AleksandarMilenkoskiandJulian-伪装与混乱中国APTs玩勒索游戏的轨迹

Camouflage and ChaosDr. Aleksandar Milenkoski (SentinelLabs, SentinelOne)Julian-Ferdinand Vögele (Insikt Group, Recorded Future)On the Trail of Chinese APTs Playing the Ransomware GameAgendaWhy Would APTs Use Ransomware?What Is China Up To?(Chinese) APTs Use Ransomware. Now What?1/17State-ignoredState-conductedWhy Would APTs Use Ransomware?FundraisingMoonlightingFinancial GainMandiant, 2019CNN, 20232/17DestabilizationCISA, 2024Eroding trustDisruption3/17MisdirectionChina’s Computer Virus Emergency Response Center (CVERC), 2024Cover for espionageMisattributionPlausible deniability4/17Overarching BenefitsDesensitizationEvidence removalAre we reallypaying attention anymore?5/17What Is China Up To?Natto Thoughts, 20246/17Case #1ChamelGang (CamoFei)The AIIMS (2022)The Presidency of Brazil (2022)DestabilizationBeaconLoader7/17Case #1 (Cont.)8/17Case #1 (Cont.)India Today, 2020BBC, 2020The Economist, 20229/17Case #1 (Cont.)CyberScoop, 202410/17Case #2DEV-0401 (SLIME34, BRONZE STARLIGHT)Techno