HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad...
Transcript of HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad...
![Page 1: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/1.jpg)
HELLO APTS IN THE MIDDLE EAST
By Mohamad Amin Hasbini
Senior Security Researcher
Kaspersky Lab
![Page 2: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/2.jpg)
IntroductionName: Mohamad Amin Hasbini• Senior Security Researcher - Kaspersky Lab - Global Research and Analysis Team www.kaspersky.com
• X-DataConsult www.dcgroup.com
• Board member - Securing Smart Cities www.securingsmartcities.org
• PHD student - Brunel University London www.brunel.ac.uk
![Page 3: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/3.jpg)
Agenda
Carbanak TURLA
APTs
Volatile Cedar
![Page 4: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/4.jpg)
The nature of the threats - 2016
Traditional cybercrime
Targeted threats to organisations
Cyber-weapons - APTs0.1%
9.9%
90%
![Page 5: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/5.jpg)
CARBA
![Page 6: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/6.jpg)
![Page 7: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/7.jpg)
![Page 8: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/8.jpg)
![Page 9: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/9.jpg)
Carbanak 2015
• Attacks in budget deps • Change registration data of
shareholders' in depository
![Page 10: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/10.jpg)
New C&C Panels?
• Samples• Passive DNS and domains• Other’s IOCs?..
![Page 11: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/11.jpg)
Oh look
Notice: Undefined index: HTTP_HOST in /var/www/html/application/modules/Crypt.php on line 6
![Page 12: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/12.jpg)
Oh look
Scan ALL the hosts!
![Page 13: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/13.jpg)
Stage 1
SYN-scan the globe
![Page 14: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/14.jpg)
Stage 2
Interrogatethe hosts
![Page 15: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/15.jpg)
New C&C Panels!
+
= Carbanak intel
![Page 16: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/16.jpg)
CARBANAK SUMMARY
1. Global criminals’ ATP2. Spear-phishing is
everything 3. It is all about MONEY
![Page 17: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/17.jpg)
TURLA
![Page 18: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/18.jpg)
![Page 19: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/19.jpg)
TURLA Satellite
![Page 20: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/20.jpg)
![Page 21: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/21.jpg)
Country InfrastructureLebanon 2 providers, 4 ip addresses
Iraq 1 provider, 1 ip address
Nigeria 2 providers, 4 ip addresses
United Arab Emirates 1 provider, 4 ip addresses
Denmark 1 provider, 3 ip addresses
United Kingdom 1 provider, 1 ip address
Zambia 1 provider, 1 ip address
Afghanistan 1 provider, 1 ip address
Somalia 1 provider, 1 ip address
![Page 22: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/22.jpg)
![Page 23: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/23.jpg)
![Page 24: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/24.jpg)
![Page 25: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/25.jpg)
![Page 26: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/26.jpg)
TURLA SUMMARY
1. BGP Hijacking and Satellites2. Anonymous infections3. State-sponsored attack
![Page 27: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/27.jpg)
Volatile Cedar
![Page 28: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/28.jpg)
![Page 29: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/29.jpg)
The victims belong to several categories:• Government• Telecom Operators• Educational Institutions
![Page 30: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/30.jpg)
Victims on :Ogeronet, Inconet, Cyberia, Terranet, Cedarcom.
![Page 31: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/31.jpg)
Compilation timestamps
![Page 32: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/32.jpg)
Importance of Threat Intelligence
• Identifying threats
• Localizing threat data
• Learning attackers techniques
• Attack readiness
• Decision making support
![Page 33: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/33.jpg)
![Page 34: HELLO APTS IN THE MIDDLE EAST - MENOG Turkey Apri… · Kaspersky Lab. Introduction Name: Mohamad Amin Hasbini • Senior ... Agenda Carbanak TURLA APTs Volatile Cedar. The nature](https://reader033.fdocuments.net/reader033/viewer/2022051918/600aca6802e3701c60053a3a/html5/thumbnails/34.jpg)
Stay Close…Mohamad Amin HasbiniSenior Security ResearcherGlobal Research and Analysis Team (GReAT)
[email protected]/Linkedin: @mahasbini
Thank you