On Wednesday February 24th Novetta released Operation Blockbuster, a report that describes how a Novetta-led coalition of private industry partners Novetta’s Threat Research & Interdiction Group (TRIG), identified and interdicted the adversary behind the Sony Pictures attack. This effort is the culmination of more than a year of research and reverse engineering by many skilled professionals with the goal of devising ways to disrupt the tools and techniques of the threat actor group to collectively protect our customers. If you haven’t yet seen this report, there’s a friendly two-page executive summary at http://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Ex-Summary.pdf and the full report is at http://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf….
Operation Blockbuster: Unraveling the Long Thread of the Sony Attack
Operation Blockbuster is a Novetta-led coalition of industry partners created to identify and disrupt the malicious tools associated with the threat actor behind the November 2014 Sony Pictures attack. We began researching last year by identifying several malware hashes publicized by the security community following the SPE attack. From these hashes, we were able to establish a baseline of the malware capabilities, as there were common code and libraries being used in the malware samples. From these common snippets of code and use of library functions, signatures were generated to detect additional malware samples using both proprietary tools and Totem,…
