start	end	text
0	6840	All right, so we are going to be starting with our next speakers, Mauro and Juan.
6840	12500	So they will be talking about Riding With The Columus, our 100 days quest to identify a North
12500	17740	Korean state-sponsored threat actor. Now I'll let them take over the stage.
19920	30840	Thanks. We are not so good, come on. Okay, welcome to our talk, Riding With The Columus,
30840	34900	our 100 day quest to identify a North Korean state-sponsored threat actor.
34900	38020	My name is Mauro Eldridge and my partner today is Juan Brotherson.
38360	43980	This talk is divided into three sections. The first, we will have a really brief introduction
43980	49700	about this talk and about ourselves, and about this mysterious war, Colima. Then we will jump
49700	57980	into the technical analysis of this talk, which is called 100 Days In The Labyrinth, which starts
58700	63640	telling... we will get in a minute to the details. And then a wrap-up section called Riding With
63640	69560	The Columus. I know that the titles are a little bit catchy, but believe me, it's worth it.
70580	74860	Let's start with a short intro. My name is Mauro Eldridge, I'm an Argentine hacker,
74860	79520	I'm the founder of Vermican Cyber Arms and DC5411, which is the Defcon group for Argentina
79520	84540	and Uruguay. This is my 10th time at Defcon, and I think it's my fifth time here at the Recon
84540	88520	Village, so I'm very happy to be here today. And my partner is Juan Brotherson,
88520	92940	he's going to introduce himself. Hi, well, I'm not a hacker, I'm a journalist.
94240	99700	This is my laptop, and they were installing something here. I'm kind of frightened,
99700	104340	but they are giving me a good headline. That is, I came to Defcon, I make a coverage,
104340	110780	I give a talk, and I got infected. So that's quite nice, right? So yes, Mauro is going to talk about
110780	117380	the technical side of this malware he found, but I write in a newspaper in Argentina that is
117380	125040	quite big, a media outlet. And of course, because this is my first Defcon, I watch a documentary
125040	132860	that you all know, and there's a quote that sticks in my head that says, from the organizers,
132860	138900	in the 101 talk, remember, the media is not your friend. And I kind of get it, because we don't
138900	146740	have a good reputation, I know that. But my part of the talk is, like, try to explain or show how
146740	153640	we told this story in a newspaper, because all of you know the technical words of these
154260	160580	kind of things, but trying to reverse engineer this idea that we are not your friend,
160580	166140	using your terminology, is what we will try to do together, right?
167280	179580	Thanks. So, this concludes the introduction. We will jump into the two chapters. The first one, I will tell a short story on how a client got infected with something quite weird,
180280	185620	and I found it to be a sample of malware we watched, really unusual, really homemade.
185840	191140	And I still keep to my words today, I still think that it was homemade, it wasn't really something complex.
191140	198240	And it was surprisingly simple and avoided all antivirus detections, all, any vendor you name it,
198240	205160	it bypassed it. It was only detected by the heuristics, so by its behavioral analysis,
205160	211100	and I started conducting some CTI, a no-sint, on the extracted indicators, and things started to
211100	221120	take, like, a little bit twisted turn, something that I wasn't expecting. It was like the real,
221800	227600	Then, when I started to suspect that this was something a little bit bigger, I had to request
227600	234560	certain answers, but nobody, especially companies, corporations, they do not answer, they do not reply
234560	242160	to threat analysts, but they will reply to the journalism. That's when I say, okay, I need a
242160	247580	journalist friend here. That's why we are important, guys. You see, media can be your friend, or an asset,
247580	257820	depending on... So, it took us almost a hundred days. Actually, the title is a hundred days, but it was
257820	262960	two hundred, almost. And we decided to team up with Juan. I started asking the questions around,
262960	268740	people had to give explanations, people had to share intel, and mostly, I knew that we heard
268740	272960	some prides here, but companies had to say, we don't have intel, we don't know, we don't have
272960	277440	anything to say about it, and it's a little bit hard for them to recognize that part, and that
278280	283840	that's one of the best parts of the journalism edition here. We have some new leads at hand
283840	289760	on this chapter, and we make a really strange wrap-up, with a wonderful surprise at the end,
289760	295800	that I hope you enjoy. So, before we start, I want to make clear what's a Colima. I know that
295800	300480	some of you already know, especially those who are from the CrowdStrike team, and some other
300480	307300	doesn't. Let's say in simple words, a Colima or Calima, it's a Pegasus from the Eastern
307300	314100	Asian culture. But, on the CrowdStrike terminology, it refers to state-sponsored actors.
314100	319500	For those who are not familiar, state-sponsored actors are threat actors that commit malicious
319500	325180	and organized activities, backed by their own state. This means basically two things.
325180	331620	The state guarantees you eternal funding, a lot of funding, a lot of money, and you're also
331620	336600	immune. You have a state-provided legal immunity, because the state itself is asking you to commit
336600	341940	crime. So, obviously, this will lead to reckless operations, like the ones that you can see listed
341940	349820	here. So, these reckless operations obviously do not have consequences for them, except that
349820	355940	being reckless sometimes has certain setbacks, like a well-placed threat analyst and a well-timed
355940	360460	journalist that just want to start asking questions around disturbing people.
361040	365280	And so, we started with this. This is the first chapter, and it started in the things from the
365280	373480	start. On February 7th, the malware was deployed and was actually managed to be downloaded and
373480	380720	executed on one of my client's equipment. It was bundled inside a fake QR generator project
380720	390100	written in Java. Actually, the project did work, did generate QR codes, but there was one of the
390100	395660	libraries that was an implant, a Java file that was a standalone implant that started
396440	401700	generating malicious activity. At the time, we only had the behavioral analysis. We didn't have
402400	407300	a name. We didn't have a family. We didn't say, this is Joker Spy. This is Raccoon. We didn't
407300	414320	know what it was. So, luckily, CrowdStrike... we are not affiliated with CrowdStrike, so it's a
414320	422200	good time to say it. CrowdStrike managed to stop it and to network contain the host. So, the host
422200	430140	will not be able to communicate without passing first to CrowdStrike. So, we were able to stop it
430140	436840	in the middle while it was happening. And the artifact had, obviously, as most artifacts, a
436840	442680	self-delete routine, a self-clean routine. But it wasn't able to execute because we blocked it
442680	450060	with Falcon, its ability to delete files. So, we were able to cease the artifact for us. We started
450060	456520	monitoring its behavior. We saw that nothing that we extracted at first sight was being used in
456520	464220	another malware family. And we started extracting the IOCs. So far, this is the first thing that I
464220	470060	wrote on my report. And I keep to my words today to be transparent and intellectually honest. I
470060	476340	wrote that it was really simple and, for me, it was homemade. It was a simple RAT that attempted
476340	482240	to open a reverse shell where the threat actor will manually connect. Nothing is automated here.
482240	488400	It opens the shell. Somebody connects in and starts popping commands at hand. At the time of
488400	493860	writing, there were no mentions. Nobody knew anything about this. So, I named it qrlog because
493860	499700	that was the name the dropper file used, qrlog.java. This is the very first report. I didn't have
499700	507200	anything better to say about it. And to be honest, it was really simple, surprisingly simple. And I
507200	514980	thought it was like a test, like some script kid was trying to do some big heist. But it was
515520	522260	strange to be successful with such a simple malware. qrlog hides in super plain sight.
522260	526740	The input itself only contains a variable which says quite some data. Nothing else.
526740	534160	Written in base64. And its final objective, as you can see on the second picture, is executing
534720	540480	a reverse shell. From that point onwards, everything is manual. Nothing is automated.
541420	548420	Now, the only company that detected the sample was a Vietnamese threat intelligence company
548940	553780	and did not detect the malware itself. It detected the link, the Google Drive link where it was
553780	560060	stored. But nothing else. It doesn't say this file is malicious. It just says something in the zip
560060	567260	file is fishy. So this was the only lead we had. All the other vendors, let me go back a second,
567260	571640	one over 90. All the other vendors said, no, this is fine, just run it.
572500	579680	Now, if you analyze the code, and we will later share all this analysis on GitHub,
579680	582760	you will see that some things are pretty basic, like how it tries to
583680	589920	find the running operating system. It also has different routines to write on different hosts.
590360	597700	The file system varies between Unix and Windows. And then it tries to create a random function
597700	603520	where it also imports two other random libraries, random generators. So this led us to believe that
603520	610660	it was either a copy-pasting or some GPT was involved in the middle. And finally, the C2 server
610660	615340	is published like in Play View. It doesn't use an array of IPs, an array of different
615340	619260	hosts to be bouncing around. It just has a URL.
619980	627200	And these novice errors led to an interesting object file, which I will share in the end.
628500	633980	But here's the point. To be honest, I'm from the Ruby side. I do not write Java code,
633980	639420	so I'm not in the position to judge anyone's code, even from a student. That's when I
640800	644220	resorted to my friend, a journalist, to ask and to find a Java expert.
644220	648280	So here we had the idea to talk to a programmer and give the code.
648720	654740	This is something that gave us a quote that is interesting. Remember, I have to translate
654740	661420	everything to a newspaper audience, right? So this idea that Maxi Feldman is a programmer and author
661420	668840	of many books in programming, and he knows Java very well. So he told us that the malware isn't
668840	674920	so hidden, like in a scale from 1 to 10 is like a 3, he was guessing. And this idea of it's like
674920	682300	if someone had made a script to hug their girlfriend was a very nice picture to explain
682300	688560	the situation. Because in our daily basis, when we talk with Mauro and send jokes and memes and
688560	697140	that kind of thing, he was telling me about this story. And that's the point when I started to
697140	702040	guess, well, this is newsworthy. We can translate it to a general audience to understand what is
702040	707560	happening here, right? So this was like the first step to start to check the information
707560	713900	that Mauro was producing and see if we could come up with a story, right?
714760	719400	A nice way to say that I don't know how to do a hello world in Java, but thanks.
720660	726500	So I was calling it a day. Put yourself in my shoes for a minute. You have a homemade
727300	733600	GIDI product artifact and you say, okay, I just upload it to see if somebody cares in the world.
733600	738340	So I opened OTX. For those who don't know, it's the Open Threat Exchange. It's my personal
738340	744120	favorite platform. And it shows some indicators calling it QR log. And if you can see, it's still
744120	748620	linked to my personal GitHub because I didn't thought that it was something big.
749200	755040	So two days later, I published the write-up, analyzing the code, and I made the intelligence
755040	762040	public through OTX, as I say. And up to this point, I called it a day. And for a long time,
762040	767100	almost two months, nothing else happened. Around the IOCs that we were extracting,
768020	774340	there was nothing really noticeable. There was nothing that actually caught my eye.
774680	780520	The domains using the SSL certificate used by Let's Encrypt, like a lot of others do,
780520	786060	we did this analysis, because it's historical, the host is no longer up, with grabber-app.io,
786060	792260	which I recommend you to try. And one of the... both the domains were burned at infra. So they
792260	798260	were really burned. They were used a lot of time. For example, pxalternet.org points to a vulture
798260	803660	IP, a vulture instance, which has a lot of associations with log-first exploitation,
803660	808980	with cobalt-type usage, with jokers-by-activity, among others. This is just to name some. There
808980	815440	were all sorts of... a total zoo of malware was running on that instance.
815880	823260	And then, the git-hub.me, which is the C2 server, properly said, is now parked,
823260	830820	it wasn't before, on park1, and all traffic is now hosted on Cloudflare. And don't let the names
830820	836420	of the nameservers mislead you. They are based on Brazilian cities, for those who don't know,
836420	842960	but the servers are in Europe, actually. But in the past, if you check previous pulses,
843960	850780	and if you run a query on any... from a ping or whatever, you will see that the host
851540	860360	was pointed to an Amazon AWS instance. And here's the thing. Lots of Intel platforms, like OTX,
860360	865200	if you see, it says, verdict whitelisted, whitelist automatically cloud instances.
865200	870820	This is a really bad practice. Really bad. And we will see why in a minute, from the very mouth
870820	876820	of the AWS chief information security officer. But I'll be there in a minute.
876880	883460	So, I published this, and this domain was actually used for, by more than 500 domains,
883460	889860	and more than 100 unit TLDs. And this indicator, two months later, when this was a dead topic for
889860	896120	me, I was, I don't know, breaking another thing, caught the eye of another researcher who called
896120	905040	me on docs. This researcher called Daniel pointed to me that this issue is part of a DPRK, Democratic
905040	912680	Public of... no, Democratic People's Republic of Korea, or North Korea, infra. He told me,
912680	918480	this IP is a C2 from them. And then, I needed to check this information, because nobody else
918480	924260	knew that information. Nobody else had that intel. And then, was when my friend, a journalist,
924260	930420	came again. This is just like a strike. I went to the AWS summit in Washington, that is, I don't
930420	938520	know if you're aware, but this summit that Amazon, well, AWS holds every year. And when Mauro told
938520	943200	me all of this, because I was covering for journalistic purposes, I told him, well, we
943200	949140	got to go through the CISO and ask about this situation. And I mean, it's... I'm sorry, where
949140	957580	was CrowdStrike? I thought it was AWS. Sorry. This one is the... I have to clear this up, that I have
957580	963920	this in a bar here. We are not affiliated with CrowdStrike, right? And drinking and that, I got
963920	972520	this t-shirt. But Falcon, which is this system that CrowdStrike uses, detected this malicious
972520	979640	activity and related to QR log. And this was the time when we could check that the sample that
979640	985520	Mauro detected was being analyzed by threat intelligence companies, right? And they connected
985520	991520	it with Labyrinth Colima, that the words that they use is height level or height confidence,
991520	996980	because you cannot attribute a hundred percent. But because of the adversary's tactics, techniques
996980	1002140	and procedures, they could connect this malware that Mauro detected with Labyrinth Colima. And
1002140	1007400	this was the piece of information that Mauro wasn't able to get from them. And this was like
1007400	1012300	the eureka moment, because he told me, oh, that's the name I put to the malware. So yes, we have
1012300	1017100	this story, right? Yeah, they were using my name and they didn't want to provide me the intel.
1018480	1023740	I should have sued for copyright. YouTube doesn't have this problem, you know.
1024640	1030400	Okay, let's get serious. So that's my conversation with Yutok's user, because here the mystery
1030400	1036600	remains untouched. And I was telling him, you actually left me frozen. I wasn't aware I was
1036600	1042740	playing with a DPRK sample. And you can see here the intel diagram from CrowdStrike, which attributes
1043380	1051340	both domains to Labyrinth Colima. Again, with high confidence. Now we were playing with a sample
1051340	1055760	from a state-sponsored actor. And what's the first thing a responsibility threat
1055760	1061100	analyst will do? We started playing with the C2, crafting messages to it, trying to interact with
1061100	1068120	it. And one thing led to another. I'm not the smartest person in the room. For journalistic,
1068120	1073660	merely journalistic purposes, we started messaging the C2 with crafted payloads, requesting them to
1073660	1078680	chat with us, to have an interview with us, and sharing our telegram alias. And obviously,
1078680	1087480	they were not really friendly about it. And during a couple of days,
1087480	1093020	Keen Boys were trying to brute force our SSH servers from the machine where we tried to
1093020	1098960	establish the connection. But unbeknownst to them, since we are always one step ahead
1098960	1104000	of the Keen Boys, that machine was disposable and was full of honeypots. So all they tried,
1104000	1110240	which was a thousand and a half of attempts, was logged by me and by my honeypot. So this
1110240	1117100	provided us with a lot of intel again. Somebody's going to die on the DPRK, I know. I can't sleep
1117100	1129240	thinking about it, man. Fucking comedy night tonight. Okay, what caught my eye here is that
1129240	1133520	both the domains and the IP addresses were scattered all around the world. Even in my
1133520	1140060	country, Argentina, Uruguay, Peru, India, you name it, they were all across. And not all of them
1140060	1144980	were exactly burned infra. Some of them had a good reputation. Yeah, I took the time to
1144980	1152060	check everyone. I'm not really fun at parties. And most of them belonged to reputable BPS
1152060	1158040	providers. Once again, including Amazon. So this is where my friend, the journalist, enters again
1158040	1164120	and say, let's get, let's pick on that guy, the chief information security officer from Amazon.
1164460	1170360	So as I was telling you before, yes, Mark Ryland, who is the CISO, I got the chance to talk with
1170360	1177200	him in DC. He was totally aware of the situation. And I'm quoting here, he said, we are aware that
1177200	1181860	hackers are willing to pay for AWS. And the explanation is simple. He said, someone who
1181860	1187040	sends spam, for example, can pay a low amount to have a Linux server and send a million phishing
1187040	1192740	emails, right? I think this would be a problem that not only AWS had, of course, other platforms
1192740	1198820	too, like Azure and Oracle and those companies. But he acknowledged to be, and I'm quoting,
1198820	1203280	that we are very concerned about spam coming from the platform because, of course, it lowers
1203280	1208120	our reputation. It causes problems for legit users that try to connect because they can't send
1208120	1214200	emails logically. And he also pointed that they have identified that there are more sophisticated
1214200	1223260	actors that conduct this kind of abuse of the platform, right? I mean, Amazon said that they
1223260	1230980	would no longer sponsor us. Yes. Okay. And so you are now... we now started to think,
1230980	1237000	this guy has used some detectable samples, even if they look like toys, distributed botnets,
1237000	1243940	and they are really, really short fuse with us. But who are the heads, the brains, the masterminds
1243940	1251240	behind these operations? A quick note, I will share all these indicators too in the GitHub
1251240	1256880	repository. Don't worry. So this led us to the wrap-up section to try to profile a little bit
1256880	1261780	what's happening behind the scenes, behind the code, behind the malware, behind the IOCs.
1261780	1267440	Let me share with you a short, once again based on CrowdStrike, which definitely is not paying us,
1267580	1273580	a state-sponsored threat landscape from the DPRK. We have two groups that seem to not be exactly
1273580	1279900	tied. They are state-sponsored, but not exactly tied to an organization, ministry, secretariat,
1279900	1285560	whatever you call it in your country. There are Velvet Kolyma, which are dedicated to US
1285560	1292880	and Republic of Korea, South Korea obviously, critical infra, NGOs, government, media, military.
1292880	1300060	The Ricochet Kolyma, which are based especially on Republic of Korea operations against government,
1300060	1306100	media, and also DPRK defectors. But we don't have a lot of intel on that part, which is the most
1306100	1310860	interesting part actually. And then we have the DPRK-RGB, which is the Reconnaissance General
1310860	1322360	Bureau, which contains the Bureau 121 and 180, which are mostly commonly known by APT38, SYNC,
1322360	1330560	Hidden Cobra, The Beagle Boys, or the infamous Lazarus. So here we started to gather information.
1330560	1335660	This is kind of well-known information, because Lazarus is like the most famous
1337000	1345020	group that Mauro named. But in order to write a news story, we have to tell the public and remember
1345020	1351060	who is Lazarus and what they're famous for. So we started gathering quotes from researchers,
1351060	1356200	and this one is from ESET, Latin America. And well, it's something that maybe all of you know,
1356200	1362920	it's a highly sophisticated cybercriminal group that targets high-profile cyberattacks,
1362920	1369300	and that they are linked to North Korea. But this is something very interesting,
1369300	1372200	that they've been active for more than 20 years, right?
1374540	1380960	And then inside Lazarus, we have three divisions. Once again, remember that all this is kind of a
1380960	1385000	black box intelligence, let's call it, to give it a name. You don't know for sure,
1385000	1391000	because you do not work for the DPRK. I promise, I don't work for them. And since you don't work
1391000	1395380	for them, you are seeing things from the outside, from outside the window. So sometimes assets or
1395380	1401640	groups may be, let's say, a little bit elastic and work for one or another. They sometimes share
1401640	1410840	infrastructure, they sometimes share the same arsenals or reuse infra from past operations.
1410840	1415740	Remember that this has to be taken with a grain of salt. We have CIDR and Colima,
1415740	1419520	which are dedicated to high-profile corporate and economic espionage,
1419520	1426200	Stardust and Colima, which are mostly focused on high-profile heists, especially for cryptocurrency
1426200	1431320	and in the past for the banking system, and the Labyrinth and Colima, which are more generally
1431320	1437900	some broader group dedicated to currency theft and corporate espionage, but even on lower levels,
1437900	1443780	not only high-profile. They are the responsible for QR log. This is what CrowdStrike have to say
1443780	1450220	about it. Yes, what's interesting about this slide is that Sony incident, WannaCry, are those cases
1450220	1455840	that actually hit headlines, right? That were in the newspapers. They like jumped the niche of
1455840	1462280	cybersecurity, right? So again, speaking to CrowdStrike, they assess that they are linked
1462280	1468900	to the Bureau 121 of the RGB, and they're conducing espionage actions and revenue generation
1468900	1477140	schemes, and that they do intelligence gathering, but also a financial gain. That is what interests
1477140	1486200	us the most, because this QR was designed to extract or rob, yes, cryptocurrency money, and
1486200	1494400	destruction and intellectual property theft. So with these quotes, we started like to,
1494400	1501860	in the article, to make the context, right? To remember the audience what all of this means.
1501860	1507160	And as I was saying, the Sony picture tax was very well known because they leaked movies that
1507160	1514640	weren't released, right? And that was something that hit very heavy on the headlines, right?
1514640	1521180	And the other piece of information that we used as context was the AstraZeneca
1522720	1530120	case that they did spear phishing to try to steal intellectual property. They didn't
1530720	1535340	succeed in the attack, but it really, it was in the headlines also, right?
1535340	1545720	So with all of this, there was a CrowdStrike report, not the quotes that they gave us to me,
1545720	1552200	but there was a previous report about Labyrinth Colima that says that the stolen assets that we
1552200	1558400	are describing are, I'm quoting, likely funding an array of state projects, including their nuclear
1558400	1564700	and weapons of mass destruction programs. And this sounds kind of crazy, right?
1565700	1573140	But I started gathering information about this, and there is a quote on Kim Jong-un,
1573140	1578520	the North Korean leader. I think we're going to have to cancel the trip to North Korea
1579140	1584160	afterwards. Yes, yes, yes. Does this go online or the talk?
1586140	1590880	But there's a quote that is very interesting, again, for a general audience that says that
1590880	1595660	civil warfare is an all-purpose war that guarantees the North Korean people's armed force,
1595660	1601660	ruthless striking capabilities, along with nuclear weapons and missiles. So Kim himself is kind of
1601660	1606540	giving us some hints about this piece of information. Actually, the Treasury of the
1606540	1613440	United States took action against North Korean hacking groups because they identified that they
1613440	1619500	were perpetrating cyber attacks to support these missile programs, right?
1621700	1630120	So, as you might know, they are organizing as an APT in order to steal currency,
1630120	1635280	primarily from banks, now they are moving into the crypto world, to finance a ballistic program.
1635280	1640820	That's no small deal. But sometimes, and this is a wonderful surprise I have for you,
1640820	1646000	sometimes these large organizations like the APTs, government agencies, secretariats,
1646000	1650640	whatever you call it, have a little bit of a hard time managing their assets,
1650640	1658340	both the technological and the human ones. Sometimes, object fails happen, like this one.
1658380	1664460	On the sample that I have collected, that I had seized, the file inputfiles.lst, for all those
1664460	1670580	who use Java and Maven, you maybe already know what's going to happen, contains Maven building
1670580	1674940	information. So, based on it, it's possible to ascertain that the author of the malware
1674940	1681700	operates on Windows, and it's called Edward. So, Edward, I know what you did there,
1681700	1686180	you did it right, using Western technology, you traitor of the DPRK.
1687320	1692500	So, let's do a quick wrap-up about this talk, and we will jump to our conclusions,
1692500	1696980	which are more like tips on lessons learned, as you want to call it.
1697600	1704340	So, the idea is how to make a headline out of this. I know this is Spanish, but it's saying,
1705040	1712040	made in North Korea, they found a virus that works like a digital model of... and I know you
1712040	1718360	don't like these headlines, guys, but how do you explain to someone that there is a malware that
1718360	1724980	it's shitty written, sorry, but as Mauro says, it's not well written, it's like something that
1724980	1729220	is not professional, but it's effective, it's not detected by the heuristics,
1729220	1735540	and that kind of thing. So, I write for a newspaper that has this number of print units
1737880	1742620	every day, and these subscriptions, and that's the average age of the readers,
1742620	1747840	so that's something you have to consider. And the big question is, how do we tell the story
1749360	1756260	to my mother, my girlfriend, my sister, my friends, because that's the whole point of it.
1756320	1762460	You hackers are providing incredible, useful insights, and there is, in Argentina, at least,
1762460	1768400	I know, like, for example, here in the States, you have lots of good people that are covering
1768400	1772840	this beat, and it's amazing that that's happened, but in Argentina, we don't have that tradition.
1772840	1780260	We don't have the InfoSec beat covered, right? So, when I try to write this down,
1780260	1786760	I try to think in these three keys, right? First, to translate. You all know, or some of you know,
1786760	1792960	what a RAT is, what an IOC is, what an APT is. I know all of this because I talked to him, right?
1792960	1797520	And after talking to him, I started reading, and I started researching, and gathering information,
1797520	1805420	reading reports from lots of companies that does Intel, not only CrowdStrike, but also Checkpoint,
1805420	1813620	ESET, Palo Alto, all of those companies make very insightful reports that are very useful.
1814180	1822100	And the challenge is to translate all of this, right? When we were talking about the RAT,
1822100	1826100	he was saying, it's like if the attacker is in front of your computer without being there. Well,
1826100	1833400	that's a good explanation, right? So, a malware, it's a virus. I mean, you could kill me because of this,
1833400	1837840	but in order to explain this to a general audience, you have to make some sacrifices.
1837840	1843940	Then in the article, when you're writing, okay, you can use parentheses, commas, and make explanation,
1843940	1851540	there's no problem with that, respecting the journalistic guidelines, right? But this is a
1851540	1857280	work we have to do in the media. We have to assess this kind of work, right? The second key aspect
1857280	1864560	to me is to give voice to specialists, to hackers, to investigators, to researchers. So that's why we
1864560	1869960	got in touch with a hardware expert, a malware analyst, and a threat analysis, and these kind of things.
1869960	1877220	And the other pillar to me is to explain to the audience why this is important. Why does
1877220	1884900	this matter, right? So one thing we were talking not only with Mauro, but other Argentine hackers
1884900	1896200	here, is that this is like the most asked question. When I came here and I started saying in my circles
1896200	1901020	I'm going to DEF CON, oh, what is DEF CON? No, a hacker convention. They told me, what? There's a hacker
1901020	1908340	convention? Is that even legal? Yes, and it's a problem, because I know all of you are very familiar
1908340	1916520	with this problem, but I think the point is to understand that this question on the left
1917380	1927320	is not useful. I mean, why do people keep asking this question? So I think that the journalistic
1927320	1933800	challenge is to shift that question towards how is this intel that you guys are providing
1933800	1940780	changing the information about the world and how we know it? Because the global landscape
1940780	1946660	is changing and it's changing really, really fast, right? So the whole point of publishing these
1946660	1952900	stories that, believe me, I have the freedom to publish like anything in my bit, in my section,
1952900	1960240	in my newspaper, problem is you don't get many users, clicks and that kind of things, right? So that's
1960240	1964460	why you have to make a headline like that with a molotov and that kind of things to catch the eye
1964460	1970860	and then explain like the technical things and try to translate. But for me, the most important thing
1970860	1977140	of the Mauro's investigation was that we could carry out that to a media outlet that is huge and
1977140	1985000	is not used to treat these topics, right? So I would like, I was telling Mauro, thinking that
1985000	1989220	this question is the question that you guys are answering, right? And that deserves a spot in the
1989220	1996620	media and someone that can translate that kind of language, right? And now your grandma fears Kim Jong-un.
1997280	2004500	Cool. So our conclusions or lessons learned from things is that any suspicious activity you find,
2004500	2009480	even the smaller one, regardless of its scale, should be investigated to the last consequences.
2009700	2014340	I got a lot of people telling me to drop it off. It was not worth it. And I only stopped
2014860	2019580	investigating it when I thought myself that it wasn't worth it. But some people even from minute
2019580	2024520	zero say, no, it's not worth it. Allow it to pass. And you don't do it, especially those folks that
2024520	2031320	work in socks. You know that you don't let almost anything pass. You have to be wary of almost
2031320	2036840	anything. Also always share the intel. If I wasn't in the first place sharing the intel, even if I
2036840	2041620	thought that it wasn't worth it, I would have never known that I was playing with a DPRK sample.
2042040	2046920	And always ask the questions. Maybe you can find someone who is asking the same question as you
2046920	2054600	or that has the answer. And media sometimes can be your friend or an asset. And if you want to check
2054600	2059840	the QR log technical analysis and all the IOCs, I'm going to publish the repository in five minutes.
2059840	2065580	I was just finished cleaning it up. I want to be honest, I still can't finish it. It is there.
2065580	2072420	I moved it from my company, Handler, not on Mauro Eldridge. And also if you want to see,
2072420	2076800	again, as he says, Labyrinth Colima tends to hit the headlines.
2077380	2083660	The story was covered on Clarín, Argentina's top newspaper. So you have the link there.
2083660	2086880	We will also share the slides in case you want to copy the link on a more
2088300	2096120	comfortable way. And we need to recognize the help from a lot of people who, without them,
2096120	2101560	this talk wouldn't be possible. Maxi Fehrman for aiding with the sample analysis. Daniel,
2101560	2108120	Merlo, Croucher, AWS, and ESET for their insight. And my folks at the DC5411 and Birmingham Cyberarms.
2108120	2113300	I think I'm not forgetting anyone. Oh, and Edward for providing the sample and giving us one of the
2113300	2118140	most enjoyable jobs we've ever done. Thank you. You have been an amazing panel.