This talk, "In-Depth Study of Linux Rootkits," will provide a comprehensive examination of the evolution of Linux rootkits, from their inception to the sophisticated variants seen today.

Participants will gain insights into advanced rootkit techniques, effective detection strategies, and the future landscape for defenders. By exploring the historical context, current methodologies, and emerging threats, attendees will have the knowledge and tools necessary to safeguard Linux systems against rootkit attacks.

Beginning with an introduction to the fundamental capabilities of Linux rootkits, this talk traces the history of these malicious tools from their origins to their increasingly sophisticated techniques. It categorizes rootkits into kernel-level, user-mode, and hybrid types, explaining their respective methods for hooking kernel functions, intercepting user-space processes, and combining techniques from both realms. The discussion includes an analysis of rootkit persistence mechanisms and stealth techniques, which allow them to remain undetected.

Next, we shift to detection strategies, starting with signature-based detection, which involves identifying known rootkits through specific patterns but also addresses the limitations of this approach. It explores behavioral analysis by monitoring system anomalies and presents case studies demonstrating the effectiveness of this method. The importance of integrity checking is highlighted, emphasizing the challenges in maintaining accurate baselines for system files and binaries.

Furthermore, this talk reviews advanced detection tools and frameworks, providing an overview of popular rootkit detection tools and practical demonstrations of their use. This comprehensive analysis underscores the ongoing battle between rootkit developers and cybersecurity professionals, emphasizing the need for continuous advancements in detection and mitigation techniques.

In recent times, ransomware actors have been increasingly using the Bring Your Own Vulnerable Driver (BYOVD) technique, but what does it actually mean? What types of drivers are suitable for BYOVD? Which drivers are they bringing and why? Which vulnerabilities are exploited and what is the purpose of exploiting them? How is it all done and which threat actors have been using them?

This presentation introduces BYOVD technique, digs deeper into driver vulnerabilities and their exploitation by ransomware threat actors. First, we investigate three primary classes of vulnerabilities in legacy Windows drivers abused by threat actors: arbitrary MSR writes, arbitrary kernel memory writes, and insufficient access controls. These vulnerabilities enable attackers to escalate privileges, load unsigned code, bypass EDR software and conduct other activities leading to the final payload.

We shift our focus on ransomware groups leveraging BYOVD for their operations, including Kasseika, Akira, Qilin, BlackByte, and RansomHub. We discuss BYOVD related TTPs of ransomware groups active in 2024.

Our session also briefly discusses Windows exploit mitigations designed to counter these threats. Features like Virtualization-Based Security (VBS), Hypervisor-Protected Code Integrity (HVCI), Kernel Control Flow Guard (kCFG), and kernel shadow stacks play crucial roles in enhancing system security.

We conclude with a section on detecting and preventing BYOVD from the point of view of blue team members, documenting sources of data and detection strategies.

By addressing both technical and operational aspects of BYOVD, this presentation emphasises insights for forensics experts, incident responders, and cyber threat researchers and provides knowledge for better research and detection of BYOVD based threats.

Kubernetes has become a critical component of modern production environments, valued for its scalability, flexibility, and ability to streamline container orchestration. However, its complexity and dynamic nature present unique challenges for security incident response. A compromised Kubernetes environment can provide attackers with substantial computational resources and access, enabling activities such as data exfiltration, intellectual property theft, or cryptocurrency mining.

Incident response in Kubernetes requires specialized knowledge, as traditional security practices often fall short in addressing the nuances of containerized systems. For example, the ephemeral nature of containers, combined with limited logging and monitoring practices and insufficient support from detection tools, makes it challenging to detect, contain and respond to incidents effectively. Many security teams are unfamiliar with Kubernetes-specific attack vectors and lack the expertise needed to respond to breaches in such environments.

This presentation will first provide examples of Kubernetes attack chains and highlight techniques—such as privilege escalation through "bad pods"—that are specific to this environment. It will then review critical logs that should be collected and explain how disk and memory forensics can aid in incident response. It will also discuss the challenges that a team might face during the analysis.

This session reveals how attackers exploit typosquatting, author impersonation, and innovative malware campaigns to infiltrate software supply chains. Learn practical threat hunting methodologies, and gain step-by-step guides to detect, analyze, and defend against these malicious threats.

In today's cloud-centric business landscape, cyber threat actors are increasingly targeting cloud infrastructures to conduct high-impact ransomware attacks. This presentation delves into the tactics, techniques, and procedures (TTPs) of the threat actor known as Scattered Spider, with a focus on understanding their ransomware deployment life cycle within cloud environments.

Drawing from in-depth research and real-world case studies targeting the insurance and financial sectors, we will explore how Scattered Spider employs advanced social engineering methods—such as voice phishing (vishing) and SMS phishing (smishing)—to compromise high-privileged accounts like IT service desk administrators and identity administrators. The session will examine their use of SIM swapping to bypass multi-factor authentication (MFA) and gain unauthorized access to critical cloud services and Software as a Service (SaaS) platforms.

We will uncover how Scattered Spider leverages legitimate cloud features, including Cross-Tenant Synchronization in Microsoft Entra ID and federated identity providers, to establish persistent access and escalate privileges within compromised environments. The talk will highlight their use of open-source tools for cloud reconnaissance, their methods for impairing security tools, and their strategies for evading detection—such as utilizing remote monitoring and management (RMM) tools, protocol tunneling, and creating unmanaged virtual machines.

Furthermore, the presentation will dissect Scattered Spider's ransomware deployment strategies targeting cloud Infrastructure as a Service (IaaS) platforms like VMware ESXi. We will discuss their automated deployment tactics, and cloud-native tools to execute ransomware payloads efficiently, making recovery efforts more challenging for victims.

By mapping out Scattered Spider's comprehensive attack life cycle—from initial cloud account compromise to ransomware execution—we aim to equip cybersecurity professionals with actionable insights to bolster their cloud security posture. The session will conclude with prevention opportunities, offering best practices in authentication and account security, cloud environment hardening, and detection queries to identify and mitigate malicious activities.

Key Takeaways:

Understand the new TTPs used by Scattered Spider in cloud environments.
Gain insights into the ransomware deployment life cycle within cloud infrastructures.
Learn how to detect and prevent similar attacks through practical security measures.
Explore real-world incidents and case studies for a comprehensive understanding of the cloud threat landscape.

Several recent works have argued that Large Language Models (LLMs) can be used to tame the data deluge in the cybersecurity field, by improving the automation of Cyber Threat Intelligence (CTI) tasks.

We present an evaluation methodology that other than allowing to test LLMs on CTI tasks when using zero-shot learning, few-shot learning and fine-tuning, also allows to quantify their consistency and their confidence level. We run experiments with three state-of-the-art LLMs and a dataset of 350 threat intelligence reports and present new evidence of potential security risks in relying on LLMs for CTI.

We show how LLMs cannot guarantee sufficient performance on real-size reports while also being inconsistent and overconfident. Few-shot learning and fine-tuning only partially improve the results, thus posing doubts about the possibility of using LLMs for CTI scenarios, where labelled datasets are lacking and where precise confidence model estimates are necessary to rely on LLMs predictions.

This is a a story-telling presentation about an unknown group spreading Latrodectus, and all its modules, to operate an espionage attack, which was concluded with a money theft. We are going to show how Threat Intelligence can speed up incident response procedures and assist in identifying other victims and active malicious infrastructure.