FireEye CEO Kevin Mandia, center, speaks on a panel with former director of the NSA and commander of the US Cyber Command, Keith Alexander, and founder and executive chairman of Lookout, John Hering, at the Vanity Fair New Establishment Summit in 2014. (Kimberly White/Getty Images for Vanity Fair)
The Sunburst espionage campaign that breached FireEye and several government agencies was devious about operational security. To protect useful attack vectors through SolarWinds, Microsoft, and VMWare, the hackers made every effort not to reuse infrastructures or settings or to tie one stage of the attack to another.
When Joe Slowik, senior security researcher at DomainTools, looked at the command and control infrastructure, there were only very loose patterns to be found. The domains were a broad mix – some hacked, and some newly established. They were registered by different services, hosted on different IPs. There was no way to leverage that information into a list of filterable domains. If defenders knew hackers were coming, there would be few traditional indicators of compromise (IoCs).
But, he said in a new blog post, there was pl ..
Support the originator by clicking the read the rest link below.
