It's rare for someone to be experienced as a CTI analyst on both cyber espionage and cybercrime threat types. I see it often that experienced cyber espionage analysts create groups and infer links for cybercrime where they don't exist [01/xx]
To truly analyze and understand cybercrime, one must understand that it's not at all like a cyber espionage group who can be bums on seats in a govt office with mostly their own tooling, infrastructure etc [02/xx]
Cybercrime is basically an actor/small group of actors who chain different capabilities together to carry out their business. Capabilities could include bulletproof hosting, malware, crypting services, ransomware services etc. The underpinning of this is the underground [03/xx]
Presenting cybercrime problems as groups (unless they are truly a group sitting together) doesn't really help an intel consumer understand that at the end of the day, cybercriminals are a business that have different pain points that can be stopped or disrupted [04/xx]
To illustrate the point, Trickbot itself is probably run by a group as a malware service (malware as a service). Combined with that, the actors behind this service are probably using it as well as customers of the service [05/xx]
The actors behind Trickbot (anyone using Trickbot) work with other actors based on the accesses they obtain through Trickbot intrusions. A financial institution with a system compromised with Trickbot could find that access sold to DPRK actors intel471.com/blog/partners-… [06/xx]
Alternatively if you're a small to mid sized org compromised with Trickbot, you might find that access to your org is sold to another cybercriminal to do follow up intrusion activity. The end objective of that right now would likely be to deploy ransomware within your org [07/xx]
TLDR: I strongly encourage experienced cyber espionage intel analysts to spend cycles to understand how cybercrime works end to end. This is totally different to cyber espionage. Become one of those rare CTI analysts who can understand both cybercrime and espionage [08/xx]
RE: ransomware, I see a lot of folks overly focusing on atomic indicators for ransomware. Ransomware is very easy to write and deploy and when a sophisticated cybercriminal is ready to deploy it, will test it out on a single system before deploying it to all [01/xx] #Ransomware
What you should be focusing on is: 1) The precursors to ransomware, i.e. (not an exhaustive list) Emotet, TrickBot, Cobalt Strike, Empire. 2) Preparing and testing backups so you can recover fast in the event of a ransomware incident across your org. [02/xx]
3) Proactively preparing people (execs, lawyers, PR etc) internally in your org as to how you will handle a ransomware incident. What will you do if someone will attempt to extort your org to pay or else they release your data publicly? How will you respond? [03/xx]
Key points from my “Lessons from the world's leading cyber threat intelligence (CTI) programs” talk at @gcfriyadh in Riyadh. Video will be shared soon. Talking points aren’t ideal for Twitter but I’ll give it a go [1/24] #ThreatIntel#CyberThreats
@gcfriyadh A CTI program is all about reducing risk for an orgs. Risk = probability x impact. CTI about understanding the internal and external factors that impact probability + impact of risks so decisions can be made that reduce risk [2/24]
@gcfriyadh CTI by definition is threat focused. A threat is a person/group with a motivation, intent and a way of working (TTPs). Malware isn’t a threat, the person using it is. Therefore a CTI program tracks threats being people/groups over time [3/24]