4 ms·
>Microsoft has identified the threat actor as Midnight Blizzard, the Russian state-sponsored actor also known as Nobelium How do they identify those groups?
by kgeist 3y ago
>Microsoft has identified the threat actor as Midnight Blizzard, the Russian state-sponsored actor also known as Nobelium
How do they identify those groups?
- rightbyte 3y agoThey are just making it up. Security people seems to be of the militaristic type ofent, so I guess they add a slive of war mongering to it to to play ball. Iran, North Korea and what not. Very convenient since it is not falsifiable in practice.
- astrange 3y agoThey are certainly identifiable from their work. State hackers are professionals and they work like other professionals do; they work 9-5 in their local time zone and they have modular implants with code reuse. Amateurs aren't like this.
- kgeist 3y agoThat's basically the only argument I've heard so far - if a hacking activity happens between 06:00 UTC and 14:00 UTC then it must be the Russians, otherwise it's someone else. Doesn't sound like a very strong argument? "Modular implants with code reuse" - sounds like exploit kits you can buy on hacking forums.
- astrange 3y ago> "Modular implants with code reuse" - sounds like exploit kits you can buy on hacking forums. This isn't a category argument, they're using a different one than what you can get on forums.
- fremenite 3y agoFrom the artifacts they leave behind after the attack, broadly speaking.
- EVa5I7bHFq9mnYK 3y agoEasily, they have "vam pizda" and "blyat" sprayed around in their malicious scripts.