Radu Emanuel Chiscariu is a Security Researcher within Keysight’s Application and Threat Intelligence Research Center. Radu holds a MSc in Computer and Network Security from Politehnica University of Bucharest. With a background in network engineering, Radu specializes in the investigation of the latest threats and attacks seen in the wild. He spends most of his time trying to reproduce attack techniques and come up with new vectors of bypassing current protection mechanisms.

Tell us More: How to Harden Your Sandboxes against malware evasions

Threat actors are very aware of the threat intelligence teams strategies to understand how they operate. One of these strategies is detonating the malware in a safe environment, in a separate network, which is known as sandboxing. Therefore, a lot of malwares will attempt to detect if it is executed in a sandbox and cease execution altogether, to avoid giving away details about their goals and infrastructure used for infection and spread. In this talk, we document such malware tactics observed in-the-wild and offer possible mitigations against them.

This presentation is co-presented with Matei Radulea, Security Researcher within Keysight’s Application and Threat Intelligence Research Center.