AN INSIDE LOOK AT NSA (EQUATION GROUP) TTPS FROM CHINA'S LENSE

Summary from the TLDR InfoSec newsletter

Reports coming out of Chinese cybersecurity entities like Qihoo 360, Pangu Lab, and the National Computer Virus Emergency Response Center (CVERC) attributed cyber operations to the NSA's APT-C-40 group. The article goes into detail about the attribution methodology used as well as identifying tools found before the Shadow Broker's leak. The investigation revealed TAO's use of sophisticated tools like SECONDDATE and NOPEN to conduct remote control, data exfiltration, and credential harvesting.