Revealing the Attack Operations Targeting Japan
summary
JPCERT/CC traces two long‑running campaigns that infect at least 130 Japanese organizations between April and September 2015, with a concentrated Flash drive‑by in July that compromises about 100 users. Intrusions start with icon‑spoofed spearphishing or targeted watering‑hole sites, attackers escalate with MS14-068 privilege escalation and MS14-058 to dump passwords, spread via admin shares and scheduled tasks, and pivot using WPAD/iptable hijack and DNS NS manipulation. Discovered tooling includes mdb T17/T20 http bots, DLL preload persistence, beginx remote shell, memory‑only loaders, stolen code signing, and Volatility/strings decrypters for analysis.
AI-written summary · about
chapters (7)
- 0:00Targeted attacks on Japan
- 4:57Campaign A: Infection and lateral movement
- 21:28Malware in campaign A and analysis
- 30:42Campaign B: Initial infection methods
- 48:03Malware in campaign B and attacker infra
- 52:31Analyzing APT17 malware
- 53:17Q&A
related talks
42mStart Covering Your Bases And Stop Chasing APT Headlines
19mOperation PZCHAO
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
46mAttacks, Lies and the Underground World
52mRansomware 101: Get Smart Understanding Real Attacks
30mCountering Persistent Threat Actors in APAC and Globally
25mGlobal Threat Brief: Hacks and Adversaries Unveiled