Who Let the Dogs Out? When PUPs Become BlackCat's Best Friend
summary
BlackCat/ALPHV trojanizes legitimate admin tools to gain initial access via malvertising and typo‑squatting, replacing downloads with ZIP/ISO payloads that evade scanners (one trojanized Rufus (≈500 MB) dropped a VDAR stealer). Compromised Advanced IP Scanner and a typo‑spelled Wireshark led to a Python reverse shell, hands‑on‑keyboard within 20 minutes, then credential theft and lateral movement. Dwell times in cases range from ~38 to 10 days; one campaign uses an ESXi encryptor that deletes backups before encryption. IOCs include hashes and squatted domains.
AI-written summary · about
chapters (17)
- 0:00Introduction and speakers
- 1:44Talk overview and BlackCat basics
- 3:28What are PUPs and why they matter
- 6:41War stories and attack patterns
- 8:53Case study Rufus trojanized download
- 12:09Case study Advanced IP Scanner attack
- 15:30Case study ESXi ransomware incident
- 18:19Case study WireShark fast intrusion
- 21:06Common themes and attacker tactics
- 24:54Prevention and detection strategies
- 27:00Baseline monitoring and policies
- 29:06Indicators of compromise and resources
- 30:52Ransomware encryption challenges
- 31:54Q&A session part one
- 33:05Q&A session part two
- 37:13Q&A session part three
- 41:44Closing and thanks
related talks
26mTracking the World's Dumbest Cyber Mercenaries
52mRansomware 101: Get Smart Understanding Real Attacks
47mDetecting and analyzing files-less malware
19mOperation PZCHAO
17mRadRAT: An all-in-one toolkit for complex espionage ops
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
42mStart Covering Your Bases And Stop Chasing APT Headlines
42mMac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads