The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access
Presenters detail vulnerability discovery and exploitation in The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access.
Summary
Talk Premise
Volexity president Stephen Adair introduces the "nearest neighbor attack," describing Russian APT use of nearby Wi-Fi for covert access based on a challenging 2022 engagement the firm can now discuss publicly.
Initial Detection
Investigation began with a custom Carbon Black Defend query flagging ser task.bat in ProgramData launching reg.exe to dump SYSTEM, SECURITY, and SAM hives into out.zip—typical credential-theft behavior on a server.
Early Timeline Clues
EDR showed an unprivileged organizational user RDP'd to the box, extracted defragment serve.zip with WinRAR GUI, and executed bundled scripts. A suspicious unsigned WaysGoose52.dll appeared under a fake Adobe directory with Print Spooler as parent process.
Forensics Response
Volexity prioritizes live memory acquisition over full disk imaging, pushing their Surge collector over RPC while continuing analysis. Adair frames the story as combining zero-day exploitation, skilled tradecraft, and innovative proximity-based access, with geopolitical espionage motivations.
Related talks
Black Hat·41 min
Mathy Vanhoef · Zhiyun Qian · Xin'an Zhou · Juefei Pu · Zhutian Liu · Zhaowei Tan · Srikanth Krishnamurthy
Analysts investigate attack surfaces and defenses concerning AirSnitch: Breaking Client Isolation in Wi-Fi Networks.
Black Hat Asia·40 min
Domien Schepers · Mathy Vanhoef
Industry experts analyze emerging threats surrounding Sweet Dreams: Abusing Sleep Mode to Break Wi-Fi Encryption and Disrupt WPA2/3 Networks.
BSides Prishtina·40 min
Ryan Dinnan
The Dark Side of Wireless Networks: Intro to Wi-Fi Hacking - Megi Bashi.