Vitaly Kamluk

Background and education

Vitaly Kamluk is a Belarusian malware researcher and digital forensics specialist who has spent most of his career at the antivirus vendor Kaspersky (formerly Kaspersky Lab). He is a graduate of the Faculty of Applied Mathematics and Computer Science at Belarusian State University, and worked as a software developer and system administrator before moving into security research.

Career at Kaspersky

Kamluk became involved in malware research at Kaspersky Lab in 2005. He was appointed Senior Antivirus Expert in 2008 and Director of the company's EEMEA (Eastern Europe, Middle East and Africa) Research Center in 2009, and later spent a year based in Japan studying threats affecting that region. He became a member of Kaspersky's Global Research and Analysis Team (GReAT), the group responsible for the company's targeted-attack and APT investigations, and has been publicly described in later years as a principal security researcher and as director of GReAT for the Asia-Pacific region, based in Singapore.

Secondment to INTERPOL

In 2014 Kamluk was seconded to the INTERPOL Global Complex for Innovation (IGCI) in Singapore, where he worked within the INTERPOL Digital Crime Centre and its Digital Forensics Lab on malware reverse engineering, forensic analysis and investigation support for police forces. The arrangement was one of several private-sector secondments INTERPOL used to give its cybercrime unit access to industry malware expertise. Describing the work in a 2015 interview published by Kaspersky, Kamluk identified jurisdictional fragmentation as the central obstacle to cybercrime investigations, noting that "Internet has no borders, but the physical world does," and said investigators frequently have to write bespoke unpackers, deobfuscators and decryptors for a single case.

Absolute Computrace research

In February 2014 Kamluk published research on Absolute Computrace, an anti-theft agent shipped in the firmware of many laptops. The analysis described how the agent achieved persistence by injecting components into the running system, used techniques normally associated with malicious code such as process injection and anti-debugging, and communicated with its network infrastructure without adequate authentication or encryption in its early stages. Kaspersky researchers reported finding systems on which the agent had become active without the owner's knowledge and warned that the weak protocol could allow an attacker in a position to redirect traffic to obtain remote code execution on affected machines.

The Simda botnet takedown

Kamluk took part in the international operation against the Simda botnet, carried out on 9 April 2015 and coordinated by the INTERPOL Global Complex for Innovation. Investigators from the Dutch National High Tech Crime Unit, the FBI, Russia's Ministry of the Interior Cybercrime Department and Luxembourg and Polish authorities seized command-and-control servers in five countries, supported technically by Kaspersky Lab, Microsoft, Trend Micro and the Cyber Defense Institute. Kamluk's account of the operation, published on Securelist on 13 April 2015, reported that fourteen command-and-control servers were seized and that Simda infections had been observed across a very wide set of countries; Microsoft estimated that more than 770,000 PCs had been affected in the preceding six months. His writeup described Simda as a pay-per-install distribution platform that evaded analysis through virtual machine and emulator detection and that modified the Windows hosts file to redirect traffic destined for major web services.

Bitscout

In July 2017 Kamluk released Bitscout, an open-source tool for building customised bootable Linux images used in remote digital forensics. The project grew out of an ad hoc live CD he had assembled, with a preconfigured VPN and SSH access, to examine a compromised machine in another country without travelling to it. Bitscout is written in shell script and distributed under the GPL-2.0 licence; it mounts target disks read-only to preserve evidence and confines the remote analyst to an unprivileged container so that the owner of the machine can see and record what the examiner does. Kamluk has said the tool was developed outside the scope of his employment, and the project credits contributions from Kaspersky, INTERPOL's Digital Forensics Lab and community volunteers. It was aimed at law enforcement agencies, researchers and educational institutions that could not afford commercial forensic suites.

Later research

Kamluk has continued to publish threat research through Securelist. In January 2022 he co-authored, with Seongsu Park, an analysis of the BlueNoroff group's SnatchCrypto campaign against cryptocurrency businesses, which documented the attackers' use of weaponised documents and a modified MetaMask browser extension to redirect transactions. He has also written on macOS threats, clipboard-injector attacks against cryptocurrency users, the abuse of blockchain technology, and the conduct of security research during the COVID-19 pandemic, and has contributed to Kaspersky Security Bulletin year-end reports. He is a frequent conference speaker, having presented at events including Black Hat USA and Black Hat Asia, DEF CON, Hack In The Box, FIRST, PHDays and ZeroNights.

Significance

Kamluk is representative of a model that became common in the 2010s, in which vendor malware analysts are embedded with law enforcement to supply technical capability that police agencies lack. His INTERPOL secondment and the Simda operation are cited as examples of public-private cooperation in botnet disruption, while the Absolute Computrace work contributed to a broader debate about pre-installed firmware agents that behave like rootkits. Bitscout, released freely, extended remote forensic capability to under-resourced investigators and addressed the trust problem inherent in letting an outside expert examine someone else's machine.

Timeline

• 2005Begins malware research work at Kaspersky Lab.
• 2008Appointed Senior Antivirus Expert at Kaspersky Lab.
• 2009Becomes Director of Kaspersky Lab's EEMEA Research Center.
• 2014-02Publishes "Absolute Computrace Revisited" on Securelist, documenting security weaknesses in the Computrace anti-theft agent.
• 2014Seconded to the INTERPOL Global Complex for Innovation in Singapore, working in the INTERPOL Digital Crime Centre.
• 2015-04-09Takes part in the INTERPOL-coordinated operation that seizes Simda botnet command-and-control servers in five countries.
• 2015-04-13Publishes the Securelist analysis "Simda's Hide and Seek: Grown-up Games" describing the takedown.
• 2017-07-06Releases Bitscout, an open-source live-OS builder for remote digital forensics, under the GPL-2.0 licence.
• 2022-01-13Co-authors Securelist research with Seongsu Park on BlueNoroff's SnatchCrypto campaign against cryptocurrency businesses.