07,410 --> 00:36:09,570 the threat actor wallet address. 753 00:36:09,570 --> 00:36:12,180 They're using stolen credit cards in order to pay 754 00:36:12,180 --> 00:36:13,650 for the C2 server. 755 00:36:13,650 --> 00:36:17,280 And they also purchase stolen Redline Stealer credentials. 756 00:36:17,280 --> 00:36:19,470 They're also using different services in order to turn 757 00:36:19,470 --> 00:36:21,960 the stolen cryptocurrency into cash, 758 00:36:21,960 --> 00:36:25,264 including virtual credit card and laundry sites. 759 00:36:25,264 --> 00:36:26,786 You can see the address here. 760 00:36:26,786 --> 00:36:27,690 We can see the attacker's wallet address 761 00:36:27,690 --> 00:36:28,980 and withdrawal operations. 762 00:36:28,980 --> 00:36:32,010 So I'm monitoring all of their activities. 763 00:36:32,010 --> 00:36:34,230 And they steal money directly for, directly from 764 00:36:34,230 --> 00:36:36,510 victim, sorry, bank accounts 765 00:36:36,510 --> 00:36:38,070 in order to pay for Google ads 766 00:36:38,070 --> 00:36:39,420 to promote their phishing website 767 00:36:39,420 --> 00:36:41,130 like we saw earlier. 768 00:36:41,130 --> 00:36:42,630 Here is another example of their 769 00:36:42,630 --> 00:36:44,737 active phishing activity, 770 00:36:44,737 --> 00:36:45,570 which is done a bit differently 771 00:36:45,570 --> 00:36:48,060 using additional Telegram groups. 772 00:36:48,060 --> 00:36:51,600 They also build a pyramid scheme to recruit members. 773 00:36:51,600 --> 00:36:54,270 Each member is allegedly participating in mining 774 00:36:54,270 --> 00:36:57,180 cryptocurrency based on the tron protocol, 775 00:36:57,180 --> 00:37:00,813 but actually is NFTs and cryptocurrencies stolen. 776 00:37:02,198 --> 00:37:03,750 As we can see the print screen here, 777 00:37:03,750 --> 00:37:06,480 demonstrate how the threat actor used public tools 778 00:37:06,480 --> 00:37:11,280 like sqlmap to take over websites, legit websites. 779 00:37:11,280 --> 00:37:13,200 And they also upload web shells 780 00:37:13,200 --> 00:37:15,123 to different vulnerable sites. 781 00:37:16,453 --> 00:37:18,123 It was like a huge campaign. 782 00:37:19,020 --> 00:37:22,041 And the attacker shared the entire C2 server code 783 00:37:22,041 --> 00:37:24,573 using the Telegram group that I am in. 784 00:37:25,474 --> 00:37:27,270 And I got all the databases. 785 00:37:27,270 --> 00:37:30,150 So the info table stole the victim private keys, 786 00:37:30,150 --> 00:37:33,930 and we can see that simple Google search for what that mean. 787 00:37:33,930 --> 00:37:38,190 Hush reveals that it's the password 1, 2, 3, 4, 5, 6. 788 00:37:38,190 --> 00:37:39,063 So amazing. 789 00:37:40,860 --> 00:37:44,612 The login leads to a Chester Phoenix admin panel, 790 00:37:44,612 --> 00:37:47,262 which is query the local collected victim wallets DB. 791 00:37:49,590 --> 00:37:54,510 The above cloud drive includes 300 gigabytes of victim 792 00:37:54,510 --> 00:37:57,030 exfiltrated data. It's not live anymore, 793 00:37:57,030 --> 00:38:01,480 but I have all of it. I will give it to the proper relevant 794 00:38:02,983 --> 00:38:05,500 agencies to look up all of it 795 00:38:07,276 --> 00:38:08,760 and report back to the victims. 796 00:38:08,760 --> 00:38:11,310 Let's speak about attribution. Believe me, it'll be funny. 797 00:38:11,310 --> 00:38:14,922 The entire conversation is entirely in Turkish. 798 00:38:14,922 --> 00:38:16,899 So we know for sure they are Turkish. 799 00:38:16,899 --> 00:38:19,500 We can see that the attackers are not using VPNs to manage 800 00:38:19,500 --> 00:38:22,080 their C2 server and because they exchange 801 00:38:22,080 --> 00:38:23,730 all of the C2 server code, 802 00:38:23,730 --> 00:38:24,840 I also have it. 803 00:38:24,840 --> 00:38:27,780 So the C2, the C panel last login file 804 00:38:27,780 --> 00:38:30,063 includes the IP address from Turkey. 805 00:38:30,926 --> 00:38:32,376 So that's their real address. 806 00:38:33,484 --> 00:38:34,800 But on 25 of June, 807 00:38:34,800 --> 00:38:37,950 after more than eight months of monitoring, 808 00:38:37,950 --> 00:38:41,880 one of them published a competition@outten.net. 809 00:38:41,880 --> 00:38:45,210 It's a public site forum for the logo 810 00:38:45,210 --> 00:38:47,130 for the new site player.com, 811 00:38:47,130 --> 00:38:50,013 which is not just a phishing site. 812 00:38:50,965 --> 00:38:54,120 And the username in the out 10 forum is called Murat, 813 00:38:54,120 --> 00:38:55,113 MuratcanATAK. 814 00:38:55,980 --> 00:38:59,610 And this led me to a bingo because I found a Twitter account 815 00:38:59,610 --> 00:39:04,020 with his photos and he tag it as a blockchain account. 816 00:39:04,020 --> 00:39:05,700 And few days later, 817 00:39:05,700 --> 00:39:09,540 he also got a message from his garage to collect his car 818 00:39:09,540 --> 00:39:12,660 with his real name and license plate number. 819 00:39:12,660 --> 00:39:15,480 And so you can see that it's a real name 820 00:39:15,480 --> 00:39:19,680 And on the right, when you surf on Chrome, 821 00:39:19,680 --> 00:39:23,430 you can sign in with your account and you have the pictures 822 00:39:23,430 --> 00:39:25,170 of your account, right? 823 00:39:25,170 --> 00:39:27,570 So if you can see on the right, 824 00:39:27,570 --> 00:39:30,363 it's the picture of the other hacker. 825 00:39:32,160 --> 00:39:33,360 I have it from the print screen 826 00:39:33,360 --> 00:39:35,010 that they share between themself. 827 00:39:35,850 --> 00:39:38,741 So these two members joined the Telegram group 828 00:39:38,741 --> 00:39:41,310 for a short while, and they had four members. 829 00:39:41,310 --> 00:39:43,890 One of them is member of the Turk hack forums, 830 00:39:43,890 --> 00:39:46,260 and also registered domains. 831 00:39:46,260 --> 00:39:49,771 And sometimes you get to know your adversaries 832 00:39:49,771 --> 00:39:51,171 more than you ever expected. 833 00:39:52,783 --> 00:39:53,983 So that's it. That's it. 834 00:39:55,380 --> 00:39:57,810 So this is his Telegram account 835 00:39:57,810 --> 00:40:00,480 and I will skip, and I will speak a little bit 836 00:40:00,480 --> 00:40:02,310 about a Tunisian threat actor, 837 00:40:02,310 --> 00:40:05,850 which got the worst grade, 78 bad points. 838 00:40:05,850 --> 00:40:08,744 I will skip it because we have only five minutes. 839 00:40:08,744 --> 00:40:10,433 I have more interesting stuff later. 840 00:40:11,704 --> 00:40:14,641 So they do the same mistake, open dir, 841 00:40:14,641 --> 00:40:16,410 compressed the files. 842 00:40:16,410 --> 00:40:21,410 But what was very terrible is that I got all of his victims, 843 00:40:23,550 --> 00:40:26,340 victim data. They have 12,000 victims, 844 00:40:26,340 --> 00:40:31,340 but he register the Telegram group with his real name. 845 00:40:31,388 --> 00:40:33,690 So I have his real name, not a nickname. 846 00:40:33,690 --> 00:40:36,690 And I was able to find his LinkedIn account. 847 00:40:36,690 --> 00:40:40,140 He's working as a security consultant by day 848 00:40:40,140 --> 00:40:41,340 in a legit company. 849 00:40:41,340 --> 00:40:45,363 And by night he is doing attacks against victims. 850 00:40:46,374 --> 00:40:49,036 And I also found his a Google certificate, 851 00:40:49,036 --> 00:40:54,036 it's both on sending on the Telegram attackers group. 852 00:40:54,180 --> 00:40:55,980 And it's the same certificate 853 00:40:55,980 --> 00:40:58,530 on his public LinkedIn account. 854 00:40:58,530 --> 00:41:00,990 And on the bottom, you can see the tab 855 00:41:00,990 --> 00:41:04,680 with his real name of his Facebook account. 856 00:41:04,680 --> 00:41:08,190 So I have a lot of crossing, and it's a verified data. 857 00:41:08,190 --> 00:41:11,940 So I will skip two different 858 00:41:11,940 --> 00:41:14,730 Iranian nation state threat actors. 859 00:41:14,730 --> 00:41:17,460 They did Apple bypass, 860 00:41:17,460 --> 00:41:19,667 two factor authentication bypass for iCloud. 861 00:41:20,689 --> 00:41:22,181 It's a new technique. 862 00:41:22,181 --> 00:41:23,660 I got all of the source code 863 00:41:23,660 --> 00:41:25,380 because of their operation security mistake. 864 00:41:25,380 --> 00:41:28,050 And I will share all the slides and all the details 865 00:41:28,050 --> 00:41:31,200 on the site and also on other platforms. 866 00:41:31,200 --> 00:41:33,673 But I don't have enough time to speak about it. 867 00:41:33,673 --> 00:41:37,170 I want to speak four minutes about this threat actor. 868 00:41:37,170 --> 00:41:39,570 This actually is a good, I don't know if it's a good, 869 00:41:39,570 --> 00:41:42,480 but it's the best operation security threat actor 870 00:41:42,480 --> 00:41:43,800 that I ever seen. 871 00:41:43,800 --> 00:41:46,203 And it's a Iranian nation state threat actor, 872 00:41:47,250 --> 00:41:50,850 is the most persistent ones that I know of. 873 00:41:50,850 --> 00:41:51,963 It's been acting, 874 00:41:52,950 --> 00:41:55,450 it's been active since 2007. 875 00:41:55,450 --> 00:41:59,970 So 15 years of operation, that's a lot. And I am monitoring. 876 00:41:59,970 --> 00:42:01,990 I first discovered it in 2015 877 00:42:04,214 --> 00:42:06,640 and wrote a lot of reports on it 878 00:42:07,995 --> 00:42:10,620 and I also did them a takedown on 2015. 879 00:42:10,620 --> 00:42:13,410 And they lost all of their very targeted victims. 880 00:42:13,410 --> 00:42:16,770 They were oppositionists to the Islamic regime 881 00:42:16,770 --> 00:42:19,420 and they were very targeted for seven years 882 00:42:20,640 --> 00:42:22,320 and they lost the Iranian, 883 00:42:22,320 --> 00:42:25,810 lost all of the access to all of their victims 884 00:42:28,024 --> 00:42:29,920 and return in 2017 with 885 00:42:30,930 --> 00:42:32,280 they learned from the mistakes 886 00:42:32,280 --> 00:42:36,420 and they got with a very secure OPSEC infrastructure. 887 00:42:36,420 --> 00:42:40,230 So they used two mechanism. One is very common. 888 00:42:40,230 --> 00:42:43,200 The DGA, which is a domain generation algorithm. 889 00:42:43,200 --> 00:42:46,470 Each week, 100 different domain names 890 00:42:46,470 --> 00:42:48,090 were use as a C2 server. 891 00:42:48,090 --> 00:42:53,090 So sinkhole is much difficult from the 2015 version 892 00:42:54,180 --> 00:42:58,050 where there were just like three outcoded domain names. 893 00:42:58,050 --> 00:43:02,100 But most interestingly is the second mechanism, 894 00:43:02,100 --> 00:43:07,100 which is, they use C2 signature verification in order to 895 00:43:07,890 --> 00:43:11,010 verify that they are speaking with the real C2 server. 896 00:43:11,010 --> 00:43:14,070 Because I reverse engineer the DGA code, 897 00:43:14,070 --> 00:43:16,890 understand what will be the next domain name, 898 00:43:16,890 --> 00:43:19,170 purchase those domain name before them 899 00:43:19,170 --> 00:43:22,740 and all the victims connected to my site. 900 00:43:22,740 --> 00:43:26,010 But I have only their IPs because 901 00:43:26,010 --> 00:43:29,760 when they download the signature files, 902 00:43:29,760 --> 00:43:32,160 which is encrypted with the private key, 903 00:43:32,160 --> 00:43:34,320 which I don't have, only the attackers have, 904 00:43:34,320 --> 00:43:37,500 they can verify that this is not a legit site 905 00:43:37,500 --> 00:43:40,500 and just move on to the next server, which will be verified. 906 00:43:44,817 --> 00:43:47,873 So this means that it's very hard to take them down. 907 00:43:49,144 --> 00:43:51,723 And from 2017, until 2022, 908 00:43:52,560 --> 00:43:57,170 you can see that there were some reports about this group, 909 00:43:57,170 --> 00:44:01,173 but no one is able to do anything to arm their operation. 910 00:44:02,130 --> 00:44:04,110 And I worked for it about three years. 911 00:44:04,110 --> 00:44:05,460 It was like a life mission. 912 00:44:06,813 --> 00:44:10,230 And recently I found the weakest link in the Infy chain, 913 00:44:10,230 --> 00:44:14,040 the transmission of files from the C2 server in Europe, 914 00:44:14,040 --> 00:44:15,753 to their attackers in Iran. 915 00:44:18,198 --> 00:44:19,683 So to make things short, 916 00:44:21,241 --> 00:44:25,110 I develop a script that connects to the C2 server 917 00:44:25,110 --> 00:44:27,810 and downloads all of the victim's data. 918 00:44:27,810 --> 00:44:31,140 And I also found that they encrypted in asymmetric keys, 919 00:44:31,140 --> 00:44:34,023 so I cannot open it because I don't have the right key, 920 00:44:34,926 --> 00:44:38,160 but some of it was not encrypted. 921 00:44:38,160 --> 00:44:42,551 And I have some metadata that I was able to deobfuscate 922 00:44:42,551 --> 00:44:45,630 and I have the username, the asked name of the victim, 923 00:44:45,630 --> 00:44:49,470 the path to the store on the C2 server, the toner version, 924 00:44:49,470 --> 00:44:53,733 which is, toner is the second step tool. 925 00:44:54,839 --> 00:44:55,890 It's a very sophisticated tool, 926 00:44:55,890 --> 00:44:58,050 which allowed them to monitor and surveillance 927 00:44:58,050 --> 00:44:59,700 all of the victims' data. 928 00:44:59,700 --> 00:45:02,700 And Tonnerre in French, I hope I'm pronouncing it right, 929 00:45:02,700 --> 00:45:07,140 is thunder, and the first tool is called lighting. 930 00:45:07,140 --> 00:45:08,703 So just one minute. 931 00:45:09,936 --> 00:45:12,818 So the lighting, the thunder come after the lightning. 932 00:45:12,818 --> 00:45:14,100 So I'll just finish with a demo. 933 00:45:14,100 --> 00:45:18,693 It will be 20 seconds and I release you. 934 00:45:20,580 --> 00:45:22,890 Okay. So you can see that I'm downloading. 935 00:45:22,890 --> 00:45:26,310 I get a list of all the files in the C2 server in real time 936 00:45:26,310 --> 00:45:29,760 with their sizes, and the URL to download them. 937 00:45:29,760 --> 00:45:33,060 And then I will run the same script with the all parameter 938 00:45:33,060 --> 00:45:35,670 and it will start downloading, it's a little bit small, 939 00:45:35,670 --> 00:45:38,250 but believe me, it will download all of the files. 940 00:45:38,250 --> 00:45:41,880 I will skip because it will be short. 941 00:45:41,880 --> 00:45:46,200 So I have a directory with sorted by all the victims' IPs 942 00:45:46,200 --> 00:45:48,690 and we can see all the infiltration data. 943 00:45:48,690 --> 00:45:53,690 Okay. I finished, so sorry for this blast, and thank you. 944 00:45:54,670 --> 00:45:57,837 (audience applauding)