Operation So-seki:
You Are a Threat Actor. As Yet You Have No Name.

Jan. 25 th , 2024
Ryo Minakawa, Kaichi Sameshima, Atsushi Kanda
NTT Communications / N.F.Laboratories© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

$whoami

Atsushi Kanda

Ryo Minakawa@NTT Communications@N.F.Laboratories

Kaichi Sameshima@NTT Communications© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC20242

Outline• Operation So-seki• Threat Actor Profile• DDoS Infrastructure and Capability• DDoS Activities• Exploring Threat Infrastructure using Flows• Hacktivist and Threat Intelligence Sharing• Summary© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

3

Hacktivists are monitoring public
information related to them© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC20244

Please do not carelessly discuss
hacktivist-related topics in public
spaces like SNS.
Please refrain strictly fromspreading any information linking
this presentation to the actor's
real name.

© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC20245

Outline• Operation So-seki• Threat Actor Profile• DDoS Infrastructure and Capability• DDoS Activities• Exploring Threat Infrastructure using Flows• Hacktivist and Threat Intelligence Sharing• Summary© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC20246

Overview: Operation So-seki••

Investigation of a cyber threat actor who names themselves•

Tracking pro-Russian DDoS attack agitators operating mainly on Telegram•

Multi-perspective analysis from the viewpoints of, and so onKey Takeaways:•Techniques for tracking andanalyzing the DDoS infrastructure•Long-term multi-perspective study of the DDoS actor•The status quo of C2 discovery techniques
using flow information•

Lessons learned from confronting the hacktivists© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC20247

Outline• Operation So-seki• Threat Actor Profile• DDoS Infrastructure and Capability• DDoS Activities• Exploring Threat Infrastructure using Flows• Hacktivist and Threat Intelligence Sharing• Summary© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC20248

Venue only

© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

9Outline• Operation So-seki• Threat Actor Profile• DDoS Infrastructure and Capability• DDoS Activities• Exploring Threat Infrastructure using Flows• Hacktivist and Threat Info. Sharing• Summary© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC202410

Venue only

© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC202411

Outline• Operation So-seki• Threat Actor Profile• DDoS Infrastructure and Capability• DDoS Activities• Exploring Threat Infrastructure using Flows• Hacktivist and Threat Intelligence Sharing• Summary© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

12

Venue only

© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

13

Outline• Operation So-seki• Threat Actor Profile• DDoS Infrastructure and Capability• DDoS Activities• Exploring Threat Infrastructure using Flows• Hacktivist and Threat Intelligence Sharing• Summary© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC202414

The Use of Flow Information by ISPs
• 『電気通信事業者におけるサイバー攻撃等への対処と通信の秘密に関するガイドライン（第6版） 』(“Guidelines for Telecommunications Carriers Regarding Response to Cyber Attacks and Secrecyof Communications (Revision 6)”[Japanese only]), 2021
• Allowing telecom carriers to investigate and discover C2 server using Flow information• The scope is to “identify C2 server”• 『国家安全保障戦略』(“National Security Strategy” [Japanese only]), 2022• The document includes a discussion on the effort implicitly assumed the use of Flow
information by telecom carriers as a consideration to introduce so-called “Active CyberDefense”

Against these backgrounds,Operation So-seki uses Flow to track C2 server© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

15

Venue only

© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC202416

Limitation of Flow information• Coverage: Only a subset of the whole Internet traffic can be observed• Constraints on collection points:
Traffic that do not pass throughthe collection points can not be observed• Constraints of sampling:
There is stochastically unobservable traffic（especially low-volume traffic）• Amount of information︓
The basic component of Flow is 5-tuple*• Itʼs quite difficult to determine whether it is
the C2 communication based on the Flow
information alone“First Step to Active Cyber Defence: The Significance of Profiling Attackers”(JSAC2023)

There are valuable insights that can only be obtained from the Flow, but they arenʼt sliver bullets.
It is essential to combine with various contextual information to increase confidence.
© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024 * 5-tuple=Source IP, Source port, Destination IP, Destination port, Protocol

17Outline• Operation So-seki• Threat Actor Profile• DDoS Infrastructure and Capability• DDoS Activities• Exploring Threat Infrastructure using Flows• Hacktivist and Threat Intelligence Sharing• Summary© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

18

Negative effects ofsharing/spreading threat intelligence

Public disclosure of TTP information

Spread of victimʼs information

Changes in TTPs

Reinforcing the attackerʻs experience of success
Reuse for further propaganda© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

19

Venue only

© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

20

Hacktivist-specific situations• The Ultimate goal
= Influence public opinion by making
their claims widely known• DDoS is just a means of attracting public interest• Hacktivists are concerned about how welltheir message is reaching the world••“Are the people aware of us and our attacks?”“How fascinate the impact caused by our attacks is?”Hacktivists want to make them andtheir activities more known
Public disclosure of the threat intelligence is inappropriate
when confronting hacktivists© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

21

Venue only

© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

22

Lessons learned from confronting hacktivists• Intelligence sharing tailored to the nature of each threat actor• Think about costs and benefits for both attacker and defender••

Back to basics of threat intelligence (4As)
••
•
•

•

Public disclosure is inappropriate when confronting hacktivists

Accurate
Audience Focused
Actionable
Adequate TimingBenefits
forAttacker

Costs
forDefenderBenefitsforDefenderCosts
for
AttackerPay attention to secondary information sharing•

Careless information spreading is more beneficial for attackers© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

23

Outline• Operation So-seki• Threat Actor Profile• DDoS Infrastructure and Capability• DDoS Activities• Exploring Threat Infrastructure using Flows• Hacktivist and Threat Intelligence Sharing• Summary© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024

24

Summary•Long-term investigation of pro-Russian hacktivist•

Key Takeaways:•Techniques for tracking and analyzing the DDoS infrastructure••Long-term multi-perspective study of the DDoS actor••

The status quo of C2 discovery techniques using flow information••

Values and limitations of using flow information

Lessons learned from confronting hacktivists•

Intelligence sharing tailored to the nature of each threat actor© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC202425

Operation So-seki:
You Are a Threat Actor. As Yet You Have No Name.

Thank you︕

Your comments & feedbacks
are always welcome© 2024 NTT Communications Corporation, N.F.Laboratories Inc.

JSAC2024