Black Hat investigations
- Thread starter CEO
- Start date
Media coverage of China's organized criminal enterprises has surged in the last few years as the pandemic and regional political concerns drove them from brick-and-mortar casinos to online crime. These organized crime groups are at the center of modern slavery in China and Southeast Asia, with illegal gambling and so-called pig butchering scams being their most profitable industries, made possible through human trafficking and a pyramid of agents, many indentured. Additionally, the clever tactic of sponsoring European Football teams, including many in the British Premier League, to promote their brands has created significant controversy in Europe and led to sanctions in April 2023 by the UK Gambling Commission. Running a massive criminal enterprise such as this requires a sophisticated network operation that is agile, secure, and self-healing. While investigative journalists have highlighted several shady impenetrable businesses behind much of the scandal, our research reveals that almost all the sanctioned brands run on the same software, using the same DNS network. What looks like tens of independent gambling companies is, in fact, one service provider.
This talk will cover how the investigation of one curiosity at our DNS recursive resolvers led to uncovering a massive criminal enterprise, their entire software stack and network, and their techniques, tactics, and procedures (TTP). We will show how reporting by investigative journalists and watchdog organizations allowed us to tie the technical discoveries to specific Chinese criminal organizations, ultimately uncovering the company at the center of the ring. We will highlight how the online criminal world is not limited to data breaches and identity theft but conspires with the physical criminal world: people are both the victims and unwilling perpetrators.
This talk will cover how the investigation of one curiosity at our DNS recursive resolvers led to uncovering a massive criminal enterprise, their entire software stack and network, and their techniques, tactics, and procedures (TTP). We will show how reporting by investigative journalists and watchdog organizations allowed us to tie the technical discoveries to specific Chinese criminal organizations, ultimately uncovering the company at the center of the ring. We will highlight how the online criminal world is not limited to data breaches and identity theft but conspires with the physical criminal world: people are both the victims and unwilling perpetrators.
