报告预览

Kyle Schmittle-俄罗斯Gamaredon APT 集团-移动监控工具.pdf

编号：185933

PDF 59页 1.35MB 下载积分：VIP专享

下载报告请您先登录！

Kyle Schmittle-俄罗斯Gamaredon APT 集团-移动监控工具.pdf

1、Russian Gamaredon APT GroupMobile Surveillance Tools2Kyle Schmittle-CISSP,CCSPSenior Security Intelligence Researcher Threat Research Team Lookout15+years in Threat Intelligence3AgendaBackgroundLookouts InvestigationSurveillanceware CapabilitiesCommand&ControlVictim Targeting4Threat Actor:Gamaredona

2、ka:Primitive Bear,Aqua Blizzard,Armageddon,Shuckworm5source:SSU6Targeting Ukraine+military,NGOs since 2013Spear-phishing for initial accessLow focus on stealth&obfuscation7Dynamic DNS or fast-flux DNS for C2 hosting8Dynamic DNS or fast-flux DNS for C2 hostingRussian bulletproof hosting providers9Loo

3、kouts Investigation10BoneSpy Android Surveillance Family11Investigation Timeline DecemberEarliest BoneSpy Samples PackagedFebruaryInitial detectionsJulyApp themes solidifyJanuaryPlainGnome Gamaredon attributionSeptemberFirst Threat Intelligence AnalysisRussian criminal groupWide variety of featuresT

4、elegramImage ViewerCode structure maturesCapabilities standardizeLures standardizeSeptemberMajor refactoring of PlainGnomeContinued BoneSpy deployment202120222023202412DecemberEarliest BoneSpy Samples PackagedFebruaryInitial detectionsJulyApp themes solidifyJanuaryPlainGnome Gamaredon attributionSep

5、temberFirst Threat Intelligence AnalysisRussian criminal groupWide variety of featuresTelegramImage ViewerCode structure maturesCapabilities standardizeLures standardizeSeptemberMajor refactoring of PlainGnomeContinued BoneSpy deployment2021202220232024Investigation Timeline 13Redline&Trickbot sampl

6、es share C2 Russian-language filenames DroidWatcher open-source codebase14Surveillance capabilities:Browser historySMSLocation trackingContact lists15Surveillance capabilities:Call logsPhone call audio recordingTaking photos from cameras16Persistence&Abuse MechanismsHeadless foreground servicesServi

友情提示

1、下载报告失败解决办法
2、PDF文件下载后，可能会被浏览器默认打开，此种情况可以点击浏览器菜单，保存网页到桌面，就可以正常下载了。
3、本站不支持迅雷下载，请使用电脑自带的IE浏览器，或者360浏览器、谷歌浏览器下载即可。
4、本站报告下载后的文档和图纸-无水印,预览文档经过压缩，下载后原文更清晰。

本文（Kyle Schmittle-俄罗斯Gamaredon APT 集团-移动监控工具.pdf）为本站（芦苇）主动上传，三个皮匠报告文库仅提供信息存储空间，仅对用户上传内容的表现方式做保护处理，对上载内容本身不做任何修改或编辑。若此文所含内容侵犯了您的版权或隐私，请立即通知三个皮匠报告文库（点击联系客服），我们立即给予删除！

温馨提示：如果因为网速或其他原因下载失败请重新下载，重复下载不扣分。