Name: Reversing mobile threats
Start: 2023-10-31T05:00:00Z
End: 2023-10-31T05:01:00.000Z
Location: BrightTALK
Rating: 0

Join us at Reasons to use Suricata for incident response and threat hunting as we delve into the world of Suricata, a powerful open-source network intrusion detection system (NIDS). In this webinar, we will explore the reasons why Suricata has become a go-to solution for incident response and threat hunting, and how it can effectively bolster your cybersecurity defenses.

Our expert, Tatyana Shishkova, Lead security researcher of Kaspersky Global Research and Analysis Team (GReAT), will provide a comprehensive introduction to Suricata’s capabilities. Gain insights from practical examples and understand how Suricata can be leveraged to proactively detect and neutralize potential cyber threats.

• get to know which threats can be detected using Suricata, and why it is crucial to write effective Suricata rules
• learn more about cases using Suricata for incident response and threat hunting
• discover new life hacks on Suricata

Reasons to use Suricata for incident response and threat hunting

Modern ransomware has transitioned to a Ransomware-as-a-Service (RaaS) model, with many groups sharing common tactics, techniques, and procedures in their attacks, or TTPs. These TTPs, described in MITRE ATT&CK, are like a glue that binds together multiple diverse teams operating at various levels with different priorities.

The Global Research and Analysis team (GReAT) at Kaspersky analyzed thousands of operations made by the different RaaS groups – and outlined the TTPs that the cybersecurity industry should consider in order to deliver a stronger protection for different organizations.

Join this webcast with Marc Rivero, a senior security researcher at Kaspersky GReAT. Marc will delve into the main TTPs used by modern ransomware groups and shed light on how to analyze them and use in attack detection and prevention.
• Kaspersky’s statistics on ransomware evolution
• Attack workflow using MITRE ATT&CK
• Overview of TTPs used by main ransomware groups
• Q&A session

Be aware of ransomware TTPs: applying MITRE to ransomware campaigns

Digital transformation is the integration of computerized technology into all areas of a business. Organizations of all sizes are fundamentally changing the way they operate and deliver value to their customers. However, it’s not always clear to some business leaders what digital transformation really means. 

As the world continues to embrace sustainable energy solutions, it is becoming imperative to address the growing cybersecurity challenges that accompany this technological shift. Join this webinar Safeguarding the future: cybersecurity risks in alternative energy sources as it focuses on key security concerns related to solar power systems, solar power inverter vulnerabilities in particular, grid management vulnerabilities, and the risks associated with remote load balancing management.

In addition to residential applications, alternative energy sources are gaining traction in industrial settings, contributing to the global shift towards sustainable and eco-friendly practices. Industries are increasingly incorporating renewable energy solutions such as large-scale solar power plants, wind farms, and biomass facilities to power their operations.

This webinar will shed light on the vulnerabilities that are currently affecting the renewable energy sector, with a particular emphasis on home solar power generation. Cloud-based applications have become a popular choice for managing solar power systems, providing users with seamless control and monitoring capabilities.

Safeguarding the future: cybersecurity risks in alternative energy sources

Not only do cybercriminals make money by committing cybercrime, but they also expand their operations by offering services to individuals without strong technical skills in malware development. This business model is known as Malware-as-a-Service (MaaS), and it operates on various sites of the "shadow" internet, including the Darknet. MaaS generates stable profits, enabling cybercriminals to maintain a team and continuously improve their services to carry out attacks on companies and individual users.

Through our research, we have identified 97 families of malware that have been distributed in the MaaS format – or "by subscription" – over the last seven years. These families include ransomware, various loaders, backdoors, botnets, and infostealers. In this webinar, Alexander Zabrovsky, Digital Footprint Analyst at Kaspersky, will delve into the inner workings of MaaS in the Darknet and address the most relevant issues:

- How did malware become a full-fledged product, and how did the "subscription" model become a new standard for cybercriminals?
- Why has YouTube become one of the key platforms for distributing malware? Who are traffers, and what is their function?
- Which families of malware are mentioned most often in the Darknet, and how does the Darknet services market depend on the news agenda?

Unveiling the Darknet's Malware-as-a-Service model

Cybercriminals tend to be secretive and act without disclosing their identity. However, when it comes to ransomware negotiations, the victim and the attacker have to “meet” face-to-face. Moreover, by the time the two sides meet to discuss the price, the attackers have already gained control of a company’s data or network – that puts the victim in a weak position.

What does it like to negotiate with someone who is trying hard to get a ransom whilst remaining in the dark? What can you expect from such negotiations? In this webcast, Marc Rivero, senior security researcher, GReAT at Kaspersky will observe various tactics used by ransomware groups, explain how the companies are trying to negotiate with these cybercriminals, and what outcome such negotiations may have.

In this webinar, you will learn:
- What Ransomware as a service (RaaS) model is
- What a data leak portal in RaaS terms is
- About ransomware negotiations: stages, means of communication
- What to do if you have been reached by a ransomware group
- Q&A session

Ransomware groups negotiation tactics: what you need to know

The sensitive data stolen from companies during a cyberattack often ends up on darknet markets. With the rise of the cybercrime as a service business model, we observe that not only data obtained from attacks is for sale but also for the information necessary to organize that attack.

Once an attacker gains access to the infrastructure of an organization, they can then sell that access to other advanced cybercriminals, such as ransomware operators. The price for accessing potential victims’ systems is relatively inexpensive when compared to the possible damage to the targeted business. In fact, the average cost for access to a company’s systems lies between the range from $2000 to $4000. Meanwhile, such attacks result in significant financial and reputational losses to the attacked organization and may even cause suspension of work and disruption of business processes. SMBs and enterprises are both key targets of such attacks.

Yuliya Novikova and Sergey Shcherbel, security experts at Kaspersky, shed light on how a company’s data and the information on their systems is sold on darknet markets.
In this webinar you will learn:
- Which types of company data are most widespread on dark markets
- Which criteria cybercriminals use to evaluate the price for organization’s data
- How to keep your data protected

Dark market for corporate data: how cybercriminals sell access to your company

In large companies, the sheer volume of information resources makes their attack surface significantly larger, compared to smaller businesses. Numerous factors contribute to this exposure, including networks spread across various locations that are consolidated into a single infrastructure, mergers and acquisitions with companies possessing lower security levels, outdated hardware and software, and more.

The level of preparedness for a potential incident directly impacts the effectiveness of the response and allows you to mitigate the attack’s impact. In this webinar, you will learn how to enhance incident responses for large-scale networks. Konstantin Sapronov, Head of Global Emergency Response Team at Kaspersky, will provide you with the following practical insights on:

• Optimizing incident response processes beyond mere scaling up by increasing personnel and systems involved
• Understanding incident response from a management perspective and why it should be an ongoing, cyclical process
• Exploring key principles for a successful response, emphasizing the significance of not only technical skills but also quality processes and soft skills
• Unveiling the limitations of backups in mitigating the consequences of an incident and discovering effective strategies to address them

Securing The Fort: How to master cyber incident response in a large company

As the world discusses ChatGPT-3 and its impressive capabilities, the business community is concerned about the AI’s potential to change the game for cyber criminals and wreak havoc in the world of defense organizations. Should businesses soon expect a wave of even more advanced cyber-attacks or simply more attacks? Will current cybersecurity solutions be enough? Or will ChatGPT instead provide cybersecurity specialists with more efficient and smarter defensive and threat hunting tools?

In this webinar, Kaspersky experts will discuss how ChatGPT currently influences the cyber threats landscape and cybersecurity in organizations, and contemplate whether this is a real game changer for the industry and, in particular Security Operation Centers (SOCs). The experts will also discuss the potential benefits of using ChatGPT in threat hunting and malware analysis.

In this webcast you will find out:
- If ChatGPT can really influence the threat landscape. Where can cyber criminals use it, and will it be effective?
- Will the emergence of ChatGPT and similar AI language models lead to increased cybersecurity costs?
- If ChatGPT is capable of becoming an autonomous hacking AI-tool
- How can cybersecurity experts employ ChatGPT: a demonstration of a scanner for Indicators of Compromise (IoCs)

The webinar will be conducted by Kaspersky's Vladislav Tushkanov, lead data scientist, Maher Yamout, senior security researcher, and Victor Sergeev, incident response team lead.

ChatGPT - good or evil? AI impact on cybersecurity

In 2022, Kaspersky Managed Detection and Response (MDR) received more than 400,000 alerts worldwide. Kaspersky team processed these alerts discovered by the service and accumulated as anonymized customer cases to provide information about the modern threat landscape and the most common adversarial techniques.

Join this webinar as Sergey Soldatov, Head of Kaspersky Security Operations Center, will highlight the results of MDR's operations occurred in 2022, including observations on:
• The most attacked industries
• The nature of high severity incidents
• Tactics, techniques and procedures used by attackers
• The most popular detection scenarios and an average threat detection rate

Findings highlighted in this webinar will help you to be aware of existing attack techniques and protect businesses from the growing number and complexity of real-life threats.

MDR analyst report: The latest statistics on global cyber-incidents

Global Endpoint Detection and Response adoption is on the rise, making it a de-facto standard for many organizations. Everybody has heard about it, but sometimes it’s hard to determine what you need for a particular task: EPP or EDR.

Join Nikita Zaychikov, Senior Product Marketing Manager at Kaspersky, to explore what EDR is really about, how it is different from EPP and when it’s best to use it. 
• EDR and EPP: what is the difference
• Why we need or don’t need EDR: exploring options for different organizations
• EDR myths
• EDR adoption in the world
• Types of EDR

EPP vs EDR: difference, use cases, adoption

This presentation will cover the methodology and measures organizations could take to prevent ransomware. It represents real-world practices, based on ransomware attacks statistics and deep analysis of ransomware groups TTPs.

• The most popular intrusion paths can be locked out
• Little efforts can cause significant problems for the spread of ransomware
• There are several ways to reduce the risk of your infrastructure being encrypted
• Light in the darkness: Is it possible to recover after encryption?

Ransomware Prevention Strategies

Modern cars are no longer just a means of transportation. Their built-in services can manage everything for drivers and passengers alike from seat heating, to using voice-controlled GPS to find a coffee, or make theater ticket reservations. Along with the development of consumer services, driver safety services have also been developed – distance sensors to neighboring cars, speed limit recognition and the eCall safety system, to name a few.

These hi-tech solutions designed to improve the user experience and make your journey safer, are architecturally based on algorithms and technologies that in themselves carry threats to information security. The wider the user experience, the wider the attack surface for an attacker. 

In this webcast, Cyberthreats to modern automotive industry, Sergey Anufrienko and Alexander Kozlov, security researchers at Kaspersky ICS CERT will discuss:

• Threat landscape: how has changed and evolved over the last 10 years
• Top threats the automotive industry is exposed to
• Standards of automotive security
• Trends in automotive security

Cyberthreats to modern automotive industry

IT and OT convergence brings a growing number of connections, equipment and services to industrial organizations. Maintaining control, availability, security and compliance will require a new generation of dedicated cybersecurity solutions. According to IDC Worldwide IT/OT Convergence 2022 Predictions, by 2024, 30% of industrial enterprises will incorporate centralized security management tools to bridge the IT/OT gap. The renewed Kaspersky Industrial CyberSecurity platform comes alongside this trend.
Kaspersky Industrial CyberSecurity (KICS) is a platform of natively integrated solutions for Operational Technology (OT) and Industrial Automation and Control Systems (IACS). It is a blend of products and expert services, catering to securing OT environments from cyber threats. These offerings provide a strategic initiative towards strengthening an enterprise's OT/IACS security landscape across industrial endpoint and network protection with centralized security management. This is powered with training, awareness, expert services, and intelligence. The KICS platform address all the cybersecurity needs of industrial enterprises and critical infrastructure operators. 
Concerned about industrial espionage and minimizing equipment downtime caused by cyberattacks? Join this webinar to learn more about how to protect your industrial infrastructure.

Achieving Cyber Resilience for Industrial and Critical Infrastructure

While some of the existing cybersecurity solutions already provide Endpoint Detection and Response functionality for small and medium business, implementation of EDR in these organizations can cause doubts. Kaspersky’s long-term experience in the development and implementation of EDR Solutions found the following has frequently raised concerns:

• EDR is just a “better antivirus”;
• This technology is only suitable for large enterprises as it is meant to discover sophisticated threats that don’t target small companies;
• EDR is a sophisticated solution that requires security staff - trained in detection and response;
• EDR provides capabilities for full response and remediation;
• EDR becomes shelf ware very quickly.

Are these concerns fair? Join this webinar to find it out and decide if EDR technology fits your company’s need

Addressing myths around EDR

With the cyber threat landscape constantly evolving, Extended detection and response or XDR promises to dramatically improve security teams’ investigation and response times. But as with any emerging approach, there can be confusion about what XDR is, how it differs from traditional security solutions, and what security outcomes users can expect from it.
In this high-risk digital environment, it’s essential to know how to manage cyber threats coherently and holistically. Security teams need to rely on deeper integration and more automation to stay ahead of cybercriminals.
Join this webinar to learn more about XDR:
• XDR meaning and definition
• How does XDR work?
• Why businesses need XDR
• What are the benefits of XDR?
• Example of XDR use cases

A proactive approach to threat detection and response – Learn more about XDR

Cybercriminals tend to be secretive and act without disclosing their identity. However, when it comes to ransomware negotiations, the victim and the attacker have to “meet” face-to-face. Moreover, by the time the two sides meet to discuss the price, the attackers have already gained control of a company’s data or network – that puts the victim in a weak position.

What is it like to negotiate with someone who is trying hard to get a ransom whilst remaining in the dark? What can you expect from such negotiations? In this webcast, Insights to Ransomware Tactics and Negotiation, Marc Rivero, senior security researcher, GReAT at Kaspersky will observe various tactics used by ransomware groups, explain how the companies are trying to negotiate with these cybercriminals, and what outcome such negotiations may have.

- What Ransomware as a service (RaaS) model is
- What a data leak portal in RaaS terms is
- About ransomware negotiations: stages, means of communication
- What to do if you have been contacted by a ransomware group

Insights to Ransomware Tactics and Negotiation

Today’s businesses focus on digital transformation is triggering rapid cloud adoption. While these initiatives can drive success, the sudden growth in infrastructure complexity brings with it significant concerns in terms of security risk and cost, governance, staff resources, performance optimization, and compliance with new regulations.

Kaspersky Hybrid Cloud Security addresses all these challenges, leaving you free to focus on other aspects of digital transformation.

Join us in the webinar to know how Kaspersky Hybrid Cloud Security provides proven cloud-native protection for your hybrid environment with optimal efficiency, making businesses more resilient with the following: 
 - Best-of-breed protection specifically designed for hybrid environments
 - Cloud-native approach for optimized hybrid infrastructure security performance
 - Cost-efficiency and convenient management for a smooth cloud journey
 - Compliance-ready security for highly regulated industries

Smart Solution for Protecting Virtual and Cloud Environments

Gain intimate hands-on experience about protecting and securing your business infrastructure through Security Operations Center (SOC) in the brand-new Kaspersky XTraining course “Security Operations and Threat Hunting”. Join the webinar of the course leader Sergey Soldatov, who will not only guide you through the extensive course material but also familiarize you with SOC infrastructure. He will also explain SOC attack hunting and mitigation tactics and offer you a sneak peek at the numerous exercises within restricted virtual labs.

During the webinar, Sergey will also introduce you to a simple scenario of malicious persistence in Windows through a service creation by the means of a C&C. The expert will demonstrate how SOC analysts tackle this issue using the virtual lab environment.

In the webinar you will:
● Learn about the Security Operations & Threat Hunting Training structure and material
● Participate in a practical session with threat hunting for malicious persistence
● Acquire tools and experience shared by the Head of Kaspersky SOC with 20+ years in the business
● Get a chance to get the answers to your questions directly from the course author!

The new Security Operations and Threat Hunting course by Kaspersky Expert Training guides you through the realms of Security Operations, including detecting and investigating malicious activities in Windows and Linux, threat hunting with Elastic stack, and includes various virtual environments where you can get hands-on practice.

The walkthrough: Kaspersky security operations and threat hunting training

Mobile threats rank high in the contemporary threat landscape. Understanding them enables cybersecurity professionals to protect corporate networks more efficiently. In this webinar, Kaspersky GReAT Lead Security Researcher Victor Chebyshev will present some up-to-date cherry-picked mobile threats which gained traction in 2022. Not only will you become familiar with the evolving cybersecurity challenges of 2022, but you will also scrutinize the most notorious ones! And here is more to come: during the webinar, Victor will reverse engineer a real-life mobile malware sample.

- be introduced to the key mobile threats of 2022 and learn to reverse engineer them
- observe reverse engineering of a real-life mobile malware sample
- get introduced to Kaspersky xTraining’s recent Mobile Malware Reverse Engineering training

Reversing mobile threats

Mobile Threats

mobile reverse engineering

Threat Hunting

Reverse Engineering

Cyber Attacks

Cyber Security

cyber security training

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Reversing mobile threats

Presented by

About this talk

More from this channel