Thread by @cglyer

.@TekDefense introducing our next talk about unmasking APT38 - a North Korean threat actor focused on financial attacks

Blog released today with more details
fireeye.com/blog/threat-re…

#FireEyeSummit

APT38 targeted banks (SWIFT messaging initiated wire transfers you've read about in the news) and crypto currency exchanges (among other orgs)

#FireEyeSummit

Yes - you read that right. APT38 has used multiple different (and escalating tactics over time) to destroy evidence including deploying ransomware and running disk wiping malware

#FireEyeSummit

"After initiating the SWIFT transfers APT38 would 'burn down the house'"

Have "fun" trying to investigate and successfully get your funds back from other banks when 10,000+ systems have been destroyed by disk wiping malware

#FireEyeSummit

APT38 Opsec techniques

"The SWIFT malware was never written to disk and was only on the system for 3 hours" -- Chris DiGiamo

#FireEyeSummit

APT38 has four different malware families to destroy/wipe systems. They've continued to innovate/improve their wiping techniques over time - showing how important this is to APT38 to do it well

"Hacked by GOP"...talk about a blast from the past

#FireEyeSummit

A week after destroying vast majority of victim Windows & Linux environment APT38 tried to re-enter a week later. They left a few "undestroyed" systems w/ backdoors & internet facing web servers w/ web shells. Attempted to access web shells from Tor exit nodes

#FireEyeSummit