Tracking Threat Actors Using Images: A Hunting & Analysis Approach
summary
Claim: images and Office artifacts let analysts pivot and track campaigns across years. Using VirusTotal exports and parsing content-types.xml and styles.xml plus embedded images, the method links instances of Gamaredon, APT28 and Blind Eagle; examples include one image appearing in 14 Word documents, another image with 100+ parent files, a style tied to 17 compressed patterns, and a PDF-first-page BMP drop that links 33 emails. Experiments with Gemini/LLMs give useful logo/person matches but fail on generic imagery.
AI-written summary · about
chapters (8)
- 0:00Introduction and agenda
- 1:04Methodology and bias
- 3:10Artifacts in office files
- 6:52Content types and styles
- 11:10Analyzing research results
- 18:14Pivoting and AI assistance
- 21:33PDF and email vectors
- 25:26Conclusion and limitations
related talks
44mUnmasking APTs: An Automated Approach for Real-World Threat Attribution
42mKeynote: The Expanding Universe of Cyber Threats
01h 03mEffects Malware hunting in Cloud environment
57mHiding In Plain Sight - Advances In Malware Covert Communication Channels
40mHunt and Gather: Developing Effective Threat Hunting Techniques
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
16mBeyond the surface: uncovering hidden threats in online ads
47mDetecting and analyzing files-less malware