Adversary Village - Phish Like An APT
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Maasakkers, Sanne
Have you ever wondered what phishing strategy real world APTs use? And how these compare with the scenarios that you use during your Red Team / social engineering activities? If you did, you probably found out that there's a lot of research about APT techniques, tactics and procedures, like the use of specific malware or attack vectors, but there are not many public resources on which techniques those attackers actually use to convince a non-suspecting person to aid them in their operation. In this talk an analysis is presented of hundreds of phishing emails that were used in real campaigns. All characteristics of an email, like the method of influence, tone of speech and used technologies are classified and measures how well a phishing campaign is designed, scoring from “obvious spam” to “near-realistic original mail”. By comparing and measuring the state of these phishing emails,we can learn more about how certain groups operate and how much “effort” they put into their scenarios. This is important knowledge for both attackers and defenders. If you want to know how to phish like you’re an APT, then this talk is for you. Spoiler alert: you might already be a better phisher than these groups.
 Welcome to my presentation about fish like an APT with the slogan phenomenal pretexting for persuasive fishing. In the next 30 minutes I'm going to pitch why we need to think about what we send in a fishing mill during adversary simulation. So first, who am I? My name is Sala Maasokers and I'm from the Netherlands. I think that's why my last name is so hard to pronounce I guess. And I work in the red team and in the research and interfusion team. So that means I do red teaming but also advise companies about threat intel and write strategic reports. If I have to think about two things in my career in the APT or fishing field, I think I have two things I'm really proud of. And first one is that I want successfully fished the white team. So during a red team we had to fish a couple of people and I also sent one of the messages to one person of the white team so they know what we were doing. And that person, well that person knew that we were going to send a fishing mill but still thought this was a real and a legit one instead of the fishing mill we were about to send for the for the simulation. So that's really nice I guess. And the second one is that I was the APT during the biggest cyber crisis exercise. It was last June and I had to create an attack for the well-known country, Raspberry in the Middle East. So I had to make up the TTPs myself and I had to create an attack targeting all governmental and vital organizations of the Netherlands. So that was really nice. Normally you do red teaming for one company and now it was 96 though. It was really a milestone in my career so far. So fishing during adversary simulation. Well we know that fishing is a commonly used technique to get initial access. Research showed that I think around 90% of attacks start with with a fishing email with well a weaponized document for example. So if we look at the MITRE attack framework we see that they have defined technique T1566 which is fishing and has three sub techniques. So the three sub techniques are the spear fishing attachment. So it's a fishing mill with an attachment like a mildoc for example or war archive which is malicious. So you send an email to the victim add an attachment that a victim opens the attachments, executes it and then you infect it the victim. The next one is the spear fishing link. So the email includes a link maybe to a fishing website maybe for credential harvesting, login page. Also could be a link to a known known service for example. So you you host your malicious document for example on google drive or on Dropbox and the last one is spear fishing via surface and I think you see that sometimes that attackers don't use email for delivering your payload or for your weapon delivering your weapon but also services like LinkedIn, Twitter or Telegram. And why do we do that? Why do attackers still fish because it just works every time? Well people still click on it it has a great return on investment so why would you not send a spear fishing email to target an organization? Because we as humans get a lot of email every day and we have to decide every time whether it's a legit email or a fishing email and we have to decide in a split second and in that split second we have to check if it matches everything we got during our security awareness training. So why do people click actually is because we don't know what a legit email or a fishing meal is so we didn't get security awareness trainings. Well that's really bad I think everyone must have a basic knowledge about fishing emails but yeah if you don't know what a fishing email is or a legit email you cannot distinguish them from each other. Well that's really bad and you don't know how to process that email. The second point was is because the email is more advanced than the awareness training coverage. So what I see is that training in security awareness is sometimes really outdated but also sometimes an email is just way more advanced. They're very very hard to distinguish from legit one so yeah your basic training is just not enough to see whether it's legit or not. And the last one is because you're just distracted at the moment so yeah maybe you know everything about fishing emails but you're running kids around the house because you're working from home they kind of get to school because of COVID-19. You have annoying colleagues in teams meetings all day and you still have to clear your inbox or you didn't have your morning coffee yet so you're not as sharp as you would like and in that case sometimes you click on something. So that's why fishing works. For example by influencing as an attacker influencing your your emotions you make easier decisions or a decision decision making is way easier because it associates new information so like a little bit like mental shortcuts and by mental shortcuts I do not mean these shortcuts of course. So if you have a fishing email you want to influence someone to click or to yeah to to interact with the email whether it's login or download or whatever give information. So the influence is based on the email itself it's not only the text it's way more than the text in the email itself. So it's about the link or the attachment so how do you influence clicking on the link? Is the link is it the domain name that is known? Is it something typosquoted for a example? Is it a legit service with hosted malware? Does it contain an attachment? Is that attachment named like an attachment that should be relevant for the for the recipient for example? And next to that we have the content so next to the to the page you have the content how the mail is constructed itself so the email body. So I'm talking about the language what language was used is the language also the used language in the organization. Does it have a design? Is it plain text or is it the copied corporate identity from another known organization or is it just neutral? And does it contain personal information? Sometimes you see that it has the correct salutation so dear miss Salam al-Sakhar or sometimes it also has some some personal information like your email or LinkedIn profile and such so attackers also influence people by using personal information of that person and they got from from open source. And the last one is the context so that everything around the content and debate and the attachment so that could be who's the sender? Is it something somewhere you know? Is it someone internal in your organization? Is it a colleague? Is it from a company you know it or is the company you should know? Or would know? Those are all the possibilities. What is the theme of the email? Is it the relevant activity or is it something you really like? Is it for charity you really like? Is it about your hobbies? Is it about your recent event? Is it the timeless activity just like here's my base slip for example and the goal? What is the goal of the attacker sending the message? Is it getting information by replying and sending it sending you to a login page? Maybe get you a payment done or download an attachment somewhere so it has different goals. So if you combine this all you can create a framework. So that's this framework I made this framework. Next to all these items I just named one of the most important is the principle of influence. So you can apply principles of influence defined by C. Aldini. Yes, define seven principles of influence. You can apply it to every part of an email so the content, the context and the debate for example. So before I start telling about the principles of influence on APT fishing mills I'm going to introduce you to five principles of influence in APT fishing mills. Well C. Aldini defined seven but I think five are only suitable for emails. So I'll show you a couple with a couple of examples. So the first one is reciprocation and that means that if I do something for you you do something for me back. Well that's nice so that's why I want to offer you something so you do something back. I think you see that a lot in emails where they offer coupon if you register or log in or something but you also see them in more malicious emails by offering you, helping you and then ask for a favor. So in this email I notified someone that their account was going to expire and you have to log in to reactivate it. Well as their recipient you're saying okay thank you for letting me know. I will definitely log in because you feel like indebted somehow. So that's the first one. The second one is an email and it was actually highly well it was not copied but I was highly influenced by one of the APT groups. This was an email sent by Lazarus Group in the COVID times and in the email they said a package they sent out a package of temporary timely and targeted measures to support public services people and businesses through this period of disruption caused by COVID-19. So they are offering you a package to help you and the last day to register your business is June 26th 2020 by 2 p.m. and this was sent in in the same week. So actually they want you to do something in a short period of time and you call it scarcity. So you offer something for a short period of time people think we need to do this we don't want to miss out and we should click. You also see that the websites and the phishing emails oh only one day left we only have a limited stock please buy from us. Well this is a principle of influence that is proven to to be a working principle. And then the third one is authority and I think this is a really clear one. If someone sends you a mail from a proven or known authority I think you're more likely to click on that link or on the attachment. So in this example I use the CEO which is just like CEO fraud. Okay you must ensure that all the pending deal of payment shall be completed by the end of the day. This was an example highly inspired by TA 505 email. So I saw this email several times asking if you could please do a payment and payment instructions and information was in the attachment. So this is one that really works as well. And then the next one is the principle of liking. If someone has shared interest or you just like someone because it's a colleague and it's a known person you are more likely to interact with the email. So now I made an email it was a little bit inspired by an email of APT 28 where I say ho ho ho it's almost Christmas and the elves are working really hard and have a message for you. And it was sent by Santa or the holiday committee committee from the organization. You think I really like that person they also really like really nice Christmas branches. I'm going to click on that link because I want to see my Christmas greeting. And the last one but definitely not the least I really like this one is the principle of social proof. I have here an example it's a it's a LinkedIn header and maybe you would think okay but why is this principle social proof. This principle of social proof is like if someone likes it you really know then you would also like it. And this one is inspired by also a Lazarus Lazarus attack because there was a person they created a personal LinkedIn added a lot of your colleagues and then wanted to chat with you. So you check out the connections the shared connections and you see okay I have a lot of shared connections. So this person should be a nice person or I could trust this person. So this is the way that they wanted to influence the person receiving the connection request from Wilson. I think in the real life you also see this a lot on the website booking.com. They are really good influencers because it's also known that the principle of social proof is used on the website by saying 40 people of your country book this room today. Hurry up hurry up. That's also the principle of social proof because you know that a lot of people from the same country also booked that hotel so it should be right right. So these are the principles of influence and now I'm going to apply those principles of influence and everything what is in an email on emails of an APT. So first I need emails of an APT of course. So I needed an adversary the email data set. So first okay I need adversaries which ones are the most suitable for my research. So first check out all the adversaries who have a phishing procedure defined. Well you can check out the micro attack framework and you see that there are a lot of adversaries using spear phishing. So that's really nice. Second is okay I need to choose what kind of groups are interesting for my adversary emulation. So during a C-Best or a Tiber you have to select a real threat for the organization. So I need a real threat for the organization. What are the most most likely threats for an organization that's the insider threat a crime group a nation state and a nation state slash proxy. Well insider threat is not going to work if I want to do an adversary simulation so I have crime groups and nation states left. So with this information and choosing multiple groups over the world I came with TA 505 APT 28 APT 40 and APT 38. So these are the four groups I selected for my research because these are really good groups we should use during our next adversary emulation. So how do I do the research then? I got a lot of emails. I got some from my threat intel colleagues which are really bad as in gathering these but I also found a lot on fire custodial because you can find for attachments with attack attachment and if you know the IOC's of the or the hashes of the malware docs you can find the parent email parent of that of those documents as well on fire custodial if you do some advanced searching. So that's why that's how I found 200 emails of APTs. And the next one is getting sprinkles from research. A lot of companies did already a lot of research on this or not on this topic but fishing of APTs so they presented it in a research report okay we saw a full attack of this APT and it started with this email. So I gathered all the screenshots of those of those fishing emails and also used it to enrich my first data set. And the last one is finding the associated IOC's of these APTs for example domains will tell you how the fishing domains are constructed. If you find Moldogs you see how they use the principle principle of influence in the Moldogs etc. So find also other information and other sources about these APTs. So now we're going to apply the research of principles of influence on those groups. So first my first one is Russia. So it works on Russia and I start with the least advanced to the most advanced. So I start with TA505 that's not really an APT but I guess you also have to emulate crime groups during CPSL or Tiber so that's why I choose this one. It's TA505 located in Russia and I would call this group hashtag lazy mode. It's really a lazy mode because they're not really an influencer to be honest. So what I see is that they use they don't use really they don't use influencing techniques in their mail. They just say this email is sent automatically or please see attachment or please pay this by the end of the day. So yeah maybe a little bit of scarcity but not really that they are using they are using the the principles of influence in their meals. What I saw is that emails are impersonal can be sent to anyone so there is no right information personal information right salutation or whatever in the email. Next one and I think that's really funny the sender email address is not matching the sender name. What TA505 does is compromise a lot of email accounts and send emails from those compromised email accounts so that they have the DKM and the DMARC set correct so it won't end up in your spam folder. So they send emails from those compromised account but they change the sender names of it so it looks like it's the sender and what they do is that they add HTML attachments or Moldox's attachments and sometimes they also host it on a website. I see this more nowadays with TA505 because it's really hard to if a dspam filter is in the fire skin and stuff like that. So I have three examples of those emails where you can see the lazy mode with the sender email address and the sender name so this is the first one the second one and the third one and you see it's in all the three emails it sent from Krishna class but the email addresses are different every time. So this is what TA505 does let's go to a more advanced one and that's APT28. And what I see in APT28 that they use two main principles of influence and that's principles of liking and authority because they are using an external company and known company copy everything from that and send emails so they send with spoofed domain names spoofed email addresses for example or they use authority by spoofing from an internal colleague or an internal CEO or something. So they use the corporate identity of another organization like Google or they just use plain text or use the corporate identity used in the organization they are sending from. And what I see is that they use domain names which are type of squatted with predictable patterns so for example when you have a subdomain they use the full name but replace the subdomain by a dash so if you have the website wanderout.ofs365.com they use the domain name ofs365-wanderout.com so that's one and they use the tlds of a domain name in a domain name itself so for example when it's nato.int they use nato-int.com to make it look legit and next to that they also use the the regular type of squad kind of things like using an rnn to bnm for example. So these are two examples this is the first one it's by google this is the one used to to disrupt the ehyler cleansing campaign a couple of years ago in usa and this is the second one here you see that you use the principle of liking someone has the same interest this is really on your it's a known authority in the same area as where you work in so they use it this kind of way. Then the next one going over to china i chose apt40 well i don't know if they're still active if you see the news from last weeks so what do they use they use the principle of liking and they pick relevant themes for the recipients so they use the local news they use activities and events in their emails and those are the main theme of the phishing mills so to do that in order to do that they do profiling of the victim by using open sources to get more information about the victim and then reach the email with that kind of information to make it more relevant and what i see that the level of the phishing mill is really diverse so i see typos all the way everywhere and i see really well crafted emails so well maybe it's because there are a couple of people with diverse levels of sending emails but it could also be that they have someone for creating the well-crafted emails and when you interact they don't have that person so it's it's not that good anymore and what i see is that they use mild oxen and tetramus or hosted on google drive for example and when they send you to their own website or a compromised website you can download you can download one of their their droppers and it downloads a payload for you and redirects it to two or legit documents they also pack with it and the last one and that's North Korea and it's it's 38 or Lazarus group and i think this is my favorite as long as you can if you can have a favorite apt but this is definitely my favorite apt because it knows how to social engineer they are building full characters or impersonating real people to influence a person they literally use every principle of of influence in their in their campaigns so they're using email, LinkedIn, Telegram or Twitter for communicating with the people so first do your initial chat on LinkedIn then go to Telegram that was described in the camp in the dream job campaign research they always use important value for the recipient they do a lot they target a lot of military organizations so they read a lot about military operations in order to make it more legit they spoof email addresses or create an unknown company so if you are a recruitment company you can also just register a new domain name and call your recruitment company that way so that's what they do and they use Dropbox or OneWrite for delivering malware as well and they are adapting to the language and form of speech but it's not always flawless so a couple of slides earlier i showed you the Rob Wilson LinkedIn profile i created based on information in research and this is how it which these are the next steps after someone connected with that Rob Wilson you see that it sends a message i like to chat with you for a job opportunity and then bonds with the person and then add them on on Telegram and have some have some conversations this one is one is about an assessment someone needs to do in order to check if it has to write expertise and send someone to a website this was this was covered in in the research of this company so concluding during your next adversary emulation i would please ask you just not grab the default scenario from the shelf you have you always use because it just works please use your creativity and create something that's really like the the adversary you have to emulate during during the assignment check influence by using the content of the of the email and the context so not only change the the text of the email but make it a full package check if there's a design check if they they use type of squad domains etc but keep in mind when you're performing an adversary emulation you have maybe a couple of weeks maybe a couple of months a real adversaries have like a couple of months or years to perform the attack so keep this in mind sometimes you have to make choices based on the time you have so sometimes you have to have to make it a little bit more advanced in order to have someone click on the link or execute or open your attachment so if you want to read a little bit more about this research or you want to use it during your next adversary emulation you can go to to my blog it's here with the link and I made for the four um uh adversaries I made a full list with examples what to use or what not to use during your next fishing campaign so this was my presentation I hope you liked it and if you have some questions please drop it in the chat and for now thank you very much
 Welcome to my presentation about fish like an APT with the slogan  phenomenal pretexting for persuasive fishing. In the next 30 minutes I'm going to pitch why we  need to think about what we send in a fishing mill during adversary simulation. So first,  who am I? My name is Sala Maasokers and I'm from the Netherlands. I think that's why my last name  is so hard to pronounce I guess. And I work in the red team and in the research and interfusion team.  So that means I do red teaming but also advise companies about threat intel and write strategic  reports. If I have to think about two things in my career in the APT or fishing field, I think I  have two things I'm really proud of. And first one is that I want successfully fished the white  team. So during a red team we had to fish a couple of people and I also sent one of the messages  to one person of the white team so they know what we were doing. And that person, well that person  knew that we were going to send a fishing mill but still thought this was a real and a legit one  instead of the fishing mill we were about to send for the for the simulation. So that's really nice  I guess. And the second one is that I was the APT during the biggest cyber crisis exercise.  It was last June and I had to create an attack for the well-known country,  Raspberry in the Middle East. So I had to make up the TTPs myself and I had to create an attack  targeting all governmental and vital organizations of the Netherlands. So that was really nice.  Normally you do red teaming for one company and now it was 96 though. It was really a milestone in  my career so far. So fishing during adversary simulation. Well we know that fishing is a commonly  used technique to get initial access. Research showed that I think around 90% of attacks start  with with a fishing email with well a weaponized document for example. So if we look at the  MITRE attack framework we see that they have defined technique T1566 which is fishing and  has three sub techniques. So the three sub techniques are the spear fishing attachment.  So it's a fishing mill with an attachment like a mildoc for example or war archive  which is malicious. So you send an email to the victim add an attachment that a victim  opens the attachments, executes it and then you infect it the victim. The next one is the spear  fishing link. So the email includes a link maybe to a fishing website maybe for credential harvesting,  login page. Also could be a link to a known known service for example. So you  you host your malicious document for example on google drive or on Dropbox and the last one  is spear fishing via surface and I think you see that sometimes that attackers don't use email for  delivering your payload or for your weapon delivering your weapon but also services like LinkedIn,  Twitter or Telegram. And why do we do that? Why do attackers still fish because it just works every  time? Well people still click on it it has a great return on investment so why would you not send  a spear fishing email to target an organization? Because we as humans get a lot of email every  day and we have to decide every time whether it's a legit email or a fishing email and we have to  decide in a split second and in that split second we have to check if it matches everything we got  during our security awareness training. So why do people click actually is because we don't know  what a legit email or a fishing meal is so we didn't get security awareness trainings.  Well that's really bad I think everyone must have a basic knowledge about fishing emails  but yeah if you don't know what a fishing email is or a legit email you cannot distinguish them  from each other. Well that's really bad and you don't know how to process that email. The second  point was is because the email is more advanced than the awareness training coverage. So what I see  is that training in security awareness is sometimes really outdated but also sometimes  an email is just way more advanced. They're very very hard to distinguish from  legit one so yeah your basic training is just not enough to see whether it's legit or not. And  the last one is because you're just distracted at the moment so yeah maybe you know everything  about fishing emails but you're running kids around the house because you're working from home  they kind of get to school because of COVID-19. You have annoying colleagues in teams meetings  all day and you still have to clear your inbox or you didn't have your morning coffee yet so  you're not as sharp as you would like and in that case sometimes you click on something. So that's why  fishing works. For example by influencing as an attacker influencing your your emotions you make  easier decisions or a decision decision making is way easier because it associates new information  so like a little bit like mental shortcuts and by mental shortcuts I do not mean these shortcuts  of course. So if you have a fishing email you want to influence someone to click or to yeah to  to interact with the email whether it's login or download or whatever give information. So the  influence is based on the email itself it's not only the text it's way more than the text in the  email itself. So it's about the link or the attachment so how do you influence clicking  on the link? Is the link is it the domain name that is known? Is it something typosquoted for a  example? Is it a legit service with hosted malware? Does it contain an attachment? Is that  attachment named like an attachment that should be relevant for the for the recipient for example?  And next to that we have the content so next to the to the page you have the content how the  mail is constructed itself so the email body. So I'm talking about the language what language was  used is the language also the used language in the organization. Does it have a design? Is it plain  text or is it the copied corporate identity from another known organization or is it just neutral?  And does it contain personal information? Sometimes you see that it has the correct  salutation so dear miss Salam al-Sakhar or sometimes it also has some some personal information like  your email or LinkedIn profile and such so attackers also influence people by using personal  information of that person and they got from from open source. And the last one is the context  so that everything around the content and debate and the attachment so that could be  who's the sender? Is it something somewhere you know? Is it someone internal in your organization?  Is it a colleague? Is it from a company you know it or is the company you should know?  Or would know? Those are all the possibilities. What is the theme of the email? Is it the relevant  activity or is it something you really like? Is it for charity you really like? Is it about your  hobbies? Is it about your recent event? Is it the timeless activity just like here's my base slip  for example and the goal? What is the goal of the attacker sending the message?  Is it getting information by replying and sending it sending you to a login page?  Maybe get you a payment done or download an attachment somewhere so it has different goals.  So if you combine this all you can create a framework. So that's this framework I made this  framework. Next to all these items I just named one of the most important is the principle of  influence. So you can apply principles of influence defined by C. Aldini. Yes, define seven  principles of influence. You can apply it to every part of an email so the content, the context and  the debate for example. So before I start telling about the principles of influence on APT  fishing mills I'm going to introduce you to five principles of influence in APT fishing mills.  Well C. Aldini defined seven but I think five are only suitable for emails. So I'll show you a couple  with a couple of examples. So the first one is reciprocation and that means that if I do something  for you you do something for me back. Well that's nice so that's why I want to offer you something  so you do something back. I think you see that a lot in emails where they offer coupon if you  register or log in or something but you also see them in more malicious emails by offering you,  helping you and then ask for a favor. So in this email I notified someone that their account was  going to expire and you have to log in to reactivate it. Well as their recipient you're saying okay  thank you for letting me know. I will definitely log in because you feel like indebted somehow.  So that's the first one. The second one is an email and it was actually highly well it was not  copied but I was highly influenced by one of the APT groups. This was an email sent by Lazarus Group  in the COVID times and in the email they said a package they sent out a package of temporary  timely and targeted measures to support public services people and businesses through this  period of disruption caused by COVID-19. So they are offering you a package to help you  and the last day to register your business is June 26th 2020 by 2 p.m. and this was sent in  in the same week. So actually they want you to do something in a short period of time and you call  it scarcity. So you offer something for a short period of time people think we need to do this we  don't want to miss out and we should click. You also see that the websites and the phishing  emails oh only one day left we only have a limited stock please buy from us. Well this is a principle  of influence that is proven to to be a working principle. And then the third one is authority  and I think this is a really clear one. If someone sends you a mail from a proven or known authority  I think you're more likely to click on that link or on the attachment. So in this example I use the  CEO which is just like CEO fraud. Okay you must ensure that all the pending deal of payment shall  be completed by the end of the day. This was an example highly inspired by TA 505 email. So I saw  this email several times asking if you could please do a payment and payment instructions and  information was in the attachment. So this is one that really works as well. And then the next one  is the principle of liking. If someone has shared interest or you just like someone because it's  a colleague and it's a known person you are more likely to interact with the email. So now I made  an email it was a little bit inspired by an email of APT 28 where I say ho ho ho it's almost Christmas  and the elves are working really hard and have a message for you. And it was sent by Santa or the  holiday committee committee from the organization. You think I really like that person they also  really like really nice Christmas branches. I'm going to click on that link because I want to see  my Christmas greeting. And the last one but definitely not the least I really like this one  is the principle of social proof. I have here an example it's a it's a LinkedIn header and  maybe you would think okay but why is this principle social proof. This principle of social  proof is like if someone likes it you really know then you would also like it. And this one is inspired  by also a Lazarus Lazarus attack because there was a person they created a personal LinkedIn  added a lot of your colleagues and then wanted to chat with you. So you check out the connections  the shared connections and you see okay I have a lot of shared connections. So this person should be  a nice person or I could trust this person. So this is the way that they wanted to influence  the person receiving the connection request from Wilson. I think in the real life you also see this  a lot on the website booking.com. They are really good influencers because it's also known that the  principle of social proof is used on the website by saying 40 people of your country book this room  today. Hurry up hurry up. That's also the principle of social proof because you know  that a lot of people from the same country also booked that hotel so it should be right right.  So these are the principles of influence and now I'm going to apply those principles of influence  and everything what is in an email on emails of an APT. So first I need emails of an APT of course.  So I needed an adversary the email data set. So first okay I need adversaries which ones are the  most suitable for my research. So first check out all the adversaries who have a phishing procedure  defined. Well you can check out the micro attack framework and you see that there are a lot of  adversaries using spear phishing. So that's really nice. Second is okay I need to choose what kind  of groups are interesting for my adversary emulation. So during a C-Best or a Tiber you have to select  a real threat for the organization. So I need a real threat for the organization. What are the most  most likely threats for an organization that's the insider threat a crime group a nation state  and a nation state slash proxy. Well insider threat is not going to work if I want to do  an adversary simulation so I have crime groups and nation states left. So with this information  and choosing multiple groups over the world I came with TA 505 APT 28 APT 40 and APT 38.  So these are the four groups I selected for my research because these are really good groups  we should use during our next adversary emulation. So how do I do the research then?  I got a lot of emails. I got some from my threat intel colleagues which are really bad as in  gathering these but I also found a lot on fire custodial because you can find for attachments  with attack attachment and if you know the IOC's of the or the hashes of the malware docs you can  find the parent email parent of that of those documents as well on fire custodial if you do some  advanced searching. So that's why that's how I found 200 emails of APTs.  And the next one is getting sprinkles from research. A lot of companies did already a lot of  research on this or not on this topic but fishing of APTs so they presented it in a research report  okay we saw a full attack of this APT and it started with this email. So I gathered all the  screenshots of those of those fishing emails and also used it to enrich my first data set.  And the last one is finding the associated IOC's of these APTs for example domains will tell you  how the fishing domains are constructed. If you find Moldogs you see how they use the principle  principle of influence in the Moldogs etc. So find also other information and other sources about  these APTs. So now we're going to apply the research of principles of influence on those groups. So  first my first one is Russia. So it works on Russia and I start with the least advanced to the most  advanced. So I start with TA505 that's not really an APT but I guess you also have to emulate crime  groups during CPSL or Tiber so that's why I choose this one. It's TA505 located in Russia  and I would call this group hashtag lazy mode. It's really a lazy mode because they're not really  an influencer to be honest. So what I see is that they use they don't use really they don't use  influencing techniques in their mail. They just say this email is sent automatically or please  see attachment or please pay this by the end of the day. So yeah maybe a little bit of scarcity but  not really that they are using they are using the the principles of influence in their meals.  What I saw is that emails are impersonal can be sent to anyone so there is no  right information personal information right salutation or whatever in the email. Next one  and I think that's really funny the sender email address is not matching the sender name.  What TA505 does is compromise a lot of email accounts and send emails from those compromised  email accounts so that they have the DKM and the DMARC set correct so it won't end up in your spam  folder. So they send emails from those compromised account but they change the sender names of it  so it looks like it's the sender and what they do is that they add HTML attachments or Moldox's  attachments and sometimes they also host it on a website. I see this more nowadays with TA505  because it's really hard to if a dspam filter is in the fire skin and stuff like that. So I have three  examples of those emails where you can see the lazy mode with the sender email address and the  sender name so this is the first one the second one and the third one and you see it's in all the  three emails it sent from Krishna class but the email addresses are different every time.  So this is what TA505 does let's go to a more advanced one and that's APT28.  And what I see in APT28 that they use two main principles of influence and that's  principles of liking and authority because they are using an external company and known company  copy everything from that and send emails so they send with spoofed domain names spoofed  email addresses for example or they use authority by spoofing from an internal colleague or  an internal CEO or something. So they use the corporate identity of another organization like  Google or they just use plain text or use the corporate identity used in the organization  they are sending from. And what I see is that they use domain names which are type of squatted  with predictable patterns so for example when you have a subdomain they use the full name  but replace the subdomain by a dash so if you have the website wanderout.ofs365.com they use  the domain name ofs365-wanderout.com so that's one and they use the tlds of a domain name in a  domain name itself so for example when it's nato.int they use nato-int.com to make it look legit  and next to that they also use the the regular type of squad kind of things like using an rnn to bnm  for example. So these are two examples this is the first one it's by google this is the one used to  to disrupt the ehyler cleansing campaign a couple of years ago in usa and this is the second one  here you see that you use the principle of liking someone has the same interest this is really on  your it's a known authority in the same area as where you work in so they use it this kind of way.  Then the next one going over to china i chose apt40 well i don't know if they're still active  if you see the news from last weeks so what do they use they use the principle of liking  and they pick relevant themes for the recipients so they use the local news they use activities  and events in their emails and those are the main theme of the phishing mills so to do that in  order to do that they do profiling of the victim by using open sources to get more information  about the victim and then reach the email with that kind of information to make it more relevant  and what i see that the level of the phishing mill is really diverse so i see typos all the way  everywhere and i see really well crafted emails so well maybe it's because there are a couple of  people with diverse levels of sending emails but it could also be that they have someone for creating  the well-crafted emails and when you interact they don't have that person so it's it's not that good  anymore and what i see is that they use mild oxen and tetramus or hosted on google drive for example  and when they send you to their own website or a compromised website you can download  you can download one of their their droppers and it downloads a payload for you and redirects it to  two or legit documents they also pack with it and the last one and that's North Korea and  it's it's 38 or Lazarus group and i think this is my favorite as long as you can if you can have a  favorite apt but this is definitely my favorite apt because it knows how to social engineer they  are building full characters or impersonating real people to influence a person they literally use  every principle of of influence in their in their campaigns so they're using email,  LinkedIn, Telegram or Twitter for communicating with the people so first do your initial  chat on LinkedIn then go to Telegram that was described in the camp in the dream job campaign  research they always use important value for the recipient they do a lot they target a lot of  military organizations so they read a lot about military operations in order to make it more  legit they spoof email addresses or create an unknown company so if you are a recruitment  company you can also just register a new domain name and call your recruitment company that way  so that's what they do and they use Dropbox or OneWrite for delivering malware as well  and they are adapting to the language and form of speech but it's not always flawless so a couple  of slides earlier i showed you the Rob Wilson LinkedIn profile i created based on information  in research and this is how it which these are the next steps after someone connected  with that Rob Wilson you see that it sends a message i like to chat with you for a job opportunity  and then bonds with the person and then add them on on Telegram and have some have some  conversations this one is one is about an assessment someone needs to do in order to check if  it has to write expertise and send someone to a website this was this was covered in in the  research of this company so concluding during your next adversary emulation i would please  ask you just not grab the default scenario from the shelf you have you always use because it just  works please use your creativity and create something that's really like the the adversary  you have to emulate during during the assignment check influence by using the content of the of  the email and the context so not only change the the text of the email but make it a full  package check if there's a design check if they they use type of squad domains etc but keep in mind  when you're performing an adversary emulation you have maybe a couple of weeks maybe a couple of  months a real adversaries have like a couple of months or years to perform the attack so keep this  in mind sometimes you have to make choices based on the time you have so sometimes you have to  have to make it a little bit more advanced in order to have someone click on the link or execute or  open your attachment so if you want to read a little bit more about this research or you want to  use it during your next adversary emulation you can go to to my blog it's here with the link and  I made for the four um uh adversaries I made a full list with examples what to use or what not to use  during your next fishing campaign so this was my presentation I hope you liked it and if you  have some questions please drop it in the chat and for now thank you very much
DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_0_479.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_480_683.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_684_2939.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_2940_3467.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_3468_6311.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_6312_8063.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_8064_10139.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_10140_14147.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_14148_15503.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_15504_16847.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_16848_21275.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_21276_23783.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_23784_25643.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_25644_28475.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_28476_28955.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_28956_30227.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_30228_31979.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_31980_32039.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_32040_32459.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_32460_33287.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_33288_35051.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_35052_35711.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_35712_35819.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_35820_36383.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_36384_38075.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_38076_38219.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_38220_38303.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_38304_38351.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_38352_38483.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_38484_38555.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_38556_38603.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_38604_38783.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_38784_38831.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_38832_38927.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_38928_39059.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_39060_39251.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_39252_39311.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_39312_39419.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_39420_41171.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_41172_41747.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_41748_42347.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_42348_43823.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_43824_44231.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_44232_44435.png DEF_CON_29_Adversary_Village_-_Sanne_Maasakkers_-__eJPx-Vr-U8E_44436_44437.png