Case: Cyber Threat Intelligence — attributing an APT group for a telco operator
Incident: compromise of the billing system of a major telco (50M+ subscribers). CDR download bucket accessed, attempted lateral movement into the SS7 core.
AgentD22 Data solutions CTI methods:
- Memory forensics and disk imaging (Volatility, Rekall)
- Network traffic analysis (Zeek, Suricata, 6 months of PCAP)
- Malware reverse engineering: Ghidra, IDA Pro — custom loader, C2 protocol
- Attribution: TTP matching (MITRE ATT&CK), infrastructure overlap (passive DNS, SSL certificates, WHOIS history), code similarity (BinDiff)
- Threat hunting: retrospective hunt for IOCs in historical traffic
Attribution: APT41 / Winnti Group (China-nexus). Overlap with 2023-2024 campaigns: ShadowPad, PlugX, Cobalt Strike BEACON with custom configuration.
Outcome:
- Full compromise map: initial access (VPN vulnerability CVE-2024-xxxx) → credential dumping → lateral movement → data staging → exfiltration
- 150+ IOCs (IPs, domains, hashes, mutexes, registry keys, YARA rules)
- Perimeter blocking, credential rotation, SS7 hardening
- IOCs shared with CERT, FIRST and vendors (Kaspersky, Positive Technologies, Solar)
Prevention: continuous CTI monitoring was introduced (AgentD22 Data solutions Threat Feed) — real-time matching of incoming traffic against threat intel.
← Back to news