Unearthing TetrisPhantom: Discovering Secrets of an Intricate Cyber Threat Campaign | Noushin Shabab
In early 2023, we uncovered a long-running sophisticated attack campaign on government entities in the APAC region employing sophisticated tools and techniques. The attacks are delivered via compromising a type of secure USB drive with a password-protected partition. Such secure USB drives are used by the government organizations of the country to securely store and transfer data physically between computer systems.
Analysis of the history and evolution of the malicious tools leading to the development of the sophisticated USB worm revealed the use of persistent backdoor modules with high level of stealthiness, virtualization-based software obfuscation for various infostealer tools and reconnaissance malwares with advanced capabilities.
Considering the extremely targeted nature of these attacks and the high level of sophistication in their malicious tools, we suspect the threat actor is a skilled and resourceful actor focused on espionage in sensitive government networks.
In this talk we will look at the various aspects of this investigation with a particular focus on the technical analysis of the malicious files involved in the attacks.
#SAS2023 #TetrisPhantom #Kaspersky