No Question: TeamViewer, Police, and Consequence
Recounts the investigation and law enforcement aftermath of an internal keylogger breach traced through TeamViewer logs and OSINT.
Summary
Discovering an Internal Network Breach
Following attendance at DEF CON Blue Team Village, an analyst uncovers a massive compromise at a non-profit client where a malicious actor deployed keyloggers across more than a hundred workstations.
Log Parsing and OSINT Attribution
Lacking enterprise SIEM or IDS infrastructure, the responder manually parses server logs, uncovers suspicious TeamViewer connection artifacts, and leverages OSINT to identify the perpetrator's physical residence.
Law Enforcement Engagement and Confession
A criminal dossier handed to local cybercrime investigators leads to a search warrant and a full confession, proving definitively that an insider was behind the widespread deployment.
The Complex Aftermath of Real-World Breaches
Despite conclusive findings, unexpected organizational politics and undisclosed decisions result in no criminal charges being filed, illustrating the challenging real-world dynamics defenders navigate.
Related talks
Blue Team Village·46 min
Project Obsidian
Project Obsidian explains forensic preparation and tooling organization to accelerate digital forensics and incident triage workflows.
RSAC Cybersecurity·10 min
Presenters detail vulnerability discovery and exploitation in Who is Who During a Cyber Incident Response Investigation.
RSA Conference (RSAC)·50 min
Reviews investigation & Incident Response Challenges for the Hybrid Enterprise and evaluates key implications for security practitioners.