A preview of Black Hat 2020

## Overview This Black Hat 2020 preview talk discusses significant cybersecurity campaigns and threat actor activities observed in 2019 and early 2020, focusing on targeted exploitation of activists and evolving Russian threat actor tactics.

## Key Campaigns The speaker highlights a campaign targeting Hong Kong activists through forum-based water holes in January. A full iOS/iPhone exploit and malware implant chain was discovered and analyzed, revealing the implants were under active development with modifications made over several months.

## Russian Threat Actor Evolution The speaker references a 2018 security analyst summit presentation on Russian threat actors (referred to as "bears") and their strategic shift eastward. A key prediction—that traditional flagship implants like x-agent (also called splm) would decline—has materialized. By early 2020, new .NET variants of x-tunnel were observed in Central European telecom targets, indicating a broader shift toward zebra-c tooling rather than traditional malware families. Traditional tools like splm downloaders have "completely fallen off the map," replaced by newer, lower-volume downloaders and server-side approaches.

## Server-Side Scanning Tactics Throughout 2019, multiple reports documented Russian threat actors scanning Exchange servers for vulnerabilities. Interest also extended to SQL servers and SMB servers exposed on the internet, representing a significant tactical shift from traditional malware deployment toward reconnaissance and precise server-side targeting.

## Attribution Challenges The speaker discusses uncertainty around attribution of activity to "cozy duke," noting a lack of direct evidence linking wellness-related findings to this group. Despite statements attributing this activity to cozy duke, the speaker indicates ongoing investigation and plans for colleagues to present more detailed findings at a future webinar. Activity has been tracked since 2018.

## Takeaways Russian threat actor behavior continues evolving toward targeted server-side scanning, precision targeting in Asia and Central Asia, and away from traditional implant deployment. Attribution remains complex, with public statements sometimes outpacing investigative confidence.