-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathtime_aware_malware.html
More file actions
230 lines (204 loc) · 11.3 KB
/
Copy pathtime_aware_malware.html
File metadata and controls
230 lines (204 loc) · 11.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Time-Aware Malware Research | Khadija Taki</title>
<link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;700&family=DM+Sans:wght@400;500;700&display=swap" rel="stylesheet">
<style>
:root {
--bg: #0a0e17;
--surface: #111827;
--border: #1e293b;
--accent: #3b82f6;
--accent-dim: #1e3a5f;
--red: #ef4444;
--amber: #f59e0b;
--green: #22c55e;
--teal: #14b8a6;
--text: #e2e8f0;
--text-dim: #94a3b8;
--text-muted: #64748b;
--mono: 'JetBrains Mono', monospace;
--sans: 'DM Sans', sans-serif;
}
* { margin:0; padding:0; box-sizing:border-box; }
body { background:var(--bg); color:var(--text); font-family:var(--sans); line-height:1.7; }
.container { max-width:900px; margin:0 auto; padding:2rem 1.5rem; }
/* Classification banner */
.banner { text-align:center; font-family:var(--mono); font-size:11px; letter-spacing:3px; color:var(--text-muted); padding:12px; border-bottom:1px solid var(--border); }
/* Header */
.header { padding:3rem 0 2rem; border-bottom:1px solid var(--border); margin-bottom:2rem; }
.header .tag { font-family:var(--mono); font-size:11px; color:var(--accent); letter-spacing:2px; text-transform:uppercase; margin-bottom:8px; }
.header h1 { font-size:2.2rem; font-weight:700; line-height:1.2; margin-bottom:12px; }
.header h1 span { color:var(--red); }
.header .meta { font-size:14px; color:var(--text-dim); }
.header .meta span { margin-right:20px; }
/* Badges */
.badges { display:flex; flex-wrap:wrap; gap:8px; margin:1.5rem 0; }
.badge { font-family:var(--mono); font-size:11px; padding:4px 10px; border-radius:4px; border:1px solid var(--border); color:var(--text-dim); }
.badge.mitre { border-color:var(--red); color:var(--red); }
.badge.geo { border-color:var(--amber); color:var(--amber); }
.badge.policy { border-color:var(--teal); color:var(--teal); }
/* Sections */
.section { margin-bottom:2.5rem; }
.section h2 { font-size:1.1rem; font-weight:700; color:var(--accent); margin-bottom:1rem; font-family:var(--mono); letter-spacing:1px; }
.section h2::before { content:'// '; color:var(--text-muted); }
.section p { color:var(--text-dim); margin-bottom:1rem; font-size:15px; }
/* MITRE Table */
.mitre-table { width:100%; border-collapse:collapse; margin:1rem 0; font-size:13px; }
.mitre-table th { font-family:var(--mono); text-align:left; padding:10px 12px; background:var(--surface); color:var(--accent); border-bottom:2px solid var(--accent-dim); font-weight:500; font-size:11px; letter-spacing:1px; text-transform:uppercase; }
.mitre-table td { padding:10px 12px; border-bottom:1px solid var(--border); color:var(--text-dim); }
.mitre-table tr:hover td { background:rgba(59,130,246,0.05); }
.mitre-table .tid { font-family:var(--mono); color:var(--red); font-weight:500; }
/* Conflict context cards */
.conflict-grid { display:grid; grid-template-columns:1fr 1fr; gap:12px; margin:1rem 0; }
.conflict-card { background:var(--surface); border:1px solid var(--border); border-radius:8px; padding:16px; }
.conflict-card .label { font-family:var(--mono); font-size:10px; letter-spacing:2px; text-transform:uppercase; margin-bottom:6px; }
.conflict-card .label.ru { color:var(--red); }
.conflict-card .label.cn { color:var(--amber); }
.conflict-card .label.me { color:var(--teal); }
.conflict-card .label.space { color:var(--accent); }
.conflict-card p { font-size:13px; color:var(--text-dim); line-height:1.5; }
/* Flow diagram */
.flow { background:var(--surface); border:1px solid var(--border); border-radius:8px; padding:20px; margin:1rem 0; text-align:center; font-family:var(--mono); font-size:12px; color:var(--text-dim); overflow-x:auto; }
.flow-chain { display:flex; align-items:center; justify-content:center; gap:0; flex-wrap:wrap; }
.flow-node { padding:8px 14px; border:1px solid var(--border); border-radius:6px; background:var(--bg); white-space:nowrap; }
.flow-node.active { border-color:var(--red); color:var(--red); }
.flow-node.check { border-color:var(--amber); color:var(--amber); }
.flow-node.result { border-color:var(--green); color:var(--green); }
.flow-arrow { color:var(--text-muted); padding:0 6px; font-size:16px; }
/* Links */
.cta { display:inline-flex; align-items:center; gap:8px; margin-top:1rem; padding:10px 20px; background:var(--accent); color:white; text-decoration:none; border-radius:6px; font-weight:500; font-size:14px; transition:opacity 0.2s; }
.cta:hover { opacity:0.85; }
.cta.secondary { background:transparent; border:1px solid var(--border); color:var(--text-dim); }
/* Portfolio connection */
.connections { display:grid; grid-template-columns:repeat(3,1fr); gap:12px; margin:1rem 0; }
.conn-card { background:var(--surface); border:1px solid var(--border); border-radius:8px; padding:14px; text-align:center; }
.conn-card .name { font-weight:700; font-size:14px; margin-bottom:4px; }
.conn-card .link-text { font-size:12px; color:var(--text-muted); }
/* Back link */
.back { display:inline-block; margin-bottom:1rem; font-family:var(--mono); font-size:12px; color:var(--text-muted); text-decoration:none; }
.back:hover { color:var(--accent); }
@media(max-width:600px) {
.conflict-grid, .connections { grid-template-columns:1fr; }
.header h1 { font-size:1.6rem; }
.flow-chain { flex-direction:column; }
.flow-arrow { transform:rotate(90deg); }
}
</style>
</head>
<body>
<div class="banner">UNCLASSIFIED // FOR EDUCATIONAL PURPOSES</div>
<div class="container">
<a href="index.html" class="back">← back to portfolio</a>
<div class="header">
<div class="tag">SILENTFALL // Threat Intelligence Module</div>
<h1>Time-Aware Malware: A Shift Toward <span>Precision</span> Cyber Targeting</h1>
<div class="meta">
<span>Khadija Taki</span>
<span>CMU Heinz College</span>
<span>March 2026</span>
</div>
</div>
<div class="badges">
<span class="badge mitre">MITRE ATT&CK</span>
<span class="badge mitre">T1082</span>
<span class="badge mitre">T1124</span>
<span class="badge mitre">T1614</span>
<span class="badge mitre">T1497</span>
<span class="badge geo">Geopolitical Context</span>
<span class="badge policy">Policy Implications</span>
</div>
<div class="section">
<h2>Overview</h2>
<p>Recent malware campaigns use conditional execution based on environmental awareness. Before activating, the malware checks system timezone, geographic location, and language settings. If conditions are not met, it exits, goes dormant, or delivers a decoy payload.</p>
<p>This reflects a transition from indiscriminate cyber activity toward targeted, intelligence-driven operations.</p>
</div>
<div class="section">
<h2>Execution flow</h2>
<div class="flow">
<div class="flow-chain">
<div class="flow-node">Delivery</div>
<span class="flow-arrow">→</span>
<div class="flow-node check">TZ check</div>
<span class="flow-arrow">→</span>
<div class="flow-node check">Locale check</div>
<span class="flow-arrow">→</span>
<div class="flow-node check">GeoIP check</div>
<span class="flow-arrow">→</span>
<div class="flow-node check">Config check</div>
<span class="flow-arrow">→</span>
<div class="flow-node active">Execute / Abort</div>
</div>
</div>
</div>
<div class="section">
<h2>Current conflict context</h2>
<div class="conflict-grid">
<div class="conflict-card">
<div class="label ru">Russia-Ukraine</div>
<p>Russian-linked ransomware groups (REvil, DarkSide, Conti) use CIS language exclusion checks. If the system keyboard is set to Russian or Ukrainian, the malware exits without executing.</p>
</div>
<div class="conflict-card">
<div class="label cn">China-Taiwan</div>
<p>APT groups linked to China (APT41, Volt Typhoon) use geolocation and timezone filtering to restrict operations. Volt Typhoon targeted US critical infrastructure with environment-aware persistence techniques.</p>
</div>
<div class="conflict-card">
<div class="label me">Middle East</div>
<p>Wiper malware targeting specific regions uses locale checks to ensure payloads only execute on systems in targeted countries. Region-restricted campaigns minimize international attribution risk.</p>
</div>
<div class="conflict-card">
<div class="label space">Space / Defense</div>
<p>Satellite ground stations operate on specific UTC offsets. A time-aware adversary could target command windows by activating only when the satellite is overhead. Cloud-based space infrastructure adds IAM attack surface.</p>
</div>
</div>
</div>
<div class="section">
<h2>MITRE ATT&CK mapping</h2>
<table class="mitre-table">
<thead>
<tr><th>Tactic</th><th>Technique</th><th>ID</th><th>Relevance</th></tr>
</thead>
<tbody>
<tr><td>Execution</td><td>Command and Scripting Interpreter</td><td class="tid">T1059</td><td>Conditional execution logic in scripts</td></tr>
<tr><td>Defense Evasion</td><td>Obfuscated/Compressed Files</td><td class="tid">T1027</td><td>Hides conditional logic and checks</td></tr>
<tr><td>Defense Evasion</td><td>Virtualization/Sandbox Evasion</td><td class="tid">T1497</td><td>Avoids analysis environments</td></tr>
<tr><td>Discovery</td><td>System Information Discovery</td><td class="tid">T1082</td><td>Gathers locale, timezone, system data</td></tr>
<tr><td>Discovery</td><td>System Time Discovery</td><td class="tid">T1124</td><td>Checks local system time and timezone</td></tr>
<tr><td>Discovery</td><td>System Language Discovery</td><td class="tid">T1614.001</td><td>Determines keyboard/language settings</td></tr>
<tr><td>Discovery</td><td>Location Discovery</td><td class="tid">T1614</td><td>Identifies geographic targeting relevance</td></tr>
<tr><td>Impact</td><td>Inhibit System Recovery</td><td class="tid">T1490</td><td>Conditional payload execution</td></tr>
</tbody>
</table>
</div>
<div class="section">
<h2>Analyst note</h2>
<p>What matters here is not just how the malware behaves, but why. Time-aware execution reflects an adversary that understands its operational environment, intentionally limits exposure, and prioritizes mission success over scale. This is closer to planned cyber operations than opportunistic attacks.</p>
<p>As adversaries adopt context-aware execution, defensive strategies must incorporate environmental awareness, behavioral analysis, and intelligence correlation.</p>
</div>
<div class="section">
<h2>Portfolio connections</h2>
<div class="connections">
<div class="conn-card">
<div class="name">BlastMap</div>
<div class="link-text">Both analyze pre-condition validation before access or execution</div>
</div>
<div class="conn-card">
<div class="name">Space Cyber Crew</div>
<div class="link-text">OSINT pipeline extended to detect time-aware indicators</div>
</div>
<div class="conn-card">
<div class="name">DeepSight</div>
<div class="link-text">Adversary context-awareness parallels deepfake evasion</div>
</div>
</div>
</div>
<div style="display:flex;gap:12px;flex-wrap:wrap;margin:2rem 0;">
<a href="time_aware_malware_brief-1.pdf" class="cta">Download PDF Brief</a>
<a href="https://github.com/ktaki8" class="cta secondary">View on GitHub</a>
</div>
</div>
<div class="banner">KHADIJA TAKI // CMU MSISPM // HEINZ COLLEGE // 2026</div>
</body>
</html>