This week during the SSTIC2017 annual cyber security conference, a French conference running consecutively since 2004, the National Cybersecurity Agency of France (ANSSI) gave a presentation detailing their 2015 audit of their investigation and remediation of the intrusion which affected TV5Monde television network channel. This intrusion was allegedly conducted by the Fancy Bear/APT28 actor, and resulted into broadcasting and social media sabotage. Although, this happened two years ago — hats off to both ANSSI and TV5Monde for sharing their experience, what they have learned and their methodology during the investigation. Very few companies understand the importance of sharing such information in order to prevent similar scenarios. This sort of feedback is incredibly valuable and informative for the community. Thanks.

Working Windows XP & 7 demos. #FRENCHMAFIA 🔗Read More: Part 1 — Part 2 — Part 3 — Part 4 — @msuiche (Twitter) In Short 🔗DO NOT REBOOT your infected machines and TRY wanakiwi ASAP*! *ASAP because prime numbers may be over written in memory after a while. Frequently Asked Questions 🔗Here. Usage 🔗You just need to download the tool and run it on the infected machine. Default settings should work. Usage: wanakiwi.exe <PID> PID (Process Id) is an optional parameter. By default, wanakiwi automatically looks for _wnry.exe_ or _wcry.exe_ processes so this parameter should not be required. But in case, the main process has a different name this parameter can be used as an input parameter. Don’t cry yet. 🔗UPDATE: Actually, wanakiwi from Benjamin Delpy (@gentilkiwi) works for both Windows XP (x86 confirmed) and Windows 7 (x86 confirmed). This would imply it works for every version of Windows from XP to 7, including Windows 2003 (x86 confirmed), Vista and 2008 and 2008 R2. See demos in the below GIFs.

Potential​ links to North Korea have been found. 🔗Read More: Part 1 — Part 2 — Part 3 — Part 4 Code similarities are shared between a February 2017 sample of WannaCry and 2015 Contopee sample (previously attributed last year to Lazarus Group by Symantec) had been found. Initially, reported on Twitter by Google researcher Neel Mehta, I investigated further. Since then, this suspicion has been shared by Kaspersky too. UPDATE: Symantec also released few hours later an article saying they also discovered similarities.