Detecting similar artifacts is crucial to identifying variants that malicious actors use to evade defenses. With static inspection of files or other parts of byte streams, using a similarity measure provides a quick mechanism to triage the vast sea of incoming unknowns.

This presentation will discuss the development and evolution of similarity measures adopted by the security community, comparing approaches for their search and clustering effectiveness and their runtime performance. In particular, the presentation will explain the algorithms used by SSDeep, SDHash, TLSH, LZJ and JA3. A demonstration on why Trend Micro leads the industry in this field, and its application to security problems, will also be showcased.

APT groups usually rely on backdoor shells to gain a foothold on the target environment. These tools open the victim machine to commands the attacker wants to perform from the outside of the system. Like any other piece of malware, having this tool run on a machine adds footprints that can be used to discover the attack.

In one case Gilbert and Abraham handled, the attacker did away with using backdoor shells and instead went full fileless. In this presentation, they will be discussing the tools the attacker used or may have used to achieve this. They will show the advantages and disadvantages the attacker has in using this approach.

APT groups usually rely on backdoor shells to gain a foothold on the target environment. These tools open the victim machine to commands the attacker wants to perform from the outside of the system. Like any other piece of malware, having this tool run on a machine adds footprints that can be used to discover the attack.

In one case Gilbert and Abraham handled, the attacker did away with using backdoor shells and instead went full fileless. In this presentation, they will be discussing the tools the attacker used or may have used to achieve this. They will show the advantages and disadvantages the attacker has in using this approach.

Malware hunting still lacks a formal definition and base model today. Developing a hunting process and quantifying the success all depend on the hunter's goals. Another challenge posed by threat hunting is that it requires extensive resources ingesting and transforming hunting data into actionable intelligence.

In this session, Monte will be sharing Trend Micro's hunting process, particularly the process of collecting data from different channels using various method both manual or automated, and how to process, store, interpret, and define data into useful context such as defining malware landscape, campaign tracking, and network defense.

In this session, Marvin will share an inside scoop on recent trend and changes in ransomware threat tactics, techniques, and procedures (TTP). Ransomware threat actors nowadays are no longer into the shotgun approach of mass-mailing targets with ransomwarelaced emails but are more like a skilled sniper - a deliberate, patient, and resolute attacker with a clear focus on its target industry or company. Today, threat actors use phishing, info-stealers, exploits or outright purchase credentials in underground market to gain preliminary access to its victims.

Marvin will also discuss what action defenders need to do and think about to address this change in ransomware TTPs.

Similarity hashing is an important tool for searching and analyzing malware samples which are similar to known malware samples. TLSH has been found to be particularly well-suited for finding related malware (and goodware) samples from known malware (and goodware) samples. In particular, TLSH has been shown to be good at finding the different variants of a given malware.

Previous works at Trend Micro have shown that TLSH hashes can be used to build fast search and clustering techniques, which can scale to tens of millions of items. In this presentation, Muqeet will present techniques that can scale to even larger data sizes by doing clustering in stages.

Designing realistic ICS honeypot requires a substantial time and resource investment, and in-depth knowledge not only of the technical aspects, but of industrial automation process. Over the past couple months of planning, Lord and his teammates designed and built a factory honeypot, one that appeared so real that it was mistakenly identified as real production environment.

Lord will share their experience on how much effort they went through to make a realistic honeypot. Then, he will highlight incidents they came across with while running the honeypot since May 2019. Lastly, he will discuss recommendations and lessons they learned and answer the question: Did they do enough to attract cybercriminals who thought they were targeting a real factory?

Firewalls are our friends. Unfortunately, firewalls have this weird and almost counterintuitive effect - it highlights where our crown jewels are. In a nutshell, because a typical "safe" configuration exposes only legitimate service ports, a firewall also inadvertently becomes a spotlight for attackers. JV calls this the "firewall spotlight problem".

It's no wonder then that services like Shodan and its more criminally inclined botnet counterparts are extremely useful - the firewall spotlight problem makes it so that exposed ports are often regarded as legitimate services the vast majority of the time, making internet-wide scanning as good investment.

In this session, JV will be exploring how honeypots, honeyports, and "trollports" can rebalance this asymmetry in favor of defenders.

Phishing has been a long time cyber threat and perhaps the simplest technique of identity theft. On a daily basis, cybercriminals deploy thousands of phishing pages and register several malicious domains to host phishing. The covid-19 pandemic crisis did not halt the perpetrators to defraud online users. In fact, it has vastly improved their techniques on social engineering schemes.

In this session, we will present an overview of phishing attacks and how it works. We will examine some of the latest techniques adapted by cybercriminals and identify those effective phishing schemes that they employ to understand why people fall for phishing attacks. Lastly, we will provide some phishing countermeasures to ensure that an individual will know how to recognize and avoid this online threat

Robots and other programmable industrial machines are the backbone of the manufacturing industry. Without them, the large-scale and fast-paced production that our modern economy depends on would simply be impossible. However, as much as modern manufacturing is dependent on them, these machines themselves rely on legacy technology designed decades ago.

This presentation will discuss the legacy programming environments of widely used industrial machines that harbor virtually undetectable vulnerabilities and malware. The security analysis of these environments, which was conducted in collaboration with Politecnico di Milano, reveals critical flaws and their repercussions for smart factories.

At last year's Decode, Matsukawa's colleague Ryan Flores had a presentation about Industry 4.0 and the cyberthreats affecting relevant industries. While it is interesting to find out that old Conficker worms are prevalent in industrial environments, they wanted to dig deeper and find out what cyberthreats are really affecting the critical endpoints tasked at controlling various industrial equipment - the ICS/SCADA computer.

This presentation will show how they built their catalogue of industrial software and fingerprint endpoints for the presence of ICS/SCADA processes, and, with this information at hand, how they monitor these critical endpoints for cyberattacks.

The ongoing pandemic compelled many organizations to shift from operating manually to maximizing various technologies for their day-to-day transactions. Due to this fact, there has been an increased traffic online, paving the way for threat actors to launch attacks against public and private institutions. For instance, there has been an increase in the number of phishing attacks using different web sharing services and cloud applications.

In this presentation, Karla and Joy will dive deep into how the current global trends have shaped the web threat landscape with the help of machine learning (ML).

The ongoing pandemic compelled many organizations to shift from operating manually to maximizing various technologies for their day-to-day transactions. Due to this fact, there has been an increased traffic online, paving the way for threat actors to launch attacks against public and private institutions. For instance, there has been an increase in the number of phishing attacks using different web sharing services and cloud applications.

In this presentation, Karla and Joy will dive deep into how the current global trends have shaped the web threat landscape with the help of machine learning (ML).