@moranned

Professor. Consultant. Analyst. Technologist. Security Geek. Privacy Advocate. Runner. Couch Potato.

 Washington, DC
Joined May 2007
  • Tweets1.6K
  • Following401
  • Followers1.6K
7Media
This. 100 times, this.
Ben Buchanan
@BuchananBen18 Dec 2020
I’m hesitant to do this because everyone says how the SolarWinds hack confirms all their priors, but here goes. My PhD and first book argues the blurred lines between espionage and preparations to attack in cyber make interpretation hard. A short thread on what that means here.
4
While MuddyWater's link to ransomware remains tenuous and unproven, the group is heavily invested in custom tool development. From PowerShell to .NET to C++ malware, Muddy is fast approaching other groups' capabilities. @snlyngaas reports w/ lines from me cyberscoop.com/muddywater-ir…

'MuddyWater' spies suspected in attacks against Middle East governments, telecoms

While other hacking teams associated with Tehran have gained notoriety for data-wiping attacks, MuddyWater as been relentless in its spying efforts.

cyberscoop.com
8
1
18
It's almost as if there are companies providing/selling capabilities whether its Implants, Exploits, or all of the above and what you may see here are downstream customers. @moranned and I covered this a little bit in shadowserver.org/news/the-it… from 2015.
Daniel Lunghi@thehellu31 Aug 2020
Replying to @thehellu
It turns out the RCSession family described by Secureworks is the same as the "Type 2" malware family that we described in our report documents.trendmicro.com/ass… So either RCSession/Type 2 malware family is shared among multiple threat actors, or #DRBControl is part of #MustangPanda
RCSession's SecureWorks description

ALT RCSession's SecureWorks description

RCSession sample class names

ALT RCSession sample class names

DRBControl Type2 description

ALT DRBControl Type2 description

DRBControl class names

ALT DRBControl class names

1
9
27
There are a number of these kinds of examples where this kind of sharing can be inferred too in the infrastructure side of things, but.. this is Twitter and they probably also read the same tweets the defenders do.
2
3
Thanks for your patience, class! Took a little hiatus for a month. But we're back! In week 5 of “Lies & Disinformation” @Georgetown, we pivoted from Russian influence activities to Chinese and Iranian IO state actors.
Оlga Belogolova 🌻@olgs712 Jun 2020
I’ve been meaning to do this for some time: starting this week, I will be sharing my syllabus and recommended readings from the “Lies, Damned Lies, and Disinformation” course I taught in the spring semester @Georgetown SSP. I’ll be sharing some highlights from each week’s lesson.
3
7
4
46
Does a doxing a cyber attacker sponsored by an authoritarian state achieve worth while results? An after action review of one case, suggests that this tactic might not have enduring effects and instead may hinder defenders in the long run.
5
35
11
89
more replies
This false sense of security could have enabled the other OilRig cells to enjoy more success.
1
4
This is not an argument against public information sharing. This is an argument against sharing without a coherent plan. If you are going to 'burn' an actor or a campaign ensure that you have a plan to reacquire the adversary if and when they change their TTPs.
1
7
37
Which Ransomware payload is deployed at the end of a killchain is pretty much a stylistic choice by the attackers. Human Operated Ransomware campaigns overlap in their entry vectors, C2 tools, and lateral movement techniques- and also in viable defenses. aka.ms/human-operated-ransom…

Human-operated ransomware attacks: A preventable disaster | Microsoft Security Blog

In human-operated ransomware attacks, adversaries exhibit extensive knowledge of systems administration and common network security misconfigurations, perform thorough reconnaissance, and adapt to...

microsoft.com
6
72
3
154
who benefits when researchers publicly posts information about vulnerabilities in an attacker's infrastructure or tools?
6
7
3
24
more replies
sharing information with other defenders is vitally important, but we, as a community, have a responsibility to do this in a way that doesn't benefit the adversary.
1
1
6
If Twitter was around during World War II do you think Alan Turing would have been posting about techniques to crack the Enigma?
1
1
15
Load more