RedSourcing: Cyberwar On a Budget
summary
Claim: nation-state espionage increasingly majority of adversary toolkits are redsourced, letting low‑budget actors match older capabilities. Evidence: multiple campaigns use off‑the‑shelf red team tools — used trial Cobalt Strike deployed via McAfee ePO — and commodity frameworks like Empire, PoshC2, Responder and Ruler. Case outcomes: ICS attack chains layer open tools early and only build custom payloads at the end — Triton used open frameworks then custom ICS malware — enabling rapid, scalable intrusions and several successful destructive and espionage operations.
AI-written summary · about
chapters (7)
- 0:00The concept of red sourcing
- 1:19Shift in adversary toolkits
- 2:48Motivations and missions
- 3:56Operational techniques
- 5:29ICS targeting and tradecraft
- 7:56Destructive campaigns
- 9:37Strategic conclusions
related talks
12mIntroduction To Red Team Tooling And Opsec
41mPurple Is the New Red - Providing the Most Value from Offensive Security
54mHacked in hours: Red team assessments unveiling vulnerabilities
40mFantastic Red-Team Attacks and How to Find Them
11mOutsourcing Cyberwar
44m The Nation State Actor Ate My Homework!
47mThe Blurred Lines between Cybercrime and Statecraft
42mRed vs. Bank: Surviving a Three Year Red Team