The Good

Prolific ransomware gang, DoppelPaymer (aka Grief), took a major hit this week as a number of their core members were arrested in Germany and Ukraine. In a joint operation conducted by Europol, the FBI, and the Dutch police force, two individuals have been taken into custody following multiple raids in both countries. IT experts and investigators are currently examining all seized electronic devices for forensic evidence and crypto tracing. In their statement, Europol stated that data from the resulting analysis is expected to trigger investigations in related cases.

Russian-linked DoppelPaymer has cost enterprises millions over the years. Operating as a Ransomware-as-a-Service (RaaS), they often leverage Emotet and Drydex malware variants to launch high profile, double extortion attacks focused on healthcare, government, and education sectors. In 2020, the gang crashed the operational systems of a hospital in Düsseldorf, causing critical delays in emergency treatments. The resulting death of one patient is often referred to as the first possible case of indirect casualty due to cyberattack. Past victims of the gang include SpaceX, NASA, Kia Motors, Compal, and Foxconn.

The DoppelPaymer sting operation is ongoing and authorities have issued arrest warrants for three more principal members who are still at large. Three suspects, Igor Olegovich Turashev, Irina Zemlyanikina, and Igor Garshin, are all wanted on charges including extortion, computer sabotage, spying, data encryption, and the administration of DoppelPaymer’s IT infrastructure, internal chats, and leak sites.

This operation is the latest in a global effort to crackdown on prominent ransomware syndicates. While collaboration between international authorities make impactful progress on dismantling cybercriminal networks, police urge organizations to continue reporting attacks immediately and implementing proactive measures against ever-rising ransomware attacks.

The Bad

IceFire ransomware operators have launched a new dedicated encryptor to actively target Linux systems. Reported this week by SentinelLabs, the ransomware gang recently targeted several media and entertainment enterprises across the world, encrypting their systems with the novel malware variant.

In this recent string of breaches, IceFire was observed exploiting a deserialization vulnerability tracked as CVE-2022-47986 (CVSS score 9.8) within IBM’s Aspera Faspex product (4.42 Patch Level 1) to deploy ransomware payloads. IceFire operators leveraged this flaw to execute arbitrary code on the infected system by sending a specially crafted obsolete API call. Upon execution, the IceFire ransomware works by encrypting files and adding the iFire extension to the name before deleting itself and removing the binary to wipe its own tracks.

SentinelLabs researchers explained that, in comparison to Windows, attackers have more difficulty deploying ransomware within Linux servers, especially at scale. To overcome this, attackers are increasingly turning to exploiting vulnerabilities within applications. Shodan, at the time of this publication, currently shows 158 Aspera Faspex servers exposed online mostly in the United States and China.

The shift from targeting Windows to Linux systems is a strategic one that is gaining traction across the greater cyberthreat landscape. Ransomware groups such as Cl0p, Hive, LockBit, HelloKitty, BlackMatter, RansomEXX, and AvosLocker have also made this move, seemingly to match global enterprises who have transitioned to Linux-powered virtual machines in the past few years. Researchers at SentinelLabs note that the recent evolution for IceFire is a clear indication that this trend will continue to grow in popularity throughout the rest of 2023.

The Ugly

A security advisory published by Fortinet this week disclosed a critical buffer underflow vulnerability impacting the company’s FortiOS and FortiProxy products. Tracked as CVE-2023-25610 (CVSS score 9.3), the vulnerability allows an unauthenticated attacker to execute arbitrary code or launch a denial of service (DoS) attack on the GUI of vulnerable devices.

Attention! Fortinet has released security patches for 15 new flaws, including a critical #vulnerability (CVE-2023-25610) affecting FortiOS and FortiProxy that could allow attackers to take control of affected systems.

Details: https://t.co/HqSHkSNKpS#infosec #cybersecurity

— Swati Khandelwal (@Swati_THN) March 9, 2023

This type of vulnerability is the result of programs trying to read more data from a memory buffer than what is available. In this scenario, the program must access adjacent memory locations that may lead to crashes and data loss. Buffer underflow vulnerabilities are most often leveraged by attackers for remote code execution (RCE) and DoS attacks. Fortinet strongly urges its users to deploy the security updates immediately. As a temporary workaround, users may also choose to disable access to the HTTP/HTTPS administrative interface or limit the IP addresses that have access to the interface.

Though Fortinet notes that it is not aware of any instance of exploitation of CVE-2023-25610 in the wild, this flaw closely follows on the heels of two other critical RCE flaws that impacted the company’s FortiNAC and FortiWeb products. Just four days after fixes were published for the pair of RCE flaws, a working proof-of-concept was made public resulting in immediate exploitation in the wild. Security teams are reminded that opportunistic attackers continuously sweep for vulnerabilities that allow them to gain initial access with as little work as possible. Critical-level vulnerabilities, particularly those that do not require authentication, are highly attractive to attackers and should be patched as a priority.

Today is International Women’s Day and the theme for this year is #EmbraceEquity. Even with our progress in gender equality, women are still grossly underrepresented in the workplace – only 1 in 4 C-suite executives is a woman, and only 1 in 20 is a woman of color.

In the tech industry, the story is similar. Roughly 25% of all tech workers are women and the imbalance dips to 16% female representation in software engineering. As we work to close the gap, women’s representation in tech new hires has increased slightly to 31%.

The recent spate of tech layoffs is not helping progress. Women account for 46% of those let go; a statistic that exponentially shrinks an already underrepresented group. Transformative change will take mass action from all and call for a seismic shift in the way we #EmbraceEquity in the workplace.

I am encouraged that many leaders are coming forward to find a path where they foster diverse workplaces without compromising on the quality of talent or impact. They realize that a more diverse, equitable and inclusive company is a more successful one. Women bring amazing talents, skill sets, experiences, and perspectives that are critical to success.

Here are five ways to #EmbraceEquity in the workplace and close the gender gap to ensure women have the same access to successful, fulfilling careers in tech and have game-changing impact on their workplaces and communities.

1. Shine the Spotlight | Diversify Your Talent Pipeline

More often than not, most leaders today want to take action, but first we need to sincerely address the common refrain of “we just don’t have diverse talent in our pipeline!”

This needs attention at all levels. A strong university recruiting and internship program can have a big impact in diversifying your pipeline, so invest in that. These can and will be your leaders for tomorrow and dramatically influence your talent mix so prioritize these programs in your operating plans. Growing your own talent will always be more effective on impact and your operating margin than poaching from your competition.

Next, closing the gender gap starts with fair and equitable hiring practices and tracking for action against those. Having qualified female representation both in the candidate slate and interview panel is paramount with more than one qualified woman candidate advancing to the final interview round. It’s also critical to have pipeline reporting where applicable by law to know just how many women are being considered – you can’t grow what you don’t know!

Most importantly, creating a culture where all voices are heard is central to have people from all genders, representations and backgrounds succeed. Succession planning, internal promotions, and a commitment to career pathing are important pathways to growing and retaining top talent on your bench. If you don’t create opportunities for your high-performing females one thing is for certain – your competitors will.

2. Amplify the Power of Community

The power of community invigorates and blazes trails for many across your organization to succeed. Create several platforms for women and their allies to connect with each other to share their journeys and stories and learn from mentorship opportunities. Employee-led women’s networks can foster an inclusive workplace and are critical catalysts for positive change, giving people a great way to network, learn, and celebrate what makes us different and unique. Leadership advocacy is crucial to success within a women’s network and for ensuring that the issues that matter most to gender equity are heard at the highest levels.

Look for established experts in the space to connect and collaborate with such as Women in Cybersecurity, Girls Who Code, and AnitaB.org. Sponsoring women of all levels to get engaged with non-profit advocacy groups is a great way to encourage networking while casting a wide net for new female talent.

3. Drive Accountability with Insights & Data

‘Diversity and Inclusion’ is not an initiative; it’s a way of operating. Just as we measure operational efficiency, sales success, and profit margin, if you want to truly #EmbraceEquity, you have to set reasonable goals, create meaningful KPIs, and consistently monitor progress. Statistics like overall gender percentages, percentage of female promotions, diversity mix of both internal and external talent pipelines and percentage of women in leadership positions are key metrics to measure improvement.

Just as important as measuring progress is halting any actions that could stop it. Swift action must be taken on any discriminatory behavior in the workplace.

4. Foster Equity Through Learning

A learning culture is a more equitable one. To fully #EmbraceEquity, there must be a defined DEI learning journey for all employees at all levels. It starts with leadership training and coaching and includes other key concepts like unconscious bias, microaggressions, sexual harassment, and bystander intervention.

Taking the time to listen and learn from the experiences of others might be the most insightful learning of all. Creating authentic mentoring relationships for women can increase confidence and accelerate development. Best part of the equation? Both sides of the relationship are better for the experience!

5. Make Space to Hear All Voices

When women feel they are being heard and that their voice matters, they use it more. Helping others find their voice can be as simple as asking for an opinion in a meeting or inviting someone to collaborate on a project. Seeking the power of female voices will not only improve your process, it will improve your product.

Inviting women of all levels and functions to make an impact is a win-win on all sides of the equation. You are instilling confidence, unlocking productivity, and building your leadership bench. Making a commitment to #EmbraceEquity is not just something we are doing to improve the workplace – it’s a call to action to improve the world!

About the Author

Divya Ghatak is a top tech talent executive with over 20 years of global experience. As the Chief People Officer at SentinelOne, Divya is a transformative leader who drives a people-first experience and fosters a values-driven culture. Her true passion is equity in the workplace and continuing to close the gender gap in tech for the next generation, including her lovely daughter, Ananya.

SentinelOne has been observing phishing campaigns that distribute the Remcos RAT using the DBatLoader malware loader to target predominantly Eastern European institutions and businesses. In this blog post, we summarize our observations on these campaigns to equip defenders with the information they need to protect against this threat.

DBatLoader is characterized by the abuse of public Cloud infrastructure to host its malware staging component. The feature-rich RAT Remcos is actively used by threat actors with cybercriminal and espionage motivations. Threat actors typically distribute the RAT through phishing emails and stage it on systems using a variety of forms and methods.

Examples include the use of the TrickGate loader stored in archive files, malicious ISO images, and URLs to VBScript scripts embedded in pictures. Further, the Ukrainian CERT has recently issued reports on Remcos RAT phishing campaigns targeting Ukrainian state institutions for espionage purposes using password-protected archives as email attachments.

This report compliments the available information about recent phishing campaigns that distribute Remcos by highlighting the way in which DBatLoader stages the RAT on infected systems.

DBatLoader and Remcos Phishing Emails

The phishing emails distributing DBatLoader and Remcos have attachments in the form of tar.lz archives that typically masquerade as financial documents, such as invoices or tender documentation. To make the emails look credible, we observed the threat actors using a variety of techniques.

From the recipient’s perspective, the phishing emails originate from institutions or business organizations related to the target such that sending an invoice would be realistic. The emails are typically sent to the sales departments of the targets or their main contact email addresses as disclosed online.

We observed emails sent from what seems to be compromised private email accounts and accounts from public email services that are also used by the targets and the legitimate institutions or organizations which are supposedly sending the email.

Many of the phishing emails we observed have been sent from email accounts with top-level domains of the same country as where the target is based. These emails typically do not contain any text accompanying the malicious attachment or contain text written in the language of the target’s country. In the cases where the threat actors are not masquerading the phishing emails as originating from an institution or business organization local to the target, the emails contain text written in English.

DBatLoader Staging Remcos RAT

The tar.lz archives attached to phishing emails contain DBatLoader executables. These pack Remcos and usually masquerade as Microsoft Office, LibreOffice, or PDF documents using double extensions and/or application icons.

When a user decompresses the attachment and runs the executable within, DBatLoader downloads and executes an obfuscated second-stage payload data from a public Cloud location. We observed download links to Microsoft OneDrive and Google Drive sites (under the drive.google.com and onedrive.live.com domains) with varying lifetime spans, the longest of which was more than one month.

The Cloud file storage locations that were active while we investigated contained only the second-stage DBatLoader payload data and were registered to individuals. We have no knowledge at this point whether the threat actors have been using self-registered and/or compromised Microsoft OneDrive and Google Drive credentials to host DBatLoader payload.

The malware then creates and executes an initial Windows batch script in the %Public%Libraries directory. This script abuses a known method for bypassing Windows User Account Control that involves the creation of mock trusted directories, such as %SystemRoot%System32, by using trailing spaces. This enables the attackers to conduct elevated activities without alerting users.

The script creates the mock %SystemRoot%System32 trusted directory by issuing requests directly to the file system – note the prepended ? to the directory names. It then copies into this directory a KDECO.bat batch script, the legitimate easinvoker.exe (Exchange ActiveSync Invoker) executable, and a malicious netutils.dll DLL file, which DBatLoader had previously dropped in the %Public%Libraries directory. The script then executes the easinvoker.exe copy and deletes the mock directory.

When it comes to the netutils.dll DLL, easinvoker.exe is susceptible to DLL hijacking enabling the execution of the malicious netutils.dll in its context. easinvoker.exe is an auto-elevated executable, meaning that Windows automatically elevates this process without issuing an UAC prompt if located in a trusted directory – the mock %SystemRoot%System32 directory ensures this criteria is fulfilled.

easinvoker.exe loads the malicious netutils.dll, which executes the KDECO.bat script.

As an anti-detection measure, KDECO.bat adds the C:Users directory to the Microsoft Defender exclusion list to exclude the directory from scanning.

powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:Users'"

DBatLoader establishes persistence across system reboots by copying itself in the %Public%Libraries directory and creating an autorun registry key under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun. This key points to an Internet Shortcut file that executes the DBatLoader executable in %Public%Libraries, which in turn executes Remcos through process injection.

We observed a wide variety of Remcos configurations, most of which configured keylogging and screenshot theft capabilities as well as duckdns dynamic DNS domains for C2 purposes.

Recommendations for Users and Administrators

To reduce risk, users should remain alert against phishing attacks and avoid opening attachments from unknown sources. It is important to note that DBatLoader and Remcos are often disguised as financial documents, emphasizing caution when handling such files.

For administrators:

• Stay vigilant against malicious network requests to public Cloud instances. The use of public Cloud infrastructure for hosting malware is an attempt to make network traffic for malware delivery look legitimate, making detection harder for defenders. This tactic is popular amongst cyber criminals and espionage threat actors, a recent example being the WIP 26 espionage activity reported by SentinelLabs and QGroup GmbH.
• Monitor for suspicious file creation activities in the %Public%Library directory and process execution activities that involve filesystem paths with trailing spaces, especially Windows . The latter is a reliable indicator of malware attempting to bypass Windows UAC by abusing mock trusted directories, such as %SystemRoot%System32.
• Consider configuring Windows UAC to Always notify, which will always alert users when a program attempts to make changes to your computers.

Conclusion

The Remcos RAT, which is distributed through phishing campaigns utilizing the DBatLoader malware loader, poses a significant threat to Eastern European organizations and enterprises. Remcos is known for its use in cybercriminal and espionage campaigns. Threat actors have used various methods, such as the TrickGate loader, malicious ISO images, and URLs embedded in pictures, to plant the RAT on systems. DBatLoader leverages public Cloud infrastructure to host its malware staging component. To protect against these attacks, administrators must remain attentive against phishing attempts, educate users to avoid opening attachments from unknown senders, and deploy advanced security measures such as XDR. Implementing XDR can provide comprehensive visibility across endpoints, cloud workloads, and network infrastructure, allowing organizations to detect and respond to threats quickly and effectively. By adopting these measures, institutions and businesses can lower their risk of falling victim to these attacks and safeguard their sensitive data.

SentinelOne is a Leader in the 2022 Gartner Magic Quadrant for Endpoint Protection Platforms (EPP) and Ranks Highest Across All Gartner Critical Capabilities Use Cases

The results are in: SentinelOne has once again been recognized as a Leader in Magic Quadrant for Endpoint Protection Platforms and ranks highest across all Gartner Critical Capabilities Use Cases. We believe our strong results and upward trajectory in Gartner’s newly released report reflects SentinelOne’s commitment to providing a best-in-class security platform, user experience, and value to organizations of every size, maturity, and industry. SentinelOne is helping organizations to protect their enterprise endpoints from attacks and breaches.

The Gartner Magic Quadrant evaluates vendors based on their Ability to Execute their Completeness of Vision. While the Critical Capabilities report evaluates vendors based on specific capabilities that Gartner believes are important for the market. We look forward to sharing results from the report and a more in-depth analysis of what our performance means for our customers in the coming days. Today, we’d like to reflect on what this recognition tells organizations about SentinelOne.

1. Customer Value Drives Our Mission

In our hyper-connected world, operating safely and effectively has become a top priority for all organizations. Security leaders face unique challenges on the digital battleground, having to contend with regulatory requirements and put up the right defenses to stay steps ahead in an ever-evolving threat landscape. To support our customers, SentinelOne’s offerings encompass all core surfaces of a digital enterprise, including endpoint, cloud, and identity, to deliver operational value and the highest level of protection.

Endpoints reside at the heart of all organizations today. As organizations continue to scale up, many work environments increasingly put the onus on the integrity of the endpoint itself. SentinelOne’s XDR platform eliminates the risk at the endpoint level by providing superior visibility and enterprise-grade prevention, detection, and response.

Identity-based attacks continue to rise with threat actors weaponizing legitimate tools and software known to and used by their victims as their lure. Exploiting human behaviors and user trust, attackers are casting a wider net through sophisticated spoof websites and elaborate phishing campaigns. SentinelOne’s Singularity Identity deflects identity-based attacks by detecting in-progress attacks and obstructing the actor’s progress before they can escalate privileges.

Cloud services boost organizational collaboration, scalability, and efficiency. However, cloud environments require businesses to secure virtual machines, containers, serverless workloads, and Kubernetes – all of which could be leveraged by opportunistic attackers. To combat common cloud-based threats including misconfigurations, insider threats, and supply chain attacks, SentinelOne’s Singularity for Cloud prevents, detects, and investigates threats in real-time without interruption to cloud workloads.

Our mission is to be a force of good and ultimately enable our customers to achieve organizational cyber resilience by reducing risks and increasing security teams efficiency. To accomplish that goal, SentinelOne leverages AI-powered technology to deliver machine speed cybersecurity across our customers’ entire infrastructure. We combine best-in-class prevention and detection and response capabilities in a single platform to defend faster, at greater scale, and with higher accuracy across all attack surfaces. SentinelOne proactively creates value for our customers, focusing on improving the return on investment by providing powerful solutions for every step of the threat lifecycle.

2. SentinelOne Innovates Beyond The Endpoint

SentinelOne has evolved significantly in the past decade, and our performance in the Gartner reports released today reflects that.

In recent years, the exponential increase in machine and user identities have accelerated threat actors’ attention on the identity surface. Security leaders protecting their identity surface from compromise are now looking beyond traditional identity management frameworks like Identity Access Management (IAM) and Privileged Access Management (PAM). While conventional tools and frameworks focus on giving users the access they need at the endpoint level, Identity Threat Detection Response (ITDR) platforms secure the infrastructure that houses vulnerable identities and assess security gaps from an identity-standpoint. SentinelOne provides the critical visibility needed to prevent common identity-based attacks from taking root in the first place.

With the acquisition of Scalyr in 2021, SentinelOne introduced its Security Data Lake which powers today all Singularity platform customers and offers security data ingestion at scale. Furthermore, with the acquisition of Attivo Networks in 2022, SentinelOne expanded its Extended Detection Response (XDR) platform even further and provides today best-in-class security across endpoint, cloud workloads, and identity. SentinelOne customers can rely on threat analysis and mitigation beyond the endpoint and across the entire enterprise and cloud attack surface.

3. A Unified Platform Enabling Customer Leadership

In addition to SentinelOne’s repeat recognition as a Leader in the Gartner Magic Quadrant for Enterprise Protection Platforms, we also received on Gartner Peer Insights  a 4.8 rating as of 1st March 2023 and a 96% recommendation in the Enterprise Protection Platform and Endpoint Detection and Response categories.

SentinelOne has also achieved a leading performance in MITRE Engenuity Enterprise ATT&CK Evaluations three years running, as well as results in the top of the pack for MITRE’s Deception and Managed Security Services ATT&CK Evaluations.

With threat adversaries moving faster than ever before, our customers rely on SentinelOne to empower them with autonomous, real-time action, richer data, and smarter workflows. Our platform uses the power of static and behavioral AI so customers can confidently build up a stronger, long-term security posture. Our unified Singularity XDR platform is the only cybersecurity platform designed with security analysts in mind, allowing modern enterprises to confidently take action against cyber threats and safeguard their entire attack surface.

SentinelOne’s Commitment To Our Customers

Our performance excellence along with our laser focus on customer outcomes is why 97% of our customers stay with us and invest in growing their cybersecurity programs with us. We are seeing more and more customers who come to us for Endpoint protection evolve their strategies with the adoption of our Cloud, Identity, Attack Surface Management, Security Data Analytics, MDR, and Incident Response modules.

Join us Wednesday, March 8th, 2023, at 8:00 AM PST / 11 AM EST for a webinar to learn more about this milestone. You will also hear from our customers about why they chose SentinelOne and how they leveraged the Gartner Magic Quadrant and MITRE ATT&CK Evaluations to identify SentinelOne as their trusted cybersecurity technology partner.