To Loot or Not to Loot? That Is Not a Question When State Nexus APT Targets Online Entertainment
summary
TeamT5 chronicles 20+ targeted campaigns since 2018 showing five China‑nexus APT clusters repeatedly hit online gambling operators for both data collection and cash extraction. Observed specifics include IIS backdoor and SQL‑level logging implants, ERP supply‑chain compromises that drop trojanized installers, customer‑support and LinkedIn spearphishing, exfiltration via cloud storage accounts, and post‑access ransomware or coin‑mining. Analysts map a kill chain with reconnaissance to precise individuals, lateral tooling and credential harvesting, then targeted server encryption or selective data theft.
AI-written summary · about
chapters (11)
- 0:00Introduction and agenda
- 3:06Online entertainment risks
- 5:27Five prominent APT groups
- 7:40Attack methods and TTPs
- 11:04Delivery and infiltration
- 16:31Malware and backdoor tools
- 21:38Lateral movement techniques
- 23:43Ransomware deployment
- 27:02Political motivations
- 29:54Strategic analysis of attacks
- 32:28Mitigation and conclusions
related talks
55mNation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
01h 02mNation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions
28mRising Tide Redux: Leviathan's Supply Chain Attacks & Kinetic Naval Intervention
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
01h 02mWhat Techniques Does the Lazarus Group* Use to Break Security?