@BushidoToken Threat Intel

Introduction to Infrastructure Pivoting Pivoting on infrastructure is a handy skill for cyber threat intelligence (CTI) analysts to learn. It can help to reveal the bigger picture when it comes to malware, phishing, or network exploitation campaigns. Infrastructure pivoting essentially is the act of looking for more systems an adversary has created. The main benefit of this pursuit is the identification of additional targets or victims, more tools or malware samples, and ultimately new insights about the adversary’s capabilities. If done correctly, being able to pivot on adversary infrastructure will be very useful during incident response (IR) engagements. For example, it may lead to being able to attribute the intrusion to a known adversary. This will help others during an IR engagement understand the level of threat posed to the victim organisation. Receiving Threat Data To be able to pivot on adversary infrastructure, threat data is needed such as the intelligence shared ...

“Cyber espionage is a form of cyber attack that steals classified, sensitive data or intellectual property to gain an advantage over a competitive company or government entity.”  - VMWare Carbon Black Recent news surrounding cyber espionage acts attributed to the US and China have reinvigorated my interest in the state of cyber relations between the two superpowers.  It all started with APT1’s disclosure by Mandiant back in 2004. Ever since Chinese cyber espionage campaigns have been waged against the US and Western world. It is now well-documented that the Chinese government has state-sponsored hacking groups to infiltrate companies with some of the most valuable intellectual property out there. China may justify this how it chooses, the fact remains the government is still targeting private enterprises to steal sensitive information and industrial secrets. However, the US has also partaken in its fair share of cyber espionage directly against Chinese gove...