Welcome to our our talk um we are we
used to work together at the National
Police uh investigating hackers and
today we're going to talk about a tool
we had to make to be able to uh
investigate a hack so me cindra um used
to work in the police um I am a police
officer and self-taught in programming
and all that stuff transition to working
at a cyber security firm as an analyst
and a my man here is like the go-to guy
at Kos if there's anything related to a
computer or Internet he is probably
involved in those
investigations probably not
but yeah I work with a small team of
developers and uh people who are close
to the investigators in cyber crime
cases or other cases we're trying to
fetch information from the internet
structure it present it and make it
understandable for the
investigators so yeah our talk today uh
we'll try to take you from early 2019
when a a fairly large company in Norway
nor kudu was hit by a ransomware attack
and it became a large International
investigation and we going to talk about
but when we got those that that initial
investigation of it we were able to
seize some C2 servers of the criminals
and then we found they used Cobalt
strike and how are we going to look at
that data it's easy if you have one one
server but if you have 100 servers it's
a hassle so we created a small tool the
first version was like really really
simple and I got help from or at some
point and we made it a bit better and it
has led to multiple multiple arrests uh
most notably in Ukraine during the
war so yeah um most of if you're from
Norway you've probably seen this image a
couple of times this is what happened
and this is what all the people working
for HW saw and basically what it says is
H is under attack do not connect your
computer to or phone to any network
until further notice this was like
everything is off everything's shut down
because they were hit hard with the
ransomware
attack so yeah Ransom and we they were
kind enough to be like really open with
the police and say yeah come come help
us and do everything and we got some IP
addresses and we were able through
Partners uh outside in Europe to seize
those servers or make snapshots of them
so the criminals didn't know we had a
data but we had
data so they were the ransom was like
yeah they used Locker Goa Mega corex you
all like all the big Ransom word melver
was used by this group and they used
cobal
strike so why do they use cobal strike
because it's it's easy to use and they
like the criminals they basically do the
same as pent testers when they get a
foothold and cobal strike is so easy to
use it's basically point and click for
some and they
had they had some pirated versions
because like you can't you can't go
ahead and buy it if you don't have a
legit company
so it's a stolen software version so and
what we've seen is like the one the one
guy that probably hacked or cracked the
software he tested it first at home and
used it and data from his computer has
followed this version all the way how he
tested it initially to see if it
worked so yeah uh since Cobble strike is
a pentest tool you get a very good
report at the end of your uh engagement
so we could use that and it's it logs
everything because it's built to log
everything in document and
that's good for us so so yeah we we had
had a couple of C2 servers with Cobalt
track and metas spit and stuff like that
so we was we needed to do a uh get a
better way of seeing or using that
data yeah so
um as Cinder says Cobalt strike is is
used and it's used in the same way as
pentester use it so it's a it's primary
P testing tool so what they do is they
set up a team server which is their Hub
they connect to it with a a client um
and then they start U some sort of a
tech chain um they um they have a vector
infect somebody fishing typically um and
they get a beacon on some poor souls
Network and this Beacon calls back to
the C2 uh Team
server and uh the team uh can be uh from
multiple countries um can be lots of
people or just one doesn't matter um
they start sending commands down to the
the beacon day where the the foo hole is
and then they start pivoting uh through
the network of the attacker or even
through other networks that the uh the
victim has access to so they try to
spread as far and wide as possible and
then they set up uh um alternative
routes to back to the C2 infrastructure
so they go through either relays or U
other team
servers and for a uh security person
then uh you are most most of the time
you see this side of things you see the
victim side somebody has been
compromised and you see the the network
logs on their side now um
on the police side we can get hold of
the these other uh servers and that's
when things where we gets really
interesting and and we can start
to uh get a view over uh how um the mode
of operation for the attackers are and
how they work and what kind of groupings
um uh are there is it this group or is
it that group that attacked this person
or um yeah how things are sort of
organized so um the team server is
basically a just a Linux machine uh
running somewhere in Cloud most of the
time we see them using VPS service like
bulletproof hosting or or other things
um they run a Cobalt strike server which
is a Java based uh
product uh and this uh thing has
uh uh different services that they they
put up so you have a web server to
deliver payloads you have a DNS server
to sort of either deliver payloads or or
um exfiltrate data out to um things like
that um and it writes on the serice side
write the log files of all the activity
that the the team that is using the team
server is doing so when somebody logs on
the Ser uh server this is is written to
a log file if somebody starts a command
saying run this on that victim computer
over there this is logged the result
that comes back from the the beacon is
logged um in addition it writes a sort
of a state uh of of the sort of inmemory
database to files so you have like a
snapshot of whatever the the server was
doing at the at the time um as
serialized Java objects um which you can
pick apart it and this is this is the ID
that Cinder had and uh which we have
sort of developed
further so this is how U the client
looks this is a cobble strike um client
and you see here a list of uh Targets
this is machines inside somebody's
Network local addresses you can just
pick one and say run whatever command on
this machine or set up uh more
elaborate uh sort of uh exploration of
the of the service you can dump active
directory database you can do um
inmemory uh dump of passwords and so on
try to extract as much information from
the victim as possible and it's all very
handy and uh well
executed uh yeah so these are uh the
names of
computers uh and notes that the the
attackers are are putting on the
machines so you can see here that they
are um saying yeah this is the ad server
here's the management uh this is the
CEO's computer this is the
whatever if they find important
computers you can see them noted in the
in the list
here so um the beacon which is uh put on
inside the victims Network that is just
a small program or you can be small or
big whatever but it has the task of
executing payloads on behalf of the
attacker so um uh payloads can be um
parts of tool chains like Metasploit or
or others um and these uh tools are
performing their work and then uh
funling their the results back to the C2
by some means of exfiltration mechanism
either just copying the files directly
out or uh if it's inside a secure
network you can use all sorts of weird
techniques like like DNS uh to
exfiltrate data it's slow but it
works
so so yeah finding the good
stuff there's a lot of logs because the
uh the tool itself is like one
engagement stop the server
get report but these guys they had like
team servers that had been running since
early 2018 so over a year running and
they've done multiple uh different
victims companies whatever so they had
like a large list of infected machines
I'm not sure how they were able to like
have control what they were doing and we
see that as well like they're trying
passwords on the wrong machine because
they didn't have control like oh
wrong yeah wrong victim so basically
this is how the logs are or the initial
logs they're in plain text log file so
this is where we started we found the
logs okay let's read them and see what
they're doing and then we had like okay
they ran this command at that timestamp
it was this use or whatever and police
officers are
doers so if there's basic mentality in
the police like if there's a th logs we
need 10 people to read them it's just
divided by people give more people more
people more people it's like and and one
example of that I got a mail from a uh
yeah colleag in France he he had been
sitting over the summer and doing
basically the same stuff I was building
a tool to do automatically manually so
his job was basically go in fire up the
VM create the Cobalt strike report in a
PDF take the PDF read it copy paste like
basically doing it all manually and he
he sent me
aail you can I think you can read it but
like you can see his frustration when he
heard about me having done what he was
doing every day for like half a year
automatically so so that's the thing
yeah basically he took the image cre
fire up the version machine ran glal
strike exported the PDF
so yeah so we started like version one
uh I only knew about these logs like
okay there's the log how do we get it
into a spreadsheet because police
officers love Excel that's the best tool
in the world you can do everything uh so
that's what they want it's okay we start
like most of you like okay we have a
file just bash or split whatever get it
out and it works sort of because and
then you go to the when you see like the
output line then it s sort of breaks the
format okay how are we handling that so
it was a pain in the ass and the script
was ugly as yeah basically just it was I
made a python script that did it and it
didn't do it really good but it did it
okay
enough so and came to a point like there
has to be a better way because the
Cobalt strike makes the PDF report it
has to get this data from somewhere I'm
not like it can't be the the the the log
text files it uses as it source so
where's the data so we
found so I'll get that but like so we
came like this program it it works we
need it and the other police uh units
out in Europe this is good we need it so
we had to start the process okay if
we're going to do it we need to do it
better so we need better structure we
need to make it plan of uh of the tool
and start like of development so we need
and refactor everything because the code
was it ran on my computer basically and
I didn't just made it okay what
dependencies do I need and I've tried to
run it on a friends computer like ah
doesn't
work and we needed to give it an awesome
name so we came up with cobal strike
parser so and that stuck so it's CSP
short internally
so the we set ourselves some goals goals
for it and so we the tool should analyze
the files inside the Cs folder we need
to provide a quick overview for the
investigators through an through Excel
and PDF reports and timelines and all
those fancy
visualizations and we had had like this
idea we were we could use this to
identify the victims because we we saw a
lot of computers that had been in
infected for a long time or the
attackers were ready to um deploy
ransomware but they haven't done it yet
okay we need to actually warn people
about
it and that's like the face of What
stages are the victims in and and also
identify other C2 servers because when
we had one server we saw they had
listeners to other C2 servers okay then
we can go and seize that server and we
get a new one and we seize that
server and also we we were able to like
provide an overview of okay what data
was exfiltrated by the the attackers and
what how many people are there working
and stuff like
that yeah so um we stuck with the idea
that this should be python script
because we are uh python
programmers so um basically the the when
the script works by pointing it out a
file folder structure this is the Cobble
strike uh folder structure
um and we have to sort of peel the
layers of this and get all the all the
details out of it um
so um you get the log files that Cinder
was mentioning in a sort of structured
semi-structured
format um where each of the beacons have
their own logs the screenshots are
stored somewhere and download the files
are stored somewhere and so on and so on
uh we just have to sort of Peel part the
uh
how does it all fit together because uh
there are internal references that needs
to be resolved and it can only be
resolved by looking at the binary files
the in memory database that uh that is
dumped to to
disk um we uh try to sort of couple the
downloaded files that are just a a given
a hash name uh and try to connect that
to the real name of the file from the
the log files so you have to correlate
Logs with the downloaded files and the
database and sort of where did this file
come from and what was it called on the
victim's
computer um and then you can start
looking for the SSL keys that are used
for encrypting data for the the beacons
Beacon
traffic uh and this can be input to uh
the security um um people who are
looking for um connections to the the C2
infrastructure they can actually use
used the keys to um to look um look for
connections that are
relevant and of course the bin files uh
which
um uh initially I think was quite a hack
with sort of um think syn used the cobal
Stark's own um deserialization code to
uh get hold of the data and then later
on we moved on to a sort of generic way
of expanding the the bin files so they
are serialized Java objects uh and
nothing complicated it's just basic
types um they are written to diss
periodically we assume uh by the Cobar
server
um they contain integer strings and Link
list of uh those kind of data structures
floats and so on and we tried to just
extract it and uh create uh our own
objects um from this so here you see the
C2 info uh uh Bin file this is a typical
object that is inside that it's a list
uh there's a list of objects that
contain the addresses of C2 servers that
the uh that is used in this
engagement uh so you have either a
domain name or an IP address there um
and which Port it's communicating on
and then again you have the targets bin
file which just lists all the machines
that they yeah not not to worry it's the
national uh test of uh notification
system going
on stay
calm the police is here
yeah it's up against the
wall sorry
[Music]
um we're done yeah I think so good yeah
so this is a list of all the machines
that the attacker has uh identified
inside the victim's Network so basically
this is the pick list uh for executing
new commands you pick a machine from
here and then yeah run whatever you want
on that one and it name one the machine
what kind of os it has the IP address
internally and so
on this is uh a good one the credentials
been filed here's the list of all the
credentials we stolen from the victim's
Network so it's fair and square list
of uh which host it was stolen from um
what's the password or the hashed
password what type of program extracted
like here mimicat um extracted the
password and what the rearm like in this
case probably an active directory domain
and notes for for that
attacker uh the listeners been F list
all the external or internal listeners
if you have to like um if the attacker
of jumps in through the network and have
different hops that it has to Traverse
to get outside you have internal
listeners and then uh eventually you get
to the outside listener um which is
running on the C2 infrastructure and
here's the um different addresses for
that um again archives. bin this is like
a history of whatever you've been
doing there's tons of information here
you can see uh the instructions that
have been run what kind of instruction
is here's a task to instructing a beacon
to become
interactive uh and uh uh Cobble strike
classifies the the actions into miter
tactics so you see here is the
t29 tactic um which is a class of of
activity that mitro has has classified
so we extract that and you use that in
our reports services. bin lists all the
services that cobal strike locates and
finds inside the victim's Network in
this case a web server running Apache
113 and you have the active sessions uh
list so here's an active uh
an object that represents an active
session from a C2 to a specific machine
inside the victim's Network and you can
see the operating system and name of the
computer addresses and so on and it's
ready to be interacted
with um
yeah right so how um the Cobalt strike
par uh has this own structure the sort
of file
structure it produces a runtime log of
whatever it's been doing sort of uh
through the the parsing of all these
files uh and it has a reports folder
with PDF Exel and CSV
reports uh has a uh a folder for the
database uh and it has also the uh pure
like uh Json objects that you just saw
for processing in other other
tools um the database is an SQ light
database so it's all like self-contain
you can take this and ship it to uh say
uh police in France and they can start
uh looking into this you don't need
anything
else
uh you just need the tool and and the
output folder and then you can start um
making this into usable police uh
reports and of course uh we uh we
produce Excel and CSV
files um this format where you can have
have a list of all the uh in this uh in
this case an activity report activities
sorted on time all the activities that
the attacker has done towards a group of
machines or uh a single machine if you
want that um and you can see here all
the uh all the commands and the the
results from the commands uh the time
stamp that has been uh uh run at we'll
mention this a little bit later on uh
which Beacon it's been uh running on uh
the tactics that has been in use mitro
tactics that is um and uh IP address for
uh external or internal machines that
have been used in this uh of
exchange uh yeah that
too uh yeah and the name of the
computer of course uh it has an amazing
UI that has
nobody has seen the likes of uh it's
very much a practical interface where
you have a management interface to when
once you load up all these CS folders
into it it's sort of Stack up and then
this helps you to detect duplicates now
why would you have duplicates yeah
because these um attackers they are uh
lazy uh slobs uh they uh copy their data
from one server to another they set up a
new VPS and take all their along
with them and then they have not just
multiple copies of the same folder in on
multiple servers but they have multiple
versions of cobalt strike pars within
the same folder structure writing on top
of the same log files so you don't know
which version of cobalt strike the log
belongs to so that's an interesting uh
challenge um when you're trying to parse
it and uh so you can uh manage all that
stuff up in the top one uh you can do
new extractions just point it out a new
folder and then on the lower part here
you have the reporting where you can
generate whatever reports you want so
simple as
that um and then you can uh generate
activity reports like uh like this per
IP or U uh per
victim and uh in this case you have um
an interesting column called data over
there uh where we have sorted now on
toss and spawn commands and spawn
commands are the ones that are
interesting because this instructs the
victim computer to say hey connect to
that C2 infrastructure over there most
of the time it it does that uh and so
here's a way to pick up new C2 servers
you have the IP addresses for the the C2
service right
there um so
so this is something that the uh
security Community U rarely sees this is
from the C2 server this is logs from the
C2 server you have to get hold of them
so we as the in the Norwegian police uh
uh contact the French police or the
Belgian police or the Netherlands uh
police and they go out and grab a server
um because they have the jurisdiction
inside their country and then you get
data and then you peel it apart and then
you find some new c2s and then you do it
again and then do it again and you stack
up this uh
yeah numerous of C2 servers and you get
a wealth of information that you can
build your case
on
um the activity reports also gives you
uh quite a good insight into what's been
going on like what kind of data have
they been uploaded to the uploading to
the victim's Network or download loading
so you can see right above uh the upload
uh uh stuff you can see ad find is a
clear indication that they've been
dumping the active directory
database so then we can use the data
inside the active directory dump to
identify the victim because all the
addresses and telephone numbers are
there you can just pick up and call them
and say hey you're
infected those are fun
talks hi I need to talk to your it
manager I'm calling from the police yeah
you're calling from the police yeah yeah
right yeah uh then you have uh uh
reports per IP address once uh sometimes
it's uh very interesting to just pick
one machine that's the machine that
they've been using for the most
interesting task you can just uh
concentrate on
that and other than that let's see yeah
session support you can see how they've
been moving along inside the the network
you can see the the patterns that
they've been using to to
spread and of course we have something
for management as well uh
PDFs um my favorite format
and this gives a quick overview over um
how many objects have we extracted from
a folder from a set of folders and also
a timeline uh so you can see the
activity and what type of activities has
been happening and you can see that
they've been in there for ages most of
the time you can see that the they uh
they've been inside the victim's Network
for quite a while before uh being
detected um all the event logs things
that have been happening on the on the
machines or inside
Network um credentials report which
credentials are compromised how did they
start their attack um
this can help when uh trying to identify
that all the screenshot that the
attackers have been taking from victim's
computer inside their network key
loggers uh all the stuff that you've
been typing on your keyboard uh in as a
victim it it comes in this
report uh the chats that the the
attackers are uh having between
themselves there we
go um also so breakdowns per um IP
address inside the um inside the victims
Network and again like timelines and uh
keystroke loggings and and chats and so
on so we try to try to make reports that
are useful for the for the
investigators so yeah
um the PDF and Excel report is fine uh
but we also would try to like do some
more visualizations and stuff like that
like okay where are the victims and I
think this is like a fairly good show of
uh the spread of this and they like the
servers were placed in Netherlands and
France at some hosting company and we
saw all over the world except there's
nothing in Russia I
think weird it's weird like so and and
and also we had this activity and when
we see the activity over a time period
there's some things you if you look
start of January there's like nothing
happening if anyone want to guess what
time period that is it's Russian
Christmas there's no activity during the
Russian holidays so not saying it's
Russian no no not saying they are
Russians or something like that but we
see that and also when you do uh like
take the time zone into consideration
you see when they're doing stuff it's
mostly between 9 to 5 in Russia or
Russia
Z so and when do they hack like wn's the
activity there's a spike on wedness
dayss or that's the day they're doing
the most stff anyone want to guess
why what happens on
Tuesdays Microsoft patching so we're
assuming like oh there's a patch
Wednesday we go in and check do we still
have access or have we lost our
access yeah another another issue is uh
when you don't see um activities on
Saturdays and Sundays so what does that
mean you're a company you're
government no overtime
yeah so yeah and also we tried like uh
Excel is good but how do you how do you
get like the overview of what's
happening so it's we tried to we built a
graph database as well uh and mostly I
use that because no one else was like
bothered with doing that uh saying
there's too much data then we we had
like okay we were able to get a over
overview of like this is a cluster you
see we got a lot of C service we threw
everything down got a mapping of it and
said okay we can fairly assume like the
big cluster is one group and we had some
other clusters like okay yeah we have
this data but they are not communicating
at all so this must be another group I
was like okay there's we're
investigating two actors actually or
three because the big cluster is the
same
guys or maybe the same guys they share
Co they're like they share their the
stuff all over the
place yeah and on the the investigators
they um they have their own way of uh of
uh sort of structuring their the
information that we bring to them so
they create something like this you have
the servers here U symbolized with the
uh the rxs those are um C2 servers that
we did get initial hold of and then uh
inside the the red squares are the
victims
network uh and you can see that uh how
the c2s connect to the different uh
victim
networks and then when we analyze the
the logs uh you get these uh um spawn
commands uh you you extract the IP
addresses from the spawn commands and
identify new C2 servers which are done
connecting to new uh victims so when you
seize the new green ones there the new
service that you have identified then
you expand on this and you identify more
victims and you build
build your
network this isn't the whole picture
this is just a little part of it the
it's quite uh uh it sort of hurts the
eyes when you look at the old one I
think I think there's like a couple
hundred thousand victim machines in the
data set yeah you don't want to look at
that no but what you want to look at is
the the c2s and when you start looking
at the patterns inside here then uh some
Islands emerge you see the top part of
of this uh this illustration is is
separate from the lower part uh and this
is the first view that we had like we
knew these C2 service we had logs from
this and then you look at the spawn
commands uh and you get these servers
and then you go to the French police or
the Netherlands police or whatever
police and they help us to um to seize
the other servers then you can uh sort
of connect the dots and you see that uh
uh these two islands are actually when
you look at the new data that you found
when adding all these new servers all
the yellow ones are new ones and the new
connections between this grouping and
the other grouping is then revealed and
so what you thought was two groups is
actually
one uh so uh just collecting all this uh
all this data helps build the case
but it's uh it's tedious tedious
work it takes time to Traverse not just
the technical side of things but also
the legal side of uh of having um the
right to go out and seize uh
material um another way of looking at
things is the usernames uh so we try to
group um users that are active on the
different C2 server so we can look at
groupings in in that way um
now cobal strike doesn't have any sort
of authenticated
user um uh concept you just pick a
username when you connect to the server
so if you don't pick a username you're
called Neo uh because that's the default
username um so a lot of the time Neo is
Neo is in the top yeah but they have
their brand every one of these hackers
have like a a cred uh they're trying to
build cred within their environment and
they use either stems of their names or
um um yeah to sort of be identified
inside their own network so we can use
that to group
activities right so q1 2024 uh this is
uh how it looks now uh the hydro case is
more or less uh sort of wrapped up we're
still arresting people though from it
but they lost 78 million
us that's the cost of that uh that
hack uh and hydro is just one of many
and hydro did not pay any ransomers
that's just lost in revenue or re
rebuilding their infrastructure and
stuff like that overtime all that stuff
it costs a lot they were very upfront
and they said it from day one we're not
going to pay we're going to fix this
ourselves and going to cooperate with
the authorities and try to sort of
resolve uh the issue that way so uh from
that uh from there on they had a really
good cooperation with the the police and
the security companies to try to sort of
um get out of the the
mire over 1,800 victims has been
identified across 17 countries um and
estimated total damages it's very hard
to uh estimate this thing but
many hundred uh million US dollars in
cost H this is what that's the best
estimate I have been able to get from
investigators nobody wants to speculate
uh but but it's like it's downtime and
uh companies going out of business uh
people losing their jobs and uh yeah it
it's complicated hundreds of computers
uh and service have been uh seized in
the operations we have found the
cryption keys for ransomware has been uh
distributed to victims and help them to
recover the data um over 50 suspects
from these groupings have been
identified worldwide and just to take
this uh the news stories on the right
side here is some pictures are from the
um from two rounds of activities in in
Ukraine during the war um where you're
trying to find individuals that are
involved in cyber crime worldwide inside
a war-ridden country
and uh it's even more complicated than
that because uh uh the groups are
actually a mix of Russian and
Ukrainian uh people so you get an
interesting group
dynamic and they sort of this was
something we saw in the middle of the
war suddenly somebody just turned on the
on their group and and sort of betrayed
the information leaked lots of
information about the their hacking
activities and of course that's great
for
us um yeah
15 uh rrest I was trying to get an exact
number of this but uh somebody in the
law uh told me that yeah what is an
arrest it's the is what you call an
arrest in one country is not what you
call an arrest in another country so
what but what we call an arrest in
Norway 15 plus
arrests Switzerland Ukraine uh we're
trying to get something from
Russia they're not really
talkative
um yeah but it's an international effort
and it's still ongoing and it's going to
going to go on for a
while so yeah uh or mentioned like uh
back to the tool the time stamps are
hard because uh at least for the log
files because the the binary it's a Unix
Tim stamp UTC basically uh so you just
convert it but the timestamp in the logs
are basically month and day and if you
want to find out what year they've done
it you have to go to the folder
structure and parse that because that's
where you have the year so so basically
when which when we were trying to to get
data from the logs we have to go okay
what kind what what folder is it for in
okay then it's a 2021 file and then we
have to find a date and suddenly he
updated the program and then the date
format changed it's like okay now we
need to have another version that also
takes this into
consideration and yeah so it's it's a
it's a mess
uh because I the data is not intended to
be used the way we do it so it's it
hasn't done it easy for us yeah another
issue is I think on the next slide is uh
yeah
um Daylight Saving
Time anyone's uh guess what's wrong with
daily daylight saving time if you don't
know what country the server is in
what's the problem with Daylight Saving
Time Changes up to the country it's up
to the country to decide when they want
to have daylight saving time so uh you
have to like
be guessing a bit and also the time zone
which time zone are you in are you
actually uh doing daylight saving time
is the time correct on the
computer uh there's a lot of loose
variables
um yeah and of course log files is can
be a mix of different versions so you
have to do this for every file and sort
of guess your way through it and
correlate with the time stamps you find
something in a log file that you can
correlate with something that has a UTC
tyap in the bin files and then you know
you can go with the log files and then
they're in sync for a while yeah
yeah and also yeah the bin files they
change when new version comes the the
data changes and like and as we said
like the hackers they they they they
tend to go like oh new version let's get
it we need to have it and this just
switch but they keep the old version
running as well so suddenly you have
four like cobal strike servers running
on the same or team service running on
the same machine
so it's a pain in the ass when we're
doing that stuff so and we we have to
evolve the parer every time or not me we
or has because I'm not working with it
anymore so this his pain
now and so yeah and also support the
older version so you need to okay see
what type of version is this and how do
you find that where is that stored yeah
and you have to go to some config files
and check this version is that and then
we should run this parer version so it's
a lot to
do so yeah what what can we or as
security companies or companies as a
whole what can they do and to contribute
with this like as we said if you're if
you're breached or you know about some
uh iocs share them because what we've
seen uh like we have victims sharing
data with us and like yeah what do we
tell them like we don't expect anything
we like we get the IP and we will share
it with europool interpool and suddenly
down the line 5 years from now FBI might
arrest some guy and say yeah we found a
guy and we found him and this is the IP
and you can link it back
and and and yeah and suddenly you solve
the case years down the
line and by getting able to getting
those IPS you can see some Serv
and we will then be able to find new
victims and help uh prevent
stuff and and that's the thing as well
like if you're out on an incident with a
customer or you as a customer or you
certain company get breached don't be
afraid to like report it to the police
because I know there's like uh people
think like oh no the police are coming
they're going to take all our servers
because we're the victim they're going
to take it and do forensics on it but no
not going to do that don't have the
story space for servers
so so yeah basically just don't be
afraid to help the police like inform
the police it's it's not that
scary yes and um on the law enforcement
side of things uh we can do stuff um as
well um we can share uh the IPS that we
see from the the attacker infrastructure
and uh
um uh in some cases at least uh so that
helps the security um
companies identify malicious
activity uh we're also looking into misp
using misp as a as tool to share um
ioc's from the police we're currently
just uh listening on misp but it's a
tool that we want to use to sort of
share um IP uh and uh and information
about
attackers um sharing is a little bit
complicated more complicated than I
thought initially but when you think
about it it's not it's not that weird
because uh some of these attackers are
actually using victims infrastructure to
host their uh their C2 and then if we
share uh like without any sort of um
vetting of of the validity of the the IP
address and saying this is a attacker
and it's actually Microsoft
and just the attacker is running
something inside Microsoft's Network
then Microsoft is going to be really
cross with us um um yeah so uh it's a
It's Complicated
um but we can inform um security uh
companies and the public about uh these
things and make sure that uh awareness
about the cost of being aor and uh to
letting people use your infrastructure
to infect others U that has a
significant cost for the on a global
basis um and also awareness about how to
handle incidents how um how to report
like Cinder says don't be afraid to
report uh somebody thinks that um uh
when you when you make a report you you
you uh notify the police it's going to
be a a big process now maybe that's not
going to be a big process because they
just note the information and it's
becomes part of the statistics which
they later on use to get funding for
further work within the field and
nothing's going to be done on on your
case um but later on we're actually
going to have focus on this type of uh
of uh uh of incident so just having a
sort of measure of the scale of the
problem is uh is useful for the police
if we if it's all in the dark we don't
know how much effort to put in on this
uh these
things so report report report um and uh
we will continue to support the
international investigation efforts
because uh this is like a a huge uh
economic problem uh the amount of money
that goes down the drain or goes to
organized crime through these um um
through these channels
is immense and uh the kind of uh other
activities that that these organization
are linked
to ER yeah it's trafficking it's drugs
it's uh you name it there're into all
sorts of things these gangs and this is
uh the organized crime scene is um is
very um business
driven there's a large there's a large
map as well of all the like uh
crypto transactions and how that network
is built with mules people just getting
something sending mixing services like
that's a huge map as well trying to find
the people and they make some mistakes
down line they all
do so yeah yep questions anyone
yes yes I have uh three questions
actually yeah uh the first is what kind
of help if any did you get from the
vendor of C yes second is based on the
statistics that you presented the target
victim statistics do you find need you
draw any conclusions is there more cable
countries uh organizations private uh
versus uh yeah uh State operating
systems and and and such and last
question is you mentioned chats were
they actually using the Cs to
communicate okay okay so yeah question
number one um did we get any help from
um see the cobal strike um guy uh
no uh we sent him an I sent him an mail
a mail uh asking if it was okay for like
breach of policy stuff like is it okay
for you that I use your code to build my
own tool for the police like and he
didn't reply so we don't know anything
never talked with him they have a quite
a vetting um procedure for for buying um
cobal strike uh you can't be a criminal
and you can't be a law
enforcement it's start grouping those
two together so yeah we were like
thinking okay can we get a legal version
to test this or no we couldn't because
we were law enforcement okay then we
have to test and build this the the
program using the criminals cracked
version that's the way we could do it so
it's hard to test when you don't have
and mil something to test with uh not
fetching just they give you some specs
or insights into the format no
nothing we could we could find something
because it was uh yeah he has reused
some code from metal spit uh or Armitage
Armitage sorry Armitage into Cobalt
strike so there's some similar larities
there so and second question was
statistics and companies and victims and
stuff like that
uh basically it was all all over the
world uh and we saw like they they
infected machines they found okay what
is this so they and then we saw like a
note they wrote down okay 10,000
computers school and then nothing more
happened or something happened and small
company four P four PCS whatever like
they they knowed okay what's the network
like and we
saw there's no Russian or like Russian
speaking countries in the list of
infected machines there there might be a
patent to the governmental uh the um uh
ABT side of things uh but uh and these
uh people seem to be organizing a sort
of a chain of uh prioritizing that
somebody is just working on getting
access they don't M it doesn't matter
who you get access to you just claim
access and secure it and then you pass
it on down line to somebody who is
trying to develop that um foothold into
something else trying to expand and and
do research and if they have a lot of
things to do then it's naturally going
to prioritize uh bigger targets and and
so on but even small targets can be uh
be focused on if they they have the time
and then they go on to exfiltrate data
and then once you have the data what
kind of data is it what can how can we
monetize it can we ex U extort the
People based on what they have for data
or should we just Ransom where encrypt
them yeah it all depends and the third
yeah about about the shat yes they used
Cobalt strike uh shot functionality so
basically they were talking to each
other and you saw they used like uh cic
uh keyboard when they were in the chat
and sometimes they forgot to switch back
to English when they were in and doing
uh commands on PCS so like why doesn't
this command work why doesn't this
command work so they like did it
multiple times before they saw oh yeah
I've written it in Russian so yeah then
you see like oh switch switch keyboard
and then it works and you also see like
when they get into a machine you see
like okay basically they've gone into a
notepad copy paste copy paste copy paste
basically they just run command down the
line because we saw like there's there's
a pth they do the same thing every time
they get a new machine and basically if
it doesn't work do it again do it again
do it again it's noisy
as I don't understand how people don't
detect it because it's so noise noisy
and they just they don't care in the
initial phase like or like Le this group
they're like we'll do everything Mimi
cats do everything like Mak a lot of
noise
and didn't get caught and if they got
caught and booted up yeah yeah just go
down onto the next one because like yeah
there's 100,000 machines here let's just
take the next
one yeah any more questions yep did you
share the tool
you yes it's an um europol's uh Tool uh
chest I don't know what they call it but
yeah it's uh right now it's like an four
or five countries in in the codebase
developing uh or submitting patches
integrating it with other tools and and
so on and uh uh we see that uh the this
tool is going to stay uh relevant for
quite a while um as long as a cobal
strike is uh you're able to use it it's
going to be relevant and uh of course
new uh tools
um pop up and then we need that tool for
that as well to sort of extract the logs
from from that uh but this kind of
Investigation technique where you
identify the C2 infrastructure grab it
analyze it
repeat and then um try to uh go for
identifying the the criminals from way
they communicate how they um how they
work
together this is the way to go and also
uh like uh if I don't know if people
were on the Troy hunt uh
the uh session earlier um where he said
that criminals they do mistakes early on
in their
career this is uh what we see as well um
and
um if you were to just have like a a
time slot from the newest information uh
then you had would have a hard time to
identify some of these guys but if you
go back in time uh you can uh get the
information from the the days where they
weren't experienced and weren't focused
on OBS and weren't um yeah doing things
properly um and then um then you sort of
hooked them that
way yeah do you find that uh like Fred
actors in non extradition countries are
like not giv a about OB and if
you're if you're using stuff like
you know for back strike and basically
tools that you pired that are one click
here cck this you know Battlefield 2
executable just a crack game go for it
and then you can you can attack anyone
without you know window I think I think
they are uh still um focused on their
personal
upsc uh maybe they're noisy and upsc on
the sort of operational side of things
uh for for what they're doing is uh
lousy but uh for the personal side of
things they they don't want to be uh
tied to a a person still if you in like
sitting in North Korea hacking away uh
you don't want to be known by your real
name so it's two sides of yeah it's like
their their obsc is good until they log
into the the the team server on like the
yeah and then when they start working on
the on the victims they don't care they
just run around and so basically they're
yeah personal obsc good U but
organizational upsc no they there's no
effort to hide that you're a state actor
no it doesn't matter no well this is
just
uh from what I've heard uh the line
between government actor and
non-government actor in some countries
is very much a gray area State like
sanctioned maybe but they're also like
you know we're just chilling in St
Petersburg no one's bothering us doing
this it's
fine could
be anyone
else nope and it's time for coffee
lunch