The situation in Ukraine presents many humanitarian and security challenges. We are obtaining a clearer view into a new form of hybrid warfare that we have previously only theorized about. SentinelOne is providing whatever technical resources we can to support Ukrainian organizations. We also have to recognize the larger threat posed by cyber threats leveraged against those that support sanctions, strategic Western sectors, or Ukrainian organizations. In this post, we offer a high-level overview of threats emerging as a result of the ongoing conflict in Ukraine.

To date, we have seen threat actors using three primary tactics: Distributed Denial of Service (DDoS) attacks, website defacements, and malicious wipers. While the techniques may be regarded as simple at a high-level, in conjunction they present a destabilizing force in limiting the availability of official information and services, either temporarily or permanently.

Denial of Service Attacks

In the early stages of the invasion, government websites belonging to Ukraine were taken offline by DDOS attacks. Specifically the Ukraine Ministry of Foreign Affairs, Ministry of Defense, Ministry of Internal Affairs, and the Security Service of Ukraine websites all observed a disruption of service. Additionally, the financial sector in Ukraine also experienced a disruption of service. The UK government attributed the events to the Russian GRU.

HeremeticWiper | Crippling Systems in the Ukraine

On Wednesday, February 23rd, as the physical invasion of Ukraine was underway, researchers discovered that Ukrainian organizations were being targeted with a wiper dubbed HermeticWiper in reference to the digital certificate used to sign the sample.

HermeticWiper appears to be a custom written application with very few standard functions. It leverages the benign EaseUS driver to access physical drives directly as well as getting partition information.

The malware focuses on corrupting the first 512 bytes, the Master Boot Record (MBR), of every physical drive. While that should be enough for a device not to boot again, HermeticWiper proceeds to enumerate and corrupt the partitions for all possible drives. The malware is also able to differentiate between FAT and NTFS partitions and act accordingly to cause the most damage. HermeticWiper eventually initiates  a system shutdown, finalizing the malware’s devastating effect.

HermeticWiper is a ‘fire-and-forget’ tool. It has neither command-and-control nor self-spreading capabilities. The attackers need to establish access to deploy the wiper. In previous cases, they’ve done so via GPO, establishing a scheduled task to run the wiper as well as decoy ransomware.

HermeticWiper is far more thorough, better developed, and efficient than WhisperGate, a wiper deployed in Ukraine in January with a very limited distribution. Our assessment at this time treats the two as separate threats likely created by separate developers.

PartyTicket Ransomware

PartyTicket is the name SentinelLabs has given to the decoy ransomware component of the original HermeticWiper attacks. This malware was observed being delivered to targets alongside HermeticWiper and is believed to be used as a distraction while the devices are wiped.

The ransomware is a custom Golang application that disrupts services and distracts defenders. PartyTicket is incredibly noisy, spawning hundreds of ancillary threads, likely resulting in an inadvertent local denial of service. The program’s custom code is full of taunting references to the US government and the Biden administration.

Similar taunts are present in the “ransom note” presented upon launch of the “ransomware”.

Recommendations for CISOs and CIOs

As the situation evolves, the SentinelOne and SentinelLabs teams continue to provide support for those in need by sharing research, recommendations, indicators, and tools to stay on top of the evolving threat landscape. We also offer 90 days of free access to the SentinelOne Singularity platform for businesses in Ukraine.

While threats have been largely contained to Ukraine (with some spillover effects to neighboring countries), escalating geopolitical tensions and sanctions will likely incentivize attacks towards Western nations. In line with CISA’s recent advisory, SentinelOne urges organizations to adopt a heightened security posture and to take proactive measures including:

• Ensure that all networks and endpoints are protected by an advanced security solution that can prevent, detect, and respond to known and novel attacks, as well as rollback devices in the event of an attack.
• Make sure your SOC and IT teams are up-to-date with the latest threat intelligence around cyber attacks on the Ukraine.
• Monitor government advisories such as CISA’s alerts and Shields Up bulletin.
• Designate a crisis-response team with updated points of contact for a cybersecurity incident.
• Verify you have cyber insurance, understand your coverage, and know how to activate incident response services.
• Run a fire-drill to ensure that everyone understands roles and responsibilities, and what action needs to be taken and when.
• Plan for a worst-case scenario and ensure a business continuity plan is in place.

Conclusion

While cyberspace has become an integral part of our digital lives, it has also become a key aspect of geopolitical conflicts. As more offensive capabilities are available, they are used by governments for surveillance and disinformation. In the midst of a physical war, cyber has become an indispensable weapon to cripple defense systems, create chaos, and demoralize a population under duress.

SentinelOne’s objective is to keep our customers safe while sharing our expertise with those who are in need. If you are a business in Ukraine or the surrounding area and your devices and networks might be impacted by the current crisis, we are here to help.

The Good

Good news this week comes by way of Spanish law enforcement, which publicly announced the dismantling of a criminal SIM-swapping organization. Investigations into the operation began in March 2021, following official complaints from locations across Spain.

The arrest of eight individuals follows a year-long investigation by the National Police into fraudulent bank transfers. The group’s MO was somewhat different from traditional SIM swapping. In this case, the group sought to extract private information from targets through emails and text messages spoofing banks. The collected data was then used to create fake identity documentation for the next stage in the scam.

Rather than just convincing a carrier to register a different SIM to the target’s number, the gang used their fake documentation to convince employees of phone stores to provide duplicate SIMs, which then gave them access to banking security messages and allowed them to conduct financial transactions. Adding insult to injury, the victims’ devices would be disabled once the gang’s devices were activated with the duplicate SIMs.

The eight detainees – seven from Barcelona and one from Seville – laundered their ill-gotten gains through bank transfers and online payment platforms. Police say that besides the arrests they have also blocked twelve bank accounts associated with the gang’s activities.

The Bad

This week SentinelLabs published research on an Iranian-aligned threat actor called TunnelVision. The research focuses on the threat actor’s exploitation of VMware Horizon Log4j vulnerabilities. The TunnelVision actor has been observed targeting organizations throughout the Middle-East and the United States.

TunnelVision has been actively exploiting the Log4j vulnerability in VMware Horizon to run malicious PowerShell commands, deploy backdoors, create backdoor users, harvest credentials and perform lateral movement.

The research takes a look at how this threat actor evolves their attack techniques making use of 1-day vulnerabilities – bugs in software that have recently been patched by vendors but not yet widely updated by organizations. Once the actors gain initial access, they download tunneling software like ngrok, Plink and FRPC (Fast Reverse Proxy Client). The threat actor also aims to avoid detection in its C2 activity by making use of legitimate public services like pastebin, transfer.sh and webhook.site, among others.

While the group’s activity is not new – other vendors have tracked activity similar to TunnelVision under different, sometimes overlapping, threat actor names – SentinelLabs says that the cluster of activity they have observed is distinct enough to warrant unique attribution.

The Ugly

As tensions continue to rise over the Ukrainian crisis, threat activity in the cyber domain has escalated in the last week. Multiple events have occurred including Ukraine technology service disruptions, potential psychological impact-themed efforts and, of course, disinformation.

Multiple Ukrainian bank services and the Ukrainian Ministry of Defense website were temporarily inaccessible due to a DDoS attack this week. Additionally, fake SMS messages have been circulating in Ukraine claiming a large impact to the ATM services across the country. The true objective of these attacks is unclear; however, one theory is that the attackers were attempting to have a psychological impact on the citizens of Ukraine, as well as draw the attention of media outlets around the world.

Disinformation campaigns are also apparent, with the West noting that Russian-controlled media is being seeded with stories of false provocations against Russian interests. Russia’s Foreign Ministry briefed journalists on Monday saying that “Moscow does not rule out provocations against the self-proclaimed republics in Donbass”. Meanwhile, Russia continues to claim that the U.S., in particular, is being deliberately alarmist and using language that only serves to inflame the situation. The Polish Ministry of Foregin Affairs has also been vocal in calling out Russian disinformation on social media.

One thing that no one is in doubt about, however, is that organizations need to be wary of the potential for cyber attacks related to the ongoing situation. CISA released an advisory Wednesday recommending network defenders review the TTPs and IoCs around suspected MBR wiper activity seen targeting Ukrainian organizations. The potential for malicious cyber activity well-beyond that realm, particularly against U.S. targets, should not be underestimated.

Historically, most corporate applications and solutions that store corporate data were protected behind the corporate network. The adoption of cloud applications and the mobile workforce has changed this paradigm dramatically. Whereas once it would have been unthinkable to allow employees to access applications outside of the corporate network, today such applications are accessible virtually anywhere thanks to cloud-native solutions. For this reason, the old perimeter that security professionals would set and protect no longer exists, and perimeter-based security models are obsolete.

Pandemic-Enabled Digital Transformation

The  COVID-19 pandemic has accelerated digital transformation efforts for organizations that need to rapidly stand up infrastructure to support an instant remote and later hybrid workforce. IT teams deployed new solutions to enable business continuity, including cloud infrastructure and Software-as-a-Service (SaaS) platforms like Zoom and Office 365.

Organizations adopted solutions that could scale and deploy without needing access to the physical data center, in some cases deploying applications that were exposed to the open internet. In parallel, many organizations needed to provide endpoints for new remote employees and roll out bring your device (BYOD) programs. In reality, securing these new operating environments was a secondary concern.

These radical shifts resulted in users accessing applications and data outside of the traditional corporate network. While some organizations tried to scale their on-premises infrastructure to cope, creating a new perimeter around the new compute-where-you-are environment with legacy tooling requires too much effort and is prohibitively expensive.

The modern organization’s attack surfaces now encompass the cloud, containers, mobile devices, IoT, and storage. As attack vectors multiply, many enterprises address each vector with a best-in-class solution to protect those specific vulnerabilities. However, these point tools don’t connect the dots across the entire technology stack. As a result, security data is collected, analyzed, and investigated in isolation, creating gaps in what security teams can see and detect.

In addition, as the number of deployed security solutions grows in the enterprise, the capacity to manage them and effectively respond to their alerts also grows. Administrators can quickly become overwhelmed by the entirety of data produced from multiple systems and a consistent stream of security alerts. All of this results in long adversary dwell times, potentially causing material damage to an organization.

Security teams need a new way of working, one that enables productivity for end-users and security for the organization—one that provides frictionless protection from endpoint to network to application.

XDR and Zero Trust as Frameworks for Improving Security for Remote Workers

XDR is the evolution of EDR, Endpoint Detection, and Response. While EDR collects and correlates activities across multiple endpoints, XDR broadens the scope of detection beyond endpoints to provide detection, analytics, and response across endpoints, networks, servers, cloud workloads, SIEM, and more.

​​XDR automatically collects and correlates data across multiple security vectors, facilitating faster threat detection so that security analysts can respond quickly before the scope of the threat broadens.  Out-of-the-box integrations and pre-tuned detection mechanisms across multiple different products and platforms help improve productivity, threat detection, and forensics.

Forrester defines Zero Trust as “moving security from a network-oriented, perimeter-based security model to one based on continuous verification of trust.” For organizations, this means rethinking the trust-by-default approach and replacing it with a default-deny posture that only authenticates users to least privilege after assessing multiple sources of risk and context. This approach assumes that attackers are already within the network and ensures that every attempt to access the resources or applications be continuously scrutinized to ensure the request is legitimate.

Fundamentally XDR and Zero Trust solve the same challenge with a different approach and methodology. While Zero Trust is risk-centric and XDR is threat-centric, both involve deep integration of the technology stack to exchange telemetry between solutions and to respond in the face of a changing threat or risk landscape. Both seek to minimize enterprise risk and attack surface while enabling end-user productivity and efficiency.

End-to-End Protection from Endpoint to Cloud

SentinelOne and Zscaler joint solution delivers end-to-end protection from endpoint to cloud while streamlining SOC workflows.

SentinelOne and Zscaler combine to simplify enterprise security across endpoint, network, and cloud, enabling enhanced end-to-end visibility, automated response, and conditional access.

With integration into SentinelOne’s new data platform, Zscaler logs are ingested into SentinelOne. They can then be queried and faceted, allowing security operations teams to quickly triage and respond to attacks.

This joint solution empowers SOC teams to accelerate response with policy-driven actions that remediate threats automatically in Zscaler before an endpoint compromise results in cloud data exfiltration or other damage.

Analysts can trigger automatic and manual response actions from SentinelOne into Zscaler, such as revoking access or moving them into a more restrictive group, automatically limiting an attacker’s ability to infiltrate and launch an attack.

Coordinated user access control via the Zscaler Zero Trust Exchange provides secure conditional access to private and SaaS applications based on Zero Trust principles. Additional Zero Trust integration points include device posture checks by the Zscaler Cloud Connector agent to enable conditional access policies based on whether the SentinelOne agent is installed and running. This approach minimizes the enterprise attack surface with a zero-trust policy for conditional access.

With seamless integration, Zscaler and SentinelOne enable security teams to accelerate investigations and remediate threats without pivoting between consoles. Security Operation Centers can triage, investigate, and remediate threats much more efficiently and with greater confidence.

Use Case 1: Extended Visibility and Holistic Remediation Between Endpoint and Cloud

This joint solution enables SentinelOne to consume Zscaler logs for expanded visibility and enables security analysts to configure flexible response policies right from the SentinelOne console.

Analysts can quickly and automatically mitigate threats such as limiting user access, quarantining a user, blocking access to one or a group of critical applications, or restricting access to specific applications only with browser isolation.

Here’s how it works:

• Install the free app from Singularity Marketplace and provide it with Zscaler API credentials.
• Ingest the Zscaler logs into the SentinelOne Singularity XDR framework
• Use default or custom policies to trigger response actions by changing user group membership such as predefined restrictive or browser isolated groups. Ensure that users are granted access to enterprise applications and data based on the dynamic conditions of threats and user risk, with speed and consistency.

Use Case 2: Zero Trust Conditional Access Based on Endpoint Security Posture

The SentinelOne and Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) integration enable seamless conditional access, ensuring that the trusted identity on a trusted device can directly access authorized corporate applications without exposing the network.

The guiding principles of Zero Trust are to assume that attackers are already in the network, which means never implicitly trusting users or applications before verifying. Assuming that the environment is already compromised, nothing should be trusted until users, devices, and applications demonstrate their trustworthiness.

Zscaler and SentinelOne combine best-in-class Zero Trust access control with unparalleled visibility, AI-powered detection, and automated response across endpoints, applications, and cloud workloads. SentinelOne continuously checks policy and enforces compliance on the endpoint. At the time of access, Zscaler checks whether SentinelOne is installed and running, considers the endpoint’s security posture, and grants access to corporate applications.

Here’s how it works:

• SentinelOne secures endpoints with enterprise-grade prevention, detection, response, and hunting.
• Zscaler Client Connector (ZCC) verifies the presence of SentinelOne by using device posture as an additional authorization vector for access control. Zscaler ZIA and ZPA can be configured to allow only compliant endpoints – ones that pass the posture check – to access selected applications.
• Zscaler admins can specify (for Windows and Mac workstations) that SentinelOne is installed and running for an endpoint to be granted access to critical business applications.

Parting Thoughts

With attack vectors multiplying due to hybrid work models and BYOD programs, enterprises struggle to secure increasing numbers of vulnerable assets inside and outside the traditional network perimeter. SentinelOne and Zscaler help organizations prevent, detect, and respond to threats more quickly and effectively by providing a comprehensive view of threats across the cloud and endpoints.

Together, SentinelOne and Zscaler provide joint customers with increased SOC efficiency, streamlined workflows, and enhanced threat protection across endpoint, cloud, and network.

To learn more, check out the SentinelOne and Zscaler joint solution brief or attend our upcoming webinar.