Disrupting Cyber Adversaries: Meta's Approach to Deterrence
summary
Meta describes three public takedowns — Ocean Lotus (Vietnam), Earth Empusa (China), Tortoiseshell (Iran) — that remove attacker infrastructure, publish IOC dumps and malware hashes, and attribute campaigns to state-linked actors (including an IRGC-linked company Mahak Rayana Fraz Tehran and Chinese firms Best LH and Nine Rush Technologies). Investigations trace phishing, social engineering, heavy use of backstop personas and phishing, server-side checks before serving iOS malware, and show public disclosures cause slower, more cautious re‑entry and measurable drops in activity.
AI-written summary · about
chapters (4)
related talks
48mThey Hide, We Seek: Leveraging Global Partnerships Against Our Adversaries
45mHiding in Plain Sight: Hunting Volt Typhoon Cyber Actors
42mKeynote: The Expanding Universe of Cyber Threats
40mResponding to Disinformation and Influence Campaigns
52mIran's Soft-War for Internet Dominance
18mCombatting Evolving Cyber Threats: Leading with Disruption
49mResponding to a Cyber Attack with Missiles
32mAre US Cyber Deterrence Operations Suppressing or Inciting Attacks?