A9 Development: A blog by Agrajag9

Although long, a highly recommended read: https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-updated.pdf One thing I want to call out is Table 3, where PWC clearly demonstrated an interesting composite indicator of a TTP that appears to be specific to this operation. Specifically, the use of @india.com registrants and ITITCH nameservers. If you have the ability to pivot on this TTP, then you're likely to find a significant number of other similar domains. Happy hunting, y'alls!

Last night one of my CTI sharing groups was discussing a report from FireEye regarding APT29 and domain fronting ( https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html ) when we all realized we had no clue who APT29 is in our own internal systems.  One member finally shared this mess: https://www.google.com/url?sa=t&source=web&rct=j&url=https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/edit&ved=0ahUKEwjNhd-novjSAhVBC2MKHYglAgoQFghIMAQ&usg=AFQjCNFe0KMzzgH09bdHImCB5VxrXo2gIA&sig2=1CI3ffYHiBNLliisz6EbAw Nobody can agree on names.  Even to the untrained eye it's obvious that there's a communication issue present here. The most amazing thing is how simple it would be to fix all of this, but none of these vendors have because #branding #sorrynotsorry #aptlolwut . The excuse "but we'd have to rename everything" is silly, because if you want to present the image of being a quali...

I want to start a series of posts on how to do CND/DFIR/CTI on a budget. I've spent the last decade of my life working in the IT world. I spent about half that time working as a part-time administrator/engineer in a small datacenter within a large corporation. I touched a lot of tech during that time frame and adopted a significant amount of it into my own homelab. But the last five years of my life have been devoted to CND/DFIR/CTI. One of the things I've experienced working in this field has been the vast differences between the large and small companies in terms of capabilities. My current job involves sharing CTI with a wide variety of companies with a wide variety of maturity in terms of CND/DFIR/CTI capabilities. A common complaint I hear from the small-/medium-sized companies is that they could never keep up with the bigger companies because they lack resources. If you fall into this bucket, then this series is for you. A few problems I hope to solve on shoestring ...