04. x33fcon 2019 - Chaos in the Machine: APT28 Complex by Jason Kitchen & Alex Orleans

Generally, state-nexus threat actors have access to more sophisticated tooling and capabilities than criminal or otherwise financially motivated actors. Based on concerns related to clandestinity and potential geopolitical consequences associated with having their operations exposed, we all tend to assume that their operations are always conceived as the result of thoughtful planning and careful execution (in contrast to more chaotic activity as represented by criminal or hacktivist actors).

However, this notion fails to account for the various motivations at work in the institutions – particularly intelligence services – that are likely the actual executors of state-nexus activities. Factors such as leadership demands, domestic politics, and organizational culture can intersect, creating effects that manifest in operational planning, execution, and reaction to compromises. Through an examination of recent reporting on APT28 and Sandworm activity, we can assess how these phenomenon materialize in a Russian context, demonstrating the chaotic dynamics potentially driving observed threat activity.

----
The idea behind x33fcon (pronounced /'zi:f-kɒn/) is to focus on a very specific need of the security industry: collaboration between blue and red teams (sometimes referred to as purple teaming) It is an event that brings both groups together, and everyone from both sides of the fence are invited to gather, share ideas and discuss thoughts on security.