"Inside Cybercrime Groups Harvesting Active Directory for Fun..."
summary
Shows concrete malware code paths and operational chains used to harvest Active Directory via LDAP to find credentials, group policy and SYSVOL files for lateral movement and persistence, including domain grabber DLL, PS_fin32 (POS finder) and network enumeration modules that query the global catalog and scheduled task XMLs. Attack flow uses Emotet/TrickBot loaders, PowerShell Empire for interactive access and Ryuk ransomware for extortion. Observed scale is 500–5,000 infections/day, a CloudJumper impact with ~$600k extortion and one claimed $5B demand. Detection suggestions: audit SYSVOL access, monitor AD event IDs and restrict delegated privileges.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:05Agenda
- 4:47How did they identify the bots
- 5:19The evolution of the bots
- 6:57The scope of the problem
- 8:00The realworld scenario
- 8:57The Los Angeles Times
- 9:43Cloud Jumper MSP
- 11:02Why Active Directory Matters
- 11:57Active Directory Basics
- 13:17Technical Analysis
- 13:33Techniques Used
- 14:36How It Works
- 15:08C Small
- 16:34Network DLL
- 17:41LDAP
- 18:11Reconnaissance Modules
- 21:00Retail Networking
- 21:47Active Directory
- 24:17Life Cycle
- 25:56Data Collection
- 31:59Takeaways
- 34:15Credits
related talks
37mThreat Hunting in Active Directory Environment
40mTop Active Directory Attacks: Understand, then Prevent and Detect
32mSurviving a Ransomware Attack - Lessons from the Field
47mThe Blurred Lines between Cybercrime and Statecraft
42mStart Covering Your Bases And Stop Chasing APT Headlines
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
52mStart covering your bases & Stop chasing APT headlines