Conti Ransomware organization Security Incident

Time Series Analysis by Leveraging GPT-4o Vision for Threat Intel Thomas Roccia 8 min read May 28, 2024 -- 1 Listen Share Zoom image will be displayed Prompt: Draw in black and white a Threat Intel Analyst sitting at their desk, staring at a computer screen filled with confusing, messy graphs. In threat intelligence, you often have to work with timelines, data graphs, and more. As part of our training, Blue Team Arsenal Python and Generative AI for Threat Intelligence , we are showcasing and teaching how generative AI can be practically applied to threat intelligence workflows. One example we demonstrate in the courseware is the analysis of the Conti Leaks. The Conti Leaks were major leaks about the Conti Ransomware organization that occurred in February 2022. Part of this leak was the internal Jabber discussions of the members, where they discussed all sorts of information such as TTPs, targets of interest, organizational details, and more. As you can imagine, this was juicy from a threat intel perspective. To illustrate this blog, I used a graph I created that visualizes the number of discussions per day on the Jabber chats, highlighting some peaks of activity. It was interesting to correlate these peaks with major events such as geopolitical developments, policy decisions, major cyber attacks, or vulnerability exploit releases. At the time of the investigation, I browsed the internet and gathered intel about the dates of the peaks to correlate with the activities, discussions, and potential geopolitical events or anything that could spark interest within the group. When the leak came out, generative AI was not as advanced as it is today In our training, we teach practical use cases of leveraging Generative AI. Our goal is to automate boring tasks, speed up analysis, and increase the efficiency of Threat Intel teams. So, I thought using GPT-4 Vision for image analysis would be a good approach, and this is what I am discussing in this post. What is GPT-4o...

... (truncated for display)