Aaamir Lakhani - Dr. Chaos presents: Top hacker tools, techniques & DeepWeb exploits

## Overview Aamir Lakhani, a security professional and threat hunter, presents a comprehensive examination of common hacking techniques, demonstrating why basic attacks remain highly effective despite sophisticated defenses. The talk emphasizes that most cybercriminals are financially motivated and operate through organized, well-structured networks with surprisingly professional operational practices.

## Key Topics

**Attack Fundamentals & Detection Evasion** Lakhani demonstrates a basic reverse shell attack by embedding malicious code into an Adobe Acrobat Reader installer and renaming it as "evil.exe." When scanned on VirusTotal (a 70-vendor scanning platform), the previously unseen file shows mixed detection results, illustrating that simple attacks often evade security controls. He emphasizes that attackers increasingly reuse existing system tools rather than creating novel malware, making detection harder.

**ATM Jackpotting** Thieves install malware on ATM machines to dispense cash automatically. Kits are available on the dark web for approximately $4,000, complete with playbooks explaining how to access USB service ports (often exposed without protective measures). ATM vendors historically prioritize ease of servicing over security. Mainstream attacks in the US began around 2018, with significant surges in 2020–2022.

**Phishing Infrastructure** The Black Eye phishing kit, freely available on GitHub, enables attackers to create convincing replica websites. Lakhani demonstrates generating a fake LinkedIn login page that includes a Let's Encrypt SSL certificate, satisfying the security indicators users are taught to trust. He documents a real attack against a colleague, capturing username, password, and location data. Phishing now extends to mobile apps and smart speakers via Alexa skills; attackers register skills with names resembling legitimate services (e.g., "Amex" instead of "American Express") to redirect users to phishing links.

**Ransomware Negotiation & Operations** Lakhani shares a real case involving a healthcare provider attacked for $10 million. Through negotiation on dark web forums, the ransom was reduced to $4 million. Threat actors operate with professional customer service: they deliver data decryption keys, provide detailed remediation reports, and maintain open communication channels. Their incentive is maintaining reputation so future victims pay without hesitation. Sadly, the ransom note was left accessible online, enabling other threat actors to re-attack the same organization.

**Botnets & Command & Control** He demonstrates "Build Your Own Botnet" (available on GitHub), showing a free version with a command-and-control interface. The paid version supports VBS scripts, PowerShell, and Office document payloads. Once a reverse shell connects, an attacker gains full system access and can install additional malware, escalate privileges, exfiltrate data, and deploy ransomware.

**Threat Hunting Methodology** Lakhani outlines his daily workflow: run suspect files through Cuckoo Sandbox to extract indicators of compromise (IOCs)—IP addresses, registry changes, network connections—and store them in a database (MISP). He then uses Maltego to visualize relationships between IOCs, searches for correlated events, and traces attack patterns to attribute threat actor groups (e.g., FIN6, FIN8). This detective work involves examining Bitcoin addresses, file hashes, and historical group communications.

**Underground Markets & Economics** Dark web forums and increasingly Telegram/WhatsApp groups sell credit cards ($2–$5 each), stolen medical records (valuable for identity theft and insurance fraud), counterfeit currency, and full identity packages. Kits for medical fraud and phishing come with step-by-step instructions. Pre-made toolkits dramatically lower barriers to entry for cybercriminals.

## Technical Details Attackers prioritize stealth by avoiding new files on disk (which trigger antivirus), instead using legitimate system tools like PowerShell, FTP servers, and built-in remote desktop. Operating systems most frequently compromised include home routers and IoT devices, as attackers exploit existing vulnerabilities and use "living off the land" techniques.

Ransomware samples, when analyzed, reveal registry modifications, network beacons, and file encryption routines. Sandboxing and behavioral analysis are essential for identifying malware families and tracking campaigns.

## Takeaways - Most cybercrime succeeds through simple, financially motivated attacks: phishing, credential theft, and ransomware. - Organized threat actors operate like businesses, with recruitment, quotas, and customer service, making attribution difficult. - Security must focus on actual weak points (user education, patch management, credential defense) rather than uniform hardening. - Free training (Hack the Box, Fortinet training) is sufficient to build competent security skills. - Visibility and understanding of real attack patterns matter more than buying additional security tools. - Threat hunting is detective work: correlating IOCs, identifying relationships, and tracing patterns to attribute campaigns.