Operation Ghost: The Dukes aren’t back - they never left!
summary
High-confidence linkage of long-running APT29 activity from 2013 through June 2019, named Operation Ghost, shows previously unseen tools plus reuse of miniDuke and public services for C2. New flagship backdoor first seen September 2016 and still deployed in June 2019; operators use image steganography, HTML clones, Twitter-based C2 and Dropbox, local named pipes, and per-victim unique network seeds. Victims include three European Ministries of Foreign Affairs and an EU embassy in Washington DC.
AI-written summary · about
chapters (4)
related talks
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
40mThe Last Remaining Cover for Action
42mWho Let the Dogs Out? When PUPs Become BlackCat's Best Friend
31mThe Wolves Among Us… A Tale of APT’s Thievery
30mUnmasking UNC1151, the Ghost Behind Ghostwriter
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
19mOperation PZCHAO
47mDNS On Fire