Mapping the Connections Inside Russia’s APT Ecosystem
summary
Research collects roughly 2,000 unique Russian-attributed samples, classifies them into 60 families and 200 modules, disassembles binaries into assembly “genes” and links samples that share unique genes. Results feed an interactive web graph for visual cluster analysis and an APT detector that automatically generates open-source YARA rules to scan Linux, macOS, and Windows hosts. Core finding: abundant code reuse inside the same actor but no cross-actor code sharing detected, so connections stop at actor boundaries.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:40What is a connection
- 2:08Questions
- 2:43Public information
- 3:21Four steps
- 3:50Collecting samples
- 4:30No naming convention
- 5:25Template
- 6:40Genetic Analysis
- 8:25Gaffey
- 9:32Types of Connections
- 10:08Our Present
- 12:24Our Disappointment
- 13:27Theories
- 14:35The Second Theory
- 14:55The Second Tool
- 16:25Conclusion
related talks
44mUnmasking APTs: An Automated Approach for Real-World Threat Attribution
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
22mAPT Attribution and DNS Profiling
30mTracking Threat Actors Using Images: A Hunting & Analysis Approach
23mData Driven APT Attribution and AI/ML Research
35mEnhancing Operations Through the Tracking of Interactive Linux-based Intrusion Campaigns
31mThe Wolves Among Us… A Tale of APT’s Thievery
38mSightings Ecosystem: A Data-driven Analysis of ATT&CK in the Wild