Riding with the Chollimas: our 100 day quest to profile a North Korean state sponsored threat actor

Talk Overview:

Step into the Labyrinth with us as we uncover the true identity of a state-sponsored threat actor from North Korea. This is a hacker and journalist’s 3-months quest for what seemed like a homemade malware sample but turned out to be a unique and dangerous artifact backed by a nation-state.

Our journey commences with a meticulous manual disassembly and thorough technical analysis of the sample. We further augment our investigation by profiling the adversary’s infrastructure and assets. Transitioning seamlessly, we delve into the social aspects through extensive interviews with government agencies, security forces, and private intelligence companies.