In August 2017, a targeted attack was attempted against a well-established corporation. he attack was carried out using innovative exploitation methods and unknown and heavily packed malware.

The first stage of the attack was exploiting websites, but once the attacker established a beachhead he dropped his arsenal and started a complex and innovative tactic importing and executing his tools together with a Sandboxie DLL. The DLL was used to bypass the signature and defuse security controls such as the Antivirus, the Host Intrusion Prevention System and Windows Security controls.

The adoption of this undocumented technique allow the attacker to implant his heavily packed malware and start harvesting data from the Company.

This is our story, the story starts from a strange webpage loaded by a user and goes along for the entire investigation and remediation processes, where a team of specialists hired to fight an unknown attacker who has already taken the upper hand upon several segments of the corporate network.

The presentation will show the initial exploitation method, the subsequent tools used by the attacker to move laterally to core networks and the technique adopted by the Adversary to implant his malware to the core systems.

Details:

Date: Friday - May 16
Time: 10:00
Length: minutes
Location: Grand Ballroom D

Speakers:

Stefano Maccaglia

Malware Analyst, part of RSA IR team. I have worked in several IR investigations worldwide. I was an active hacker in …