Cedric PERNET - Threat Intel, APT & Cybercrime

It is rare to be able to track the activities of a real cybermercenary threat actor. But we did ;-)

Ladies and gents, please meet Void Balaur.

Full paper here.

Forbes article here, Le Monde here.

Hello,

Cela faisait longtemps que je n'avais pas contribué à MISC, non pas par manque de temps ou de motivation mais tout simplement par manque de sujet intéressant. Il devient difficile pour moi de trouver des sujets qui n'ont pas déjà été exposés dans MISC, et je dois bien avouer que je ne prends pas forcément le temps non plus de me creuser le caillou pour trouver des sujets.

Celui-ci est plutôt lié à mon actualité professionnelle, puisque depuis de nombreux mois je vois de plus en plus de malwares (notamment en APT) utilisant des plateformes légitimes pour gérer leurs communications.

Je vous invite donc à lire mon nouvel article dans MISC 107 sur ce sujet.

Et bonnes fêtes de fin d'année ! :-)

Hello there,

I had the pleasure to work with Feike and Kenney on this blog post which reveals an interesting (hopefully) part of APT33's infrastructure.

Hope you'll like it !

The SLUB guys are back !

We detected them from another watering hole, and they updated their malware. More about it here.

As a reminder, we first published about them here

So here is a new blog post. It was a great collaborative work with several of my highly skilled colleagues :-)

It is all about a new malware we discovered recently, used in an APT, and sitting on an interesting watering hole.

Hi all,

I have written this blog post in collab with my good friends Kenney and Lenart... ;-)

Available HERE.

Hi folks,

I've published a new blog post today on Trend Micro's blog. This is once again about some APT campaign, this time showing some of the new modus operandi from a threat actor named Winnti.

It is available here.

I have published a new report about an APT threat actor known as "Emissary Panda" which originates from China. The blog entry is here, while the full paper is here. There is also an appendix here.

This research paper involved a lot of work with my great colleagues from CSS/Trend Micro. It was a great pleasure to write it :-)

I hope you will enjoy this long (more than 50 pages) paper ! :-)

Here is the link to a new blog post I wrote with friends Kenney Lu and Dark Luo from Trend Micro.

It has several interesting aspects, in my mind:

• The fact that there is an ongoing campaign against french people, using french material, which is rare enough to be worth mentioning;
• The fact that there is a kit used to drop different payloads: Gootkit, CryptoWall, some banking trojan...;
• The fact that it uses an innovating method to infect the victims computers.

Hope you will enjoy the read ! :-)