Three Buddy Problem - Episode 28: In this episode, we explore the ongoing challenges of threat actor naming in cybersecurity and the confusion caused by a lack of standardization, methodological inconsistencies and skewed, marketing-driven incentives.
Plus, the US Treasury/BeyondTrust hack, the surge in 0day discoveries, a new variant of the Xdr33 CIA Hive malware, and exclusive new information on the Cyberhaven Chrome extension security incident.
Cast: Juan Andres Guerrero-Saade ( juanandres_gs) , Costin Raiu ( craiu) and Ryan Naraine ( ryanaraine) .
Links:
• Transcript (unedited, AI-generated) (docs.google.com/document/d/1Fozuh0j1k3EiKJr8mSxP__6O6dQ3iLgAxeEq8f9GKxI/edit?tab=t.0#heading=h.1u39inyn4ent)
• BeyondTrust statement on hack investigation (www.beyondtrust.com/remote-support-saas-service-security-investigation)
• U.S. Treasury says it was hacked by China-backed actors (archive.ph/0ELY2)
• Another Palo Alto 0day exploited in the wild (security.paloaltonetworks.com/CVE-2024-3393)
• US telcos say they've evicted Salt Typhoon Chinese hackers (www.reuters.com/technology/cybersecurity/chinese-salt-typhoon-cyberespionage-targets-att-networks-secure-carrier-says-2024-12-29/)
• Google: What is BeyondCorp? (cloud.google.com/beyondcorp)
• Introducing the MISP Threat Actor Naming Standard (www.misp-standard.org/blog/Naming-Threat-Actor/)
• MISP: Recommendations on Naming Threat Actors (www.misp-standard.org/rfc/threat-actor-naming.html)
• New variant of the CIA HIVE attack kit (x.com/nextronresearch/status/1874690494930014703)
• Xdr33 Variant Of CIA's HIVE Attack Kit Emerges (blog.netlab.360.com/headsup_xdr33_variant_of_ciahive_emeerges/)
• Savvy Seahorse connection to Cyberhaven incident (blogs.infoblox.com/threat-intelligence/beware-the-shallow-waters-savvy-seahorse-lures-victims-to-fake-investment-platforms-through-facebook-ads/)
• US sanctions China's Integrity Technology over Flax Typhoon hacks (www.reuters.com/technology/cybersecurity/us-issues-cybersecurity-sanctions-against-chinas-integrity-technology-2025-01-03/)
• Operation Aurora (en.wikipedia.org/wiki/Operation_Aurora)
• APT1 Exposing One of China’s Cyber Espionage Units (www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf)