Kartik Jivani
Last known affiliation: Seqrite Labs
Bio: Kartik Jivani works as a Security Researcher I at Seqrite Labs, Quick Heal Technology and specializes in malware analysis and open source intelligence (OSINT). He gathers and analyses threats from both public and dark/deep web sources. Kartik tracks Advanced Persistent Threat (APT) groups and keeps an eye on hacktivist groups that target the government and infrastructure of different countries. In addition, he studies international conflicts—especially those involving India—and conducts thorough analyses of distinct malware strains. He has participated in Capture The Flag (CTF) tournaments to gain problem-solving and OSINT skills.
Sathwik Ram Prakki 🗣 | Kartik Jivani 🗣
Abstract (click to view)
In the aftermath of the disclosure of vulnerabilities within WinRAR, a concerning trend has emerged wherein multiple advanced persistent threat (APT) groups and malicious actors have leveraged these weaknesses to launch targeted attacks on critical sectors spanning various nations. This presentation delves into the exploitation of a specific WinRAR vulnerability, CVE-2023-38831, offering insights into the vulnerability and the tactics employed by threat actors who disseminate malicious ZIP archives through phishing campaigns.
Focusing on a notable case study involving the SideCopy APT, this talk explores the intricacies of how WinRAR is weaponized to compromise the security of entities in India. The examination includes a deep dive into six different clusters of this APT, a detailed dissection of payloads, strategically deployed in a sophisticated multi-platform attack campaign featuring diverse decoys and a consistent naming convention throughout 2024. Furthermore, this presentation sheds light on the discovery of the infrastructure utilized by SideCopy APT, revealing insights into the group’s modus operandi. Specifically focusing on compromised domains with shared IPs used across multiple campaigns throughout the year; targeting of government, maritime and even education sectors, and tons of correlation like shared code & infra with the parent APT group Transparent Tribe (APT36) and Operation RusticWeb.
