AttackerFriction

"Months of planning and it's all blown by a fucking fart." - Sissy

Tabletop scenarios for offensive players.
DM to submit!

[AttackerFriction @AttackFriction]

Your target gets suspicious of reduced battery life of their implanted device.

[AttackerFriction @AttackFriction]

Everyone hates fragmentation.

(Time to give out some iPhones as gifts?)

[Ace Pace @ace__pace]

Similar to NSO, Candiru suffers from Android fragmentation like every other developer. But unlike other platforms (see later), they actually seem to support multiple Android versions.

[AttackerFriction @AttackFriction]

Your target runs obsolete software.

[Ace Pace @ace__pace]

A fact I missed. They don't even really support many Chrome versions back!
So run Windows 8.1 with old Chrome and you're safe!

Please don't do this

[AttackerFriction @AttackFriction]

Your customer works in an IE-only environment.

[Ace Pace @ace__pace]

Fun fact! Even malware developers need to code front ends and even there they're too lazy to support anything except Chrome!

[AttackerFriction @AttackFriction]

Trust relationships between your C2 hosts are abused to take down your operation from a single compromised node. #hackback

[AttackerFriction @AttackFriction]

Reuse of leaked asymmetric keys compromises operations

(Full analysis by Pangu: https://t.co/Ba4zfbIgvw )

[AttackerFriction @AttackFriction]

A 6 years old compromise still affects your operations, but at least the enemy admits you rock.

[VICE @VICE]

This is not the first time a Chinese cybersecurity company published research on an alleged American intelligence hacking operation. https://t.co/IbU5GgqHTJ

[AttackerFriction @AttackFriction]

Your victims scroll social all day, unconnected from their enterprise network.

[@[email protected] @buherator]

When slacking off while WFH, have the decency to at least connect to the corp VPN!

Sincerely,
Your Red Team

[Gábor Stefanik @netrolller3d]

@AttackFriction I mean, dogfooding is a thing, but you probably shouldn't dogfood malware.

[AttackerFriction @AttackFriction]

It's hard to untangle this one. Your development practices are a dumpster fire?

https://t.co/SEdlT1O6rr

[AttackerFriction @AttackFriction]

The catalog you keep about your own IOC's is leaked to the Internet.

https://t.co/AnwP4th8w2

[AttackerFriction @AttackFriction]

Your competitor steals your 0day, then both of you get caught with it, providing fuel for policing your use of exploits.

https://t.co/GljEZySGmg

#burn #nuclearsubmarines

[AttackerFriction @AttackFriction]

Development servers are reused in operations.

https://t.co/mWg0TpPCnx

[AttackerFriction @AttackFriction]

Too much interest makes the target device overheat. #OtherAttackers

https://t.co/mWg0TpPCnx

[AttackerFriction @AttackFriction]

Your C2 infra uses Log4j2 for logging. Many of your victims are playing on their machines with the DNS-based trigger.

[AttackerFriction @AttackFriction]

Your customers start to use your product against each other.

[Joseph Cox @josephfcox]

New: U.S. State Department employees were targeted with NSO Group malware. NSO told us it terminated the relevant customers' access to its system. https://t.co/Si0xkdVgoU

[AttackerFriction @AttackFriction]

The vendor you exploited starts notifying your targets about your attacks.

[Costin Raiu @craiu]

“Apple is notifying the small number of users that it discovered may have been targeted by FORCEDENTRY (exploit).” #nso #pegasus https://t.co/XKUDj0Ur8O

[AttackerFriction @AttackFriction]

The largest tech company on Earth sends its lawyers after you for abusing its services.

[Lorenzo Franceschi-Bicchierai @lorenzofb]

NEW: Apple has sued NSO Group for hacking its users and in an effort to curb the abyse of spyware.

Apple called NSO "amoral 21st century mercenaries who have created highly sophisticated cyber-surveillance machinery."

https://t.co/kBFsJQA6oF

[AttackerFriction @AttackFriction]

Your company ends up sanctioned by the U.S.

[Lorenzo Franceschi-Bicchierai @lorenzofb]

New: The US government has sanctioned NSO Group, prohibiting American companies from selling products to the spyware company.

This means company may not be able to rely on Microsoft, Amazon, Dell, and Intel, all companies that sold to NSO previously.

https://t.co/3UYz2uJISn

[JD Work @HostileSpectrum]

When demonstrating commitment to the juche revolutionary struggle through daily work practices is more important than good operational decisions...