You Are a Threat Actor. As Yet You Have No Name.

This talk covers Operation So-seki, a months-long investigation into a pro-Russian hacktivist group referred to as X, which has run DDoS attacks against organisations worldwide since March 2022. The speakers, from a Japanese telecommunications company's threat intelligence team, describe how the group recruits volunteers through a set of Telegram channels: a public channel that announces successful attacks, and private channels that distribute tooling, share targets and reward participants through a points and ranking system.

The research centred on the group's botnet client. The team analysed its command-and-control exchange, which wrapped AES-256 GCM encrypted data in JSON, and was able to decrypt the target lists the server returned. Because the infrastructure changed every few days, they used a fast internet scanner to narrow the search to HTTP servers and then probed those for the client's fingerprint, automating daily collection of targets. Across more than a thousand attacks they compared target lists with Telegram success reports, noting scheduled posting hours, shifting target-country patterns and attack success rates that varied widely from day to day. Many targets were hit repeatedly.

The speakers argue that public disclosure of technical details appeared to prompt the group to change servers or protocols within weeks, and that publicised victims fed its propaganda. Their approach was to notify affected organisations privately, which helped them separate attack traffic from benign spikes and focus response resources. Practitioners should weigh whether sharing a given detail helps defenders more than it helps the attackers.