Abstract

In today's rapidly evolving cyber landscape, traditional methods of threat hunting and threat intelligence are often not sufficient to keep up with sophisticated adversaries. Our talk aims to bridge this gap by focusing on passive signals intelligence (SIGINT) as a robust solution for tracking cyber actors without directly interacting with them. By adopting passive techniques, we can conduct monitoring globally and collect actionable insights while maintaining a low profile, thereby reducing the risk of alerting the adversary to our monitoring efforts.

The talk will be divided into three key parts. The first segment will provide an in-depth introduction to what passive SIGINT entails. Unlike active SIGINT, where data is obtained through direct engagement, passive SIGINT relies on 'listening' to the traffic, both incoming and outgoing. This involves monitoring data packets, DNS requests, and other network-level indicators that pass through global networks.

In the second part of the talk, we will delve into the intricacies of advanced SIGINT techniques. We will explore various cutting-edge technologies and tools that are crucial for conducting passive SIGINT operations. The audience will gain insights into a spectrum of solutions, starting with fundamental packet sniffing tools such as Wireshark, and progressing to highly sophisticated platforms that leverage machine learning algorithms for the detection and analysis of complex data patterns.

Moreover, we will examine the integration of cloud-based threat intelligence feeds into your passive SIGINT operations. These feeds play a pivotal role in enhancing your overall situational awareness and providing a more comprehensive understanding of the evolving threat landscape. By harnessing the power of cloud-based intelligence, SIGINT analysts can stay ahead of adversaries and make more informed decisions in the realm of cybersecurity.

In the third segment of our presentation, we will showcase concrete examples of real-world attacks to illustrate the practical application of passive SIGINT techniques. Our focus will be on demonstrating how advanced SIGINT methods were employed to detect and expose Advanced Persistent Threats (APTs) by analyzing global network traffic.

During this section, we will unveil valuable insights into how these threat actors manifest themselves within network environments. We will also delve into the specific methodologies we employed for tracking and identifying threat actors originating from North Korea and China. This research will shed light on the distinctive characteristics of these threat actors when viewed from a network perspective, providing a deeper understanding of their tactics, techniques, and procedures.