Turns out your outsourced dev team vibe-coded the encryption routine of your #ransomware.
"Months of planning and it's all blown by a fucking fart." - Sissy
Tabletop scenarios for offensive cyber
DM to submit!
| C&C | http://attacker.com |
Attacker Friction
- 56 Followers
- 1 Following
- 33 Posts
You fail to realize you are on a honeypot.
https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation/
Workforce shortage: a developer changed career to mine stone for Great Leader after infecting his own machine for testing, turning your operation into an online version of the imperialist video game Uplink.
Customer burns some of your tooling when using a deprecated version.
You install PSP on your operator workstation and the vendor starts spying on you.
https://www.huntress.com/blog/rare-look-inside-attacker-operation
The competition compromises your C2 infrastructure and operator workstations.
"a longstanding campaign orchestrated by the Russian-based threat actor known as 'Secret Blizzard' (also referred to as Turla). This group has successfully infiltrated 33 separate command-and-control (C2) nodes used by Pakistani-based actor, 'Storm-0156.'"
https://blog.lumen.com/snowblind-the-invisible-hand-of-secret-blizzard/
EDR bug crashes all your points of access.
Vendor investigation and Incident Response processes are started, risking the exposure of your operation.
Your employees accidentally infect their own machines with malware, allowing security companies to spy on your operations.
(Note: we don't really know this is how this particular investigation went down, but we wouldn't be surprised...)
https://research.checkpoint.com/2024/agent-tesla-targeting-united-states-and-australia/
Agent Tesla Targeting United States & Australia: Revealing the Attackers' Identities - Check Point Research
Research by: Antonis Terefos, Raman Ladutska Part I from the series E-Crime & Punishment Introduction When considering a notoriously famous topic known for quite a long time, it may feel like there is nothing new to add to this area anymore – all paths traced, all words said, all “i”s dotted. Is it worth an […]
Your developers upload 0-day exploit documentation to VirusTotal.
QakBot attacks with Windows zero-day (CVE-2024-30051)
In April 2024, while researching CVE-2023-36033, we discovered another zero-day elevation-of-privilege vulnerability, which was assigned CVE-2024-30051 identifier and patched on May, 14 as part of Microsoft's patch Tuesday. We have seen it exploited by QakBot and other malware.