BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//bsideslv24//speaker//VR7S9Q
BEGIN:VTIMEZONE
TZID:America/Los_Angeles
BEGIN:DAYLIGHT
DTSTART:20230807T000000
TZNAME:PDT
TZOFFSETFROM:-0700
TZOFFSETTO:-0700
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20231105T020000
RDATE:20241103T020000
TZNAME:PST
TZOFFSETFROM:-0700
TZOFFSETTO:-0800
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20240310T030000
RDATE:20250309T030000
TZNAME:PDT
TZOFFSETFROM:-0800
TZOFFSETTO:-0700
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Operation So-seki: You Are a Threat Actor. As Yet You Have No Name
 . - Ryo Minakawa\, Atsushi Kanda\, Kaichi Sameshima
DTSTART;TZID=America/Los_Angeles:20240806T170000
DTEND;TZID=America/Los_Angeles:20240806T174500
DTSTAMP:20260809T102351Z
UID:pretalx-bsideslv24-LGUTRH@pretalx.com
DESCRIPTION:This presentation shares the findings and lessons learned from
  an investigation into a pro-Russian hacktivist group\, tentatively called
  X. Their DDoS attacks have been reported worldwide and have been conducte
 d in an organized manner. Since their activities began in March 2022\, bot
 h the scale and the targets of their attacks have gradually expanded.\n\nW
 e have been tracking the DDoS attacks conducted by X for nearly a year and
  carrying out "Operation So-seki" to alert and provide knowledge to the ta
 rgeted organizations. In Operation So-seki\, we obtained a botnet client t
 ool used by X and clarified the mechanism of the command and control (C2).
  We have automated collecting DDoS target information and analyzed more th
 an 1\,000 attacks by monitoring botnets and effectively tracking their inf
 rastructure using net flow.\n\nIn this presentation\, we will share the fi
 ndings through cross-analysis of the above information\, the methods of an
 alyzing and tracking their infrastructures\, operators behind the X\, thei
 r tactics techniques and procedures (TTPs)\, DDoS countermeasure technique
 s\, and what we have learned from dealing with DDoS hacktivist groups.
LOCATION:Florentine A
URL:https://pretalx.com/bsideslv24/talk/LGUTRH/
END:VEVENT
END:VCALENDAR