Stories from NC3 - investigating hackers
summary
When forensics logs prove useless a bespoke extractor parses Cobalt Strike folders, deserializes serialized Java objects from .bin snapshots and correlates logs, downloads and screenshots into an SQLite DB, Excel and PDF timelines. That pipeline surfaces spawn commands to find and seize chained C2 servers, recovers ransomware keys to help victims, and maps over 1,800 victims across 17 countries. Investigations link 50+ suspects and 15+ arrests so far and attribute Hydro’s incident to ~USD 78M in damage. Cobalt Strike parser and timeline reports drive the work.
AI-written summary · about
chapters (20)
- 0:00NC3 investigations intro
- 1:13Norway’s ransomware attack findings
- 3:20Criminals using Cobalt Strike
- 6:39Police seizing C2 servers
- 8:28Cobalt Strike logging structure
- 11:42Manual parsing frustrations
- 14:34Developing Cobalt Strike Parser
- 17:24Parsing Cobalt Strike files
- 20:14Extracting victim and attacker data
- 23:06CSP tool output features
- 25:15Detecting duplicate data
- 27:06Finding new C2 servers
- 30:59Visualizing attacker activity
- 33:11Graph database of C2 networks
- 36:25Legal and technical investigation work
- 37:53Hydro ransomware outcomes
- 41:11Timestamp and version challenges
- 44:45Recommendations for companies
- 48:26Why report breaches to police
- 50:17Q&A
related talks
14mDFIR - Don't Forget Your Roots!
46mReading Between The Lines Of Law Enforcement Press Releases
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
59mInnovation lessons we can learn from hackers
53mForensic Investigations of Web Exploitations
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
53mForensics Skillset: Techniques for Extraction and Analysis of the Evidence
35mEnhancing Operations Through the Tracking of Interactive Linux-based Intrusion Campaigns