CYBERWARCON 2021
2021-11-16
Arlington, United States
[CYBERWARCON 2018, CYBERWARCON 2019, CYBERWARCON 2021, CYBERWARCON 2022, CYBERWARCON 2025]
who it's for
threat intelligence analysts, influence operations analysts, security researchers, incident responders, network defenders, cyber policy makers, election security teams
topics
SolarWinds supply-chain compromise; Afghanistan internet reachability changes; Ragwa / Machete RAT analysis; credential-harvesting phishing campaigns; influence operations measurement studies; commercial IO firm attribution; platform takedowns and deterrence; strategic web compromise Candiru links; disruptive ransomware and custom wipers; defense acquisition and satellite cyber risk; UNC1151 / Ghostwriter attribution
| title | author | length |
|---|---|---|
| Keynote | Chris Krebs | 27m |
A policy and operational update that names concrete campaigns and numbers: SolarWinds/Nobelium supply-chain campaign as exemplar of third‑party compromise, a… | ||
| Disruptions in Afghanistan Internet Infrastructure After Taliban Takeover | Allan Liska, Supriya Mazumdar, Nicole Perlroth | 07m |
Timeline and measurements show Afghanistan’s Internet shifts since August 2021: Greynoise data records a surge in traffic during Kabul’s fall, then a plateau… | ||
| Surfacing from the Underbrush: Machete Pivots to Intrusion-Enabled Info Ops | Blake Djavaherian | 10m |
June 2021 malware-laced Office macros deliver a Python backdoor known as Ragwa RAT aka Machete, and passive DNS links the dropper domain… | ||
| Questioning Election Security | Shane Huntley | 10m |
Defines "election related" as requiring a plausible operational link rather than any tangential political tie; distinguishes hacking (credential-stealing… | ||
| Influence Operations: What is Known and What Isn't? | Alicia Wanless | 06m |
Year-long meta‑studies from the Partnership for Countering Influence Operations catalog 460 initiatives, find most focus on fact‑checking or journalism, and… | ||
| CCyberattacks: Is the Juice Worth the Squeeze? | Dmitri Alperovitch | 10m |
A rapid case-by-case audit of famous nation-state operations shows most fail to achieve strategic aims: North Korea’s 2009 DDoS with botnet wiping prompts no… | ||
| Chinese IO Commercial Firm Attribution | Zeshan Aziz | 29m |
High-production pro-CCP videos point to a commercial IO firm hosted at onesite.cn, discovered by matching a high-reach Facebook video to domain registration… | ||
| Disrupting Cyber Adversaries: Meta's Approach to Deterrence | David Agranovich, Mike Dvilyanksi | 09m |
Meta describes three public takedowns — Ocean Lotus (Vietnam), Earth Empusa (China), Tortoiseshell (Iran) — that remove attacker infrastructure, publish IOC… | ||
| Planes, Ships, and Satellites: Cyber in Warfare | Daniel Moore | 28m |
Government audits show 45 major defense acquisition programs face systemic cyber risk: only 10 of 45 undergo full red‑team/component evaluation, satellite… | ||
| Strategic Web Compromises in the Middle East with a Pinch of Candiru | Matthieu Faou | 26m |
Built a Nikola‑style scanner that analyzes 6,000 websites daily and flags suspicious JavaScript, discovering over twenty high‑profile sites primarily in the… | ||
| Their Own Little War: Iran Adopts Disruptive Ransomware | Katie Blankenship, Alex Orleans | 12m |
Since 2020 four Iran‑nexus adversaries pivot from extortion to disruption, using commodity and bespoke tooling to lock and leak victim networks rather than… | ||
| Unmasking UNC1151, the Ghost Behind Ghostwriter | Ben Read, Gabriella Roncone | 30m |
Claims that UNC1151 provides operational support to Ghostwriter campaigns targeting Poland Lithuania Latvia and Ukraine since 2017, using GoPhish… | ||
| Attributing Digital Covert Action: The Curious Case of WikiSaudiLeaks | Simin Kargar | 22m |
A 2015 multi-stage hack-and-leak against Saudi targets splits into distinct components: website defacements (Al-Hayat, Saudi MOFA) and a dump of 120,000… | ||
| The Last Remaining Cover for Action | Juan Andrés Guerrero-Saade | 40m |
Argues that many high‑profile “hacktivist” operations since 2012 are actually nation‑state or proxy campaigns using real destructive tools: Shamoon/StoneDrill… | ||
| nothing matches | ||