Going from IOCs to Behaviors: Threat Hunting for the Actor Behind CYBERCOM's Recent Ukraine Report

CYBERCOM recently released a report with indicators of compromise (IOCs) from compromised Ukrainian networks. While IOCs are a great way to find very specific parts of an attack, we explore how to instead look for potential behaviors related to the provided IOCs when threat hunting. Please like and subscribe to support our channel! Welcome to Insane Cyber! Formerly known as Insane Forensics, we've evolved into Insane Cyber—bringing cutting-edge cybersecurity solutions to the industrial world. Our mission remains the same: delivering full-spectrum visibility, rapid response, and expert-driven security to protect critical assets. We’re the team behind: 🔹 Valkyrie – Security automation platform for fast, actionable insights 🔹 Cygnet – Rapid-response flyaway kit for field-ready cybersecurity 🔹 Corvus – Managed security services for continuous protection 🔹 Aesir – Professional services for expert-led cybersecurity solutions Explore our latest innovations, insights, and tech talks right here. 🔗 Learn more at https://insanecyber.com/ 🔗 Follow us on LinkedIn:   / insane-cyber-inc   --------------------------------------------------------------- Chapters: 00:00 - Intro 00:22 - Overview of CYBERCOM's Ukranian Network IOC Report 00:36 - Overview of the Primitive, IOC-based Threat Hunt Approach 02:51 - How to Move from IOCs to Behaviors 03:33 - Exploring the Tie Between CYBERCOM's IOCs and previous InvisiMole Operations 05:47 - Overview of Who InvisiMole Is 07:58 - How The "Who" Question Gets Us To Our First InvisiMole Hypothesis 10:04 - Cyber Threat Hunting for InvisiMole 11:29 - Overview of Gamaredon/Primitive Bear 13:30 - Threat Hunting for Gamaredon/Primitive Bear 13:50 - How To Move Hunt Away from IOCs 16:23 - Wrapping Up