Secureworks Global Threat Intelligence Summit 2024

Navigating the Cybersecurity Labyrinth: From Data to Defense.

Looking ahead to 2025, cybersecurity experts come together to discuss emerging threats and provide the latest insight into how to combat today’s adversaries.

The status quo is changing, and the stakes are high — join us in the frontline defense against the adversary.

Building on the "D3Fck Loader: A Deep Dive into Malware-as-a-Service" session, this talk takes you behind the scenes of a leading malware researcher’s analytical workflow. We’ll explore the tools, techniques, and methodologies used to dissect complex loaders like D3Fck, providing insights into how researchers uncover, analyze, and respond to emerging threats.

Take an in-depth look with us on the Contagious Interview campaign, a North Korean-led operation targeting freelance job candidates with malicious interview tasks. We’ll explore how threat actors use platforms like Fiverr, LinkedIn, and GitHub to infiltrate corporate networks, often by exploiting company-owned devices used by unsuspecting candidates. Attendees will gain insights into the campaign’s tactics, such as the use of malware-laden coding tasks and compromised video conferencing software, along with practical advice on how to defend against such social engineering threats.

This session will explore how business impact analyses, risk assessments, and policy development collectively strengthen an organization’s cybersecurity. We’ll clarify the roles of policies and plans, show how risk assessments identify and prioritize risks to inform policy and plan creation, and demonstrate how business impact analyses ensure plans address critical functions and recovery priorities. By following a workflow from policy development to plan refinement, we’ll illustrate how these components work together to enhance preparedness and resilience against cyber threats.

This session will delve into the intricacies of large-scale malware intelligence within the Secureworks® Counter Threat Unit™ (CTU™ ) ecosystem. We’ll explore how CTU’s comprehensive analysis capabilities assemble diverse data sources and simulate real-world scenarios to enhance threat understanding. Join us to uncover the challenges and advantages of managing and interpreting large volumes of malware intelligence, and how this approach strengthens our defensive posture against evolving threats.

When it's your job to dive deep into the world of cybercrime every day, the ethics of what you do and how you do it matter more than ever. In this session, we'll explore the ethical challenges that arise in eCrime research, delving into the complexities of handling sensitive data, engaging with threat actors in underground forums, and the legal and moral responsibilities when collaborating with law enforcement agencies. Attendees will gain a deeper understanding of how to navigate these challenges while maintaining the integrity of their research and protecting the rights of all involved parties.

Business Email Compromise (BEC) remains one of the most prominent attack vectors today. How did it evolve in 2024? In this session, attendees will gain a comprehensive understanding of BEC, from its fundamental concepts to the latest tactics employed by cybercriminals. The talk will cover how BEC techniques have adapted over time, highlighting recent trends and emerging threats. Key focus areas include new attack vectors, sophisticated social engineering methods, and the impact of evolving technologies on BEC strategies. By analyzing case studies and recent incidents, the session aims to equip participants with the knowledge to recognize, prevent, and respond to BEC threats effectively.

Explore the anatomy of a typical compromise through the lens of an experienced pentester. By examining each stage of an attack, the session demonstrates how to effectively detect and counteract malicious activities. The insights provided will help identify critical touchpoints in the attack chain, enhancing the ability to catch intruders and strengthen overall security defenses.

Join us for an in-depth look at a cyberattack's progression from initial infostealer deployment to the final ransomware outbreak, viewed through the lens of incident response professionals. We’ll explore how compromised data dumps led to credential theft, remote access, and privilege escalation, ultimately resulting in a ransomware attack. By examining real-world threat intelligence and leveraging dark web research, we will illustrate how the pieces were put together to understand and mitigate the attack. Attendees will gain insights into the challenges and strategies involved in responding to such complex, multi-stage incidents.

Vulnerabilities in Microsoft Entra ID applications are dangerous to your business when exploited. The session will highlight key tactics and techniques used by threat actors to compromise applications, pivot across tenants, and maintain access undetected. Drawing from Microsoft’s response and ongoing investigation, we will discuss practical guidance for detecting and mitigating similar threats, providing actionable insights to enhance organizational security against sophisticated attacks.

Your ability to detect real threats quickly, without excess noise, is fundamental to protecting your business. Join us in this session to explore the comprehensive lifecycle of detection development within Taegis™, from initial research to real-world application. We’ll cover the foundational aspects of detection, including IOC-based, signature-based, and application-based detections, and how these are integrated into Taegis XDR. Learn about the CTU™ Detection Research team’s mission to embed threat intelligence into detection mechanisms to ensure top-notch protection. We’ll delve into the continuous R&D process, highlighting how we use a blend of open source, commercial, and internal tools to maintain high-fidelity detections and stay ahead of adversaries.

Released in January 2024, D3Fck is a multi-stage downloader that leverages security-through-obscurity to deploy malware covertly. Marketed as part of a Malware-as-a-Service (MaaS) offering on Russian-speaking underground forums, the loader is linked to the "GhostBusters Team," a group of traffers specializing in malware distribution. This session will cover the key features of the D3Fck loader, its role in the cybercrime ecosystem, and insights into the actors behind its operation.

This session will provide a comprehensive review of Russian hostile state cyber tradecraft, focusing on the techniques used in the Ukraine conflict and other global operations. We’ll explore how Russia’s military, intelligence agencies, patriotic proxies, and contracted private companies combine computer network exploitation with information warfare to project power. From the abuse of perimeter network devices and poorly protected accounts to the manipulation of social media platforms, we’ll examine both traditional and novel tactics used by Russian actors. Viewers will gain insights into how these strategies impact global cybersecurity.

This session will explore North Korean IT worker infiltration schemes, detailing known cases of fraud where DPRK nationals have posed as legitimate IT professionals to gain access to organizations around the globe. We’ll discuss how these actors operate, the risks they pose, and practical measures organizations can take to protect themselves from this growing threat.

In 2024, law enforcement takedowns of prominent ransomware groups have impacted the cybercrime ecosystem. Together, we’ll analyze how effective these actions have been in disrupting criminal networks and the broader implications for the threat landscape. Viewers will gain insights into the successes and challenges of using takedowns to combat cybercrime.

Adversary-in-the-Middle (AiTM) phishing attacks have notably increased in the past year, requiring new focus in customer defense strategies. This session will discuss how attackers use email or messaging services to intercept and manipulate communications between users and legitimate services. We’ll also explore the Axios AiTM campaign and how tools like Evilginx have been leveraged in these attacks, along with practical strategies to detect and prevent this growing threat.

2024 has been the year of major botnet takedowns. How has the malware landscape shifted since? We'll highlight key changes observed in adversarial tactics and how these have shaped the way we track, analyze, and protect against modern malware threats. Attendees will gain insights into the evolving strategies needed to defend against this constantly changing threat environment.

Transforming raw adversarial discussions into actionable human intelligence is critical to helping our customers outpace the adversary. In this session, we’ll break down the processes of gathering, analyzing, and synthesizing underground chatter into tactical, operational, and strategic intelligence. Viewers will learn how to convert fragmented conversations into insights that enhance security decision-making and response strategies.

How do adversaries move from discussing proof-of-concept (POC) exploits in underground forums to exploiting Common Vulnerabilities and Exposures (CVEs) in the wild? Drawing on incident response data and underground research, we’ll explore how vulnerabilities are identified, POCs are shared, and exploitation tactics evolve. Attendees will gain valuable insights into how threat actors weaponize vulnerabilities and the critical steps needed to mitigate these risks.

As trends evolve in underground stealer markets, what are the implications for the cybersecurity landscape? We’ll examine how these illicit markets operate, the latest tactics threat actors are using, and the risks they pose to organizations worldwide. Attendees will leave with a clearer understanding of the threats emerging from these underground networks and how to defend against them.