Red Russians - How Russian APT Groups Follow Offensive Security Research

Explore how Russian intelligence services and advanced persistent threat (APT) groups rapidly adopt and adapt techniques developed by Red Team researchers in this 24-minute conference talk from DEF CON 33. Discover the concerning trend of hostile nation-states learning from offensive security research, sometimes implementing newly disclosed exploits, tools, and tactics within weeks of public disclosure. Learn how these campaigns target modern enterprise systems including Microsoft 365 services, Windows features, software development systems, authentication systems, and cloud infrastructure. Gain valuable detection engineering and threat hunting techniques to identify and prevent these types of attacks. Understand the dual implications for both Red Teamers, who must recognize that their testing tools and tradecraft are being weaponized in real-world espionage campaigns against governments and public services, and Blue Teamers, who need to stay vigilant about cutting-edge offensive tooling developments. Examine specific case studies of how Russian APT groups have operationalized research from the offensive security community and discover practical defensive strategies to counter these evolving threats.