They mostly target relatively large companies . They can also work with the government, then they target government and military targets.The range of attacks of such attackers is quite extensive . Their
attacks are usually multi-layered (i.e. after the planning and anchoring phase (e.g. with a virus, or a compromised employee, or a network hack), about 2/3 of the attacker phase follows).Such attackers often use various malware to gain access . Here is an interesting thread on github with molware . Also here are different sources of viruses you can have a look.
Our BlackHats can also exploit network vulnerabilities, dudos and dos attacks. As well as if the device, from which it is necessary to steal data is not connected to the network, they use physical vulnerabilities (for example thermal or electromagnetic) to transmit and capture data. Also the attackers in smaller companies can use web vulnerabilities (like sqli) to obtain the data they need. It is important not only to get on the server, but also to stealthily get there data unlike the encryptors.
Which in some cases (when the device is disconnected from the network, for example) is quite difficult.
Attackers who target surveillance🔎Most often they target more or less famous people - politicians, journalists, businessmen.For their actions
they usually use malware. But as an example, they can hack into networks or devices to spy on them manually. They often use pegasus. Also if they work with the government, they can compromise the provider and intercept phone calls, sms, as well as cell phone traffic.
Here are a few examples Let's start with the coders 🔐
After planning an attack, a group of cryptographers, with the help of a commented employee, have established themselves in the network of a mattress manufacturing company.Then they
need to get on the server and encrypt the data to later demand a ransom.
At the company server is windows server 2012. Since the attackers are
already on the network they conduct a local dos attack (for example through scapy). Forcing the administrator (no, not me, but the system🙃) to re-enter the server.
And then they intercept the login session (with metasploit for example) or the password (with wireshark (but they need to decrypt it, they can do it with hydra or hashcat for example)) . Logging into windows server they will need to elevate their privileges. (Here is a small manual on the subject ).After the attackers need to gain access to the servers with backups. After getting it they upload encryption tools to victim's server and encrypt data, after that they ask for ransom.
Here are some examples of attackers who collect data 🔬Our attacker gang is targeting an
IT company with a pioneer technology (the attackers were hired by their competitors to get some important technology from the source code) To get the data they want, they
plant a rat virus on the computer of one of their coworkers and collect the data they need to log on (the virus collects passwords in browsers, has keylogging capabilities, and can also elevate privileges. ) Once they have the data they need, they
log on to the server.
Now they need to get and transfer the sources. The server is ubuntu. To do that they must elevate privileges. They do it with different vulnerabilities, here is an example of an exploit for one of them
#network #air_gap #dos #cve #exploit #linux #web #ransomware #malware #pentest #traffic_analysis #attackers #windows #data_collection
