OopsSec: The Bad, the Worst, and the Ugly of APT Operations Security
SafeBreach research director Tomer Bar exposes hilarious and critical operational security blunders made by state-sponsored Advanced Persistent Threat (APT) groups.
Summary
The Fallibility of Advanced Threat Actors
While state-sponsored APT groups possess sophisticated zero-days and massive budgets, their human operators frequently make catastrophic operational security (OPSEC) mistakes.
Analyzing Real-World Nation-State Blunders
Tomer Bar reviews case studies involving Iranian, Russian, and North Korean threat groups leaking internal development logs and leaving debugging symbols in production malware.
Tracking Developer Identity Leaks and Infrastructure Reuse
Bar demonstrates how reusing test domain names, personal email accounts, and staging GitHub repos enabled analysts to unmask threat actor identities.
Operationalizing Adversary OPSEC Failures for Threat Hunting
The presentation provides threat intelligence analysts with methodologies for hunting developer artifacts and tracking threat actor infrastructure pivots.
Related talks
Blue Team Village·55 min
Meisam Eslahi
Meisam Eslahi presents advanced threat hunting tradecraft to track stealthy adversaries lurking across enterprise infrastructure.
Adversary Village·30 min
Mark Loveless
Industry veteran Mark Loveless dissects the origin of the term 'APT', detailing nation-state attribution methodologies using an actual attack on his home network.
Recon Village·29 min
Ladislav Baco
Ladislav Baco demonstrates how independent threat researchers can discover nation-state APT campaigns through proactive telemetry hunting and pivoting.