First Step to Active Cyber Defence:
The Significance of Profiling Attackers

JPCERT Coordination Center
Early Warning Group Manager
Threat Analyst
Hayato SasakiBefore start
Current status (November 2022)
As the government is considering revisions to the three key national security documents, the concept of "active cyberdefense" is mentioned.
While there is a lot of talk about whether to include or not to include "counterattacks," there is no concrete explanationof the "definition," what kind of operations are involved, or the advantages or disadvantages of such operations.

Actually, there is no definition of such a term, and no one knows the
specific theory!

Issue
In general, in this kind of issue, various “means” newly considered may become activity traps.
The "who's going to do it?" argument can essentially lead to a false means.
Will there be any "divergence" or "conflict" with existing incident response sites?

Profiling* of attackers is important to determine specific operations andwhich threats to counter.
*While "criminal profiling" is well known for inferring criminals based on crime types and characteristics of crimes committed,
this presentation will use it as an analysis of attacker groupings and attack characteristics and trends.

1© 2023 JPCERT/CC

Preliminary Research
September 21, 2022 JPCERT/CC Blog
(Japanese only)
explains how the term "active cyberdefense" came to be used, how it has
evolved, and how the "definition" of theterm has become blurred.
points out that there is a combination ofdifferent options for countering proactive
cyber attacks

https://blogs.jpcert.or.jp/ja/2022/09/active-cyber-defense.html

2© 2023 JPCERT/CC

From the research: The evolution of the terminology[Hypothesis]
With various entities using the terminology, themix of terms that have flowed in from industries
other than cybersecurity may haveconfused/diversified the concept.
[Background].
People rephrased the terms more "positive
sounding expressions" at the time.
Example: defensive combat doctrine →"active defense" (1976)
Terminology imported from themilitary/intelligence industry to thecybersecurity industry.
E.g., kill chain, threat intelligence, etc.

https://blogs.jpcert.or.jp/ja/2022/09/active-cyber-defense.html

3© 2023 JPCERT/CC

From the research: Proactive countermeasure options
Various proactive countermeasures exist in addition to offensive methods.

https://blogs.jpcert.or.jp/ja/2022/09/active-cyber-defense.html

4© 2023 JPCERT/CC

Consider flexible and dynamic countermeasures
Of the various options for dealing with attackers, "active cyber defense" or "offensive" operations are only a smallpart of the equation.
Nevertheless, as we consider "active cyber defense," isn't it useful to try something that hasn't been done
before?
Countries’ response

What needs to be
determined/executedby each government
agencyWhat can be
implemented by eachprivate entity

Diplomatic action, statement of condemnation
economic sanctions

Criminal investigation (international
investigation), measures under the Foreign
Exchange and Foreign Trade Act, etc.
An "aggressive" operation?

Active Cyber Defense*Various methods for imposing
attack costs
What is already being worked on

Information about theattack5© 2023 JPCERT/CC

Selection/combination of countermeasures by various
actors "effective against each attacker/activity"
depending on the characteristics of the attacker, timing,and understanding of the attack.

What needs to be
determined/executed
as a country

Attackers’ feature

Takedowns
Information dissemination, such as alerts and report releases
Information Sharing

Is it being implemented by anational organization? Is it"outsourced" to private
entities?
What is the objective?

What type of attack
infrastructure is used?

What is the time span of theactivity?

...but in the end, we don‘t know about it yet.
Are we talking about responding to individual cases or the country as awhole?
Should we respond before or after an attack?
Is it to stop or interrupt offensive activity?

Let’s look back at the “definition” of the word a bit6© 2023 JPCERT/CC

Limitations in expanding application of the original "active cyberdefense"A proactive attack response concept originally intended for implementation in individual organizational units
When collaborating by industry/sector or region, the larger the scale, the more difficult it becomes tocollaborate between organizations, and the different types of attacks they are subjected to make it difficult
to respond proactively in a logical manner.
Original concept

Extendedapplication

Informationfrom outside

detectioninformationIntegration
andautomation
through tools

cope

attackdetection information
detection
information

7© 2023 JPCERT/CC

Origins of the ambiguity in "active cyber defense"
strategy

Objectives for thecountry as a whole

The concept of "active defense" as it
appears in U.S. Army Combat Doctrine FM
100-5 (1976 edition)
Operational Art

Operational Art

Doctrine

Active Defense

tactics

8（How to achieve theobjectives of each"campaign" (based on
the strategy)© 2023 JPCERT/CC

Methods to achieve theobjectives of individual
case units- Operational art is the art of campaign"(John English, 1996).
- Operational art is the link between tactical
success and strategic achievement points(British Integration Doctrine).

The concept of "active defence" wascriticized for being focused on the tacticallevel and was subsequently revised toovercome this at the operational level
Improvements are needed to extend "active(cyber) defense," originally at the "tactical"
level, to the "operational" level.
References: Keizo Kitagawa, "Intellectual Innovation in Military
Organizations: Doctrine and the Imagination of Operational Art," David M.
Glantz, "Soviet Military <Operational Art>: The Pursuit of Vertical Deep
Battle," etc.

Point to consider a definition: Campaign
Michael P. Fischerkeller, Emily O. Goldman, Richard J.
Harknett, "CYBER PERSITENCE THEORY," 2022
He pointed out that most cyber attacks backed by state
actors are not "coercion" but "exploitation" and "faitaccompli.
Evaluates and analyzes the history of countermeasure
implementation in the U.S. to date, including theineffectiveness of countermeasures such as public
attribution based on existing deterrence theory.
Focusing on the attack "campaign" unit, we proposethe "Cyber Persistence Theory," an approach tomaintaining superiority through sustained "Direct Cyber
Engagement" in response.

https://global.oup.com/academic/product/cyber-persistence-theory9780197638255?cc=us&lang=en&

9© 2023 JPCERT/CC

Active Cyber Defense as Doctrine
Vertical axis: What are we going to do
Horizontal axis: What is a purpose and when to do
attackcampaign

Attack Campaign

Takedowns
Filtering and blocking
Hack back
Information Disclosure

Doctrinetacticalresponse
Response at the operational level

Strategic level response10© 2023 JPCERT/CC

attackcampaign

Point to consider a definition: timing and coststatus quo
Damageoccurred

attackcorrective
action (esp. in
response to acrisis)Damage Prevention

cope

attackfailureIf the objective is "damage prevention," when andwhat kind of attack "damage" is to be prevented?
- APT attacks are difficult to capture early. Need
information from the first "hit" organization- For example, if an unauthorized access is received,
isn't it "damage prevention" to catch it early andstop the attack before the information is leaked?

Suspension/interferencecope

Imposing "cost" on attackers.
- Raising the cost of launching/successfully launchingan attack (denial deterrence?)- To suspend the attack- - Sanctions as punitive deterrence

attackInterrupting/Interrupting Attacks"Deterrence."
Damageoccurred

attackafter the fact
countermeasureprospects

copingability11© 2023 JPCERT/CC

ability to deter(an attack, etc.)

attackWhat does it mean to "impose a cost" on an attacker?
The term "imposing costs" is increasingly used by Western governments and others.
It is a double-meaning.
Punitive deterrence: "cost" in the sense of "making them pay the price". It is only intended to aim at
subsequent deterrence through measures taken after the attack.
Denial deterrence: "cost" in the sense that it is difficult for an attack to succeed/takes a great deal ofeffort to succeed.
Punitive inhibition12© 2023 JPCERT/CC

negative inhibition

Rethink Attacker's Cost
Isn't the phase immediately prior to a breach of the target organization the most costly phase, including preparationof human resources, malware development, preparation of attack infrastructure, target selection, and initialpenetration route development?
Could there be an approach that not only "imposes costs" but also generates/increases lost profits or sunk costs on
the part of the attacker?
start-up costs

Cost of maintaining operations

cost

compromise
Timing of sufficient results

Timing of minimum results

Timing of
maximum cost
beforeachievingtargets

Hours.

13© 2023 JPCERT/CC

Rethink Attacker's Cost
Rather than capturing and taking down a portion of the C2 server population before full-scale attack activity, wouldn't
it be more "costly" to abort the attack at a time when the attack has begun but the C2 server population can
generally be captured and the sunk cost to the attacker is at its maximum?
Accurate profiling of attackers is essential.
Timing of successful infringement but
not achieving results and near
maximum input costs?

cost(if there is spare or redundant C2
infrastructure)
Additional costs, such as switching to adifferent C2 server, will only push back thetiming of a full-scale attack?

（Early takedown of(some) C2 servers

com
pro
mise

Takedown of a group of
C2 servers used in theattackTiming of sufficient results

com
pro
mise

Hours.

14© 2023 JPCERT/CC

Individual tactics

15© 2023 JPCERT/CC

Block Communication
Even if legal and technical problems are solved, proactive measures cannot be taken unless thesource of the unauthorized communication can be identified at an early stage.
Much of the current situation is capturing
past attacks.

Preparation phase of theattack infrastructureattackAttackInfrastructure
Preparation phaseofCan you supplement "Current Attacks?"

New Attacks*Not all attacks can be grasped.

AttackInfrastructure

AttackInfrastructure

AttackInfrastructure(Preparation
phase)

AttackInfrastructure(under attack)communicat
ionsblockadeearlycaptureincident
investigation16© 2023 JPCERT/CC

After the damage isrecognized, the attacker
goes to investigate theattack infrastructure, but
the infrastructure has
already been shut down.

earlycaptureExample: Investigate infrastructure used for an attack
Investigation of Trickbot's attack
infrastructure configuration by analyzing
Netflow data
Verification of a method to locate the C2server configuration that constitutes theattack infrastructure based on thecharacteristics of the botnet network
connectivity.
Extract communications from Netflow datathat have characteristics that match thebotnet infrastructure configuration andcommunication patterns.
Note that the take-down of Trickbot itself(October 2020) failed (*explains later).

https://insight-jp.nttsecurity.com/post/102fvek/12-5-soc-trickbot

17© 2023 JPCERT/CC

Can we investigate infrastructure used for an attack (C2 hunting)?
Past investigations by ThreatConnect
Investigate non-known C2 servers based on
characteristics of SSL certificates commonly usedby APT28 (Sofacy) C2 servers.

https://threatconnect.com/blog/using-fancy-bear-sslcertificate-information-to-identify-their-infrastructure/18© 2023 JPCERT/CC

Search for suspicious domains based on thecharacteristics of the registrar, name server, acquisitiondate, and IP address/hosting service associated withthe domain, which are frequently used by the attacker.

https://twitter.com/kyleehmke/status/1430485267916460038

Can we do a proactive C2 search?
Revision of the Guidelines- Allow investigation and identification of C2 using Net Flow information- Immediate shutdown is not envisioned at this time.
By using Net Flow information, we can search attack infrastructures, such as botnets, that havecharacteristic intercommunication between C2s, but we cannot search C2 servers that exist on theirown.
Search by the known infrastructure
configurations

How do we search a single attack
infrastructure?

?

19© 2023 JPCERT/CC

Effectiveness of Blocking Communication*Assuming this measure as a counter to APT.

Advantages over other countermeasures- Can be implemented before damage occurs- Low response cost burden on an affected organization- Can be implemented at the time of maximum cost to attackers
Limitations of effectiveness as a countermeasure
Can only be performed on attack activities that have some accumulated information on known
attackers/infrastructure (e.g., large botnets that have been in operation for some time).
- Attacker can switch to another C2 server after blocking- Attacker can take a redundancy measure based on the assumption that communication is blocked.
- May become an endless battle (continually increasing the burden on telecommunications carriers)
Issue- Only a limited number of attack communications can be captured by NetFlow information alone- Need to comprehensively capture unidentified attack infrastructures based not only on observed attack
infrastructures at the damage site, but also on the features of each attack group⇒Profiling of attackers is important
20© 2023 JPCERT/CC

"Public Attribution" issue
Content, granularity, and timing of public attribution (PA) depends on who the "audience" is- To contain attackers?
- To contain the background entity?
- To draw attention?
- To appeal to the relations with allies?
- To appeal to the international community?

Timing of PA
Collecting Information/Investigation

Individual attack or
campaign

PA in the attack
campaign

21© 2023 JPCERT/CC

Individual attack or
campaign

Offensive Campaign
Early PA

Individual attack or
campaign

PA just before theattack campaign

Public Attribution "tolerance" issue
Myth of Public Attribution
There are many attack activities/groups that are highly attribution "resistant".
Accurate profiling of attackers is critical.
APT28,Sandworm attack activity

Attribution

Cyber attacks carried out asactive measures

PA ResistanceShowing information that "the Russians
are behind it" is also part of the effect.

Attack activity aimed at cryptocurrencies
by a subgroup of Lazarus

Attribution

Cyber Attacks for Financial Purposes

PA Resistance

The fact that North Korea is acting illegallyis already a public fact.
22© 2023 JPCERT/CC

"Active" cross-border access - who will do it?
The same access may have different purposes and legal characteristics depending on the entity.
The issue of the basis for implementationin the domestic legal system is also an
issue.

Military
military activities

Relationship with thegovernment of thecountry of residence

espionage activities

Relationship with thegovernment of thecountry of residenceIntelligenceagency*Intelligence activities themselves are notimmediately a violation of international law.

Police/Administrative
Agencies

Jurisdictional Issues
Investigations,administrative
investigations,etc.

Private entity?
*If the act in question is attributed to the state, the state is held
responsible.

23© 2023 JPCERT/CC

Issues with
infrastructure
providers (privateinternational law
issues)Case Study: BlackTech's C2 Server Survey
JPCERT/CC’s blog post on September 2021
The possibility of a distraction on the part of theattacker or a "trap" for the investigator was also
assumed.
Information from closer proximity to the attacker,
such as the attack infrastructure or theattacker's "arsenal," increases the accuracy of
attacker profiling

Malware Gh0stTimes used by JPCERT/CC attack group BlackTech
https://blogs.jpcert.or.jp/ja/2021/09/gh0sttimes.html

24© 2023 JPCERT/CC

"Active" Cross-border Access - Where to "Fight Back"
Not only is it a matter of information acquisition and timing, but it is forgotten that the "counterattack"is basically on the (foreign) civilian infrastructure.
Problem of not finding a counterattack"destination" due to time constraints.
General Unauthorized
Access Cases

In many cases, the attack isover by the time it isrecognized).
Slow intervention by a thirdparty

The question of whether
counterattack is appropriate.
Attack infrastructure is basically running on
private servers.
Even if it is due to fraudulent contracts, there
is a problem of damage to the infrastructure
provider itself or other subscribers due tocounterattacks.

Time Lapse

Not already inoperation

Large-Scale
Cyber Incidents

It is difficult for a third party tointervene to investigate asecurity incident when thepriority is on restoration, etc.
25

© 2023 JPCERT/CC

cloud computing provider
hosting company
ISP, etc.

Time Lapse

"Active" Cross-border Access - What Happens After "Fighting Back"?
Need to discuss technically/operationally realistic assumptions for each attacker
In particular, there is no preliminary knowledge of how to prepare for countermeasures or "counterattacks"
on the part of the attacker against countermeasures
If an ongoing attack isrecognizable

In addition to takedown, C2 servers
can be shut down by direct
manipulation.
Conduct cyber attack to attackers

What will the attacker do?

Retaliation/disturbance/destructionof evidence against the victim
organization

Obstructing investigations, retaliating,setting "traps"
If the preparation of attack is captured. It is unclear if the attack is targeting
domestic organizations. However,assumingly it is prepared by the actor
who has attacked in the past.
Domain takedown
Prepare for (immediate) communication
blocking and filtering
Disable by direct operation
26© 2023 JPCERT/CC

What will the attacker do?

Extensive use of legitimate server
tampering and botnets
Takeover/abuse of legitimate infrastructure
within the target country
Leading to "decoy" attack infrastructure

The Importance of Profiling27© 2023 JPCERT/CC

Identify threats correctly
Various attack activities with completely different objectives/entities are all described as "cyber-attacks“ andare basically handled by the affected industry/sector.
Entities of various
Do we properly identify threats?
backgrounds/configurations

Competent
ministry A

Competent
ministry C

criticalinfrastructure

Research/Institut
ions

...

enterprisesmallercompanies
individual28© 2023 JPCERT/CC

Cyber Attack

Competent
ministry B

Cyber attacks carried out asa use of force

government
body (agency)

Cyber Coercion

Cyber attacks carried out asInformation warfare (active measures, etc.)

Cyber Attacks Performed as Covert Actions

Cyber-attacks conducted as
espionage activities

Cyberattacks conducted asindustrial espionage

Cybercrimes for monetary purposes
other than the aboveEffective countermeasures according to threat characteristics
Effective countermeasures vary depending on the purpose of the attack/the entity carrying out the attack
Profiling of attackers is critical.
Executing entities of various
backgrounds/configurations
exercise of (right of) self-defense
Diplomatic Measures

Things the party wants to avoid:
The lack of diplomaticendorsement?

(Unknown at this time)*No theory?

Things the party wants to avoid:
Unknown

Cyber attacks carried out as a use of force

Cyber Coercion
Cyber attacks conducted as information
warfare (mainly active measures)

public attribution(Diplomatic Measures, etc.)

29

Things the party wants to avoid:
To be clear who did it and at
whose direction.

public attribution
Takedown and other measures
Information dissemination andsharing

Things the party wants to avoid:
To be discovered/interrupted in
the act being performed

Takedown and other measures
Criminal procedure, etc.
Relay infrastructure / interdiction
actions by relay countries

Things the party wants to avoid:
Money flow blocked.

© 2023 JPCERT/CC

Cyber Attacks conducted as Covert Actions

Cyber-attacks conducted as espionage
activities

Cyberattacks conducted as industrial
espionage
Cybercrimes for monetary purposes otherthan the above

From the past cases30© 2023 JPCERT/CC

Overseas examples of (pro)active operations
Soft- Prompt sharing/publication of information in the 2014 Sony Picture Entertainment case
- Early information sharing/publication on multiple wiper prior to the 2022 invasion of Ukraine(Relatively) soft
- Takedown using civil injunctive proceedings against APT28-related domains in Microsoft
Corporation prior to the 2018 U.S. midterm elections.
Hard*Technical effectiveness is unknown.
- Cyber operations by U.S. Cyber Command against Russian IRA infrastructure prior to 2018
midterm elections (details unknown)- 2019 Operation by the U.S. Cyber Command against the infrastructure of a cyber attack group thatclaims to have been involved in the attack in retaliation for the Strait of Hormuz tanker attack(details unknown).
- 2020 Trickbot takedown operations and operations by U.S. Cyber Command (details unknown)

31© 2023 JPCERT/CC

Assessment of Operations Against Trickbot on October 2020
Domain Injunction Proceedings by Microsoft
In addition, the possibility of a "disruption" operation by U.S.
cyber forces
The fact that Trickbot did not completely cease its activities
after a series of responses led to a series of negative viewsof the U.S. Cyber Command's operations.
On the other hand, the response was made in advance of the
U.S. presidential election in November 2020, and somebelieve that it was not exploited in a large-scale attack that
could have affected the presidential election during theperiod in question.

Attack Campaign

https://krebsonsecurity.com/2020/10/report-u-s-cyber-command-behind-trickbot-tricks/

32© 2023 JPCERT/CC

Attack Campaign

Attack Campaign

Further Issues to Consider

33© 2023 JPCERT/CC

Rethink how to obtain information on the edge
The earlier it is, the more options for countermeasures
No single organization (security vendor, specialized agency, police, etc.) can consider and implement countermeasures alone
Even if recognized early by individual organizational units, if it takes time/coordination costs to be shared among theorganizations involved, the time needed to consider countermeasures will be consumed.
Limitations of detailed information on the affected organization
When countermeasures are effective
Attack Campaign

Individual cases or campaign(Current) Timing of reactions by society
as a whole

Report Publication
investigation

Reporting/Publication/Reporting, etc.

Delayed communication of information to third parties
Delayed sharing among organizations that intervened in the case
Conflict between information sharing/dissemination/tracking34© 2023 JPCERT/CC

Who will make the decision to do this?
Strategic decision-making layers should not interfere with detailed tactical unit decision-making in the field.
Each unit/commander chooses the tactics necessary for its objectives based on doctrine
Decentralized command will be necessary to ensure mobility ← Need to secure sufficient human resources
to withstand thisA classic example of a failed operation

strategy

strategy

doctrine
strategytactics

35© 2023 JPCERT/CC

What the "Art of Operation" is all about

Tactical unit decisionmaking intervention by
upper management

doctrine
strategytactics

Operational decisions
based on awarenessof strategic objectives
Flexible response
through decentralizedcommandImpact of professional organizations and analysts
The activities of professional organizations and analysts
will become even more important.

Relationship to previous activities

Newly required roles

How can we respond to retaliation orinterference from the attacker after an"offensive" countermeasure has beentaken? How can we assume this?

Response to the issue of who will do theevaluation after a positive operation has
taken place.

How to accept that the APT group will beless traceable after a disruptive operation
Will there be any restrictions on thedissemination of information by individual
analysts, security companies, andresearchers with autonomy?
36© 2023 JPCERT/CC

Role of Analysts in External Evaluations
Other Than Active Operations Performers
Role as one of the parties involved inconstantly evaluating the ethics ofcountermeasuresSummary
Building a "doctrine" of countermeasures- Assemble countermeasures (selection) targeting the attack campaign ⇒ "5W1H" of countermeasures- Theoretical organization is needed to determine when and for what purpose countermeasures should be implemented (notfrom existing deterrence theory, but from new perspectives such as attacker cost)

Importance of Public-Private Partnerships- New approaches to understanding information are needed for early recognition of attacks, not relying too heavily on"information provided by the victim organization.
- The more powerful countermeasures that require legal authority and the more the role of state institutions increases, the more
the issue of response "timing" becomes a bottleneck, so that a close collaboration between state institutions that take(procedural) time but can initiate powerful measures, and soft but highly mobile private actors' activities Close coordination
will be necessary.

Reevaluation of prior cases, case studies- Even in the U.S., which is ahead of other countries, there is trial and error, and even the evaluation of past cases(measurement of effectiveness) has not yet been established. In addition, the actors/background entities to be confronted
are also different. ⇒Simply trying to imitate "the same thing as overseas" is meaningless.
- Need to examine each technical/operational issue based on specific past case studies

Profiling, tracking and evaluation- Accurate profiling of actors targeting their countries is necessary first, and the role of analysts becomes even more important.
- In order to evaluate the results of proactive operations, especially mid- to long-term impacts, it may be necessary to
track/evaluate analysts from "outside" the organization conducting the operations.
37© 2023 JPCERT/CC

There’s just on more thing…
DWIGHT D. EISENHOWER, “Plans are useless,but planning is indispensable”
When formulating strategic documents, it is often
the case that participants are limited from thestandpoint of preserving confidentiality.
If the subordinate organizations that make up theorganization do not have a sense of ownership,
they will not have a sense that the strategy
document prepared by a limited number ofmembers is "their strategy”.
Example of a higher-level strategy being shared astacit knowledge- The policy of “containment” of the U.S. during theCold War was not defined as an official strategy
document, although George Kennan's "Long
Telegram" and "X Article" existed.
38© 2023 JPCERT/CC

Thank you

39© 2023 JPCERT/CC