CyberCrimeCon 2020

Group-IB presents «High-Tech Crime Trends 2020/2021», the company’s annual overview of the evolution of the cyberthreat landscape. The comprehensive analysis is powered by world-class proprietary technologies and vast experience in incident response and cyber investigations. The report offers reliable strategic data; key trends and forecasts for 2021 separated by industry; an in-depth review of ransomware developments and state-sponsored warfare; and much more.

Every criminal endeavor has a con, a process, a workflow, or a «scheme» associated. For these schemes to be successful, they must have a certain, predictable outcome for the criminal. By examining cybercriminal adversary behavior, targets, and origins, we can build logical stories or use cases for what the adversary might be trying to accomplish — their desired outcomes. Once we understand what adversaries expect to see, receive, and monetize (or operationalize), we can work to de-incentivize the scheme, remove or delay feedback loops, and build in deception. These actions work together to cause as much pain to adversaries as possible. At the end of this discussion you will have a solid understanding of the TITO Threat Intelligence Framework, know how to apply TITO concepts to your existing Threat Intelligence program to improve operational workflows, and be able to add new friction to adversaries.

How to detect attacks if the threat actors use legitimate websites? Since late 2019, Lazarus has been continuously updating its proxy layer infrastructure. It is now impossible to detect malicious communications using traffic analyzers. I’ll tell you a story about how an innocuous acquaintanceship in WhatsApp led to a defence supplier being compromised.

Within the cyber security community, we very often see public reports identifying threat actor activity in very general terms. For example, a recent write-up regarding activity associated with threat actors deploying the Snatch ransomware stated that they, «...turned off Windows Defender...» without going any further. While there are a number of ways to accomplish this task, sharing the methodology details, or «toolmarks» not only provides actionable intel for proactive and DFIR threat hunting, but the granularity and context contributes to attribution. This presentation will demonstrate what «toolmarks» are through the use of examples.

The world has seen several surges of successful high-profile ransomware attacks since early 2020. In common beliefs, ransom attacks are straightforward hacking activities. However, there are more beyond the simple step of data encryption. This research presents the audience a close-up look into a ransom attack against a Singapore financial institute caused by PulseVPN vulnerability. It examines REvil’s delicate operation models under its raw hammer style power exhibition. It further surveys the underground eco-system which supports REvil’s success.

You need a solution that predicts threats and protects infrastructure. That is why we are proud to present Group-IB Threat Hunting Framework, a single solution for IT and OT environments that is designed to detect unknown threats and targeted attacks, hunt for threats both within and beyond the protected perimeter, and help investigate and respond to cybersecurity incidents.

Do we as a cyber-community learn from the past? Have we looked into the major historical cyber-attacks, and been able to understand the key shortfalls? More importantly, did we gear up to defend ourselves from a repeat attack? Are we doing enough to defend the critical national infrastructure, and to ensure we do not repeat the mistakes of the past? This talk walks thru a few case-studies and deep dives into what really happened and what should have been done to better defend ourselves.

Ransomware groups have outdone themselves in 2020. Their activity and demands have surpassed all imaginable (and unimaginable) records. Notably, nearly all ransomware operators have targeted enterprise networks, a trend that has aptly been named «Big Game Hunting». In this report, you’ll learn why these groups have been successful and why more groups like them are joining the big game.

In April 2020, Diebold Nixdorf, the world’s largest provider of ATMs, became the victim of a ransomware attack. Until today, relatively little is known about the incident and customers have been left with only brief information. In contrast, the number of supply chain attacks is growing exponentially, which in turn increases the risk potential for customers to become victims of a subsequent attack. This presentation examines the incident at Diebold Nixdorf from a perspective of a financial IT provider and presents the results of the technical analysis.

The Europol joined Carding Action focuses on fraudsters selling and purchasing compromised credit card details and login credentials online. The audience will see how high value targets are prioritized, identified and investigated by law enforcement. Moreover, financial institutes helped to mitigate millions of potential losses which makes it a prime example of public-private partnership. The Carding Action 2020 was conducted in cooperation with Group-IB.

Investigation team process at least 5 incidents every day from our clients for the persons involved. Some of them lead to the conclusion that there is no real threat and some of them lead to the real investigation with attribution to a country and group, finalizing with details of hackers’ identities. During this short session I would like to show the details of 3 our investigations: phishing, scam and national leakage. All cases were happened in the APAC region this year. You will see the patterns of hackers behavior and technical issues that can lead to their deanonymization.