#HITB2016AMS CommSec Track D2 - Anatomy Of An APT Attack

### Overview In this presentation at HITB 2016 Amsterdam (CommSec Track D2), the speaker discusses the real-world operational realities of Advanced Persistent Threats (APTs). Demystifying the buzzword, the talk uses an anonymized nation-state adversary—referred to as the "Democratic Republic of Vango"—to illustrate how state-sponsored cyber espionage campaigns function, target organizations, and how defense and incident response teams handle long-term remediations.

### Key Topics - **Defining the Threat Landscape**: Law enforcement statistics categorizing 98% of cybercrime as easy to moderate, while reserving the remaining 2% for "moderate to hard" threats comprising organized crime, intelligence agencies, and state-sponsored espionage. - **Adversary Objectives & Targets**: Beyond traditional military designs, adversaries focus on corporate and industrial espionage, intellectual property, trade secrets, financial markets/high-frequency trading announcements, critical national infrastructure (CNI), and pharmaceuticals/biotechnology. - **Attacker Ecosystem & Tooling**: The operational lifecycle of an intrusion team, starting from reconnaissance ("the bagman") to initial spear-phishing compromises, pivoting via Active Directory, and maintaining redundant layers of persistence (Team A, Team B, and Team C). - **Remediation Strategy**: Why major incident remediation efforts can span several months and cost millions of pounds, highlighting the strategic necessity of leaving attackers active on compromised networks to study their methods before executing a swift, coordinated eviction over a weekend.

### Technical Details - **Convergence of Low and High-End Threats**: The barrier to entry for lower-level actors has collapsed due to modern post-exploitation utilities like Mimikatz, enabling script kiddies to execute operations that previously required advanced skill. - **Attack Lifecycle**: 1. *Reconnaissance*: A dedicated operator ("bagman") aggregates target dossiers via job postings, personal background, and social engineering vectors to craft high-yield spear-phishing emails. 2. *Initial Access & Persistence*: Upon successful spear-phishing (accounting for roughly 99.9% of initial entries), attackers rapidly establish persistence, perform host/network reconnaissance, and target Active Directory to pivot across systems. 3. *Exfiltration*: Small, strategically impactful files (press releases, trade secrets, market reports) are prioritized over massive data dumps to minimize bandwidth exposure. - **Tiered Adversary Hierarchy**: - *Team A*: The initial compromise team utilizing recognizable off-the-shelf and penetration testing tools (e.g., Metasploit, Mimikatz). - *Team B*: Activated if Team A is discovered and removed; utilizes custom-authored, hand-written assembly malware and deeper persistence mechanisms. - *Team C*: Higher-tier operators deploying low, slow, highly obfuscated techniques considered premier state assets. - **Remediation Methodology**: Instant eviction upon discovery often backfires by causing adversaries to adapt or pivot to hidden backdoors. The speaker outlines an engagement taking six months and £7 million, where defenders monitored the attacker inside the network—tracking their 9-to-5 schedules and national holidays—while systematically improving internal controls, architecture visibility, and logging. Once sufficient intelligence was gathered, eviction and system rebuilding were completed across a single weekend.

### Takeaways - **Threat Intelligence Gaps**: Threat intelligence is often ineffective if organizations collect data without a practical operational plan on how to act upon it. - **Supply Chain Vulnerabilities**: Attackers frequently bypass hardened primary targets by compromising weaker tier-2 and tier-3 suppliers in the integrated supply chain. - **Staff Security Training**: Standard tokenistic annual security awareness training fails; organizations need continuous, bespoke training, baseline tracking, and internal phishing assessments with measurable metrics.