03. Chasing the White Whale of Malware by Rushikesh D. Nandedkar
Details 03. Chasing the White Whale of Malware by Rushikesh D. Nandedkar and evaluates key implications for security practitioners.
Summary
Motivation and OT Visibility Gap
Mandiant researcher Rushikesh Nandedkar explains hunting cyber-physical (OT) malware after keyword searches for PLC/SCADA binaries returned thousands of irrelevant hits. Only six major OT campaigns were publicly known across twelve years since Stuxnet, suggesting massive under-detection.
Why OT Binaries Hide
Sandboxes mis-flag legitimate OT traffic as malicious because Modbus-like client-server PCAP patterns violate generic rules. OT software is custom, expensive, poorly documented, distributed in parts, and rarely indexed online—making static/dynamic analysis and VirusTotal-style hunting unreliable.
Selection Criteria Framework
Facing analyst pushback (“why is this OT-relevant?”), he developed deduction tests to justify binary classification. Criteria include proprietary protocols, closed-source builds without debug symbols, vendor-specific hardware coupling, and behaviors normal in IT sandboxes but benign in OT contexts.
Architecture and Hunting Outlook
OT often sits between corporate IT and isolated plant networks that are not truly air-gapped. The talk advocates better legit-OT corpora, improved sandbox tuning, and systematic collection to expand beyond the handful of famous ICS incidents.
Related talks
x33fcon·44 min
Repeatable Malware Techniques Testing
Repeatable Malware Techniques Testing examines 9. Dobin Rutishauser: Detonator.
x33fcon·45 min
2. Yuya Chudo & Ryunosuke Tsuruda: Signed, Trusted, Abused: Advanced BYOSI Malware Loader Techniques
Security researchers examine technical aspects of 2. Yuya Chudo & Ryunosuke Tsuruda: Signed, Trusted, Abused: Advanced BYOSI Malware Loader Techniques.
x33fcon·46 min
Analysts investigate attack surfaces and defenses concerning 12. Ryan Robinson: Unpacking the Unstoppable: How Loaders Continue to Outwit AI, EDR, and Sandboxes.