Barely Whispering
summary
Argues that Sofacy, Zebrocy, BlackEnergy and a Hades cluster are transitively linked based on concrete overlaps: shared infrastructure and IPs, reuse of X-Agent, reuse of a Siemens exploit across BlackEnergy/Kolenergo incidents, and Hades’ role in Olympic Destroyer and wipers. Notes tool shifts to Go, C#, Delphi, PowerShell macros and remote templates, increased spearphishing, Wi‑Fi man-in-the-middle delivery, Zebrocy replacing some Sofacy activity, and a marked decline in ex‑agent sightings since November.
AI-written summary · about
related talks
40mThe Last Remaining Cover for Action
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
34mEgregor Awakens: Taking a Tour of a Threat Action New Digs
48mThey Hide, We Seek: Leveraging Global Partnerships Against Our Adversaries
39mThe Renaissance of Cyber Physical Offensive Capabilities
45mHiding in Plain Sight: Hunting Volt Typhoon Cyber Actors
49mConducting a Successful False Flag Cyber Operation (Blame it on China)
42mStart Covering Your Bases And Stop Chasing APT Headlines