Connecting the Dots in a Cyber Pandemic Era
summary
A national CERT links seemingly separate incidents to a single compromised ERP platform used by 70% of cargo companies, uncovering ~90 victims, half direct customers. Attackers exploit no MFA/weak RDP, unsecured VPN and backup servers, move laterally with legitimate tools, and deploy a shutdown tool while staging pay-to-key double‑extortion leaks. The CERT aggregates IR findings, uses C2 intelligence to build IOCs, severs risky connections, issues TLP‑tagged alerts and dispatches IR teams — actions that stop scheduled disruptions and protect vaccine shipments.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:34Incidents
- 5:21Attack
- 10:41Attack Attribution
- 12:00High Profile Activity
- 13:35Threat Intelligence
- 15:22Dilemmas
- 19:01Bottom Line
related talks
29mCritical Infrastructure Network Attacks: Code Red, Alert Network Operators
40mOne Step Ahead: Keeping Security at the Forefront
37mMore Than a CSIRT: Lessons Learned from Supporting a National Response to COVID-19
52mLessons Learned from the Summer of Supply Chain Attacks
52mRansomware; The Real Pandemic
02h 15mFIRSTCON21 - June 9 | Stream 2 (12:00-14:15)
22mCyber...
42mKeynote: The Expanding Universe of Cyber Threats