Deception Is on the Rise, But Is It Time to Unleash Engagement Operations?
summary
Overview of a deployed program that combines honeypots, fake personas on Telegram, MISP for intel sharing and MITRE Engage/HDHD playbooks to hunt and shape a DDoS-focused group (NoName057) and its DoSia tooling. A six-step ACD Loop drives intelligence, risk scoring, adversary modeling and tuning; results show defense index 32→74 and stopped 36 DDoS while adversaries patch exposed TTPs within months. Practical notes: use MISP objects, control trust boundaries and expect iterative tuning.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 7:15What is cyber deception
- 12:45History and modern use
- 16:01From hobby to professional
- 20:24Active Cyber Defense Loop
- 24:30Real-world use case: NoName057
- 35:26Time to engage adversaries
- 38:52Counter-deception and takeaways
- 39:20Question and answer session
related talks
46mApplied Deception Beyond the Honeypot: Moving Past 101
40mStrengthening Cyber Resiliency in a Time of Geopolitical Crises...
45mSlaying Dragons Together...
50mStop Being Sitting Cyber Ducks! Adversary Engagement: the New Cyber-Defense
40mA Primer: Getting Started with MITRE Shield
52mInvestigating DDOS - Architecture Actors and Attribution
45mThe Devil Does Not Exist - The Role of Deception in Cyber
47mRough and Ready: Frameworks to Measure Persistent Engagement and Deterrence