Скачать или смотреть Follow the Dynamite: Commemorating TeamTNT's Cloud Attacks

Follow the Dynamite: Commemorating TeamTNT's Cloud Attacks
Speakers: Nicole Fishbein (Intezer, IL), Joakim Kennedy (Intezer, IE)

About Speakers:
Nicole Fishbein is a security researcher and malware analyst. Prior to Intezer she was an embedded researcher in the Israel Defense Forces (IDF) Intelligence Corps. Nicole has been part of research that led to discovery of phishing campaigns, undetected malware and attacks on Linux-based cloud environments.

Dr. Joakim Kennedy is a Security Researcher for Intezer. On a daily basis he analyzes malware, tracks threat actors, and solves security problems. His work is mainly focused on threats that target Linux systems and Cloud environments. Dr. Kennedy began in the industry as a security researcher at Rapid7 where he got his start in vulnerability research. Following his time with Rapid7, he joined Anomali. While there, he managed Anomali's Threat Research Team, where they focused on creating threat intelligence. Dr. Kennedy has been a featured speaker at multiple BSides and at the CCB's Quarterly Cyber Threat Report Event. He has also presented at various other industry events. For the last few years, Dr. Kennedy has been researching malware written in Go. To make the analysis easier he has written the Go Reverse Engineering Toolkit (github.com/goretk), an open-source toolkit for analysis of Go binaries.

----

Cloud computing is growing swiftly and misconfigured cloud services can be low-hanging fruit for an attacker. Misconfigured cloud services are swiftly compromised by threat actors, recent studies found that 80% of honeypots were infected within a day and all the honeypots within seven days. Most of these misconfigurations are exploited to engage in cryptojacking, with TeamTNT being one of the most active threat actors in this field. TeamTNT is a well known threat actor group that systematically targets Linux servers and also compromises Kubernetes clusters and servers running Docker. This presentation will cover the evolution of TeamTNT's activity, including TTPs throughout the various campaigns and services they targeted, such as Redis and Windows servers. The scripts and tools used in each of their campaigns will be presented, along with TeamTNT's uniqueness when it comes to targeting cloud and ways you can identify their tools in your environment.