Phish Like an APT
Sanne Maasakkers analyzes real-world nation-state phishing strategies, comparing APT psychological pretexts with traditional red team social engineering.
Summary
Analyzing Real-World APT Phishing Campaigns
While security research heavily documents nation-state malware and exploit chains, the specific social engineering pretexts used to deliver those payloads receive less empirical focus.
Deconstructing Nation-State Phishing Strategies
Sanne Maasakkers investigates real-world APT spear-phishing campaigns, analyzing how threat actors tailor pretexts to target industries, geopolitics, and current events.
Comparing APT Pretexts to Red Team Scenarios
Maasakkers compares sophisticated APT lures with standard commercial red team phishing templates, highlighting common oversights in enterprise simulations.
Building Realistic Threat Emulation Phishing Programs
The author provides red teams with frameworks for designing realistic, high-fidelity phishing campaigns based on genuine threat actor OSINT research.
Related talks
Village Presentations·44 min
Wayne Crowder
Wayne Crowder draws parallels between professional sport fishing and targeted phishing, illustrating how environmental recon yields high-yield social engineering.
Main Stage·36 min
C Tafani-Dereeper · M Muir
Examines campaigns by nation-state actors (such as Iranian and DPRK groups) targeting cybersecurity researchers and think tanks via social engineering.
Social Engineering Village·51 min
Chris Silvers, Taylor Banks
DEF CON SECTF champions demonstrate advanced hunting techniques—combining phishing, OSINT, and red team tactics to track and engage targets.