3 ms·
Depends. If the breadcrumbs are key material which correlates to other known incidents from the same group, or exclusive tooling, or C2 infrastructure, then the
by mr_mitm 3y ago
Depends. If the breadcrumbs are key material which correlates to other known incidents from the same group, or exclusive tooling, or C2 infrastructure, then there is definitely something stopping them from putting breadcrumbs there. They'd have to hack the other group first in order to do so.
I agree with you that seeing evidence would be nice, but I understand that there is the possibility that evidence supporting the claim exists and at the same time cannot be released to the public.
- sudosysgen 3y agoAs we've seen, many of the cybersecurity teams have been pwned, so a large part of the breadcrumbs they'd pattern match are already out there. Additionally, if security is poor enough, there can be more than one hacker into a system, which is another way they could accumulate breadcrumbs. This has precedent - there has been malware that uninstalls other malware.
- mr_mitm 3y agoMany? I'm only aware of the Equation group, believed to be the NSA, whose extremely powerful tools were made public. What other threat actor's internals (and I mean more then chat logs) have been made public?
- ClickedUp 3y agoCIA & GCHQ (Wikileaks).
- sudosysgen 3y agoWhy would they have to be made public? They only have to be known to a handful of other nation states.
- mr_mitm 3y agoBecause this discussion is about the comment "Nothing is stopping anybody here". I already conceded in my original response that if you hacked another group first, then yes, you can leave fake breadcrumbs.
- sudosysgen 3y agoMy point is that this has already been done. It's not a question of if. Once that's done, these things can spread around. And I'm also saying you don't necessarily need to hack another group to find their tools.