EVOL V15.rar
Per public attribution, Russian cybercriminal groups have always been active. Their tactics, techniques, and procedures (TTPs) have not significantly evolved over time, although some changes have been observed. Lately, the threat landscape has changed, as multiple domains have partially merged. This trend was already on-going, but the increased digital activity further accelerated and exposed said trend. This paper will cover the cybercriminal evolutions over time, the impact of a (cyber)war, observed activity, and finally a call to action.
eVOL v15.rar
The changes over time can be split into multiple evolutions, where each evolution is based on the one prior. This section provides insight into these evolutions, in chronological order. As these events unfolded organically, it is important to note that there is no exact date when one transformed into another. The goal here is to provide a further understanding of the historic events which occurred prior to the latest, and still ongoing, transformation.
Trellix has historically had a significant customer base in Ukraine and when the cyberattacks targeting the country intensified, we coordinated closely with government and industry partners to provide greater visibility into the evolving threat landscape. We have been eager to support the region against malicious cyber activity and have been able to go beyond sharing knowledge to also provide a wide range of security appliances at no cost in the affected region (our special thanks go out to our partners at Mandiant in getting some of the appliances deployed at those organizations who needed protection the most).
As mentioned earlier, since the preamble in the non-contention-based RAP is assigned by the base station, there will be no collision during RAP. Hence, this paper only discusses the contention-based RAP. There are six opportunities for a UE to initiate contention-based RAP [1]: (i) a UE needs to perform initial access to evolved Node B (eNodeB) from RRC (Radio Resource Control)_IDLE state; (ii) a UE wants to re-establish RRC connection; (iii) a UE has uplink data to be transmitted but its uplink synchronization status shows that it is asynchronous; (iv) a UE has uplink data to transmit but does not have PUCCH resources to transmit the uplink scheduling request (SR); (v) eNodeB has to perform downlink transmission but the uplink synchronization status of the UE shows that it is asynchronous; (vi) handover. 041b061a72