Malware Attribution Team

Tender description

Why the Work is Being Done With an ever increasing number of malware strains, the ability, at pace and at scale, to link these to on-going campaigns, malware families and criminals/ organised crime groups is a key deliverable for the NCA. We are looking to further uplift the effort to deliver a sustainable and in house capability. We are therefore seeking new knowledge, skills and data to support this mission and ensure that our response is both proactive and predictive. Problem to Be Solved NCA has access to unique operational data from recent investigations gathered during proactive intelligence developments. This is only part of the overall picture and would benefit from being analysed in conjunction with other data sets. This could include knowledge of criminal infrastructure and hosting and large volumes of current and historic malware samples and datasets to query against. NCA currently has a malware laboratory which, while helpful, will not on its own allow us to achieve the required outcomes. It is expected this work will develop links to existing malware strains and new lines of enquiry. Who Are the Users The proposal will require staff from within NCCU to work alongside those brought in to deliver the outcomes. These staff will include those from the intelligence teams, operational teams, technical and forensic teams Early Market Engagement N\A Work Already Done A capability already exists, however the desire is to take this to the next level and continue to evolve our tools, techniques and tradecraft Existing Team The existing team is spread across a number of business areas, the aspiration with this piece of work is to develop a joined up approach to put focus on this problem Current Phase Alpha Work Location The NCA, Spring Gardens, Tinworth Street, Vauxhall, London. Working Arrangments The intention of this bid is that it provides the NCA with truly transformational capabilities – it is anticipated that over the course of the two years the upskilling and mentoring, will empower NCA to continue to evolve this capability. This project will provide an in-house team made up of embedded industry expertise and NCCU officers to link, map and attribute malware to malware families to criminal actors and associated real world identities using NCA and partner intelligence and any additional data made available through this contract. Security Clearance The ability to hold or achieve DV clearance. Some work can be conducted with an SC Additional T&Cs All foreground IP will remain property of the Crown. Background IP should be clearly identified before used in this engagement Skills & Experience Experience of cybercrime landscape and knowledge of campaigns and malware families Specific experience of malware analysis of complex malware families with a view to attribute the malware to a real world persona Demonstrable experience of creation of processes and systems to process malware data at scale Excellent analytical skills – ideal operated-in cybercrime environment, use experience of analysis, inference building, development of hypothesis to attribute to real world identities to make recommendations and drive decision making Ability to collect malware and perform static and dynamic code analysis Demonstrable experience of linking malware families based on both technical and tradecraft techniques used. Experience in developing capability utilising mixed skill sets, developing and transferring knowledge to government customers Ability to create tools and techniques to automate and drive insights quickly. Demonstrable knowledge of working with law enforcement and wider government Nice to Haves Access to historic malware data Knowledge of Amazon Web Services for capability development Access to specialist niche datasets of interest Access to historic malware data No. of Suppliers to Evaluate 3 Proposal Criteria An overview of the supplier’s organisation The supplier’s understanding of the task and key challenges in undertaking it, specifically the: Technical challenges, including speed of processing and analytics approaches Team mobilisation approach and composition including SFIA grades, roles and skills Supplier’s ability to operate at OFFICIAL SENSITIVE Approach to aligning with the NCCU culture and ways of working Proposal for multi site working Relevant Track Record Total price presented on a monthly basis, by individual and with expenses clearly identified where relevant Cultural Fit Criteria The team is looking to partner with organisations that can support the aims and culture of the NCCU. Please describe the following areas: Share knowledge and skills Collaborative approach Demonstrate integrity and support Subject matter expertise Work with flexibility Payment Approach Capped time and materials Assessment Method Written proposal Work history Presentation Evaluation Weighting Technical competence 50% Cultural fit 20% Price 30% Questions from Suppliers Budget range not to exceed £1,000,000 over two years