GTsST Iron Viking
For this week’s TTP Tuesday, we’re releasing a new GTsST themed chain centered around Iron Viking in cooperation with Sandworm, both sub teams of GTsST, and their destructive attack against Ukraine on April 8th, 2022. This attack was split into two, one on the IT network and the other on the ICS network. We focused on the IT Network attack which consisted of AWFULSHRED, ORCSHRED, and SOLOSHRED. AWFULSHRED is a Linux worm that installs either ORCSHRED or SOLOSHRED. The main difference between the two is the operating system.
Timeline:
00:00 Prelude Intro
00:07 GTsST Iron Viking Introduction
00:17 Russo-Ukrainian Conflict
00:42 Pre-Invasion
01:28 Invasion
01:59 Industroyer
02:28 Awfulshred
02:56 The Worm
04:17 The Wiper
05:30 Iron Viking Chain Demo
09:39 Prelude Outro