The Wolves Among Us… A Tale of APT’s Thievery
summary
Diplomatic network suffers multi-gigabyte exfiltration traced to an APT; incident investigation over two weeks reconstructs two simultaneous attackers, five infected hosts plus a REPO server, and three distinct C2s. Forensics finds w.exe Windows Credential Editor dumping domain credentials, a weaponized Excel macro using MSXML2.XMLHTTP, and persistence via upd.vbs + dn.ps1 persistence via NvidiaUpdate scheduled task. Later analysis uncovers Turla Gazer using vboxdrv and OWA webshell capturing credentials and Turla abusing the victim’s C2 via BITS; remediation requires rebuilds, domain password reset and 2FA.
AI-written summary · about
chapters (13)
- 0:00Start
- 3:59Initial Findings
- 7:58Investigation (cont.)
- 10:52Initial infection (cont.)
- 13:03The big picture
- 15:44Epic Turla relics
- 18:07Turla Gazer malware diagram
- 21:00Epic Turla implants
- 22:24Turla BITS implant Analysis
- 22:55Malware falls back
- 26:54The wolf is among us...
- 27:20The Epic Show of Epic Turla
- 29:26Lesson Learned
related talks
52mStart covering your bases & Stop chasing APT headlines
42mStart Covering Your Bases And Stop Chasing APT Headlines
55mNation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
29mThe Wolf in Sheep's Clothing: How Cybercriminals Leverage OneNote for Stealthy...
55mRevealing the Attack Operations Targeting Japan
52mRansomware 101: Get Smart Understanding Real Attacks