APT Attribution: Trials and Tribulations From the Field
DISCARDED: Tales From the Threat Research Trenches
00:00
How Do You Attribute Threads?
Tend to approach it a little bit differently based on your own ppersonal experiences. Most advanced thread actors utilize quick adoption of tooling and zero days whenever they become known or readily available, such as past experiences with russian military officers. Some are super simple, make a rule, watch for an actor, control emal te trigger and just move on with my life. Others, like a p t 28, involve me focusing on a particular target,. i could reliably monitor for credential fishing at a specific target. And confirm through bower analysis that the same web hook was being utilized for b t 28 when they were focusing on predential harassing campaigns.
Transcript
Play full episode
