SlideShare uses cookies to improve functionality and performance, and to provide you with relevant advertising. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it. Details a massive intrusion by Russian APT29 (AKA CozyDuke, Cozy Bear) . Every IR presents unique challenges. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it. RAR) included deleted items in Accessed Files STEALTHYATTACKER FUN FACT: Now it’s built-in. DERBYCON 2016 #NOEASYBREACH Matt Dunwoody @matthewdunwoody Nick Carr @itsreallynick 22 likes . Views . You have now unlocked unlimited access to 20M+ documents. Unlimited Reading . Learn faster and smarter from top experts . Unlimited Downloading . Download to take your learnings offline and on the go . You also get free access to Scribd. Instant access to millions of ebooks, audiobooks, magazines, podcasts and more. Free access to premium services like Tuneln, Mubi and more. Enjoy access to millions of ebooks, audiobooks, magazines, and more from Scribd