{
	"id": "30fd4ed0-e73c-464a-b8e1-f1d242d7b13c",
	"created_at": "2026-04-06T00:21:05.405847Z",
	"updated_at": "2026-04-10T03:37:17.008101Z",
	"deleted_at": null,
	"sha1_hash": "90a210af26d723f910c15d076ce05b2572dec9cf",
	"title": "No Easy Breach DerbyCon 2016",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 73050,
	"plain_text": "No Easy Breach DerbyCon 2016\r\nArchived: 2026-04-05 13:41:38 UTC\r\n1.\r\nCopyright © FireEye,Inc. All rights reserved.1 NO EASY BREACH DERBYCON 2016 #NOEASYBREACH\r\nMatt Dunwoody @matthewdunwoody Nick Carr @itsreallynick\r\n2.\r\nCopyright © FireEye,Inc. All rights reserved.2 How It All Started • 1 average spearphishing email • 1 failed client\r\nremediation • 1 very determined nation state • Attacker’s mission not impacted by ongoing remediation measures •\r\n2 attacker objectives: • Steal email of targeted VIPs • Monitor security team, response \u0026 detection efforts FUN\r\nFACT: This was APT29\r\n3.\r\nCopyright © FireEye,Inc. All rights reserved.3 Several Months Later… • The Aftermath • Four person Mandiant\r\nteam • Over 1,039 compromised systems • Over 1,000 unique malware samples • Over 1,000 different unique C2\r\ndomains / IPs • Over 50,000 email communications stolen • Including scripts \u0026 tools: 7,000+ attacker files • How\r\ndid they pull it off? • Fast-paced intrusion • Very stealthy • Rapidly changing tactics • Employed advanced attack\r\ntechniques\r\n4.\r\nCopyright © FireEye,Inc. All rights reserved.4 Challenge 1: Fast-Paced Attacker • Attacker infected 10 systems\r\nper day with primary backdoor family • Especially when provoked (maintained baseline foothold) • Accessed\r\nhundreds of systems for recon and credential theft • Removed tools and forensic artifacts to hide activity •\r\nDeployed additional backdoor families • Continued to steal data every week\r\n5.\r\nCopyright © FireEye,Inc. All rights reserved.5 Our Response: Triaged Where Possible • Moved from typical Live\r\nResponse analysis to abbreviated triage • Brief analysis leveraging known attacker TTPs • Developed indicators to\r\nassist triage • Partially automated the analysis process • Some activity not unique enough to sig • Focused on: •\r\nLateral movement • Walking back up the chain • Pivoting, recon, new tools or backdoors • Signs of data theft •\r\nDeviation from typical attacker activity FAST-PACED ATTACKER\r\n6.\r\nCopyright © FireEye,Inc. All rights reserved.6 Our Response: Streamlined Documentation • Typical LR reports\r\nand timelines took too much time • Still needed to document findings • Compressed notes from systems into brief,\r\nstandardized text blocks • Malware and attacker tools on the system • Persistence mechanisms • Periods of\r\nhttp://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016\r\nPage 1 of 6\n\nattacker activity and significant timestamps • Source of activity • Documented significant findings • New TTPs •\r\nData theft FAST-PACED ATTACKER\r\n7.\r\nCopyright © FireEye,Inc. All rights reserved.7 Lesson Learned: Be Fast and Flexible • Be willing to change\r\nnormal practices and disregard official methodologies when they’re not working • Make the most of outside help -\r\naccept the limitations of your circumstances and do what you can to maximize your chances of success FAST-PACED ATTACKER\r\n8.\r\nCopyright © FireEye,Inc. All rights reserved.8 Challenge 2: Stealthy Attacker • Attacker using counter forensic\r\ntechniques to hide endpoint and network activity • Endpoint: secure deletion, impressive OPSEC (pack up and\r\nmove), 90% doctrine • Network: compromised third party websites \u0026 social media C2, altered communication\r\nscheme + strong crypto, embraced SSL • The odds were stacked against us • Unable to use Mandiant network\r\nsensors and signatures • Existing devices inconsistently-deployed and coverage spotty • “Rolling remediation”\r\nactions showed our hand so attacker knew which evasion tactics were working\r\n9.\r\nCopyright © FireEye,Inc. All rights reserved.9 • Attacker considered every detail • Mass activity to obscure the\r\nreal target • More evident in recent campaigns • Widespread phishing with a prioritized target list • They might\r\neven want the first system to be caught • Data theft using only legitimate US-based services, complicating any law\r\nenforcement response • Gmail, Google Drive using APIs • OneDrive • Monitored Us • Targeted the IR operations\r\nthroughout the compromise • Were we onto them and how much time did they have left? BONUS SLIDE: Even\r\nMore OPSEC he looks cozy\r\n10.\r\nCopyright © FireEye,Inc. All rights reserved.10 Our Response: Found Clues in the Ruble • Maximized the utility\r\nof trace forensic artifacts • Some attacker behavior recovered from sdelete • File path regex for artifacts •\r\nEverything from AAA.AAA to ZZZ.ZZZ • Entry Modified timestamp typically indicated when sdelete occurred •\r\nEULA Accept registry key for each Sysinternals tool • Searched for new sdelete usage • Prefetch entries for some\r\noperations (e.g., RAR) included deleted items in Accessed Files STEALTHYATTACKER FUN FACT: Now it’s\r\nbuilt-in!\r\n11.\r\nCopyright © FireEye,Inc. All rights reserved.11 Our Response: Made the Best of What We Had • Learned and\r\nleveraged client’s network tools • Embraced the varying technology across business units • Took time and patience\r\nto filter out the network noise • Searched for every new system by timeframe • Searched activity between sets of\r\ninfected hosts • Automated where possible • Developed dashboards STEALTHYATTACKER\r\n12.\r\nhttp://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016\r\nPage 2 of 6\n\nCopyright © FireEye,Inc. All rights reserved.12 Our Response: Made the Best of What We Had • Found the\r\nhelpful but forgotten alerts • SMB transfer of UPX-packed files • Extracted fields we wanted • Signature\r\ncombinations solved mysteries • Schtasks.exe usage by UUID • SMB writes to System32 • Network time\r\npreserved when other timestamps could not be trusted STEALTHYATTACKER\r\nsignature=MSRPC_SuspiciousEncryption event_info=\"UUID=86d35949-83c9-4044-b424- db363231fd0c*”\r\nsrc_ip=\"10.*\" dest_ip=\"10.*” ( dest_port=49154 OR dest_port=49155 ) FUN FACT: This was our initial\r\ndiscovery of HAMMERTOSS\r\n13.\r\nCopyright © FireEye,Inc. All rights reserved.13 Our Response: Made New Shiny Things • Deployed additional\r\nbudget-friendly open source tech • Found ways to apply our methodology • Connected to our incident tracker •\r\nSparklines for time + volume of activity • Prioritized host analysis based on traffic • Smashed and grabbed before\r\nthe wipe! STEALTHYATTACKER host_10 host_9 host_8 host_7 host_6 host_5 host_4 host_3 host_2 host_1\r\n14.\r\nCopyright © FireEye,Inc. All rights reserved.14 Lesson Learned: Improve Visibility and Don’t Stop Looking •\r\nMap attacker activity to potential data sources and use everything available to minimize blind spots • Give your\r\nteam access to existing tools outside of their normal process • Consider deploying additional technology •\r\nNetwork time provides reliable chronology despite host-based timestomping • Combat IR fatigue by automating\r\nhigh-confidence (and boring stuff) • Once an attacker is found, fight to maintain line-of- sight\r\nSTEALTHYATTACKER\r\n15.\r\nCopyright © FireEye,Inc. All rights reserved.15 Challenge 3: Rapidly-Evolving Tactics • New and updated\r\nbackdoors • 7 distinct backdoor families • SEADADDY went through 3 version updates • Seven unique\r\npersistence mechanisms • Registry run key, .LNK files, services, WMI, named scheduled tasks, hijacking\r\nscheduled tasks, over-writing legitimate files • Cycled persistence techniques regularly • Minimal re-use of\r\nmetadata commonly tracked and shared as indicators • Malware MD5, file name, file size, and C2 unique to each\r\nsystem • Attacker didn’t need to re-use compromised accounts FUN FACT: On current case, APT29 used unique\r\nUAC bypass \u0026 persistence that was first posted online days before\r\n16.\r\nCopyright © FireEye,Inc. All rights reserved.16 Our Response: Maintained Eye Contact • Fought to keep network\r\nvisibility on all malware families • Backdoor version 1: could see it, sig it, and decode it PHPSESSID = base64(\r\nzlib( aes( BACKDOOR C2 ) ) ) • Backdoor version 2: lost ability to decode it Cookie{2,7} = customb64( zlib(\r\nrc4( aes( BACKDOOR C2 ) ) ) ) • Backdoor version 3: lost ability to sig it random_split( Cookie{2,7} =\r\ncustomb64( zlib( rc4( aes( BACKDOOR C2 ) ) ) ) • Wrapped in SSL: lost ability to see it … at first RAPIDLY-EVOLVING TACTICS FUN FACT: This was SEADADDY certificate email SSL cipher start stop\r\nroot@domain1.com TLS_DHE_RSA_WITH_AES_256_CBC_SHA 10/14/15 14:13:00 10/15/15 00:14:37\r\nsupport@vendor.com TLS_RSA_WITH_3DES_EDE_CBC_SHA 10/14/15 16:13:29 10/14/15 16:13:29\r\nroot@domain2.com TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 10/13/15 13:30:17 10/14/15 03:14:04\r\nhttp://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016\r\nPage 3 of 6\n\nadmin@example.com TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 10/11/15 13:02:21 10/12/15 10:58:59\r\nFinding attacker SSL usage using Bro’s ssl.log\r\n17.\r\nCopyright © FireEye,Inc. All rights reserved.17 Our Response: Prioritized the Unknown • Spent time analyzing\r\nsystems with unknown activity • The most interesting systems were the ones accessed but we didn’t know what\r\nthey did • Limited analysis on systems with known and consistent attacker tactics • While not useful as standalone\r\nindicators, tracked breach data to prioritize discovered systems • Identified common forensic artifacts between\r\nsystems with shared C2 RAPIDLY-EVOLVING TACTICS\r\n18.\r\nCopyright © FireEye,Inc. All rights reserved.18 Our Response: Continually Improved Indicators • Created\r\nindicators for every stage of attack lifecycle • All seven persistence mechanisms, recon, lateral movement, and\r\ndata theft • Methodology IOCs helped identify systems without known malware • Reverse engineered every\r\nbackdoor revision \u0026 updated indicators • Maintained a list of high-confidence indicators to focus new IOC\r\ndevelopment • Developed flexible \u0026 resilient indicators • Provided high-fidelity matches across versions,\r\nregardless of morphing • Used imports and exports, size ranges, section names, compile times, and other\r\nconsistent attributes RAPIDLY-EVOLVING TACTICS\r\n19.\r\nCopyright © FireEye,Inc. All rights reserved.19 Our Response: Continually Improved Indicators RAPIDLY-EVOLVING TACTICS • Automated analysis of backdoor for comparison and configuration extraction; enterprise-wide search of process memory • Indicators based on packaging and delivery • Import hashes, size, section names,\r\nartifacts of wrapper execution everywhere possible • Adapted file system IOC+regex to process handles, prefetch,\r\nand event logs • Identified malware staged for SMB transfer obfuscated- backdoor.py PyInstaller / Py2Exe UPX-packed ...transferred laterally\r\n20.\r\nCopyright © FireEye,Inc. All rights reserved.20 Lesson Learned: Find It, Refine It, Re-Find It • Enhance and test\r\nyour best indicators even when they’re working • Track what the attacker can change before you lose visibility of\r\ntheir activity • Don’t let technical data fall through the cracks, even when visibility is good and the details have\r\nmarginal value as indicators RAPIDLY-EVOLVING TACTICS\r\n21.\r\nCopyright © FireEye,Inc. All rights reserved.21 Challenge 4: Advanced Attack Techniques • Windows\r\nManagement Instrumentation (WMI) • Attacker used WMI to persist backdoors • Embedded backdoor files and\r\nPowerShell scripts in WMI repo • Used WMI to steal credentials from remote systems • Configured WMI to\r\nextract and execute backdoors months in the future, to evade remediation • Attacker leveraged PowerShell •\r\nStealthy backdoors • PowerShell scripts like Invoke-Mimikatz evaded A/V detection • Excellent WMI integration\r\n• Kerberos • Attacker used Kerberos ticket attacks, which made tracking lateral movement difficult\r\nhttp://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016\r\nPage 4 of 6\n\n22.\r\nCopyright © FireEye,Inc. All rights reserved.22 Our Response: Tackled Attacker WMI Usage • Searched for WMI\r\npersistence • Manually parsed from objects.data strings on endpoints • Ran script across the environment to\r\nidentify persistence • Colleagues developed custom MIR audit to allow for sweeping • Identified evidence of\r\nattacker code in WMI repo • Attacker embedded PowerShell code in WMI class properties to execute on remote\r\nsystem • Identified class and property names and code in objects.data strings • Searched contents of CIM repo at\r\nscale • Parsed out embedded scripts and malware • The repo was a poorly documented, complex structure, so\r\nparsing was difficult and manual • Willi Ballenthin, Matt Graeber and Claudiu Teodorescu made repo parsers\r\n(after the investigation was completed) ADVANCED ATTACK TECHNIQUES\r\n23.\r\nCopyright © FireEye,Inc. All rights reserved.23 Our Response: Tackled Attacker WMI Usage ADVANCED\r\nATTACK TECHNIQUES\r\n24.\r\nCopyright © FireEye,Inc. All rights reserved.24 Our Response: Increased PowerShell Visibility • Upgraded the\r\nenvironment to PowerShell 3.0 and enabled logging • Logging captured input/output, variable initialization, etc. •\r\nCaptured entire functions of PS scripts, attacker commands, script output, etc. • Wrote indicators based on\r\nobserved attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon,\r\npersistence creation, etc. • Turned attacker PowerShell usage from a threat to a benefit • Logging and IOCs made\r\nfinding and analyzing attacker activity much easier ADVANCED ATTACK TECHNIQUES FUN FACT: There’s\r\nnow a blog post and my script block logging parser on GitHub\r\n25.\r\nCopyright © FireEye,Inc. All rights reserved.25 Our Response: Increased PowerShell Visibility ADVANCED\r\nATTACK TECHNIQUES\r\n26.\r\nCopyright © FireEye,Inc. All rights reserved.26 Our Response: Addressed Ticket Attacks • Worked around\r\nKerberos attacks • Swept for Invoke-Mimikatz PTT usage in PS logs to identify pivot systems • Swept for other\r\nindicators of lateral movement to identify destination systems • Looked for remote Kerberos logons around the\r\ntime of attacker activity • Developed indicators • Based on research by Sean Metcalf at adsecurity.org • Developed\r\nlate in the investigation • Extremely high-fidelity ADVANCED ATTACK TECHNIQUES\r\n27.\r\nCopyright © FireEye,Inc. All rights reserved.27 Our Response: Addressed Ticket Attacks ADVANCED ATTACK\r\nTECHNIQUES Event ID 4624 Event ID 4672 Event ID 4634\r\n28.\r\n29.\r\nhttp://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016\r\nPage 5 of 6\n\nCopyright © FireEye,Inc. All rights reserved.29 BONUS SLIDE: Even More WMI + PS FUN FACT: We saw the\r\nattacker test this backdoor before deployment\r\n30.\r\nCopyright © FireEye,Inc. All rights reserved.30 Lesson Learned: Turn Weakness Into Strength RAPIDLY-EVOLVING TACTICS • Use attackers’ strengths against them • Unique attacks make for high-fidelity indicators •\r\nIdentify the activity • Develop indicators • Increase visibility at scale • Automate detection • Create an alerting\r\nsystem, if possible\r\n31.\r\nCopyright © FireEye,Inc. All rights reserved.31 • Backdoor used TOR hidden services to provide secure, discrete\r\nremote access • Used Meek plugin to hide traffic • Forwarded TOR traffic to ports: • 3389 – Remote Desktop •\r\n139 – Netbios • 445 – SMB • Modified registry to enable RDP • “Sticky-keys” to provide unauthenticated,\r\nprivileged console access BONUS SLIDE: TOR backdoor (just because it’s cool) FUN FACT: This was first\r\ndeployed 3 hours before remediation\r\n32.\r\nCopyright © FireEye,Inc. All rights reserved.32 BONUS SLIDE: TOR backdoor (just because it’s cool)\r\n33.\r\nCopyright © FireEye,Inc. All rights reserved.33 BONUS SLIDE: TOR backdoor (just because it’s cool) Client\r\nEndpoint APT29 (actual image) TOR network Meekreflector .appspot.com Mail.google.com Google Cloud SSL\r\nHTTP TOR TOR\r\n34.\r\nCopyright © FireEye,Inc. All rights reserved.34 If You’ve Learned Nothing Else Today… SUPER IMPRESSIVE\r\nCONCLUSION SLIDE • You must match or exceed the attacker’s pace • You must match or exceed the attacker’s\r\nvisibility • You must match or exceed the attacker’s development • You must match or exceed the attacker’s\r\nadvanced techniques • You must match or exceed the attacker’s intensity.\r\n35.\r\nCopyright © FireEye,Inc. All rights reserved.35 “True happiness incident response is a life of continual self-improvement. The greater the struggle, the more enriching the experience is for your life.”\r\n36.\r\nCopyright © FireEye,Inc. All rights reserved.36 THANK YOU QUESTIONS? DERBYCON 2016\r\n#NOEASYBREACH Matt Dunwoody @matthewdunwoody Nick Carr @itsreallynick\r\nSource: http://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016\r\nhttp://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016\r\nPage 6 of 6",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"http://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016"
	],
	"report_names": [
		"no-easy-breach-derby-con-2016"
	],
	"threat_actors": [
		{
			"id": "5b748f86-ac32-4715-be9f-6cf25ae48a4e",
			"created_at": "2024-06-04T02:03:07.956135Z",
			"updated_at": "2026-04-10T02:00:03.689959Z",
			"deleted_at": null,
			"main_name": "IRON HEMLOCK",
			"aliases": [
				"APT29 ",
				"ATK7 ",
				"Blue Kitsune ",
				"Cozy Bear ",
				"The Dukes",
				"UNC2452 ",
				"YTTRIUM "
			],
			"source_name": "Secureworks:IRON HEMLOCK",
			"tools": [
				"CosmicDuke",
				"CozyCar",
				"CozyDuke",
				"DiefenDuke",
				"FatDuke",
				"HAMMERTOSS",
				"LiteDuke",
				"MiniDuke",
				"OnionDuke",
				"PolyglotDuke",
				"RegDuke",
				"RegDuke Loader",
				"SeaDuke",
				"Sliver"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "a241a1ca-2bc9-450b-a07b-aae747ee2710",
			"created_at": "2024-06-19T02:03:08.150052Z",
			"updated_at": "2026-04-10T02:00:03.737173Z",
			"deleted_at": null,
			"main_name": "IRON RITUAL",
			"aliases": [
				"APT29",
				"Blue Dev 5 ",
				"BlueBravo ",
				"Cloaked Ursa ",
				"CozyLarch ",
				"Dark Halo ",
				"Midnight Blizzard ",
				"NOBELIUM ",
				"StellarParticle ",
				"UNC2452 "
			],
			"source_name": "Secureworks:IRON RITUAL",
			"tools": [
				"Brute Ratel C4",
				"Cobalt Strike",
				"EnvyScout",
				"GoldFinder",
				"GoldMax",
				"NativeZone",
				"RAINDROP",
				"SUNBURST",
				"Sibot",
				"TEARDROP",
				"VaporRage"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "46b3c0fc-fa0c-4d63-a38a-b33a524561fb",
			"created_at": "2023-01-06T13:46:38.393409Z",
			"updated_at": "2026-04-10T02:00:02.955738Z",
			"deleted_at": null,
			"main_name": "APT29",
			"aliases": [
				"Cloaked Ursa",
				"TA421",
				"Blue Kitsune",
				"BlueBravo",
				"IRON HEMLOCK",
				"G0016",
				"Nobelium",
				"Group 100",
				"YTTRIUM",
				"Grizzly Steppe",
				"ATK7",
				"ITG11",
				"COZY BEAR",
				"The Dukes",
				"Minidionis",
				"UAC-0029",
				"SeaDuke"
			],
			"source_name": "MISPGALAXY:APT29",
			"tools": [
				"SNOWYAMBER",
				"HALFRIG",
				"QUARTERRIG"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "20d3a08a-3b97-4b2f-90b8-92a89089a57a",
			"created_at": "2022-10-25T15:50:23.548494Z",
			"updated_at": "2026-04-10T02:00:05.292748Z",
			"deleted_at": null,
			"main_name": "APT29",
			"aliases": [
				"APT29",
				"IRON RITUAL",
				"IRON HEMLOCK",
				"NobleBaron",
				"Dark Halo",
				"NOBELIUM",
				"UNC2452",
				"YTTRIUM",
				"The Dukes",
				"Cozy Bear",
				"CozyDuke",
				"SolarStorm",
				"Blue Kitsune",
				"UNC3524",
				"Midnight Blizzard"
			],
			"source_name": "MITRE:APT29",
			"tools": [
				"PinchDuke",
				"ROADTools",
				"WellMail",
				"CozyCar",
				"Mimikatz",
				"Tasklist",
				"OnionDuke",
				"FatDuke",
				"POSHSPY",
				"EnvyScout",
				"SoreFang",
				"GeminiDuke",
				"reGeorg",
				"GoldMax",
				"FoggyWeb",
				"SDelete",
				"PolyglotDuke",
				"AADInternals",
				"MiniDuke",
				"SeaDuke",
				"Sibot",
				"RegDuke",
				"CloudDuke",
				"GoldFinder",
				"AdFind",
				"PsExec",
				"NativeZone",
				"Systeminfo",
				"ipconfig",
				"Impacket",
				"Cobalt Strike",
				"PowerDuke",
				"QUIETEXIT",
				"HAMMERTOSS",
				"BoomBox",
				"CosmicDuke",
				"WellMess",
				"VaporRage",
				"LiteDuke"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775434865,
	"ts_updated_at": 1775792237,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/90a210af26d723f910c15d076ce05b2572dec9cf.pdf",
		"text": "https://archive.orkl.eu/90a210af26d723f910c15d076ce05b2572dec9cf.txt",
		"img": "https://archive.orkl.eu/90a210af26d723f910c15d076ce05b2572dec9cf.jpg"
	}
}