AI
Threat Actor Reality: What IR Cases Actually Show
Across roughly 400 IR engagements in 2024, the dominant threats were ransomware and business email compromise. Zero-days appeared almost never. What attackers actually used were unpatched n-day vulnerabilities, some years old. One customer confirmed their product had been end-of-life for two years, fully patched two years prior, no updates since. That was the entry point.
“the offensive world is more of an academic version of the real world.” — Hasain Alshakarti
The criminal syndicates behind these cases run like any other business. Eight to five. No overtime. No working vacations.
curl as a Living-off-the-Land C2 Channel
curl is now built into Windows. No download required, and it ships as a signed Microsoft binary. Alshakarti showed a single one-liner that pipes curl’s output into PowerShell via stdin, executes whatever command the attacker put in the file at /t, then uploads the result back to the same server using curl -T -. The server hostname in the HTTP headers reads windowsupdate.com. Forensics sees curl talking to Windows Update. The firewall sees another routine request. Live, the demo returned the hostname of SRV03 (19:49). Wrapped in a scheduled task set to fire once a day, this is a C2 channel built entirely from tools Windows already trusts.
“This is very popular among developers and ransomware gangs.” — Hasain Alshakarti
SSH Reverse Tunneling for Persistent RDP Access
One SSH command, no custom malware. Ransomware gangs tunnel RDP over port 22 through services like surveyo.net, ngrok, or localhost.run. Port 3389 stays internal; the outbound SSH connection carries it out. The attacker gets a full GUI session and can click their tools like any admin.
“This is very popular among developers and ransomware gangs.” — Hasain Alshakarti
SSH ships built-in on Windows, signed by Microsoft. Most enterprise firewalls allow outbound SSH. Few teams log it. For harder-to-inspect traffic, Alshakarti also built C2 inside OCSP certificate validation requests (29:48), where commands ride inside encrypted, signed PKI traffic that no firewall inspects.
DLL Sideloading via Trusted Binaries
APT10 ran the same playbook from 2006 to 2018: find a DLL a legitimate binary depends on, swap it for a custom version that forwards all real calls and runs your code on the side. Their target was WSCSAPI.dll, the Windows Security Center API. Any binary that loaded it became a carrier. A recent ransomware case ran the same trick. The threat actor sent a Microsoft Teams vishing message, convinced a user to hand over control via Quick Assist, then dropped install.bat. That batch file ran tasklist, searched for CrowdStrike Falcon, and loaded a modified Qbot DLL through either the OneDrive standalone updater or Titan Plus RMM, depending on what it found (36:58). Both binaries are legitimately signed. Neither triggered the EDR.
Identity-Based Persistence: Rogue Device Registration and Stolen Certificates
A phishing attempt and a password reset were all it took. The threat actor registered their own device into the corporate MDM, collected the full configuration pushed to enrolled devices, and walked in through the VPN. No implant. No C2 beacon. The device registration was already listed for sale on Russian Market before the ink dried. A separate case went deeper: a misconfigured certificate template let the attacker enroll domain-admin certificates directly. With those in hand, the VPN was their persistence. They never needed anything else.
ViewState Abuse for Agentless Web Server Persistence
.NET’s ViewState mechanism signs and encrypts page state using keys stored in the application’s web.config. If those keys are static and an attacker gets them, they can forge their own ViewState payload and send a crafted web request that runs cmd /c whoami and writes the output to a temp file (45:22). The server returns a validation error. The file still gets written.
No implant. No agent. Just HTTP.
“threat actor doesn’t have a need to hide today. That’s the sad part of the story.” — Hasain Alshakarti
Q&A
When DLL hijacking replaces a Windows DLL, can the rogue DLL forward calls to the real DLL so the system doesn’t crash? Yes — the rogue DLL can load the original DLL and proxy all calls through to it, leaving the application fully functional. ▶ 48:22
Notable Quotes
the offensive world is more of an academic version of the real world. Hasain Alshakarti · ▶ 2:27
This is very popular among developers and ransomware gangs. Hasain Alshakarti · ▶ 27:29
They are just regular IT dudes but doing illegal business. Hasain Alshakarti · ▶ 27:00
threat actor doesn’t have a need to hide today. That’s the sad part of the story. Hasain Alshakarti · ▶ 47:04
Key Takeaways
- Use only signed, built-in OS tools (curl, SSH, PowerShell) to build C2 channels that blend into normal enterprise traffic.
- Prioritize identity-layer persistence — stolen certificates and registered devices survive endpoint reimaging and evade EDR entirely.
- Rotate or isolate .NET machine keys and audit DLL search order for every trusted binary to close two of the most detection-resistant persistence vectors.
About the Speaker
Hasain Alshakarti
Hasain, also known as “The Wolf”, is an industry-leading cyber security expert with more than 26 years of experience. He has extensive and deep expertise from numerous design projects, security audits, advanced implementation projects, incident response, digital forensic, threat hunting and penetration testing. He helps customers understand and build solutions to protect, detect and respond to cyber threats for enterprises, government agencies, banks, military organizations among others. Due to his expertise, he is a sought-after advisor, speaker and a popular instructor. For his many achievements over the years, Hasain has been awarded recognition as “Sweden’s leading IT security expert” and Microsoft MVP in Enterprise Security and Cloud & Datacenter.