#rmisc — Public Fediverse posts

Fascinating talk by Roger Grimes (KnowBe4) about all the fun ways that MFA can be bypassed. #RMISC

Went to #RMISC day 1 today and had a good time.

Last year I was invited to present a talk at a conference called #MicrosoftDCC and spoke about a particularly vicious #botnet #malware called #qakbot.

My colleague Steeve and I had cracked the methodology for decoding their command-and-control functionality. We published our work in a blog post and presented it at #VirusBulletin, #RMISC, and #DCC.

Today, the #FBI announced that in an international operation with France, Germany, the Netherlands, Romania, Latvia, and the United Kingdom they have shut down the botnet.

I do this work to help people everywhere.

https://www.fbi.gov/news/stories/fbi-partners-dismantle-qakbot-infrastructure-in-multinational-cyber-takedown

Any of my peeps at #RMISC today, my talk will be in room 406 right after the coffee break at 9:30am MDT. We're gonna do a little message thread injection, decrypt some #Qakbot #malware C2, and see where we go from there. Don't forget to bring your rubber ducks.

Any of my peeps attending #RMISC? Want to meet up tomorrow or Friday? Drop me a line.

It's been an eventful Friday for #malware to relay #malspam.

This chart shows a bot running in my lab connecting to its C2 IP, receiving instructions and a copy of a malicious PDF attachment, and sending it out via SMTP using a compromised email credentials on a variety of different service providers.

I'll be sharing more about this (and other #qakbot developments) at the #RMISC conference next month.

https://iplanit.swoogo.com/RMISC2023/session/1409336/b5-if-it-qaks-like-a-duck-decoding-qakbot%E2%80%99s-behavior-and-c2-messaging

Hooray! I just got notified that I'll be speaking at the Rocky Mountain Information Security Conference (#RMISC) in June, in Denver. See you all there, then!