3 ms·

Depends on what their SOP is. Attribution is hard but there are a lot of really, really smart people trying really hard to identify orgs by their TTPs. You ca

Depends on what their SOP is. Attribution is hard but there are a lot of really, really smart people trying really hard to identify orgs by their TTPs. You can rebrand as CaTBUTT, or Indrik Spider 2.0, or whatever, but if you're using some custom version of Mirai they'll eventually tag your M.O. and the threat intelligence briefings will reflect that. And then no ransom.

tanelpoder 3y ago
Didn't think of that, thank you.
Exuma 3y ago
What is Mirai? Can you re-explain what you said in plain english?
- not2b 3y ago
  You could have Googled it, but you can start with https://en.wikipedia.org/wiki/Mirai_(malware) https://en.wikipedia.org/wiki/Mirai_(malware)
  - Exuma 3y ago
    [flagged]
- red-iron-pine 3y ago
  Mirai is malware that was written by a college student but their code was released to the public, and a lot of other malware uses it as a base. It (and other malware) tend to behave in specific ways and follow specific patterns, and those patterns can be analyzed. Ditto for the servers they use, targets they hit, etc. These approaches are known as TTPs, and documenting them is how you attribute an attack to a specific group or actor. Even if you change your org and start using servers in a different country eventually your MO will give you away. These approaches are cataloged by IT security types, and many cybersecurity orgs release publications about Group X using approach Y. So when you get hacked by Group Z, but they sound like X and Y, you guess it was them. And if Group X has a history of burning ransom payers then you don't pay -- they'd fuck you anyway, so save the money and start rebuilding.
  - Exuma 3y ago
    Very interesting.. so what makes Mirai so important as a base that they can't just rewrite it of sorts? Is it just a lot of work/boilerplate? Or would it be too time consuming to rewrite some base code so the fingerprint is different?

tanelpoder 3y ago

Didn't think of that, thank you.

Exuma 3y ago

What is Mirai? Can you re-explain what you said in plain english?

not2b 3y ago
You could have Googled it, but you can start with https://en.wikipedia.org/wiki/Mirai_(malware) https://en.wikipedia.org/wiki/Mirai_(malware)
- Exuma 3y ago
  [flagged]
red-iron-pine 3y ago
Mirai is malware that was written by a college student but their code was released to the public, and a lot of other malware uses it as a base. It (and other malware) tend to behave in specific ways and follow specific patterns, and those patterns can be analyzed. Ditto for the servers they use, targets they hit, etc. These approaches are known as TTPs, and documenting them is how you attribute an attack to a specific group or actor. Even if you change your org and start using servers in a different country eventually your MO will give you away. These approaches are cataloged by IT security types, and many cybersecurity orgs release publications about Group X using approach Y. So when you get hacked by Group Z, but they sound like X and Y, you guess it was them. And if Group X has a history of burning ransom payers then you don't pay -- they'd fuck you anyway, so save the money and start rebuilding.
- Exuma 3y ago
  Very interesting.. so what makes Mirai so important as a base that they can't just rewrite it of sorts? Is it just a lot of work/boilerplate? Or would it be too time consuming to rewrite some base code so the fingerprint is different?