Investigating Threat Actor Targeting Researchers, Academics
Examines campaigns by nation-state actors (such as Iranian and DPRK groups) targeting cybersecurity researchers and think tanks via social engineering.
Summary
Adversary Targeting of the Cybersecurity Community
Nation-state threat actors increasingly target vulnerability researchers, academic scholars, and foreign policy think tanks to acquire exploit tradecraft, intelligence reports, and access credentials.
Persona Construction and Social Engineering Tradecraft
C Tafani-Dereeper and M Muir analyze the sophisticated multi-platform personas utilized by Iranian (e.g., Charming Kitten) and North Korean (e.g., Lazarus) actors across LinkedIn, Twitter/X, and WhatsApp.
Custom Malware Delivery and Collaborative Lures
Adversaries establish rapport over weeks before delivering malicious collaboration invitations, trojanized IDA Pro plugins, or weaponized research papers containing custom backdoors.
Protecting the Research Community
Defending security researchers requires cultivating heightened operational awareness, validating collaborative identities through out-of-band channels, and sandboxing untrusted research tools.
Related talks
Community Stage·36 min
N Case · J McCoy
Analyzes real-world breaches in research laboratories and manufacturing facilities to examine how nation-state actors exploit human error and misconfigurations.
Adversary Village·45 min
Cheryl Biswas
Cheryl Biswas analyzes decades of Chinese state-sponsored supply chain intrusions and economic espionage campaigns across global technology sectors.
Main Stage·35 min
Andrew Brandt
Sophos researcher Andrew Brandt chronicles a five-year investigation into Chinese nation-state campaigns weaponizing zero-days against perimeter firewall appliances.