Our team is looking to hire for 2 positions on our APT tracking team.
Primary responsibilities & day-to-day will be disrupting state-aligned or state-sponsored actors trying to deliver malware, phish, or otherwise engage with our customers, in email data.
We're big on culture ADD - we'd love fresh and additive ideas that might challenge our assumptions & biases to help bonk the adversaries
members of this team have prev been network wizards, incident responders, computer scientists, developers, & traditional gubbymint analysts
We're looking for folks who've either experience tracking APT groups in similar data, or who have worked in tracking actors within email-based telemetry, with bonus points for those with detection experience.
you'll get to partner across the Threat Research org with amazing teams including the wizards of the wire (@ET_Labs), the malware maestros of CORSIG/DDX, the brave souls who stand vanguard against ecrime & fraud everyday, and many many more!
lots of important work in CTI on 🇰🇵 DPRK crypto-ops 🪙 going on at the moment!
I wanted to highlight a few talks that were very helpful for me in understanding how we got here!
1st, Katie Blankenship gave an excellent overview of DPRK cyber evolution
Before we dive into crypto-ops fully, let’s take a step back and see where most of them evolved from: APT38 The folks at Mandiant gave an awesome talk on this back in the day:
Sticking with the SWIFT targeting @saffronsec provides a deep look at North Korean intrusions leading to SWIFT heists:
We saw TA444 try out a lot of chains in 2022, from their usual password.txt.lnk -> CageyChameleon, to MSIs, VHDs, CHMs, and ISOs.
We also saw them, very strangely, send out a phishing campaign that… kinda stunk? Typos everywhere, super broad targeting, real clunky feel
Our reporting builds on a lot of great reporting, especially December work from @unpacker , diving into TA444/Bluenoroff MoTW bypasses and malware usage, and highlights some of the peculiarities of their varied file formats used for malware delivery: securelist.com/bluenoroff-met…
Day 15 of #100DaysofYARA is all about named pipes! We'll be looking for both the \\.\pipe\ strings as well as common references to named and anonymous pipe methods and obfuscation methods. Lots malware fams use named pipes!