IT Security Conference 2025 | Edgar Coutinho & David Marques | Logicalis
summary
A red-team exercise demonstrates credential theft starting from Telegram/infostealer marketplaces, creating a typosquatted domain and a man-in-the-middle portal to capture MFA tokens and socially engineer an IT director into granting elevated access. Attackers route through Tor exit nodes or commercial VPNs, join the corporate VPN, enumerate shares and vulnerable services, and delete logs via the configuration management system; defensive telemetry — CTI, DNS/MX monitoring, and MISPO reputation — is used to detect the campaign early and enable takedown and forced credential resets.
AI-written summary · about
related talks
30mTales of Red Teaming
49mStories from the trenches - How a red team exercise gained full control of a client network
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
39mLocknote: Conclusions and Key Takeaways from Day 2
40mModern Identity Hacking: Have Hackers Really Adjusted to Constant Remote?
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
29mCritical Infrastructure Network Attacks: Code Red, Alert Network Operators