Practical CTI Analysis Over 2023 ITW Linux Implants: Extending Detection Over Blind Spots

SANS Cyber Threat Intelligence Summit 2023

Practical CTI Analysis Over 2023 ITW Linux Implants: Extending Detection Over Blind Spots
Pedro Drimel, Threat Researcher,BlackBerry Cylance
Jose Luis Sanchez Martinez, Senior Security Researcher, BlackBerry Cylance

Linux ecosystem remains underplayed. Cybercriminals and TA threat actors have continuously invested in tooling, from Ransomware to persistent backdoors with info stealer capabilities. As the industry, we have developed great technologies for hunting, detection, and response on Windows, while the visibility on Linux is minimal. So, the …

analysis backdoors blackberry blind spots capabilities cti cyber cybercriminals cyber threat cyber threat intelligence cylance detection ecosystem great hunting implants industry info info stealer intelligence linux persistent ransomware researcher sans security security researcher stealer summit technologies threat threat actors threat intelligence tooling