Operation Clairvoyance: How APT Groups Spy on the Media Industry
summary
Taiwanese media endure focused APT campaigns that pivot from web flaws to long-term access: operators use SQL injection with sqlmap to get in, run credential dumping (custom mimilove/mimikatz), tunnel with NeoReGeorg/Impacket and DNSCat, then stage Cobalt Strike over DNS tunnel. Multiple Chinese-linked groups (Ameba/Winnti, Huapii, Goser, Slime variants) deploy loaders like Funny Switch, Chain Loader (payload-in-certificate + ChaCha20), and Dropbox-backed backdoors (DropCloud) — three media and one government Dropbox victim are confirmed.
AI-written summary · about
chapters (13)
- 0:00Operation Clairvoyance intro
- 1:28APT groups target media
- 3:16Media org vulnerabilities
- 6:35Global APT attacks overview
- 7:36Taiwan key APT target
- 10:07Clairvoyance explained
- 11:59APT TTPs and malware
- 16:46Huapii and Goser profiles
- 20:46Slime backdoor techniques
- 22:11Slime phishing methods
- 25:25Taiwan media breach case
- 28:17Key takeaways and mitigation
- 30:32Conclusion and Q&A
related talks
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
55mRevealing the Attack Operations Targeting Japan
19mOperation PZCHAO
32mHow Things Are Going For APT41 In 2024
55mNation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
46mAttacks, Lies and the Underground World