Sockbot in GoLand - Linking APT actors with Ransomware Gangs

Sockbot in GoLand - Linking APT actors with Ransomware Gangs

Our incident response team had responded to malicious activity in one of our clients' network infrastructure. The tools we found in the incident have been used in the past by multiple threat actors, including nation-state sponsored and the attack was identified as a suspected ransomware by alleged Russian ransom gangs. This talk will tell the story behind a highly complex incident, and how we lived to tell.