📗 Threat Chords: Tuning into Persistent Patterns in Adversary Behavior 🔥
summary
Claim: attackers reuse operational playbooks so defenders should detect sequences not single IOCs. Evidence: Scattered Spider/Shiny Hunters repeatedly use identity compromise chord—social‑engineering help‑desk calls, MFA transfer, Octa enrollment and SSO abuse—often augmented with AI voice cloning and residential proxies. Amos info‑stealer targets macOS via sponsored support pages that run staged downloaders whose payloads shift domains and hashes but reuse endpoints and hex+gzip obfuscation and Google WE1 TLS issuer preferences. Indicators burn; behavioral and infra patterns persist.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:01Threat intelligence basics
- 5:12Problem with IOCs today
- 10:26Chasing the chords
- 10:47Case study Scattered Spider
- 20:16Case study Amos info stealer
- 30:08Making threat intel part of practice
- 36:52Q&A
related talks
34mKeynote: Multiplying Threat Intelligence
52mStart covering your bases & Stop chasing APT headlines
42mStart Covering Your Bases And Stop Chasing APT Headlines
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
42mKeynote: The Expanding Universe of Cyber Threats
52mFlying Under the Radar - New Security Evasion Techniques
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
30mCountering Persistent Threat Actors in APAC and Globally