Discover and read the best of Twitter Threads about #APT33
Most recents (4)
OK so this is my last week at @Mandiant / @FireEye ๐ข
Here's the truth:
โฅ๏ธ Joining Mandiant was the best decision of my career โ the people & company have been SO good to me
๐ง Many of the brilliant minds in security are here & we have FUN every day
1/8
Here's the truth:
โฅ๏ธ Joining Mandiant was the best decision of my career โ the people & company have been SO good to me
๐ง Many of the brilliant minds in security are here & we have FUN every day
1/8
๐ป๐ There is no better professional #infosec experience than responding to the intrusions that matter & defending at-scale alongside awesome people. If you have the chance to work here โ .
๐๏ธ One year here is worth many more in experience. So here are some highlights:
2/8
๐๏ธ One year here is worth many more in experience. So here are some highlights:
2/8
โ๏ธ Doing LRs & writing decoders during my first Mandiant breach response - with #APT17's HIKIT & also BLACKCOFFEE malware using technet for C2: fireeye.com/blog/threat-reโฆ
๐ฐ I was fortunate to lead the first IR for the group that would come to be known as #FIN7
3/8
๐ฐ I was fortunate to lead the first IR for the group that would come to be known as #FIN7
3/8
In response to increased U.S.-Iran tensions & concerns of retaliatory cyber attacks, Iranian intrusion experts @sj94356 & @QW5kcmV3 are on #StateOfTheHack for the latest on all things Iran: #APT33 #APT34 #APT35 #APT39 #MuddyWater & active UNC groups ๐ฎ๐ท๐จโ๐ป๐ต๏ธโโ๏ธ
@sj94356 @QW5kcmV3 Wait, did @YouTube remove the #StateOfTheHack episode? ๐feye.io/soth ๐
Are we being oppressed? Do they think this is a U.S.-Iran influence operation? ... is it? ๐บ๐ธ๐ฎ๐ทAm I going to get a bunch of weird #MAGA replies to this tweet? I have so many questions ๐ ๐
Are we being oppressed? Do they think this is a U.S.-Iran influence operation? ... is it? ๐บ๐ธ๐ฎ๐ทAm I going to get a bunch of weird #MAGA replies to this tweet? I have so many questions ๐ ๐
For more information on mitigations as well as our public source material supporting the discussion from the show, please check out:
โข APT33 graduation: fireeye.com/blog/threat-reโฆ
brighttalk.com/webcast/10703/โฆ
โข APT33 webinar & examples: fireeye.com/blog/threat-reโฆ
... (more below)
โข APT33 graduation: fireeye.com/blog/threat-reโฆ
brighttalk.com/webcast/10703/โฆ
โข APT33 webinar & examples: fireeye.com/blog/threat-reโฆ
... (more below)
๐จA Tough Outlook for Home Page Attacks
๐fireeye.com/blog/threat-reโฆ
Blog has #APT33 ๐ฎ๐ท, #APT34 ๐ฎ๐ท, and #UNC1194 ๐ด๓ ต๓ ณ๓ ฏ๓ จ๓ ฟ๐ home page persistence & RCE.
๐We talk CVE-2017-11774 patch tampering in-the-wild and made a hardening guide!
๐ฑCool TTPs (pictured) #GuardrailsOfTheGalaxy
๐fireeye.com/blog/threat-reโฆ
Blog has #APT33 ๐ฎ๐ท, #APT34 ๐ฎ๐ท, and #UNC1194 ๐ด๓ ต๓ ณ๓ ฏ๓ จ๓ ฟ๐ home page persistence & RCE.
๐We talk CVE-2017-11774 patch tampering in-the-wild and made a hardening guide!
๐ฑCool TTPs (pictured) #GuardrailsOfTheGalaxy
Here is the #UNC1194 first stage (recon) payload stored in an attacker-controlled @Azure storage blob:
Pretty neat that the attacker (@TrustedSec) can conduct a full intrusion by just swapping the storage blob content for the next stage!
Pretty neat that the attacker (@TrustedSec) can conduct a full intrusion by just swapping the storage blob content for the next stage!
This was a fun one to write with McWhirt & @doughsec. We ended up with 3 registry settings to enforce with Group Policy for CVE-2017-11774 Outlook hardening:
fireeye.com/blog/threat-reโฆ
Final step is to enforce GPO reprocessing.
fireeye.com/blog/threat-reโฆ
Final step is to enforce GPO reprocessing.
OVERRULED: Here's our take on outmaneuvering a potentially destructive adversary fireeye.com/blog/threat-reโฆ
We talk compromise, RULER, and links to APT33.
Infosec Twitter suggests they dropped #SHAMOON ๐ฅ
Shout-out to co-authors: @QW5kcmV3 @_gackerman_ @a_tweeter_user @WylieNewmark
We talk compromise, RULER, and links to APT33.
Infosec Twitter suggests they dropped #SHAMOON ๐ฅ
Shout-out to co-authors: @QW5kcmV3 @_gackerman_ @a_tweeter_user @WylieNewmark
If you liked this part about our threat similarity engine; I have a confession: that is CYBER #machinelearning!
Designed by @BarryV & Nalani F.
Studied & prototyped by our data scientist @secbern.
Learn more here ๐บ: (it's not officially called APTinder)
Designed by @BarryV & Nalani F.
Studied & prototyped by our data scientist @secbern.
Learn more here ๐บ: (it's not officially called APTinder)
If you like Operational Timelines, #AdversaryPursuit has you covered. We're including them in blogs because it's how we operate & it improves #threatintel sharing. Thx @QW5kcmV3
๐ผ๏ธ #1: Suspected #APT33 โฒ๏ธ fireeye.com/blog/threat-reโฆ
๐ผ๏ธ #2: Suspected #APT29 โฒ๏ธ fireeye.com/blog/threat-reโฆ
๐ผ๏ธ #1: Suspected #APT33 โฒ๏ธ fireeye.com/blog/threat-reโฆ
๐ผ๏ธ #2: Suspected #APT29 โฒ๏ธ fireeye.com/blog/threat-reโฆ
