APTs Go Teleworking - The Rise of VPN Exploits

Explore the rise of VPN exploits in the era of remote work in this 25-minute Black Hat conference talk. Delve into the vulnerabilities of Pulse Secure VPN devices, a leading technology often deployed at the intersection of trusted and untrusted networks. Examine how threat actors, including suspected Chinese-nexus groups, have exploited these vulnerabilities for cyber espionage. Learn about traditional incident response methods, integrity tools, and cluster analysis techniques used to combat these threats. Investigate antiforensics tactics employed by attackers and discover forensic approaches to counter them. Gain insights into credential reuse and exit node strategies utilized in these attacks. Conclude with a comprehensive summary and key takeaways on securing VPN technologies in the evolving landscape of remote work.

Intro
About Bart
Controversy
Pulse Secure
Traditional Incident Response
Integrity Tool
Cluster Overview
Upgrade Script
Slow Pulse
Cluster 2717
Pulse Jump
Antiforensics
Forensics
Exit nodes
Credential reuse
Summary
Bottom Line