Ned Moran
@moranned
Followers
2K
Following
710
Media
7
Statuses
2K
Professor. Consultant. Analyst. Technologist. Security Geek. Privacy Advocate. Runner. Couch Potato.
Washington, DC
Joined May 2007
This. 100 times, this.
I’m hesitant to do this because everyone says how the SolarWinds hack confirms all their priors, but here goes. My PhD and first book argues the blurred lines between espionage and preparations to attack in cyber make interpretation hard. A short thread on what that means here.
0
0
3
While MuddyWater's link to ransomware remains tenuous and unproven, the group is heavily invested in custom tool development. From PowerShell to .NET to C++ malware, Muddy is fast approaching other groups' capabilities. @snlyngaas reports w/ lines from me
cyberscoop.com
While other hacking teams associated with Tehran have gained notoriety for data-wiping attacks, MuddyWater as been relentless in its spying efforts.
0
9
19
It's almost as if there are companies providing/selling capabilities whether its Implants, Exploits, or all of the above and what you may see here are downstream customers. @moranned and I covered this a little bit in https://t.co/O1Unl2tMtr from 2015.
It turns out the RCSession family described by Secureworks is the same as the "Type 2" malware family that we described in our report https://t.co/0OLwpLMjIX So either RCSession/Type 2 malware family is shared among multiple threat actors, or #DRBControl is part of #MustangPanda
1
9
27
There are a number of these kinds of examples where this kind of sharing can be inferred too in the infrastructure side of things, but.. this is Twitter and they probably also read the same tweets the defenders do.
0
2
3
Thanks for your patience, class! Took a little hiatus for a month. But we're back! In week 5 of “Lies & Disinformation” @Georgetown, we pivoted from Russian influence activities to Chinese and Iranian IO state actors.
I’ve been meaning to do this for some time: starting this week, I will be sharing my syllabus and recommended readings from the “Lies, Damned Lies, and Disinformation” course I taught in the spring semester @Georgetown SSP. I’ll be sharing some highlights from each week’s lesson.
3
7
46
This is not an argument against public information sharing. This is an argument against sharing without a coherent plan. If you are going to 'burn' an actor or a campaign ensure that you have a plan to reacquire the adversary if and when they change their TTPs.
1
7
38
This false sense of security could have enabled the other OilRig cells to enjoy more success.
1
0
4
The net result of the Lab Dookhtegan campaign may have been *improvements* to OilRig that complicated a defenders ability to track the various cells and led many, including myself for a time, to believe the campaign targeting Lebanon was the only active one.
1
1
10
OilRig appears to have made efforts to ensure different operational cells linked to them cannot be easily connected via public data so that if one cell is outed the other cells will not be so easily discovered and disrupted.
1
1
7
Since the doxing, OilRig has evolved and made efforts to 'airgap' various campaigns under their purview. The aforementioned blogs document just one of these campaigns - one that targets orgs in Lebanon. OilRig campaigns targeting other countries and sectors continue to this day.
1
0
4
Do these blogs represents the whole of OilRig's activity since April 2019. The answer is a resounding no.
1
0
2
Apart from a small number of blogs from Fireeye, Intezer, and Telsy, security companies have not published about active OilRig campaigns since the original Lab Dookhtegan data dump. The lack of coverage suggested that OilRig was disrupted by the Lab Dookhtegan doxing.
1
0
1
The inclusion of operators identities separates these 'doxing' campaigns from more conventional security blogs that detail only forensic information about a campaign.
1
0
3
Beginning in April 2019, the operators of the Lab Dookhtegan Telegram channel doxed OilRig - a well-known actor believed to be sponsored by the Iranian government. Dumped data included the identities of suspected operators as well as details of attack infrastructure and tools.
2
0
4
Does a doxing a cyber attacker sponsored by an authoritarian state achieve worth while results? An after action review of one case, suggests that this tactic might not have enduring effects and instead may hinder defenders in the long run.
5
35
90
Which Ransomware payload is deployed at the end of a killchain is pretty much a stylistic choice by the attackers. Human Operated Ransomware campaigns overlap in their entry vectors, C2 tools, and lateral movement techniques- and also in viable defenses.
microsoft.com
In human-operated ransomware attacks, adversaries exhibit extensive knowledge of systems administration and common network security misconfigurations, perform thorough reconnaissance, and adapt to...
6
72
156
If Twitter was around during World War II do you think Alan Turing would have been posting about techniques to crack the Enigma?
0
1
15
sharing information with other defenders is vitally important, but we, as a community, have a responsibility to do this in a way that doesn't benefit the adversary.
1
1
6