The Cyberattack on Visma in 2018, experience sharing and views from the blue team
summary
August 2018 attackers use phishing and weak passwords (one was literally "August2018!") to access an exposed Citrix server, escalate with off‑the‑shelf tools, and stole Active Directory credentials then stage exfiltration via Dropbox. Evidence shows a seven‑day C2 buildup before breach, 4,500+ domains at stake, $4,000 paid to a bounty finder who flagged Dropbox artifacts, and 10,000 users forced to rotate passwords and rotate AD secrets; Recorded Future’s 70‑page report and legal domain takedown confirm attribution leaning to Chinese MSS (APT10) and that transparency and lawsuits work.
AI-written summary · about
chapters (36)
- 0:00Introduction and context
- 4:13Company profile and scale
- 5:31The adversary profile
- 7:10Setting the stage
- 7:54Reconnaissance phase
- 8:59Command and control
- 10:23Initial awareness
- 10:54D-Day infiltration
- 11:25Credential exploitation
- 13:43Moving laterally
- 14:18Escalating the threat
- 15:00Planting tools
- 16:22Exfiltration and discovery
- 16:48Post-discovery reflection
- 18:19Incident response initiation
- 20:08Fog of war operations
- 21:50Security hygiene overhaul
- 22:41Persistence and monitoring
- 23:39Decision to go public
- 25:18Transparency as a policy
- 26:40Managing the media storm
- 27:30Impact on professional life
- 29:54Attribution and validation
- 31:46Industry feedback
- 32:09Categorizing adversaries
- 32:19Limits of investigation
- 32:49Strategic value of truth
- 34:01Supporting other victims
- 35:14Core mantra: Read the logs
- 35:36Building alliances
- 37:56Technical security takeaways
- 39:16Report resources
- 39:27Future commitments
- 40:10Maturity check questions
- 40:22Law and technical outcomes
- 44:13Conclusion
related talks
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
42mIt’s Getting Real & Hitting the Fan 2023 Edition (Real World SaaS Attacks)
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
35m"Inside Cybercrime Groups Harvesting Active Directory for Fun..."
52mLessons Learned from the Summer of Supply Chain Attacks
22mDevSecOps - The Story of 3 Security Breaches
54mHacked in hours: Red team assessments unveiling vulnerabilities
09mIT Security Conference 2025 | Edgar Coutinho & David Marques | Logicalis