SagaLabs Community Night

​From Linux Processes to the Aisuru-Kimwolf Botnet

​A suspicious process is running on your Linux server, but its binary has disappeared from disk. Now what?

​At our next SagaLabs Community event, we’re joined by Asger Strunk, Principal Incident Responder at InfoGuard. With more than a decade across offensive and defensive security, Asger will share practical lessons from his work in incident response.

​We’ll dig into /proc to see what a running Linux system can tell us, even when someone has tried to hide their tracks. Asger will show how to look beyond misleading process names, spot signs of rootkits, and recover deleted binaries while they’re still running.

​Jonathan from Webscout.io is joining us too. He’s a former Principal Threat Intelligence Analyst and has been involved in some seriously interesting work. At Webscout, he helps defenders investigate suspicious IPs and uncover the infrastructure attackers use.

​He’ll take us inside the Aisuru-Kimwolf botnet, which delivered the largest DDoS attacks ever recorded over the past year, peaking at 31.4 Tbps. We’ll dig into how it reached that scale and why the conditions for the next hyper-volumetric botnet are already in place. It’s a question of when, not if.

​Come along, bring your questions, and meet others in the community. We hope to see you!