Armin Buescher

But I heard him exclaim, ere he VPN'd out of sight— “Thanks for your data, and to all a good night!”

And laying his finger aside of his nose, And giving a nod, up the gateway he rose; He sprang to his server, to his team gave a whistle, And away they all flew like the down of a thistle.

A wink of his eye and a sandbox report Soon gave me to know I had no retort; He typed not a word, but clicked all his work, And filled all the ZIPs; then turned with a jerk,

His droll little mouth he drew up in a pinch, And the hair on his head was as green as the Grinch; He was chubby and plump, and coded in Delph, And I laughed when I saw him, in spite of myself;

He was dressed all in black, from his head to his foot, And his clothes were all tarnished with Cheetos and soot; A bundle of documents he had flung on his back, And he looked like a thief just opening his pack.

So up to the firewall the downloads they flew With the sleigh full of malware, and Powershell too— As I drew in my head, and was turning around, Down the proxy the operator came with a bound.

"Now, PlugX! now, PoisonIvy! now Termite and a dropper! On, gh0st! on, Mimikatz! on, Htran and China Chopper! To the top of the endpoint! to the top of the directory! Now dash away! dash away! dash away into the memory!"

With a little old operator so lively and at ease, I knew in a moment he must be Chinese. More rapid than eagles his tools they came, And he whistled, and shouted, and called them by name:

The moon on the breast of the display glow, Gave a lustre of midday to the keyboard below, When what to my wondering eyes did appear, But a miniature loader that gave me fear,

When out on Twitter there arose such a clatter, I sprang from my bed to see what was the matter. Away to the laptop I flew like a flash, Tore open the logs and threw up the bash.

The analysts were nestled all snug in their beds; While visions of assembly danced in their heads; And the red team in their hoodies, and I in my cap, Had just settled our brains for a long winter's nap,

A little christmassy APT poem: 'Twas the night before Christmas, when all through the net Not a creature was stirring, not even a RAT; The signatures were hung in VirusTotal with care, In hopes that threat actors soon would be there;

Threat intel attribution deniability: When you don't share IOCs in a public blog, nobody can disprove the link of a campaign to an actor.