6 ms·
How do they even know it's Indian? What footprint is used
by amriksohata 5y ago
How do they even know it's Indian? What footprint is used
- schleck8 5y agoSignature approaches most likely, like code style, languages, exploits, software, infrastructure https://attack.mitre.org/groups/G0040/ https://attack.mitre.org/groups/G0040/
- Asooka 5y agoI would guess by IP.
- ashishknitcs 5y agoIP may not be right choice as VPN are used
- ashishknitcs 5y agoKeyboard setup says EN IN
- dharmatva 5y agoNo one - literally no one in India uses the 'EN IN' locale in India. Everyone uses the 'EN US' locale in India.
- dartharva 5y agoI'm Indian and I do use EN-IN, as do scores of people using devices sold in India that have pre-installed and pre-configured Windows.
- dhruvdh 5y agoIf using en-in is as unpopular as you suggest in India, then surely it’s non-existent outside of India..
- desi_ninja 5y agoI use en in too. Better with autocorrect in phones and computers
- sangeeth96 5y agoNot true mate. Have setup plenty of machines with this as the choice and have also seen others running with ENG IN as the layout in their off-the-shelf laptops.
- EdwardDiego 5y agoOccam's grooming implement suggests that someone using English / Indian keyboards and targeting Pakistan is probably Indian.
- hluska 5y agoHa! I had to read that three times but I’m glad I did. Occam’s grooming implement is some good writing/thinking. Nicely put.
- theWreckluse 5y agoWell, do break it down for me :)
- hluska 5y ago“Occam’s grooming implement” is a riff on Occam’s razor. It caught me way off guard and I had to read it three times, but it was worth it. English is a really strange language, and well timed word play is a real gift.
- vlovich123 5y agohttps://en.wikipedia.org/wiki/Occam%27s_razor https://en.wikipedia.org/wiki/Occam%27s_razor
- amriksohata 5y agoEn/in keyboard maps are probably sold all over south asia
- dudeinhawaii 5y agoI think the fact that they were able to use the attackers own exploit to get onto their dev machine and see the EN/IN keyboard layout was a major flag (along with the targets of the malware). Having been in this field myself at one time, this is fairly common (self-infection when testing) and why you would never develop or test on an internet facing machine. It's also why you ensure your command and control and all comms are encrypted, keys rotated, expirations, etc. Most people developing advanced malware don't want someone else sniffing around, finding their drops, using their tools, or worse, discovering what's been exfiled and why the target was specifically selected.