Vladimir Dashchenko@VDashchenko

Principal ICS Cyber sec person @ Kaspersky ICS CERT. Proud BEER-ISAC and RUSCADASEC member. Tweets are mine or written by Markov Chains

Joined May 2019
70 Photos and videos
Terribly sad news. Sergey @Skvern0 left this world. He was one of the best APT hunters, absolutely passioned about fighting cybercrime. His YARA training was always sold out! And he was a GReAT person and friend Goodnight, mr. Alice. You’ll be missed. Rest in peace my friend 💔
3
13
4,540
Happy to see Moscow Central Circle (МЦК), part of the Moscow Metro system, is on @CISAgov website! cisa.gov/topics/critical-inf…
157
Here we go! 0day exploits description by @oct0xor #operationtriangulation #thesascon2023
7
657
#iosTriangulation’s binary validator and @2igosha telling the most interesting details of investigation. Will we see those four 0days used? 🤔 #TheSAS2023
6
462
#IoSTriangulation latest report: securelist.com/triangulation… However @2igosha will share additional details today at @TheSAScon #thesas2023
1
2
254
Vladimir Dashchenko retweeted
Kaspersky
@kaspersky
25 Oct 2023
Welcome to #TheSAS2023
15
4
3,147
#StripedFly talk by @61ack1ynx. Just wow! Good old #thesas2023 securelist.com/stripedfly-pe…

StripedFly: Perennially flying under the radar

Nobody would even suspect the mining malware was merely a mask, masquerading behind an intricate modular framework that supports both Linux and Windows. The amount of effort that went into creating...

securelist.com
3
193
Vladimir Dashchenko retweeted
Georgy Kucherin
@kucher1n
21 Jun 2023
Our next blogpost on #iOSTriangulation (securelist.com/triangledb-tr…) is finally out. Today we are ready to share details about the final payload used in the attack, which is a #spyware implant that we dubbed #TriangleDB @bzvr_ @2igosha [1/3]
3
108
220
117,201
Amazing news! @TheSAScon is back 😍😍😍
155
Vladimir Dashchenko retweeted
Georgy Kucherin
@kucher1n
3 Apr 2023
Hey everyone, this is my first tweet! We identified a backdoor we dubbed #Gopuram, the final payload in the #3CX attack. The threat actor (likely to be Lazarus) has deployed it to cryptocurrency companies. More details in this thread and on Securelist (securelist.com/gopuram-backd…)

Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack

A DLL named guard64.dll, which was loaded into the infected 3CXDesktopApp.exe process, was used in recent deployments of a backdoor that we dubbed “Gopuram” and had been tracking internally since...

securelist.com
6
92
163
58,988
We made a report "Threat landscape for industrial automation systems" in H2 2022. We decided to show statistical changes in ICS threat landscape for Russia separately from the rest of the world - one of the most interesting data Here's a full report ics-cert.kaspersky.com/publi…

Threat landscape for industrial automation systems. Statistics for H2 2022

The statistical data presented in the report was received from ICS computers protected by Kaspersky products that Kaspersky ICS CERT categorizes as part of the industrial infrastructure at organiza...

ics-cert.kaspersky.com
1
164
Besides that we've analyzed how CVE-2022-27228 (Remote Code Execution in Bitrix CMS “Polls, Votes” module) affected ICS computers in Russia, Belarus and Central Asia. Which is also quite interesting
169
Is there any chance to find alternatives for an expensive IDA Pro? There’s a cool post by @2igosha “How to train your Ghidra”. securelist.com/how-to-train-…

How to train your Ghidra

Brief introduction to setting up Ghidra, and then configuring it with a familiar UI and shortcuts, so that you would not need to re-learn all the key sequences you have got used to over the years.

securelist.com
212
Together with GReAT we've prepared an analysis of various activities that were observed in cyberspace in relation to the military conflict in Ukraine. Did a cyberwar happen? This is a simple question with a very complicated answer securelist.com/reassessing-c…

Reassessing cyberwarfare. Lessons learned in 2022

In this report, we propose to go over the various activities that were observed in cyberspace in relation to the conflict in Ukraine, understand their meaning in the context of the current conflict,...

securelist.com
1
140
Here are some of the tricks and methods I have seen used to gain that all important initial access to remote systems. Specifically, the unexpected and unusual tricks! ics-cert.kaspersky.com/publi…
4
Bravo! kaspersky.com/blog/is-avast-…
1
We've prepared ICS Cybersecurity predictions for 2023+ Ideologically and politically motivated insiders, degrading communications between law enforcement, failing trust relationships in supply chains for both products and services(including OEM) ics-cert.kaspersky.com/publi…

ICS cyberthreats in 2023 – what to expect

Cybersecurity incidents were plentiful in 2022, causing many problems for industrial infrastructure owners and operators. Below we share some of our thoughts on potential developments of 2023, though...

ics-cert.kaspersky.com
1
I know it’s really humiliating for GCHQ, but it’s hilarious

ALT Season 9 Lol GIF by The Office

Kim Zetter
@KimZetter
29 Oct 2022
Replying to @KimZetter
“Truss’s mobile phone number…was for sale on the internet, along with those of 25 Cabinet Ministers. They could be accessed on a shady US website charging just £6.49 for access to the information”
Really cool research! Kudos to @MsftSecIntel
Microsoft Threat Intelligence
@MsftSecIntel
27 Oct 2022
Microsoft has discovered Raspberry Robin activity establishing its role in a complex, interconnected malware ecosystem that facilitates human-operated ransomware. Our latest blog details active operations and links to other malware and threat actors: msft.it/6011djXFR
The secrets of Schneider Electric’s UMAS protocol - our new publication about implementation of the Unified Messaging Application Services protocol. Details about implementation, connections between CVE-2020-28212 and CVE-2021-22779, bypassing auth Enjoy! ics-cert.kaspersky.com/publi…
1
5
Load more