Everyone has focused on the Equation Group's "weapons grade" exploits but no one has focused on their extremely effective post exploitation capabilities. In this talk I will cover the tools, methods, and capabilities built into the DanderSpritz post exploitation framework. We will review how the Equation Group gained and maintained persistence, bypassed auditing and AV, scan, sampled, subdued, and successfully dominated an entire organization ninja-style. We'll dig into the technical details of how the framework gains persistence, performs key logging, captures traffic and screenshots, steals credentials, gathers target information, owns AV and WSUS servers, exfiltrates secrets, and causes general mayhem.

Francisco has knee-deep in many facets of security. From Network Security Analysis and Engineering, to security consulting for some of the world's most valuable companies, bringing along a marriage of DevOps and Security along the way. Francisco is now focused on leading a team developing Managed Security Services at a Swiss based security organization.

@Francisckrs

Back to Derbycon 2017 video list