Looking back at 2022, we’ve reported on positive strides and wins seen across our community as well as some seriously heinous threats to the digital landscape. The Good, Bad and the Ugly series takes this week’s edition to rewind and revisit the best, the worst, and the ugliest from the past 12 months.

The Best

Throughout 2022, law enforcement groups across the globe made a sweeping number of arrests – many the result of international collaborations between agencies. Crackdowns this year saw the arrests of key members from infamous cyberthreat gangs such as JabberZeus and LockBit, as well as the shuttering of multiple darknet marketplaces and malicious domains.

From a policy standpoint, the U.S. government made good on their pledge to harden the country’s cyber posture by implementing the Digital Services and Digital Markets Acts, publishing new guidelines for securing supply chain operations, and adding key cybersecurity hires to their Crypto Assets and Cyber Units.

SentinelOne’s focus on technical innovations, partnership, and sharing security intel was best highlighted by the successful launch of LABScon this September. At this inaugural security conference, SentinelLabs hosted a gathering of the most prominent speakers and researchers from the infosec community with the goal of advancing cybersecurity research for the benefit of a collective digital defense.

The Worst

Despite the wins, threat actors were busy across the year attacking targets old and new.

At the beginning of the year, a Red Cross contractor suffered a large-scale cyberattack exposing the personally identifiable information (PII) of over half-million individuals. In April, a ransomware attack on the Costa Rican government triggered a national emergency that took over a month to remediate. In July, it was revealed that a Conti attack on a healthcare debt collection firm impacted more than 1.91 million patients and 650 medical providers.

As students returned to education in September, the Los Angeles school district supporting over 640,000 students disclosed a data breach on their IT systems.

Los Angeles Unified Targeted by Ransomware Attack

For more information, please visit https://t.co/Itdix5TlqK. pic.twitter.com/HDgktJKT0S

— Los Angeles Unified (@LASchools) September 6, 2022

Cybercrime-as-a-Service has introduced a new wave of low and medium-level cyber criminals to more complex and devastating attack methods. Services like Caffeine, for example, allow anyone on the internet to pay for customized phishing kits and URLs for hosting malware payloads.

Threat groups such as Vice Society were reported in October to be taking on a fluid approach to the spectrum of data extortion. Adapting different tactics based on their targets, some groups have been known to demand ransoms without deploying ransomware, instead threatening victims with exposure of the leaked data. Public exposure of sensitive data can be catastrophic for some organizations, while for others, just the cost of returning to normal operations can put an organization out of business entirely.

Attacks on enterprise cloud surfaces have also become an increasingly worrisome vector throughout 2022, with breaches of major companies such as Twilio, Okta, NetStandard, and LastPass raising fears that even as businesses have understood the need to harden endpoint security, cloud workloads and user identities remain easy targets.

The Ugliest

Amidst an ongoing economic downturn, active warfare, and civil unrest, the ugliest moments of 2022 showed that cybersecurity and cybersecurity awareness is a challenge for society across the board.

A feature of some of 2022’s worst moments was the increasing awareness of how governments around the world are using private espionage companies to throttle dissent and attack civilians including journalists, lawyers and civil rights protesters. In February, SentinelLabs reported on ModifiedElephant, an APT that has been targeting activists by planting false digital evidence.

A private sector offensive actor based in Austria was uncovered in July, while Spain-based IT company Variston were outed in early December as trading in commercial spyware.

Of course, the dominant news of 2022 centered around Ukraine. As the conflict in Ukraine unfolded in the early months of the year, banks, major websites, and other public services in Ukraine were hit with distributed denial-of-service (DDoS) attacks leading up to Russia’s invasion.

In February, SentinelOne researchers reported on HermeticWiper, a new custom wiper malware circulating in Ukrainian organizations in an effort to break down the country’s information systems. Shortly after, another wiper attack on Ukraine dubbed AcidRain hit satellite modems in neighboring countries.

The traffic wasn’t all one way: Russian courts and mayoral offices were targeted with CryWiper. Elsewhere, wipers were deployed by Iranian-linked APT Agrius on targets in Hong Kong, Israel and South Africa. Unlike ransomware, these wipers do not attempt to extort the victim; their intent is only to destroy the victim’s ability to operate, and collectively may be the most nefarious of cyber threats we’ve seen over the last year.

Conclusion

2022 was a year in which cybersecurity headlines reached out into the mainstream media and public consciousness more so than ever. We can hope that this increased awareness will pay dividends in 2023, as public and private organizations, and indeed individual users, develop a greater understanding of cyber risk and how to mitigate it.

Our regular weekly roundups will return next Friday. Meanwhile, find our predictions for 2023 here, and from all of us at SentinelOne, have a happy and very safe New Year.

2022 has been another eventful year for the SentinelLabs research team, with events in Ukraine dominating and directing a large portion of our research output. We also hosted the first ever LABScon, bringing together top tier researchers and thought leaders from across the industry, and found time to investigate a number of supply chain attacks, adversaries, macOS, Linux and Windows malware, and exploitable vulnerabilities.

We’ve seen a shift in ransomware TTPs with increasing use of hybrid and partial encryption and a greater focus from threat actors on stealing data for ransom as well as – and sometimes instead of – using file lockers.

All our research and threat intelligence posts can be found on the SentinelLabs home page, but for a quick recap of the year’s main highlights, take a scroll through the 2022 timeline below.

January

In January, we identified new variants of the PowGoop malware belonging to Iranian-linked threat actor MuddyWater. We described how this adversary used tunneling tools and likely exploited CVE-2020-0688 on Exchange servers to compromise governmental organizations in the Middle East. Like many other Iranian threat actors, the group displays less sophistication and technological complexity compared to other state-sponsored APT groups but continues to be successful through its use of publicly available offensive security tools and exploitation of unpatched vulnerabilities.

January also saw SentinelLabs post research on threat hunting for macOS adware infections, recent hacktivist campaigns, and analyses of BlackCat ransomware, and CVE-2021-45608 – a flaw in NetUSB affecting millions of routers.

February

The Russian invasion of Ukraine in February 2022 was an event that had, and continues to have, a global impact. It was widely expected that the Russian campaign would be swift and decisive, and accompanied by an equally destructive cyber warfare campaign. Those expectations turned out to be far from correct. While the resolve of the Ukrainians took both the Russians and many observers by surprise, the cyber campaigns associated with the war also had an unexpected dimension. In February, the first of these was a new destructive wiper that SentinelLabs dubbed Hermetic Wiper, a signed driver targeting Windows devices in Ukrainian organizations.

This month, SentinelLabs also exposed a decade-old state-sponsored adversary named ModifiedElephant targeting human rights activists, lawyers, academics and others involved in civilian dissent in India. The objective of ModifiedElephant is long-term surveillance that at times concludes with the delivery of ‘evidence’—files that incriminate the target in specific crimes—prior to conveniently coordinated arrests.

SentinelLabs also reported on an Iranian threat actor, TunnelVision, exploiting the Log4j2 and other vulnerabilities against Middle East and US targets.

March

As the war in Ukraine gathered pace, so did the cyber attacks: WhisperKill, WhisperGate, HermeticWiper, IsaacWiper, CaddyWiper, and DoubleZero were all reported on across the industry, but AcidRain saw a new development. An attempt to take out Ukrainian military command-and-control capabilities by hindering satellite connectivity spilled over to affect German infrastructure with remote monitoring and control of almost 6000 Enercon wind turbines disrupted by an attack on Viatsat modems.

It turns out it hasn’t only been the Russians targeting Ukraine, either. In March, SentinelLabs reported on a Chinese threat actor Scarab APT attempting to infect organizations in Ukraine with HeaderTip malware. Meanwhile, multiple critical severity flaws in Microsoft Azure’s Defender for IoT were disclosed by SentinelLabs that could allow unauthenticated attackers to remotely compromise devices.

April

In April, SentinelLabs’ focus turned to crimeware with research on LockBit 3.0 discovering that threat actors were sideloading Cobalt Strike beacons via a signed VMware xfer logs command line utility. We subsequently discovered this technique was connected with an affiliate Microsoft tracks as DEV-0401, a threat actor that had not previously been known to use LockBit.

SentinelLabs also published on Nokoyama ransomware in April, finding that it was clearly an evolution of Karma/Nemty rather than Hive, as suggested by some earlier analyses.

May

Supply-chain attacks via shared code repositiores were flavor of the month in May. SentinelLabs reported on CrateDepression this month, a supply-chain attack against the Rust development community. This followed an advisory from the Rust Security Response Working Group announcing the discovery of a malicious crate that targeted victims using GitLab Continuous Integration (CI) pipelines. Infected CI pipelines were served a second-stage payload we identified as Go binaries built on the red-teaming framework, Mythic. Both macOS and Linux payloads were available to the threat actors.

Also in May, threat actors targeted PyPI with a malicious Python package in a typosquatting campaign. We noted how the macOS payload used a similar obfuscation technique to OSX.Zuru in 2021 to drop a Cobalt Strike beacon on infected devices.

June

June 2022 saw SentinelLabs’ research turn to focus on Chinese-linked threat activity. Our research revealed a newly-discovered APT dubbed Aoqin Dragon that had been quietly spying on government, education, and telecommunication organizations in Southeast Asia and Australia for over a decade.

We found that the threat actor had a history of using document lures with pornographic themes to infect users and typically drops one of two backdoors: Mongall and a modified version of the open source Heyoka project.

July

In July, SentinelLabs research discovered that a Chinese state-sponsored cyber espionage group had set its sights on Russian targets in the midst of the Ukraine war.

We also explored how malicious Windows applications created as APPX and MISIX packages were being used by threat actors as an alternative infection vector to Office macros. LockBit 3.0 continued to be a significant threat for many enterpriss and we published new research on LockBit’s latest anti-analysis and evasion techniques.

August

Furthering our research on alternative vectors in light of Microsoft’s announced lockdown of Office Macros, SentinelLabs published on how Windows shortcuts, LNK files, were being abused by threat actors. This detailed research was based on an analysis of over 27,000 malicious LNK file samples.

We discovered that Windows Explorer was the top LOLBin (living off the land binary) in the chain of LOLBins that threat actors use to execute malware via LNK files.

September

September was the month of LABScon, and unsurprisingly saw some big reveals from the SentinelLabs research team. First up came Metador, a mysterious threat actor that SentinelLabs found had been targeting telecommunications, internet service providers, and universities in several countries in the Middle East and Africa.

We also published research on Void Balaur, a cyber mercenary group running hack-for-hire campaigns throughout 2022 on targets in the United States, Russia, Ukraine, and other countries. SentinelLabs also reported on JuiceLedger, a relativey new threat actor focused on infostealing through a .NET assembly called ‘JuiceStealer’, and its phishing campaign against PyPI contributors.

October

In October, our research returned to focusing on Chinese-linked APTs with research on a new threat cluster we track as WIP19.

WIP19 has been targeting telecommunications and IT service providers in the Middle East and Asia using a stolen digital certificate signed by a company called “DEEPSoft”. The activity was notable for the fact that almost all operations performed by the threat actor were conducted in a “hands-on keyboard” manner, with the attacker foregoing using C2 channels in exchange for increased stealth.

November

As the festive and holiday season started to approach, our focus turned once again to crimeware actors that typically ramp up their activities as the year rounds to a close. Our research into SocGholish noted how the actors had significantly diversified and expanded their infrastructure for staging malware with new servers, many of which were located in Europe, with the Netherlands, the United Kingdom, and France at the top of the list.

We also covered Black Basta ransomware and were the first to note links to its tools and cybercrime gang FIN7. For those who missed out on LABScon, we began a series of posts on some of the presentations that took to the main stage.

December

SentinelLabs was as busy at the end of the year as at the beginning. In December, we published research into crimeware group Vice Society, revealing how the group had pivoted to using a custome-branded ransomware variant we dubbed ‘PolyVice’.

We also dug deeper into Metador, exploring the anti-analysis techniques used in one of the actor’s backdoors, Mafalda. In collaboration with industry partners, we published on POORTRY and STONESTOP malware, used in active intrusions into telecommunication, BPO, MSSP, and financial services businesses.

SentinelOne was an early pioneer of the use of AI and machine learning in cybersecurity, but the technology hit public awareness in a big way with OpenAI’s release of ChatGPT 3. We found time to report on the wonders of this AI tool for the work of malware analysis and reverse engineering, and of course, we topped off the year by sharing more LABScon talks for the rest of the cybersecurity world to enjoy and learn from.

Conclusion

Throughout 2022, SentinelLabs has kept defenders informed and up-to-date on the latest developments across the crimeware ecosystem, adversaries, APTs, malware campaigns and critical vulnerabilities, and we’re not quite done yet: look out for a special LABScon talk that we’ll share before the New Year.

We’ll be back in 2023 with more security research, threat intelligence and vulnerability reporting. In the meantime, we wish all a happy, secure and peaceful New Year and 2023. Predictions for what 2023 in cybersecurity might look like from both SentinelLabs researchers and SentinelOne thought leaders can be found here.

This is Part 5, the concluding part of our multi-part XDR (eXtended Detection and Response) blog series.

If you haven’t read the earlier posts in this series yet, we recommend checking out the following:

• Part 1 discusses why organizations need to extend protection beyond the endpoint to stay ahead of adversaries
• Part 2 discusses why Endpoint Detection and Response (EDR) is a foundation and a cornerstone for any XDR strategy.
• Part 3discusses why identity security is a cornerstone of an XDR strategy
• Part 4 discusses the importance and value of security data for detection and investigation.

In this post we discuss the importance of why an XDR solution should be Open XDR.

The State of Security Operations Center

The only constant in security is change. New exploits are met with new defenses. The more we integrate technology into society, the more opportunities attackers have to hack for power or profit and so both sides keep innovating.

When attackers took to the supply chain and to lifting legitimate credentials from phishing and breaches, defenders moved further into vulnerability management, Zero Trust, and invented new Identity Threat Detection and Response (ITDR) tools. As attackers increasingly leverage crimeware  markets to grab off-the-shelf malware and lower the skill level needed to run an attack, defenders increasingly look to smarter tools and XDR Marketplaces to integrate tools and run automation that is a force multiplier for their team, turning disparate tools into connected defense networks sharing IOCs, risk levels, and coordinated response.

In Cybersecurity, Effectiveness Counts

Before we can talk about what good Open XDR systems do, we need to acknowledge why they’re here. Behind all of this are customer buying behaviors. Some of the world’s largest tech companies have long tried to convince customers that they can get all their security software from one vendor. The market evaluated that offer and decided the compromise in quality was too great and most have continued buying best in class tools from disparate vendors.

Convenience and cost drives some buyers to reduce the number of vendors but most have put security first and that is a good thing. We are all members of banks, we are all scanning our fingers and faces to get into our phones, and we’re all online, putting our data into databases almost. As consumers and members of societies that are under constant attack, we should be happy knowing that most organizations we buy from still choose better tools over streamlined buying and support or a deeply discounted EA package.

Throughout history we see that battles are a measure of numbers, training, and equipment quality. Armies don’t win by buying planes and ships from the same vendor to get a good deal. CISOs and SOC Managers know that they can’t afford as many personnel as they need and can’t find the people with the level of training and expertise that they need. There has been a skills shortage for years and it’s not getting better. Instead, CISOs and SOCs coming up on their EPP/EDR renewal are asking questions about automation and AI. Tooling has to make the difference.

Where Open XDR Diverges from Other Security Tools Like the SIEM and SOAR

Before XDR, data often lived in two places: in the SIEM and in the EDR database. EDR data is too voluminous to send to most SIEMs without selling the headquarters to pay for it, so the data stayed separated. This meant searching, rule writing, dashboarding, and reporting all had to be done in two places.

It’s important then to realize that any SIEM that hasn’t solved the data silo issue is still just a SIEM, not XDR. If the SIEM hasn’t extended to cover all critical parts of the stack, there’s no “X”. Most XDR vendors solve the data separation issue by bringing all data to the EDR database. At the same time, some XDR vendors have acquired indexless database companies, making log ingest cheaper than it was with SIEMs.

XDR also solves the SOAR problem. SOARs were too expensive and complex for most teams so market penetration was low. XDR had to solve this because automation is the backbone of XDR. Instead of a complicated solution that requires writing a large check every year and adding headcount to build and maintain the playbooks, XDR delivers turnkey automation as part of existing or slightly higher packaging. Where SOAR was expensive shelfware, XDR is automation for the masses.

Where Open XDR Comes In

Beyond the centralized data and automation is one common thread: X. If it doesn’t extend, it’s just Detection and Response. If it’s not all the data, it’s by definition only part of the picture.

This is where XDR buyers need to look more closely and understand, is this native or open XDR? It’s important to know that behind the scenes, some vendors don’t want connected ecosystems, Native XDR vendors are focused on their portfolio. Open XDR vendors are investing in integrations with vendors that customers indicate are important. SentinelOne’s Singularity XDR has native coverage across workstation, mobile, OT, cloud, and identity but every month rolls out new integrations with third parties or updates to existing integration with security partners, many in those same areas.

This benefits customers in several ways.

• Leverage Existing Investments: Open XDR helps maximize the value of your security investments. While a native XDR requires the vendor to supply all the required sensors for typical use cases, an Open XDR works with what’s in place today, with minimal disruption or change.
• Vendor agnostic: With Open XDR, companies are freed from being locked into specific solutions, letting SOCs customize their stack to the tools that are best for their industry and to evolve with it as new vendors innovate and disrupt. With Open XDR it’s even easy to integrate with multiple threat intelligence vendors, multiple firewalls, multiple clouds, or all of the above.
• Scalable Solution: Open XDR makes it straightforward to onboard new security tools and technology, as well as easily integrate and connect these tools with each other. For example, our multi-tenancy means you can install one identity integration for one part of your organization and a completely different integration for another part of your organization. Scopes make that easy. Our open IOC database means your intel can work together too. You can push in threat intel from anywhere you’d like and it’s combined into our database to use for enriching, alerting, mitigating, writing custom rules, or firing automations.

Conclusion

A successful defense cannot be won with sheer numbers, no security team has enough people for it. Even the teams with the best budgets, with the best firewalls and threat intel, are still searching for a centralized, automated, intelligent tool that’s going to continually make their teams the defenders of tomorrow. Can your threat intel trigger a detection that triggers a Slack notification? Can a high enough threat intel score trigger a true positive or kick a detection into remediation mode? Can those be enabled with a few clicks and no code? Last week OpenAI proved to the world that AI may be closer than we think. This week is a great time to ask whether your tools are built for tomorrow.

If you would like to learn more about SentinelOne Singularity XDR platform, contact us for more information or request a free demo. Also join and listen to the XDR webinar to learn more about best practices and building blocks for an enterprise looking to adopt XDR.

In just a few years, the world of cybersecurity has changed dramatically. New technologies and threats have emerged, old ones have fallen by the wayside, and the stakes have never been higher.

As we move into 2023, it’s important to take stock of the past year and learn from our mistakes. Here are some of the biggest cybersecurity mistakes of 2022 – and how to avoid them in the New Year.

With the increasing reliance on technology in our personal and professional lives, it is essential to have strong cybersecurity measures in place to safeguard against threats such as hackers, malware, and data breaches. Making mistakes in this area can have serious consequences, including losing sensitive information, financial damage, and damage to an organization’s reputation.

Besides implementing the right level of security (using AI), here are a few of the main mistakes we observed in 2022:

• Failing to update software and security patches
• Using weak and easily guessable passwords
• Neglecting to back up important data
• Falling for phishing scams
• Neglecting to train employees on cybersecurity best practices
• Relying on outdated security measures
• No Identity protection implemented
• No threat hunting and lack of regular monitoring for security breaches

Failing to Update Software and Security Patches

Not keeping software up to date can be risky as new security vulnerabilities are regularly identified and patched by software vendors. One example is vulnerabilities like those found in Microsoft products, designated with a CVE (Common Vulnerabilities and Exposure) label.

Zero-day vulnerabilities, where no patch yet exists from the vendor, can quickly become N-day vulnerabilities, meaning a patch has been issued but the organization has not yet applied it. N-days are potentially more dangerous than zero-days because the vulnerability’s existence is now public, and threat actors are quick to develop exploits and search for organizations who have yet to patch. The infamous WannaCry ransomware that wreaked havoc across the world was a N-day vulnerability in Microsoft’s SMBv1 server protocol, more popularly known as EternalBlue.

These kinds of scenarios provide even greater reason for organizations to keep their environment current and running the most recent versions of each product. Proactive maintenance can help protect data centers and networks against breaches and data loss.

Here’s a typical lifecycle of an attack utilizing a zero day to compromise devices:

1. A malware author discovers a vulnerability or new attack vector.
2. The capability is weaponized and proven to work
3. The zero-day is kept secret and utilized by cybercriminals.
4. Defenders discover the vulnerability.
5. The OS vendor or application vendor delivers a patch.
6. The zero-day becomes an N-day.

The challenge is that patching requires time. It starts with the disclosure of the vulnerable software, then there is the time it takes the vendor to create a fix, and lastly, the time it takes to deploy the fix.

Using Weak and Easily Guessable Passwords / Reusing Passwords for Multiple Accounts

Using weak and easily guessable passwords is a common mistake that can seriously affect cybersecurity. Passwords are the first line of defense against unauthorized access to an online account or device, so it is crucial to use strong and unique passwords that are difficult for others to guess or crack.

Weak passwords are short, use common words or phrases, or include easily guessable personal information such as a name or birthdate. These passwords can be easily cracked by attackers using automated tools, which can then be used to gain access to an account or device.

Using weak and easily guessable passwords puts sensitive information and the security of the account or device itself at risk. Using strong, unique passwords and avoiding using the same password for multiple accounts can help mitigate password compromises.

Maintaining a secure identity and account protection is critical for everyone in today’s connected world. Unfortunately, keeping track of multiple passwords is difficult, prompting many people to reuse the same or similar passwords on multiple accounts – a dangerous security practice that can easily lead to breaches. Organizations can take advantage of multifactor authentication (MFA) and two-factor authentication (2FA) options to help strengthen account security. Hardware security keys and biometric authentication are also recommended for extra security.

Neglecting to Back Up Important Data

Neglecting to back up necessary data is a mistake for cybersecurity because it can have severe consequences in the event of a cyber attack or other incident resulting in data loss. Backing up data regularly creates a copy of important files and information, which can be used to restore the original data if it is lost or corrupted. Without backups, recovering lost or damaged data may be impossible, leading to significant disruption, financial loss, or other negative consequences.

In addition to protecting against data loss, regularly backing up critical data can also help to restore data encrypted in ransomware attacks. Although this may not prevent attackers from attempting to extort victims with threats to leak stolen data, it can help businesses to restore essential services and minimize business disruption caused by such attacks.

Falling for Phishing Scams

In the second quarter of 2022, the Anti-Phishing Working Group (APWG) observed a record number of phishing attacks, with over 1 million instances. This marks the worst quarter for phishing that APWG has ever observed. There has also been an increase in the amount requested in wire transfer Business Email Compromise (BEC) attacks, and industries such as healthcare and transportation have seen an increase in ransomware attacks.

Threats on social media have also risen, with a 47% increase from Q1 to Q2 2022. Mobile phone-based fraud, such as smishing and vishing, has also increased. These trends highlight the ongoing and evolving nature of cybersecurity risks from phishing attacks.

Increasingly sophisticated phishing scams are an unfortunate reality of our digital world, posing a serious threat to personal and financial security. Fraudulent emails or websites appear legitimate but deceive victims into giving away sensitive information such as passwords, credit card numbers, and other details, which can be detrimental if malicious actors access them. Furthermore, these attacks often serve as entry points for malware distribution, which poses yet another risk to the victim’s device and data systems.

Neglecting to Train Employees On Cybersecurity Best Practices

Neglecting to train employees on cybersecurity best practices is a mistake because it leaves individuals within an organization vulnerable to cyber attacks. Humans are often considered the weakest link in an organization’s cybersecurity defenses, as cybercriminals can easily trick or manipulate them using phishing or social engineering tactics. If employees are not trained to recognize and prevent these attacks, they may unwittingly put the organization’s data and systems at risk.

Employees who need to be trained on cybersecurity best practices may need to learn how to handle sensitive data properly or maintain the security of the organization’s systems, which can further increase the organization’s vulnerability to cyber-attacks. Training employees on cybersecurity best practices is essential to an organization’s overall cybersecurity strategy.

Relying on Outdated Security Measures

The problem businesses faced with the old, legacy AV solutions revolved around the fact that they were based on detecting malware files through signatures – typically a hash of the file, but later through identifying tell-tale strings contained in the binary through search methodologies like YARA rules.

This approach proved to have several weaknesses. First, malware authors began to sidestep signature-based detection simply by padding files with extra bytes to change the malware’s hash or using different ways to encrypt strings that could not be easily read by binary scanning. Second, adversaries intent on stealing company data and IP, or inflicting damage through ransomware, were no longer just trying to write malicious, detectable files to a victim’s machine. Instead, bad actors’ tactics had evolved to include in-memory “fileless” attacks, exploiting built-in applications and processes (“living off the land”) and compromising networks by phishing users for credentials or stealing resources with cryptomining. Legacy AV solutions didn’t have the resources to deal with the new wave of tactics, techniques, and procedures.

As of today, there is still a significant amount of the market relying on these products. Security teams can compare legacy AV solutions with more modern technology like SentinelOne to help understand the implications of relying on older security technologies.

No Identity Protection Implemented

Having no identity protection implemented is a problem for cybersecurity because it leaves individuals and organizations vulnerable to identity theft and other types of cyber attacks.

As we’ve seen in the Cisco breach, it’s enough to compromise a user to gain access to the entire network. With social networks, multi-tasking, and the evolution of devices around us, it just makes sense for adversaries to keep investing in social engineering.

SentinelOne’s Singularity Identity platform solves this problem through:

• Identity Threat Detection and Response: The identity suite delivers holistic prevention, detection, and response. It protects in real time against credential theft, privilege escalation, lateral movement, data cloaking, identity exposure, and more, supporting conditional access and zero trust cybersecurity.
• Identity Attack Surface Management: Identity assessment tools provides instant Active Directory visibility of misconfigurations, suspicious password and account changes, credential exposures, unauthorized access, and more, enabling identity-focused attack surface reduction.
• Identity Cyber Deception: The network and cloud-based deception suite lures attackers into revealing themselves. Through misdirection of the attack with tactics including breadcrumbs and decoy accounts, files and IPs, organizations gain the advantage of time to detect, analyze, and stop attackers and insider threats without impacting enterprise assets.

No Threat Hunting and Lack of Regular Monitoring for Security Breaches

Not conducting threat hunting and failing to regularly monitor for security breaches is a problem for cybersecurity because it can lead to undetected or unmitigated threats and attacks.

Organization’s can implement a security strategy that involves looking for various tools and techniques to identify indicators of compromise (IOCs), such as unusual network traffic or suspicious user behavior, and investigating them to determine if they are a threat.

This is required because:

• No security measures are 100% effective, so it is important to have multiple layers of protection in place. By conducting threat hunting and regularly monitoring for security breaches, organizations can identify potential threats and attacks as soon as possible, allowing them to take action to prevent or minimize the damage.
• Threat hunting will enable organizations to proactively search for signs of potential security breaches or attacks within their systems and networks. This can help them to identify new indicators of compromise that their existing security measures may not detect. Organizations can improve their security posture by conducting threat hunting and better protect themselves against potential threats.

Conclusion

Are we losing the war against cybercrime? While it is true that there are constantly new threats emerging and that it can be difficult to stay ahead of these threats, it is important to remember there is much that enterprises can do to mitigate the risk, to cut off easy avenues of attack, and to harden the organization’s cybersecurity defenses.

As we look into 2023, solving the cybersecurity challenge will be a combination of deploying the right product and having the right people, processes and procedures in place to minimize the risk.

Don’t stay behind – upgrade your defenses with leading solutions from SentinelOne.