Rise of the Vermilion: Cross-platform Cobalt Strike Beacon Targeting Linux and Windows скачать в хорошем качестве

Rise of the Vermilion: Cross-platform Cobalt Strike Beacon Targeting Linux and Windows

Rise of the Vermilion: Cross-platform Cobalt Strike Beacon Targeting Linux and Windows Speakers: Ryan Robinson (Intezer, IE), Avigayil Mechtinger (Intezer, IL) About Speakers: Ryan Robinson is a security researcher for Intezer. He specializes in malware reverse engineering and incident response. In previous roles, Ryan has worked as a Security Engineer securing cloud applications and as an analyst in Anomali's Threat Research team. Avigayil is a security researcher at Intezer specializing in malware analysis and threat hunting. During her time at Intezer, she has uncovered and documented different malware targeting both Linux and Windows platforms. As part of her ongoing work she has initiated the ELF Malware Analysis 101 series, to make ELF analysis approachable for beginners. Prior to joining Intezer, Avigayil was a cyber analyst in Check Point's mobile threat detection group. ---- As one of the most heavily used tools by threat actors, Cobalt Strike is an integral part of many attack chains targeting Windows environments. It was used as a post exploitation tool in high-profile breaches including the infamous SolarWinds and Colonial Pipeline. Until recently, Cobalt Strike was not documented targeting Linux systems in the wild, which makes sense as there is no official Cobalt Strike version for Linux. Recently, we discovered a fully undetected ELF implementation of Cobalt Strike's Beacon, which we named Vermilion Strike. After further analysis, Windows versions were found sharing the same functionalities with the Linux version, contacting the same C2. Based on telemetry, this threat has been active in the wild targeting high profile entities in multiple industries. This talk will discuss Cobalt Strike and it's popularity, provide an in-depth analysis of Vermilion Strike including its TTPs, and suggest methods for detection and response to these threats.