Attack Surface in Motion

Introduction to Recon Village and Keynote Speaker

Karan Sha welcomes attendees to Recon Village and thanks the sponsors: OENT Industries, Kad Networks, Red and Labs, Pentesters, Synak, and Sync Red Teaming, Square X. The first keynote, "Attack Surface in Motion: Why Today's Threats Don't Knock First," is presented by Muslim Corsair.

Speaker's Background and Expertise

Muslim Corsair has over 25 years of experience in information security, specializing in cyber threat intelligence, cyber risk management, and cybersecurity consulting. He has worked with Fortinet (where he is currently VP focusing on attack surface and threat intelligence), Volon (co-founder, acquired by Fortinet), FireEye, and Ipartners. He was also involved in India's honeypot project, developing early Linux-based honeypots like Detox and spam-focused honeypots like Shiva. Additionally, he has contributed to establishing national and organizational Computer Emergency Response Teams (CERTs) in multiple countries.

Talk Agenda: Evolution of Cyber Threats

The talk will cover the evolution of cyber threats and attack surfaces from 2005 to 2025, comparing past and present tactics, actors, and motivations. The agenda includes:

Revisiting past attacks and threat actors.

Discussing the evolution of attack surfaces over time.

Examining current threats and recent trends (last 6 months).

Summarizing the overall impact of today's threats.

Past Threat Actors and Motivations (Circa 2009-2012)

The speaker presents logos of past threat groups, highlighting their characteristics:

Anonymous: Anti-establishment activism, split into various factions.

Lizard Squad (est. 2011): Known for the Sony hack in 2011, also anti-establishment.

LulzSec (LulzSec): Famous for causing widespread disruption, active for only 50 days before core members were arrested.

Syrian Electronic Army: Pro-Assad group active during the Syrian war.

RedHack: Pro-Turkey, anti-establishment group.

Hacker Squad: Active until 2-3 years prior, anti-establishment.

These groups were primarily driven by ideology and activism. Their main tactic was often Denial of Service (DoS) attacks, using tools like Loic. Operations were decentralized and coordinated via IRC channels.

Shift in Motivations: From Activism to Financial Gain

While activism was a primary driver in the past, the focus has shifted significantly towards financial gain. Today's threat actors are motivated by profit, leading to different types of cybercrime.

Evolution of Tactics and Tools (2010-2015)

Phishing and Social Engineering: Targeted phishing and spear-phishing became more prevalent.

Script Kiddies: A rise in individuals using pre-made tools without full understanding, though this decreased between 2015-2023. However, with advancements in AI, this trend is resurging.

Banking Trojans: Prevalent tools like Zeus and Citadel used web injects to steal data and target banks.

Crime-as-a-Service: Services like malware and system offerings began emerging on the dark web.

Cryptocurrencies: Early on, actors used Liberty Reserve (LR). Post-LR's shutdown, Bitcoin and Monero became dominant.

Ransomware: Began its rise, though not as dominant as today. The ecosystem was still developing.

Browser-Based Attacks: Man-in-the-browser techniques were used, primarily by banking trojans, to capture data directly from user sessions.

Rise of Advanced Persistent Threats (APTs)

The term APT gained traction during this period (2010-2015). While nation-state attacks were known, the coordinated and persistent nature of APTs became more recognized, leading to naming conventions for various groups.

Evolution of the Attack Surface

On-Premises to Cloud: Organizations have moved from solely on-premises infrastructure to hybrid and multi-cloud environments (Azure, Google Cloud, AWS). This decentralization makes managing the attack surface more complex.

Proliferation of IoT: The increasing number of connected devices in homes and offices expands the attack surface significantly.

Supply Chain Risk: Vulnerabilities in connected devices (e.g., HVAC systems) can serve as entry points into networks.

Mobile Work: The shift to remote work, accelerated by COVID-19, has expanded the attack surface beyond corporate perimeters to home networks and personal devices.

AI Integration: AI is rapidly changing attack vectors. Malicious actors can use AI to generate phishing kits, craft exploits, and potentially extract sensitive information by manipulating AI models.

The Dark Web Landscape

Shifting Modus Operandi: Historically, threat actors built personas and trust on dark web forums to share intelligence. Now, the trend is towards quick, one-off posts, often selling compromised data or initial access.

New Monetization: Instead of selling databases or vulnerabilities, actors now focus on selling network access, VPN credentials, and initial access. This is largely driven by the rise of InfoStealers.

The Impact of InfoStealers

InfoStealers are designed to capture credentials from websites visited by the victim, sending them to a command-and-control server. This provides easy initial access for other threat actors. By purchasing stolen VPN credentials for as little as $10, attackers can gain direct access to corporate networks without needing to exploit vulnerabilities.

Initial Access Brokers (IABs): These actors specialize in collecting, validating, and selling compromised credentials and access (e.g., VPN, database access). They form a crucial link in the cybercrime ecosystem.

Ransomware Affiliates: These groups purchase initial access from IABs, escalate privileges, deploy ransomware, and exfiltrate data.

Communication and Tools on the Dark Web

Platform Shift: Communication has moved from IRC and Jabber to more immediate platforms like Telegram and Discord, making monitoring more challenging.

Malicious AI Models: Unfiltered AI models are available on the dark web, enabling the creation of sophisticated exploits and malicious code without the safety filters present in public AI tools.

Current Trends (Last 1.5 Years)

Exploitation: Increased exploitation of CVEs by ransomware groups.

Vulnerability Chatter: Increased discussion of vulnerabilities on the dark web, but decreased chatter on IM platforms like Telegram in the last six months.

Credential Value: SSO, email, and GitHub credentials are among the most valuable, often sold for around $10.

Ransomware Targets: Companies of all sizes are targets, with a focus shifting beyond just large corporations to include those with revenue under $5 million.

Geopolitical Influence: Activist operations (e.g., Op Israel, Op Russia) fluctuate based on current geopolitical events.

Conclusion: The Modern Threat Landscape

Today's threats bypass traditional security measures. Attackers no longer need to