The Blurred Lines between Cybercrime and Statecraft
summary
CrowdStrike reports that state and criminal actors reuse leaked tools (eg EternalBlue) and legitimate OS utilities to evade malware-focused defenses: examples include WannaCry, NotPetya, BadRabbit, SamSam and campaigns that harvest SMB NTLM hashes via web requests, plus PowerShell execution via InstallUtil, certutil, expand and csvde for downloading, decoding and AD reconnaissance. Detection averages 63 hours, breakout time drops to 1h58. Recommended actions: enforce MFA, block unused signed utilities, hunt for indicators of attack, and aim for the 1–10–60 detection/investigate/contain goal.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:20Mike Santos Vp Technology Strategy
- 11:19State-Sponsored Ransomware Attacks
- 13:10Maturing of Enterprise Ransomware
- 15:05Attacks on Manero
- 19:10Prudential Theft
- 25:34Countermeasures
- 32:24What Else Do Attackers Do
- 32:34Reconnaissance
- 39:27The Breakout Time
- 40:4011060 Rule
- 42:00Summary
related talks
42mStart Covering Your Bases And Stop Chasing APT Headlines
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
26mTechnical Tracks
42mKeynote: The Expanding Universe of Cyber Threats
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
44m The Nation State Actor Ate My Homework!
52mStart covering your bases & Stop chasing APT headlines