Countering Persistent Threat Actors in APAC and Globally
summary
Mandiant reports attackers reattempt access ~1 in 3 times globally (about 9 in 10 in APJ historically) and demonstrate concrete return methods: web shells, RDP tunneling with plink that yields full GUI access, exploit chains against Citrix Netscaler/Pulse Secure/SharePoint/Apache Struts, and a password filter implant that logs 800–1,000 reset passwords. Defenses that work are concrete: enable 2FA on all internet-facing services, enable restricted-admin RDP, collect HTTP and BASH history logs, hunt for ISAPI filters/cron persistence and block macros and AppData execution.
AI-written summary · about
chapters (16)
- 0:00Start
- 5:52Evolving Threat Landscape
- 7:33Example of Tool Evolution - Mimikatz
- 8:47Avenues of Return
- 9:57Reusable Data Acquired in First Attack
- 10:58Setting Up Base for Future Attacks
- 11:18RDP Tunneling
- 12:44Web Shell Example
- 13:24Scheduled Task Example
- 17:07Unrelated Non-targeted Malware Systems
- 18:45Let me help you with that password reset...
- 23:22Rough Patching Netscaler
- 25:46ISAPI Filters - Remote Activated Timebomb
- 26:41High Level Recommendations
- 28:00Tactical Advice for Major Avenues
- 28:48Tactical Advice for Blocking Macros
related talks
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
52mStart covering your bases & Stop chasing APT headlines
48mCrucial Cyber Hygiene Defenses for 2023
42mStart Covering Your Bases And Stop Chasing APT Headlines
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
50mInsights into New Supply Chain and Cloud-Identity Attacks
52mRansomware; The Real Pandemic