Using Geopolitical Conflicts for Threat Hunting
summary
Claims a strong link between active conflicts and targeted mobile surveillance and shows concrete cases and tooling: Silverhawk targets anti‑Assad Syrians with remote audio recording, photo/video exfiltration and a survival counter, C2 in plaintext; ViperRat uses a two-stage Play Store implant and compressed exfiltration that yields 9,000 files (97% photos) including passports and geolocation; FrozenCell/DesertScorpion tie Android implants to Micropia desktop C2s and Fatah‑themed lures; XCSSET/Emarat runs Android plus jailbroken iOS + Android C2 against Hong Kong activists.
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker background
- 1:07Why geopolitics matters in threat hunting
- 3:58Mobile surveillance as a nation-state tool
- 5:20Case study: Silverhawk malware in Syria
- 12:35Case study: Viper Rat targeting IDF
- 19:33Case study: FrozenCell and Desert Scorpion
- 25:04Surveillance in authoritarian regimes
- 29:55Evolution of Xsser Emarat malware
- 30:36Lawful intercept software market
- 31:39Conclusion and Q&A
related talks
26mUnder the SEA - A Look at the Syrian Electronic Army's Mobile Tooling
56mCybersecurity & Privacy From The Global Lens
49mEffects of Weaponized Malware on End-to-End Encryption and Exfiltrating Data from Signal Messenger
01h 02mSecurity for Humans: Privacy and Coercion Resistant Design
45mThe Discovery of a Government Malware and an Unexpected Spy Scandal
26mThe Secret Life of Sandworms
46mCan Cyber Mercenaries and Human...
26mTracking the World's Dumbest Cyber Mercenaries