Profile

Home•Profiles•Tom Hegel

Tom Hegel

Principal Threat Researcher at SentinelLabs

Tom Hegel is a cybersecurity researcher with a history of tracking some of the most interesting and unique threat actors globally. As the Principal Threat Researcher with SentinelLabs, he has uncovered and published numerous discoveries of APTs across Russia, China, Iran, North Korea, India and more, as well as new mercenary groups and financially motivated crimeware gangs.

Some of Tom’s most notable contributions include uncovering the tactics and infrastructure of the ModifiedElephant APT, a hack-for-hire organization responsible for attacks and evidence planting campaigns against human rights activists, as well as his work tracking the operations of Chinese state-sponsored attackers.

Tom is a dedicated advocate of humanitarian cybersecurity research initiatives, focusing on fortifying security measures and gathering intelligence on attackers who target high-risk individuals and organizations.

AllSessions

Day 2
May 10, 2024
3:45 am

There’s more “Un” To This Story | The Details We Did Not Share

Aleksandar MilenkoskiTom Hegel
10 May
Time:  3:45 am - 4:15 am
Location: 
Speaker:  Aleksandar MilenkoskiTom Hegel

In this talk, we reveal previously undisclosed details about several North Korean APT activities we have unearthed over the past months. Our objective is to enrich the accumulated intelligence on the North Korean cyber threat landscape within the community and contribute to a deeper understanding of the evolving tactics used by its constituent groups.

This presentation begins by revealing deceptive lateral movement tactics observed during our investigation into an intrusion at NPO Mashinostroyeniya, a Russian missile engineering firm. We then explore ScarCruft's testing grounds — a collection of malware recovered during the planning and testing phases of the group's development cycle, likely intended for future campaigns. We disclose here our insights into ScarCruft's infrastructure, malware implementation processes, and experimentation with staging and evasive techniques. In concluding the technical discussion, we share curious relationships to cryptocurrency scams, highlighting North Korea's evolving interest in the cryptocurrency industry.

During times of major shifts in the North Korean foreign policy, the future trajectory of the country's cyber activities is uncertain. We conclude our presentation by speculating on potential changes in North Korea's cyber strategies and their implications for threat intelligence collection and effective defense.