I suppose that all of you are aware of the hack of Kaspersky in June of 2015. In Kaspersky's report they say that the intrusion was noticed when one of their engineers tested a new detection tool and discovered an abnormality. In an Haaretz article about the incident they are talking about the hacking of a third party company and altering of their code which leads to this hack.

Is there anyone who have an idea about how Kaspersky manged to discover this kind of attack (the tool that they used, how they work, etc.) and how they managed to analyze it? What I'm looking for is the "howto" that can help each one of use to have a better understating of the first league game even three years after the incident!


Kaspersky wah hit by Duqu 2.0 and according to them:

We detected the attack in early spring of this year. We were able to discover it thanks to the expertise of our researchers and our technologies: during a test, a prototype of an anti-APT solution developed by Kaspersky Lab showed signs of a complex targeted attack on its corporate network. After the attack was noticed an internal investigation was launched. A team of Kaspersky Lab researchers, reverse engineers and malware analysts worked around the clock to analyze this exceptional attack.

How they analyzed it ? Here is the full technical report on this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.