Frankfurt December 2019

Lazarus APT vs Banking Sector: Combining CTI & DFIR to Investigate APT Intrusions

• Jess Garcia
• Tuesday, December 10th, 7:00pm - 8:00pm

The Lazarus APT Group, tied to the North Korean government, has been heavily targeting the banking sector worldwide during the last few years. Near 100 million dollars were stolen from the Bank of Bangladesh, which very close became 1 billion dollars, and several others followed. A little later, the whole Polish and Mexican banking sectors were targeted, only to be discovered 4 months later. Extensive Cyber Threat Intelligence was published in Open and Closed Sources about these incidents, allowing Incident Responders in the affected organizations to properly address the Threat, illustrating the key role that CTI plays in DFIR today. In this talk Jess Garcia, who was fighting some of these incidents in the trenches with his team at One eSecurity, will show you how to combine Cyber Threat Intelligence, Forensics and Malware Analysis to carry out an effective Incident Response in the context of an APT Incident.

Location: Ballsaal 1