All right. Our next speaker is not a newcomer to DEF CON. Sounds like this is his third time here. Give him a hands up.
When we were talking, it sounds like we're going to hear some fun stories about OPSEC. We all love that, huh?
All right. So big round of applause again for Tomar Barr.
Hi, everybody. Who came here to have some fun? Yeah. So I'm going to give up this one. Okay. For the one that will shout the loudest during the presentation, I will give you the sign when to shout.
I will give you a sign. Okay. So let's begin. Okay. My name is Tomar Barr. I am currently leading SafeBridge Labs as the director of security research.
And my main focus is on vulnerability research and nation state APT research. This is my third time in a row at DEF CON. So I'm so excited to be here.
Thank you.
Okay. So I will start by describing the research assumptions and approach. And then I will describe the operation security of first APT threat actor and continue with several examples.
So I will start by describing the research assumptions and approach. And then I will describe the operation security of first APT threat actor.
So I will start by describing the research assumptions and approach. And then I will describe the operation security of first APT threat actor and continue with several examples.
So stay tuned. The research state of mind is focused on understanding the adversary, both the nation state and the cyber criminal, that launch attacks on the western world.
If we can win this mind game, we can understand their plans, motives, tactics, and techniques.
So every research starts with assembly.
So let's describe them.
The first assumption is that advanced threat actors is not necessarily the same as strong operation security.
And you will see unbelievable mistake later on.
The second assumption is that some threat actors are lazy and feel comfortable even after a research report was published about their specific activities.
So they continue as usual.
And last it will be about security.
The third assumption is that advanced threat actors are not necessarily the same as strong operation security.
And this is also a very good idea to study them in the backyards.
So in order to understand their plans, their targets, to do a damage control and so on.
And so on.
And I develop this OOPSEC Meter.
You can see it.
And for comparing different threat actors operation security mistakes.
And the grade is from zero bad points.
It's the best.
To the 100 bad points.
10 categories each category can give 10 maximum points and the categories merge
measure how much data we can gather on victims attribute the attackers identity
and how much we can influence their campaign to do a take out take down
temporary take down or disinformation attack and so on so in the next hour I
will present those APTs so whenever you see this symbol of the hour meter just
shout your grade from 0 to 100 and at the end you can get a flag. Okay. So our first
threat actor is located in the Gaza strip it has been active since 2012 so they have a
decade of malicious activity attacking both Windows and Android targets. In 2017 it was
first discovered the threat actor has self developed a web browser and it has been
activated by using the Group rooms deep inside a web panel with assure
auto authentication the problem was navigating directly to the inner pages
resulted in full access to the system with no authentication required so yeah it from
the right you can see the exits traded 신 he loves the victims so it for privacy. Quantum
to 22 the threat actor is still active and masquerading as Google Apps.idad but can also be
up. And the malware was uploaded from Gaza by one of the victims or by the attacker themselves for
testing purposes and the certificate was also signed in Gaza. The malware has plenty of
collection capabilities like SMS, call logs, contacts, record audio and much more. And the
exfiltration is done via HTTP post request. And the malware exfiltrated data to this URL via
post. So the Laravel code, the back-end code of the C2 server expects a post request. But when
sending a get request instead, an error invokes and exposes the MySQL DB credentials. So it's
unbelievable, right? It's crazy. I just, you should see me when I saw that. It was crazy. And
all C2 servers are vulnerable. Here are the credentials of the Windows based victim database.
They're free to use. They're free to use. They're free to use. They're free to use. They're
free to use. They're free to use. They're free to use. They're free to use. They're free to use.
The former one was the Android victim database. So on 2017, the first stage malware code
downloaded the second step malware and the name was ddd.zip from the C2 server, pal4u.net.
And the name of the folder was five times the letter Z. On 2022, a subdomain of the same
domain was used. App.pal4u.net. And this time the CCC directory also used the same domain. And the
name of the folder was 5x. And the name was xfiltrated. I will show a demo in few moments
how to download all of the victim's data. I was able to map almost 8,000 victims. Most of them in
the Gaza strip but others in other Middle Eastern countries. So the amount of xfiltrated data is
huge. Almost 500 compressed megabytes is the average xfiltrated data for a day. And our estimation is
that the total size of the data is between at least two terabytes to three terabytes.
Another mistake which we see is very common among all tractors is open C2 servers. So as we can see
the C2 server was updated at February 2022. Let's check if this is a one-time mistake and of course
not. The C2 server is opened here and include a 12 megabyte file in the name of the domain name of
the C2 server called Tawaji or something like this dot zip file which include the full back-end
logic because if you try to download the back-end code from just by surfing you cannot do it
because it's a PHP or SPX or something like this. It's not downloadable. But when they leave a
compressed folder of all of the stuff, all of the content in the website I can download it. So I
get the C2 server and I can download the C2 server and I can download the C2 server and I can
download the source code of the C2 server. Thank you, thank you. So the upload file logic is
done well using a unique ID to randomize the uploaded file name and make it difficult for
hackers to find a potential web shell they uploaded because you cannot predict the file name.
And the upload itself is limited to a specific file type by a white list which is good. So
the they upload. But on the other end, they know JS revealed the upload path of where the files
will be uploaded to which is bad practice eventually. So let's see a little demo. No
demo? Okay. So we can see that there is no demo. So let's get rid of the demo. Because we're
So, we will serve to the CCC directory.
You can see all of the files arranged by date, so it's very convenient.
We will download one of them, the smallest one.
It's like 150 megabytes.
And then there is a password, I brute force it, and it will extract all of the files.
I will sort it and see the, I will show you the file types that are included, like the,
it's like screen captures and images from the phone, from the Android phone, and also
a lot of voice recording during the, using the microphone of the Android device.
So you see a lot of files in just one day.
I have like one year of that stuff.
And I will just open one of them and see, I'll show you that it's working.
Just a second.
Is it moving on?
Okay.
Sorry.
Never mind.
Believe me, it's working.
It's demo.
Even if it's prerecorded, it's not working.
Okay.
So, that's your time to shout.
What do you think the score should be?
I give it 47.
I see you.
I see you.
You are leading.
You are leading.
Okay.
For now.
For now.
Okay.
So, as you can see, they failed, because, I don't know, I don't know.
I was able to build a victim heat map, understand the attack vector, access the C2 backend code,
and so on.
Okay.
So, different threat actors will do different mistakes, so we can compare them using the
OOPSEC meter.
Okay.
Moving on to a different threat actor.
This time, it will be, I will focus on a threat actor cyber crime activity in Iran, and I
will describe the five steps of the infection chain, one by one.
And the OOPSEC mistake they have made.
But generally speaking, they are up to stealing credit cards.
It's a large-scale cyber crime.
And let's describe it.
So on the left is a partial list of the C2 server that were alive at the time of the
check.
It was the middle of January this year.
And one of them stored the entire code on the pay.zip file at the C2 server.
So the same mistake like we saw earlier.
So I downloaded the zip file.
And the victims are found in different second-hand online market sites.
One of the sites is called divar.ir.
And the left script extracts phone numbers from published ads on divar.
So if you want to sell something, I don't know, your car or something like this, you
just publish an ad with your phone number, and they have an API to extract all of the
phone numbers of victims in Iran.
The script on the right will send them a threat phishing text.
Okay.
This is funny.
The full victim list is textual and downloadable.
Phone numbers are available in the users.lst file, which is downloadable.
But even more funny, the C2 server internal files are exposed.
Even the bash history command output is available to download.
So I don't believe it.
I found plenty of smishing lures.
Threat of arrest in 72 hours, and in Iran it's scary, COVID-19 payments, and even dating
site.
When the victim tried to chat, he will be threatened to pay, or his details will be
sent to the government.
And he is redirected to a payment site.
And the sites are all opened here.
So the payment allegedly can only be done via an Android app.
You can see it on the bottom left.
It's done automatically.
And it's a dual attack.
So they spy on the SMS to get the two-factor authentication codes, and also redirect the
payment on the attacker's fake site to phish his victim credit card.
So the malware, the Android malware, just exfiltrates all the SMS messages.
And decompiling the Android malware, we can see that the resource files, all the phishing
URL, back there.
And here's the PHP page.
Uploads the victim SMS, this is the backend code, to the C2 server using hard-coded text
file name.
This is not a good practice.
And the exfiltrated SMS are also textual, predictable, and downloadable.
So it's very convenient.
And the file name here is LydiaTeam.txt.
Please remember the Lydia, we'll come to it later.
And we can also see, it's hard to see, I know, the incoming SMS messages.
And in this case, they tried 16 different phishing loom messages in order to infect
this specific victim.
So it's crazy.
And this is a fake payment site masquerading as a legit government pay site.
So at the top, you can see the IP address, even though it doesn't have the domain name
for the C2 server.
But below that, it's the URL of a real payment site in Iran.
So the victim is allegedly redirected.
Directed to a legit government site.
But it's a fake page, and the credit card is stolen.
This is the backend code for stealing the credit card.
The details are collected and sent to the attacker telegram group.
And the subject of each exfiltration is new card received, and I don't know if you can
see it, but there is a typo there, and it will help us later.
User credentials are exfiltrated as well.
And querying the telegram group, this is where it becomes interesting, using the telegram
bot API, includes a valid invite.
So you can see it marked in blue.
And just copy-paste it, and I'm a new member of their private groups.
Yeah.
It was very interesting.
In this case, thank you.
In this case, the victim SMS data and credit card.
Are split into three groups.
And I. And they have all the data there.
The data telegram group is misconfigured to display all group members and hackers.
Without even joining the group.
So.
Thank you.
The SMS and data group are not private.
All members are administrators.
Everybody is welcome to join.
But we.
Without access.
to the messages themselves, so it's a problem.
I joined with my real name, Tomer Bar, to all groups
and stayed there for a while.
But there was no access to the messages by new members.
You can see my name here at the top.
I use my real name, my real Telegram account.
And all of the other Iranian hackers, right?
So I didn't have access to the messages.
But the card group is not private,
and all data is accessible using the Telegram bot API
called Get Updates.
I will use it a lot during this research.
And then I found the group they called So Good.
And indeed, they know what they are doing, it's so good.
It's like the main group.
And pay attention to the user, Baba Zoro.
Username is one of the threat actors.
We will focus on it later on.
And So Good allows access to all messages
without being required to join.
So hundreds of credit card, I was able to join,
but I didn't need to.
Hundreds of credit card details are listed.
And on the left, we can see that one of the site
was detected by Chrome to be a malicious site,
and they exchanged messages between themselves.
Let's do that, let's do that.
And on the right, you can see shared malware files,
and even attackers.
And attackers voice messages between themselves.
I don't know Farsi language, but it's interesting.
And a deeper analysis, you can see it's amazing,
revealed massive activity, hundreds of malware samples,
and hundreds and thousands of C2 servers infrastructure.
So it's kind of a big infrastructure,
so I was curious.
And believe me, this is just the tip of the iceberg.
Let's continue.
A simple Google search reveals that Lydia
Kim, the name of the file that we mentioned before,
is a user who is active in the Professor Phishing Telegram
Group.
So he has an academic degree, which includes 15,000 members.
Searching for new card received in Google
with the intentional typo seen before,
returned with a second group, Zalem Phishing.
And the result includes stolen credit card.
So in Google, in Google, you can get the stolen credit card.
Yeah?
And Baba Zoro is our own so-good team member,
is the owner of Zalem Phishing Telegram Group,
with 30,000 members.
So he's a big shot there.
And I found many Iranian phishing group.
Some of them has a few members, and those
was the most interesting group.
But up to 80,000 members for just one group.
And the large group are usually used for exchanging or selling
phishing kits.
Or . . .
And I was able to join all of this group, and much more,
like 20 groups.
And I had like 100%.
But there was just one group called the ,
which requires approval by admin.
So I said, what the heck?
I sent him a joint request with my real name.
I am Israeli, and got an approval.
So I have 100%.
OK.
So let's go.
Let's go technical.
Decompiling the malware.
Focus on the Lydia TXT class.
It's the Android malware with the name of Lydia.
And the exfiltrated SMS data are messages, sorry,
were uploaded to the C2 server.
And the randomization of the name
was done on the malware side.
So no victim-unique data was used.
So if the malware upload a file named victim.txt,
it will be victim.txt on the C2 server.
And the file name was a number.
With five digits.
So very hard to guess.
And I developed a brute force tool
to download all the exfiltrated files.
The Android C2 server is based on a Firebase API,
and also Telegram-based API, developed in Python.
And one of the attacker is, let's do attribution.
We know it's Iranian, but who is it?
One of them is called Amir Ranjabar.
And he's testing his own malware,
on his own machine.
So never do it.
Never do it.
And one of the SMS is from an Austin provider,
confirming his newly registered domain, which is the C2 server.
And it's called sanairan.xyz.
So now we know it's Docker, right?
Maybe he's in charge on the C2 servers, infrastructure,
or maintenance.
I don't know.
But we have his name.
But that's not it.
I have his SMSes.
He runs it on his Android device.
So I have his account number, International Bank of Iran,
and his phone number.
I have two phones.
One ends with 85, if you can see it, and the full address
at home, if you want to visit him.
And the attacker also offers hacking services in this site,
like professional hackers, and using the same phone number.
So we have a cross that it's a real phone number.
It appears that Lidia team is selling and promoting
their phishing and Android malware services
with three possible plans.
So you can choose from a basic plan to a full phishing
as a service plan.
And they offer dozens of phishing kits for customers.
Let's say customers, for example,
Instagram account phishing.
But you can see a list of all the sites that they duplicate
and are used as phishing rules.
And they use a pyramid.
A pyramid structure.
The bot is given for use in return for 20%
of the collected credit card.
So I googled it, Google Translate,
and this is the translation to English.
And the SMS file, I gave it a 65.
What do you think?
75!
Save it.
Whoa, this one, this one.
Yeah, second.
OK.
OK, let's continue.
So I asked myself if this Telegram bot API is commonly
used by other threat actors.
And the answer is totally positive.
Right?
So a simple pivoting on the API.telegram.org,
the official site, using VirusTotalGraph,
provide me with a positive answer.
We have found actually two types.
Executable with hard-coded Telegram bot API token.
So I have a lot of tokens and chat IDs,
and also C2 backend code kits that were uploaded to VirusTotal
by I don't know who.
But it's there.
So it's easy to find them.
And the second type is more, I found it more interesting.
And I developed an automated script to download all chat
and check if they are still active.
Because it can be uploaded like six months ago or something
like this.
And I got a lot, a lot of active groups.
And I have their tokens.
So I can control some of their activity.
And the first interesting case, this is a new threat actor.
It's called, they call themselves Ukraine Logs.
So think about the former attack.
And this group used malware to steal cryptocurrency
from victim machines.
And it's a very large scale operation.
And we'll see it in a minute.
And they used dozens of malwares and loaders.
But one of them, one of the interesting one,
was the Bitcoin.
It was a loader that download and execute
Mars Stealer, which is a fort of Vidar Stealer, if you know it.
And Mars Stealer actually steals two-factor authentication
and cryptocurrency.
And the code is packed with unknown packer.
And the main function was actually so complex,
and it was even too big to even been displayed in IDOGRAPH.
So it was a very sophisticated packer.
But I just try it on, and it locating the correct address.
And I think it's a very, very nice packer.
It's one of the few methods in which to place the breakpoint
was quite easy.
It's like old school.
And after that, I have the unpacked version.
So I started to analyze it and found
that this info steerer is interesting because of two checks
that is doing anti-detection checks.
First, it uses anti-emulation against Windows Defender.
I didn't know that at that time.
but Windows Defender, and they knew, Windows Defender is using a fixed computer name used by
the emulator. So if they just check what is the computer name, if it's equal to HAL90H,
they know that they are in an emulator. So that's a good practice. But the second one is exit if
it's being run from Russia and nearby countries. So we have a little bit of attribution here,
but trust me, we'll get much more info later. And so they just check their language and decide if
it's Russian or not. And the third one was the expiration check. So it was limited to one month
from compile time. And if you try to run it as a researcher after this month, it won't do
anything. And it's packed, so it can be difficult for some. And the attack is still ongoing.
This is a tool to deobstocate strings that I wrote, and the sample is not public, and the C2 server
was not known until now, but I will publish all the details today. I also found the Telegram group
API key used by this group to exfiltrate screen captures. The loader also downloads and executes
the final GoLang info stealer from a legit site. And the GoLang malware is a cookie stealer. It's
very complex. It steals OAuth or tokens. And it's very complex. It's very complex. It's very complex.
In fact, a lot of victims in large scale, mostly via YouTube links. So I will give some example,
but let's first discuss the GoLang malware. So I don't know how much of you tried to reverse
engineer GoLang malwares, but it's a nightmare. And there are some tools, and Jags at Recon
presented one that is better than what I used here because it was before. But we can
see that I used the IDA script. And when running it I had 83 hundred unrecognized functions.
And after running it, the rename function button, the script was able to detect 2,000 of them.
So it was very helpful, but still complex. And as I said, the infectious vector is through
publishing YouTube links to an encrypted executable. And as we can see, there were 20,000
results on the right. Only for the 0909 password encrypted malware instance. So there was no
were different instances and only for that instance there are 20,000 different YouTube
links and this detector also is smart and it's published the link on a crypto app related
site so it's logical because they want to steal cryptocurrency and wallets so people
that are interested in crypto movies so probably they will have a better chance to have wallets
on their computers. And also on video sharing platforms so if you are using it be careful. And
back to the info stealer loader code this is very interesting I think. I used the Telegram API
different one get chat and got an invite link. I was able to join the attacker Telegram group and
become the tenth member for months and I was able to download all past messages even before I
joined and get in real time all messages from me. So I was able to download all messages from
now on. So I'm like in between. And on the left you can see the configuration of the malware. We
can see that it was configured to collect it's hard to see but it was configured to collect screen
captures and victims environmental data such as OS, IP and hardware ID. In the middle and on the
right you can see the exfiltrated victim screenshot and exfiltrated environmental data from
the attacker Telegram group. So we have a match and using a simple tool we can see the
data and also the data that was used to download all victim screen captures and I have 35,000
script captures of different victims. So it's like open for almost everyone. We can see some
example of the stolen data which include both cryptocurrency and you can see also NFT theft they
like NFT a lot. And hundreds of wallets were exfiltrated and top balances can reach thousands
of US dollars and the attacker also exfiltrated the 12 wallets that were exfiltrated. So
basically the attacker can control the password of wallets like Metamask and the password. So
from at that point the attacker can control the victim's wallet. 27% of the victims are located in
the US. The exfiltrated cookies are for wide range of services like beginning with PayPal,
Amazon, games, bank, cryptocurrency wallets, Google Pay and stake.com which runs crypto betting
platform. So let's speak about attribution. So the first thing we're going to talk about is the
first indication of the attacker origin is that all C2 server were located in Russia. So it's not
surprising right? Uh in addition the spoken language of the attackers is Russian and they tried to
hide it by replacing it with English after a while but I have all the messages so I know they
are Russian. And I was able to discover the attacker's IP located in Russia. The exact
attack IP and the first 8,000 of the exfiltrated data messages originally were located in Russia.
It was eliminated from the same IP in Russia which was used by the attackers for testing purposes.
Again, don't do it. And later as a C2 server. On the bottom we can see that this red, this is a red
line info stealer that connects to the same IP address of the 8,000 messages and it's also using
the red line stealer bot id onyx 0.1. So I used another telegram bot API function to see if I could
it's called get chat administrator and we found that the group has six administrators so nine
hackers, myself, but six of them are administrator and one of them is onyx zero. So onyx zero,
onyx zero point one and the second is called P2 memory. And then I found that onyx is a creator
of threads for selling stolen tokens and the second admin is P2 memory and they are chatting
with each other and I don't know their real identity but they are real people. So let's speak
about a little bit about takedown. The bot is administrator and I could create, edit or revoke
the invite link so nobody can join and I can also temporarily take it down by blocking all
members. Or I can even set a web hook to automatically transfer all messages to
safebridge.com which you can see was done successfully. I'm going to show you how to do this.
So all of the victim messages, I didn't try to catch them, just stop them from reaching the real
C2 and they temporarily lost all victims and but probably they could easily recover from this
attack. So I gave them the same score, you know, don't need to shout anymore. We have a winner.
Woo! So I gave them the same score, you know, don't need to shout anymore. We have a winner.
So I gave them the same score, you know, don't need to shout anymore. We have a winner.
But with different mistakes. Okay this one is very very interesting because I'm monitoring them
for almost a year now. It's still going on. And those are Turkish threat actors. They call
themselves or something like this. In English it means the bread boat. And they're
referring to all the stolen cryptos which are being stolen from their system. They know that they're
Cryptocurrency NFC is bread bring me bread and so on so the bread boat
And they still cryptocurrency with a different approach from the ukulele
You can log try to infect a machine and steal the cryptocurrency wallets. They are using zero infections
Techniques, so let's describe them
So the PHP code redirects the exfiltrated data from the city web server to a telegram group
in addition the PHP code save it to a local C2 server file named file a test dot txt and
the victims clicks on the connect wallet button as you can see on the
Top left and enter the metamask passphrase this time and this is a phishing page
Which writes the passphrase to the test dot txt local file?
Okay, the attackers would
Working very hard to promote the phishing loose
So they are paying Google
For advertising their phishing sites and the C2 server is the third result in my google search above
So they're doing good work and they also target victims using telegram and other social networks via Twitter ads
For example as we can see on the right
The ads include a link to their metamask phishing site
So by now you know the drill I joined via the invite link and download all messages
But after a short while they sent me a message in Turkish, which I don't understand and I was immediately kicked out
So I thought is this the end and then I figure out that they kick out Tomer bar
My user but they don't kick out their bot
So I just bought a script to automatically download updates using get updates API and was able to monitor all
The messages in the group until now for almost a year
And descriptor
also to uh translate the messages, the script that I wrote, translate the messages from
Turkish to English so I it's it will be easier for me and the bot API is probably revealing
here the attacker's running wallet address and passphrase so I can control their uh the
wallet and on the bottom they are sharing additional wallet addresses. The main uh C2
server include more than 400 phishing domain names uh added daily and from October 2021 and
it's still active every day. Every day there are new domains. And the second phishing server
uh which is still active also is implemented crypto scram with different techniques uh the
the dumbest uh method is like promise to uh provide profit if you just send them your crypto.
Uh so don't don't do it. Uh and the other C2 servers exfiltrate the passphrase to local files
or to Google Forms. Uh I I I don't know what to say. Uh I don't know what to say. Uh I don't
know what to say. I'm I understand their attack in in details and the attacker's plans uh
the entire attack in details. They stole 30,000 uh dollar in in just two hours and then the
boss set a target of 100,000 dollar for this day. And on the bottom we can see that they
share the admin credentials to manage all the different C2 servers. But it's not legal to use
it. Uh so but and it's not required because they did a lot of obstacles uh mistakes and all
the track actor C2 servers uh removed their passphrase. Uh so I I don't know what to say. Uh
so uh this is just an example. But believe me. And uh this is another example of a
unconfigured Laravel backend uh like we saw earlier. And exposing the DB credentials and
up key uh when the expected parameter is not provided. So they expected uh a special
parameter. I didn't provide them that. And they just print the uh the password. Uh the same
exposed data is accessible by a second method by browsing to the dot ENV file which is textual and
includes the same credentials. The trade actor invested a lot of effort in phishing NFT and the
attacker is bragging in telegram that he has stolen 25 Ethereum at that time it was worth
$75,000 using phishing rules on the famous NFT sites. As we can see the C2 server is opened here
and the main J script includes the trade actor wallet address. They're using stolen credit cards
in order to pay for the C2 server and they also purchased stolen Redline Stealer credentials.
They're also using different services in order to turn the stolen cryptocurrency into cash
including virtual credit card and laundry sites you can see the address here. We can see the
attacker's wallet address and withdrawal operations so I'm monitoring all of their
activities. And they steal money directly to for directly from victims sorry bank account
in order to pay for Google hats to promote their phishing website like we saw earlier. Here is
another example of their active phishing activity which is done a bit differently using additional
telegram groups. They also built a pyramid scheme to recruit members. Each member is
allegedly participating in mining cryptocurrency based on the drone protocol but actually is
NFTs and cryptocurrency stolen. As we can see the print screen here demonstrate how the trade
actor used public credit cards. This is an example of an active phishing activity which is done
in order to take over websites, legit websites and they also upload web shares to different
vulnerable sites. It was like a huge campaign. And the attacker shared the entire C2 server code
using the telegram group that I am in and I got all the databases so the info table stores the
victim private keys and we can see that the simple Google search is for what the admin hash reveals
that it's the password one two three four five six so amazing. The login leads to a
Chester finished admin panel which is query the local collected victim wallets DB. Uh the above
cloud drive includes three hundred gigabytes of victim exfiltrated data. It's not live anymore
but I have all of it and I will give it to the proper relevant uh uh agencies to look uh look at
couple of it and then um report back to the victims. Uh let's speak about attribution,
believe me it will be funny. The entire conversation is uh Intergram is Turkish so we
know for sure they are Turkish. Uh we can see that the attackers are not using VPNs to manage
their C2 server and because they exchanged all of the C2 server code uh so I have it so the
C2 the cPanel last login file includes the IP address from Turkey so that's their real
real address but on 25 of June after more than 8 months of monitoring uh one of them published
a competition at uh r10.net it's a public site forum uh for the for the logo for their new
site player.com which is uh just a phishing uh site and the user name in the r10 forum uh is
called Murat. Murat can attack and this led me to a bingo because I found a Twitter account
with his photos and his IP address and I found a picture of him and I found a picture of him and
I found a picture of him and he tagged it as uh blockchain account and few days later he also
got a message from his garage to collect his car with his real name uh and license plate
number and so you can see that uh it's uh it's his real name and on the right uh wha- when
you uh on a Chrome you can uh sign in with your account and you have the pictures of the your
account right. So if you can see on the right it's the the the the picture of the other attacker.
I have it from the print screen that they share between themselves. So these two members
joined the Telegram group for a short while and they are four members. One of them is a member
of the two forms and also of registered domains and sometimes you get to know your
adversaries more than you ever expected. So that's it. That's it. So this is his Telegram
account. And I will skip and I will speak a little bit about a Tunisian threat actor which got
the worst grade, 78 bad points. I will skip it because we have only five minutes. I have more
interesting stuff later. So they did the same mistake, opened the, compressed the files. But
what was very terrible is that I got all of his victim data. They have 12,000 victims. But
he registered the Telegram group with his real name. So I have his real name, not a nickname,
and I was able to find his LinkedIn account. He's working as a security consultant by day in a
legit company and by night he's doing attacks against victims. And I also found his Google
certificates both on sending it on the Telegram attackers group and it's the same certificate on
his digital account.
Public LinkedIn account. So on the bottom you can see the tab with his real name of his Facebook
account. So I have a lot of crossing and it's a verified data. So I will skip two different
Iranian nation state threat actors. They did Apple bypass, two-factor authentication bypass for
iCloud. It's a new technique. I got all of the source code because of their operation security
mistake. And I will share all the slides. So that's it. Thank you.
And I will share all the slides and all of the details on the site and also on other platforms.
But I don't have enough time to speak about it. I want to speak four minutes about this threat
actor. This actually is a good, I don't know if it's a good, but it's the best operation security
threat actor that I have ever seen. And it's an Iranian nation state threat actor. It is the most
persistent ones that I know of. It's been acting, it's been active since 2007. So 15 years of
of operation. That's a lot. And I am monitoring, I first discovered it in 2015 and wrote a lot of
reports on it and also did a take down on 2015 and they lost all of their very targeted victims.
They were opposition to the Islamic regime and they were very targeted for seven years. And
in 2017, they learned from their mistakes and they got with a very secure infrastructure. So
they used two mechanisms. One is very common, the DGA, which is a domain generation algorithm.
Each week, 100 different domain names were used as a C2 server. So is much
difficult from the 2015 version, where there were just like three out coded
domain names. But most interesting is the second mechanism, which is they use C2 signature
verification in order to verify that they are speaking with the real C2 server. Because I
reverse engineered the DGA code, understand what will be the next domain name, purchase those
domain names before them, and all the victims connected to my site. But I have only their IPs
because when they download the signature files, which is encrypted with a private key, which I
don't have, only the attackers have, they can verify that this is not a legit site and just move
on to the next server, which will be verified. So this means that it's very hard to take them
down. And from 2017 until 2022, you can see that there were some reports that were not
using C2. There are certain reports about this group, but no one is able to do anything to arm
their operation. And I worked for it for about three years. It was like a life mission. And
recently I found the weakest link in the infi chain, the transmission of files from the C2
server in Europe to their attackers in Iran. So to make things short, I developed a script that
connects C2 server and C2 server and C2 server. And, if you know a thing or materials, you can use it.
downloads all of the victims data and I also found that they encrypt it in
asymmetric key so I cannot open it because I don't have the right key but
some of the some of it was not encrypted and I have some metadata that I was able
to the off-succate and I have the user name the host name of the victim the path
to the store on the C2 server the toner version which is toner is the second
step tool it's very sophisticated tool which allow them to monitor and
surveillance all of the victims data and toner in French open pronunciated right
is thunder and the first tool is called lightning so just one minute and so the
lightning the Thunder's come after the lightning so I'll just finish with a
demo it will be 20 seconds and I will see you okay so you can see that I'm
okay so you can see that I'm
okay so you can see that I'm downloading I get a list of all the files in the C2
server in real time with their sizes and the URL to download them and then I will
run the same script with the all parameter and it will start downloading
it's a little bit small but believe me it will download all of the files I will
skip because it will be short so I have a directory which sorted by all the
victims IPs and we can see all the infiltration data okay I'm finished so
sorry for
this blast and thank you