Turns out your outsourced dev team vibe-coded the encryption routine of your #ransomware.
"Months of planning and it's all blown by a fucking fart." - Sissy
Tabletop scenarios for offensive cyber
DM to submit!
| C&C | http://attacker.com |
Attacker Friction
- 56 Followers
- 1 Following
- 33 Posts
You fail to realize you are on a honeypot.
https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation/
Workforce shortage: a developer changed career to mine stone for Great Leader after infecting his own machine for testing, turning your operation into an online version of the imperialist video game Uplink.
Customer burns some of your tooling when using a deprecated version.
You install PSP on your operator workstation and the vendor starts spying on you.
https://www.huntress.com/blog/rare-look-inside-attacker-operation
EDR bug crashes all your points of access.
Vendor investigation and Incident Response processes are started, risking the exposure of your operation.
Your employees accidentally infect their own machines with malware, allowing security companies to spy on your operations.
(Note: we don't really know this is how this particular investigation went down, but we wouldn't be surprised...)
https://research.checkpoint.com/2024/agent-tesla-targeting-united-states-and-australia/
Agent Tesla Targeting United States & Australia: Revealing the Attackers' Identities - Check Point Research
Research by: Antonis Terefos, Raman Ladutska Part I from the series E-Crime & Punishment Introduction When considering a notoriously famous topic known for quite a long time, it may feel like there is nothing new to add to this area anymore – all paths traced, all words said, all “i”s dotted. Is it worth an […]
Your developers upload 0-day exploit documentation to VirusTotal.
QakBot attacks with Windows zero-day (CVE-2024-30051)
In April 2024, while researching CVE-2023-36033, we discovered another zero-day elevation-of-privilege vulnerability, which was assigned CVE-2024-30051 identifier and patched on May, 14 as part of Microsoft's patch Tuesday. We have seen it exploited by QakBot and other malware.
Fast hashing allows the recovery of the ID's of your sockpuppet accounts.
https://securelist.com/triangulation-validators-modules/110847/
(On a related note: has anyone unblurred the texts on the first diagram yet? :))
