We see nation state trying to copycat or mimic cyber criminal behavior to camouflage espionage or destructive attacks. Hi and welcome to Sabirism's malicious life besides, I'm Ren Levy.

Earlier this month, February 2022, Cyber reasons noctornous team, a group specializing in the analysis

on reverse engineering of new attack vectors and malware tools

released two new and interesting reports about two Iranian hacker groups, Moses Staff

and Phosphorus.

These two nation-sponsored actors, in particular Moses Staff, blur the line between criminal

hacker gangs and APT by using a variety of criminal techniques and open source tools.

Why would an APT try to masquerade itself as a criminal entity?

One obvious reason is to make things more difficult for the investigators of their

attacks.

But as Asaf de Han notes in the following conversation with Nate Nelson, there are other reasons, some practical and some

geopolitical. So what is the dividing line between state-sponsored attacks and

criminal activity.

Why would an APT attacker use ransomware?

Asaf-Dahan gives us a glimpse into the mind of an APT actor.

Both reports about Phosphorus and Moses staff are available at Cyberizans blog at cyberizan.

com.

Enjoy the interview.

Assaf, I imagine that most people think of cybercrime and nation-state attacks as distinct phenomena, but increasingly they're not. At what point in history did that line start to blur?

Yeah, that's a very good observation.

I think, while it's not a completely new phenomena, we definitely see an increase in where those lines get blurred.

Over the years we've seen different groups, especially like nation state groups, kind of like

...