The Good | DigiHeals Aims to Boost Resilience of Healthcare Sector to Fight Off Cyber Attacks

The healthcare sector has borne a particularly tough brunt of attacks over the last few years as ransomware-wielding cybercriminals have sought easy-pickings from often-under-resourced public services. Good news this week, then, as the Biden-Harris administration’s ARPA-H project has launched a digital health security initiative to help ensure patients continue to receive care in the wake of a medical facility cyberattack.

The initiative, dubbed DigiHeals, aims to encourage proposals for proven technologies developed for national security and apply them to civilian health systems, clinical care facilities, and personal health devices.

The aim is to focus on cutting-edge security protocols, vulnerability detection, and automatic patching in order to limit the ability for threat actors to attack digital health software, with the ultimate objective being to ensure continuity of care for patients in the wake of a cyberattack on a medical facility.

Aside from a lack of cybersecurity resources, healthcare services present unique problems for digital defense, as medical facility networks are typically made up of a vast patchwork of disparate devices, systems, and services. The DigiHeals project hopes to encourage submissions from researchers, both amateur and professional, from a wide range of fields and expertise. Accepted proposals related to vulnerability detection, software hardening, and system patching, as well as the expansion or development of security protocols, will receive funding and further support from the project.

The Bad | Actively Exploited Citrix Vulnerabilities May Pose Threat Evan After Patching

Bad news for Citrix users this week as CISA are warning that cyber adversaries are making widespread use of two n-day vulnerabilities, CVE-2023-24489 and CVE-2023-3519. Neither are new, but in-the-wild exploitations are on the rise, with some admins having patched their systems but failing to check whether they had already been breached.

CVE-2023-3519 is a vulnerability in Citrix’s networking product NetScalers, first disclosed last month. Researchers say that almost 70% of patched NetScalers still contain a backdoor, indicating that admins applied the patch after the bug had been successfully exploited and did not check or discover the compromise.

Over 1,900+ Citrix NetScaler instances breached in a massive attack exploiting critical #vulnerability.

Hackers used automated methods to install web shells, gaining unauthorized access even after patches.

Details: https://t.co/DowI4QRzhR#cybersecurity #infosec #hacking

— The Hacker News (@TheHackersNews) August 16, 2023

According to the researchers, it appears an adversary exploited the bug in an automated fashion in mid-July, dropping webshells on vulnerable systems. The webshells allow for the execution of arbitrary commands, even if the NetScaler is subsequently patched or rebooted.

Equally concerning, CVE-2023-24489 is a bug with a CVSS score of 9.1 out of 10 affecting the Citrix Content Collaboration tool ShareFile. Exploitation allows an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.

CISA advised on Wednesday that the bug was being actively exploited. Researchers at GreyNoise reported a steep spike in attacker activity around CVE-2023-24489 after the advisory went public, indicating that attackers are racing against time to exploit vulnerable instances before security teams plug the gap.

Researchers believe there are anywhere between 1000-6000 vulnerable instances that are accessible from the public internet.

In both cases, admins are urged both to patch without delay and to investigate whether a compromise may have already occurred.

The Ugly | Free Cloud Storage Services Abused By Threat Actors Phishing for Microsoft Credentials

Cloud security is in the spotlight again this week as cloud storage service Cloudflare R2 has reportedly seen a 61-fold increase in hosted phishing pages in the last six months. R2, which offers a similar service to Azure blob and AWS S3, is being used for campaigns that primarily phish for Microsoft login credentials, although Adobe, Dropbox and other cloud apps’ login pages have also been targeted.

The massive increase may relate to the fact that R2, a relatively new entrant in the field of cloud storage, offers some free services to attract customers that threat actors have found useful to abuse. First, fake login pages are hosted on a free subdomain that can be reused without limit. The domains all have the pattern:

https://pub-.r2.dev

Second, Cloudflare offers a free CAPTCHA service called Turnstile to help legitimate websites reduce spam. The threat actors have deployed Turnstile to prevent URL scanners and internet analyzers from examining the phishing pages’ content and marking them as dangerous. The use of the CAPTCHA has the added bonus of making the site seem more legitimate to unsuspecting users.

In addition, victims are redirected to the phishing pages from other malicious websites, and the former only serve up the fake login pages if the referring sites are recognized as the source. Researchers say that referring web pages include a timestamp after a hash (#) symbol in the URL. If the URL parameter is missing, the visitor is instead redirected to Google’s home page, helping to ensure only intended victims can see the phishing content.

The news comes as the same researchers report that the number of cloud apps being abused to deliver malware has increased to 167, with Microsoft OneDrive, Squarespace, GitHub, SharePoint, and Weebly topping the list. Amazon AWS login pages were also recently targeted in a cloud phishing campaign using Google ads, underlying the efforts attackers are now making to capitalize on the rise of cloud services in the enterprise.

The rise of nation-state cyber attacks has become a defining feature of modern geopolitics. With blurred lines between advanced persistent threats (APTs) and cybercrime, understanding this complex landscape has become a critical element in building a strong cybersecurity strategy. According to recent reports on the rise of state-sponsored cyber attacks, nation-state actors targeting critical infrastructures have doubled from 20% to 40% in the past two years alone. As for the costs? Organizations are estimating a total of $1.6 million per cyber incident.

Not only is the frequency and financial consequences of such attacks accelerating, the threat landscape in which these nation-state actors now operate is also shifting. Cyber warfare and the use of cyberweapons in the ongoing Russo-Ukrainian war, for example, have magnified the intersection of conflict across geopolitical and digital surfaces.

The challenge is that nation-state threat actors are well-funded and possess specialized skills, focusing their attacks on high-value targets including government and military entities, think tanks, universities, and those providing critical infrastructure services.

This post explores how nation-state sponsored attacks have evolved over recent years to become a threat not just to individual targets but to all organizations, as well as to the civil, economic and political fabric of our society. Sharing our collective knowledge on how such groups operate and the impacts they have can help the cyber defense community better understand and mitigate these sophisticated threats.

A Shadowy Threat | A Brief History of Cyber Espionage & Nation-State Attacks

Cyber espionage, a stealthy practice dating back to the very beginnings of internet connectivity, has undergone substantial changes in recent years, fueled by rapid advancements in technology and evolving global dynamics.

The origins of cyber espionage trace back to the 1980s when the French intelligence agency, led by the “Farewell Dossier”, exploited a KGB officer’s computer to gather critical information on Soviet activities. At the same time, a German hacker group known as the Chaos Computer Club exposed vulnerabilities in government and military systems. These incidents marked the inception of digital espionage and highlighted the potential of exploiting interconnected networks to gather intelligence. These early instances foreshadowed the evolution of cyber espionage into a formidable global concern in the decades that followed.

Cyber espionage has since evolved into a potent tool for nation-state threat actors and a critical security issue for organizations, with implications sounding across political, economic, and societal domains.

Subsequently, state-sponsored hacking campaigns, corporate espionage, and intellectual property (IP) theft have become rampant, with the potential to disrupt critical service industries and compromise national security. The interconnected nature of the modern world amplifies this impact as a breach in one corner of the globe can trigger far-reaching consequences.

As nations, corporations, and civilians have become increasingly reliant on digital infrastructure, the stakes have escalated, making targeted, state-sponsored cyber attacks a top-tier and global security concern. To safeguard against this escalating threat, international cooperation, robust cybersecurity measures, and innovative defense strategies are crucial in this new era of digital spycraft.

The Big Players | Navigating The Complex Landscape of APTs

By some estimates, there could be over a hundred different APT groups worldwide, but when we look at where most activity that threatens our interests originates from, there are four major nation-states that have been in the game longer than the rest.

Between them, China, Russia, North Korea and Iran have developed some of the most sophisticated and comprehensive threat activity and cyber tradecraft that businesses in all sectors have to face today.

China

China’s cyber threat is not only broad and persistent but also evolving. The Office of the Director of National Intelligence’s 2023 Annual Threat Assessment paints a clear picture of the cyber threat posed by the People’s Republic of China (PRC), noting that:

The annual report contains a stark warning.

Emerging in the early 2000s, Chinese-based threat groups rapidly matured in terms of tactics, techniques, and targets. The infamous Titan Rain campaign of the mid-2000s marked a watershed moment, exposing China’s cyber capabilities as it targeted U.S. defense and technology sectors. This trend continued with APT1, linked to the Chinese military, launching widespread attacks on various industries.

As time progressed, the Chinese cyber espionage ecosystem diversified. From 2006 to the present day, APT10 (aka Red Apollo/Stone Panda) has been reported targeting a wide-range of companies across multiple continents, including healthcare, defense, aerospace and government sectors. APT17 (DeputyDog) is a threat group sponsored by the Jinan bureau of the Chinese Ministry of State Security. First seen in 2009, it was attributed for the Operation Aurora and CCleaner supply chain attacks in 2017. APT41 (aka Winnti Group) was first seen in 2012 and combines financially-motivated cybercrime with information theft and espionage.

In general, Chinese APT groups have been known to use tactics like living-off-the-land (LOTL), where they abuse native tools like PowerShell and WMI to evade detection, and to develop comprehensive programs for vulnerability research and exploitation.

Most recently, Chinese threat groups are known to be disguising traffic to malicious servers through botnets of compromised IoT devices and to use DNS, HTTP and TCP/IP hijacking. Security researchers have found that Chinese threat groups tend to focus on security, networking and virtualization tools to obtain and maintain stealthy access to targeted organizations’ internal networks.

PRC sponsored cyber actors have exploited telecommunications and other network service providers to expand targeting worldwide. Our latest report with @CISAgov and @FBI outlines continued general trends and specific TTPs used in this targeting. https://t.co/jU2XcYP2x2 pic.twitter.com/r4JNC1XXaH

— NSA Cyber (@NSACyber) June 7, 2022

Some notable recent case studies of Chinese-based APT groups and campaigns include:

• Aoqin Dragon – Operating since 2013, Aoqin Dragon targets government, education, and telecommunication organizations in Southeast Asia and Australia. Their tactics include document exploits and fake removable devices. They seek initial access through document exploits and use techniques like DLL hijacking and DNS tunneling to evade detection.
• WIP19 Espionage – This Chinese-speaking threat group has been targeting telecommunications and IT service providers in the Middle East and Asia, using stolen certificates to sign novel malware such as SQLMaggie and ScreenCap.
• Operation Tainted Love – An evolution of tooling associated with Operation Soft Cell, Chinese cyber espionage groups attacked telecommunication providers in the Middle East using well-maintained, versioned credential theft capability and a new dropper mechanism.

Russia

In the late 2000s, the notorious APT28 (Sofacy) and APT29 (NobleBaron, The Dukes) threat groups gained notoriety for their state-sponsored activities such as targeting government agencies, think tanks, and critical infrastructures worldwide. These groups have since been implicated in high-profile incidents, including mass supply chain attacks and interference in U.S. presidential elections. The U.S. government has noted that such activity is an extension of Russia’s larger geopolitical goals.

The Russian APT landscape evolved with groups like Turla, whose history of activity has been suggested to span almost 30 years, beginning with Moonlight Maze in 1996. Later, APT28 (linked to Russia’s GRU military intelligence unit) and APT29 (now understood to be operated under the auspices of Russia’s Foreign Intelligence Service, SVR) continued their activities, adapting their tactics and diversifying their targets to encompass sectors beyond politics. APT groups like Gamaredon and Sandworm have also emerged, exhibiting a blend of cyber espionage and disruptive operations.

As geopolitical tensions continue to heighten, Russian APT groups have become increasingly adept at utilizing supply chain attacks, zero-day exploits, and deception techniques. They have also exploited global events, such as the COVID-19 pandemic, to launch tailored and themed attacks.

Presently, Russian-based APT groups continue to engage in a broad spectrum of cyber operations, spanning espionage, disinformation, and potential sabotage. Russia’s focus on targeting critical infrastructure, including underwater cables and industrial control systems, has been noted in intelligence assessments.

Some notable case studies of Russian APT groups and campaigns include:

• HermeticWiper Malware – This destructive malware was used against Ukrainian organizations, manipulating the MBR to cause boot failure. This attack reflects Russia’s willingness to deploy destructive tools against neighboring countries.
• APT28 (Sofacy) – Known for its espionage and influence capabilities, APT28 has been particularly focused on targeting critical infrastructure, including underwater cables and industrial control systems in the U.S. and allied countries through the use of malware like X-Agent.
• APT29 (Nobelium/NobleBaron) – Involved in the 2014 White House attack, this group has targeted various government, military, energy, and media organizations, using tools like CozyDuke. In 2021, the group was attributed with being behind the Solarwinds supply chain attack.
• Snake Implant – A sophisticated cyber espionage tool created and deployed by Russia’s Federal Security Service, FSB. Found in over 50 countries including the U.S., Snake malware is used to collect sensitive intelligence from high priority targets.

North Korea

North Korea’s cyber program poses a sophisticated threat, adapting to global trends in cybercrime as a whole. Their journey began in the early 2000s with the Lazarus group,  which has operated since 2009 and is responsible for some of the most notorious cyberattacks in history, including the 2014 hack on Sony Pictures and the 2017 outbreak of WannaCry. They added stealing cryptocurrency to their bow in 2017. At the end of 2019, SentinelLabs connected the Lazarus and TrickBot groups, showing how the DPRK was extending to collaborate with cybercrime groups and take over funds to support their government.

Lazarus and its subgroups like BlueNoroff, APT38 and Andariel (Silent Chollima), continue to evolve, demonstrating a growing sophistication in their tactics and techniques. They have expanded their target scope beyond high-profile attacks to include financial institutions, cryptocurrency exchanges, and global infrastructure. BlueNoroff, in particular, has become notorious for conducting large-scale heists to fund the regime’s activities, with attacks on ATMs and banks using the SWIFT messaging system.

In recent years, North Korean APT groups have further diversified, with increasing focus on supply chain attacks, cryptocurrency theft, and the exploitation of zero-day vulnerabilities. The evolution of North Korean APTs highlights their adaptability and the intertwining of cyber operations with broader geopolitical strategies.

Other North Korean subgroups include ScarCruft (aka Inky Squid, APT37, or Group123) and Kimsuky.  Some notable case studies of North Korean-based APT groups and campaigns include:

• ScarCruft & Lazarus Group – SentinelLabs identified a North Korean intrusion into a Russian missile engineering organization, NPO Mashinostroyeniya. This case involved two instances of compromise, including the use of a Windows backdoor dubbed OpenCarrot.
• Kimsuky’s Reconnaissance Capabilities – Utilizing a new malware component called ReconShark, North Korean APT Kimsuky has targeted organizations across Asia, North America, and Europe.
• JumpCloud Intrusion – This intrusion into the cloud-based IT management service JumpCloud is linked to North Korean APT activity, showcasing the DPRK’s focus on supply chain targeting.

Iran

Iran-based APT groups have steadily gained prominence in the realm of cyber espionage. Their beginnings date back to the late 2000s, when groups like APT33 (Elfin) and APT34 (OilRig) first emerged onto the scene. These early campaigns were characterized by targeting foreign governments, critical infrastructure, and regional rivals such as the Shamoon wiper attacks of 2012 conducted against Saudi Aramco and Rasgas.

As the years progressed, Iranian APT groups increased in sophistication and breadth. APT34, for instance, diversified its focus to include industrial espionage, particularly targeting sectors like energy and telecommunications. The group’s activities revealed Iran’s intent to bolster its domestic industries and capabilities. MuddyWater (aka TA450) likely began its earliest operations around 2017 with a focus on espionage attacks on Middle Eastern targets initially but later expanding to Belarus, Turkey and Ukraine.

In a geopolitical context, tensions spurred Iran-based APT groups to engage in more aggressive and disruptive activities. APT33, in particular, was implicated in destructive attacks against targets in the Middle East and beyond. The emergence of APT35 (Charming Kitten), for instance, signaled a shift towards influence operations and spear phishing campaigns against political dissidents, journalists, and human rights organizations.

Iranian APT groups have showcased their adaptability by incorporating innovative tactics such as domain spoofing, social engineering, and leveraging cloud infrastructure for command and control. This agility has enabled them to effectively navigate the evolving cybersecurity landscape and continue their operations despite international scrutiny.

Today, Iran-based APT groups remain a significant player in the world of cyber espionage, combining state-sponsored activities with disruptive operations that incorporate tactics such as domain spoofing, social engineering, and leveraging cloud infrastructure for command and control. Iran’s growing expertise and willingness to conduct aggressive cyber operations make it a significant threat. Recent Iranian state-sponsored activities include destructive malware and ransomware operations.

Some notable recent case studies of Iranian-based APT groups and campaigns include:

• APT33 – Known for destructive malware and ransomware operations on the aerospace and energy sectors, Iran’s cyber capabilities have grown significantly. They are known for their use of tools like DropShot to conduct campaigns against organizations in Saudi Arabia and the US, in particular.
• TunnelVision – An Iranian-aligned threat actor operating in the Middle-East and the U.S. using timely-exploitation of recent vulnerabilities such as Log4j and ProxyShell.
• MuddyWater – Uses a suite of open-source malware and DNS Tunneling to conduct espionage and other malicious activity. Believed to be sponsored by the Iranian Ministry of Intelligence (MOIS).

Counting the Cost | The Widespread Impact of State-Sponsored Cyber Attacks

Nation-states, driven by political agendas, have harnessed cyber espionage as a powerful tool to gather intelligence, influence events, and undermine rivals. This has led to a heightened sense of vulnerability among nations and catalyzed international tensions. Cyber attacks sponsored by nation states have had a profound impact across various aspects of global security, economy, and geopolitics.

Industry & Sector-Specific Impacts

Over the years, there have been many reported cases of government agencies, energy grids, financial institutions, and healthcare systems falling prey to targeted attacks, jeopardizing both economic stability and public safety. Some examples include:

• Healthcare – North Korean ransomware campaigns against healthcare organizations during the COVID-19 pandemic underscore the willingness of nation-state actors to target essential services.
• Telecommunications – Chinese APTs targeting telecom providers in the Middle East and Asia reveal a strategic interest in monitoring communications and gathering intelligence.
• Defense – The compromise of Russian defense companies by North Korean actors illustrates the global reach and strategic focus of state-sponsored cyber espionage.

Economic Impacts

Cyber espionage’s impact on the global economy has redefined the dynamics of trade, innovation, and security. Businesses lose billions annually when intellectual property is compromised and the increasing number of supply chain attacks disrupt manufacturing and distribution networks to an alarming degree.

• Financial Losses – Cyber espionage activities have led to billions of dollars in financial losses.
• Intellectual Property Theft – China’s cyber espionage campaigns have reportedly stolen intellectual property worth hundreds of billions of dollars annually from U.S. companies.
• Cryptocurrency Heists – North Korea’s cybercrime activities, including cryptocurrency heists, have reportedly generated funds that support the regime’s military programs.

Security & Geopolitical Impacts

Nation-states exploit digital vulnerabilities to influence elections, gather classified intelligence, and disrupt rival activities. This has blurred the traditional boundary between physical and virtual warfare and reshaped power dynamics in the cyber arena, allowing smaller nations to wield disproportionate influence far beyond their physical borders.

• Critical Infrastructure Attacks – Nation-state actors have targeted critical infrastructure, such as energy grids and transportation systems. Iran’s attack on Saudi Aramco in 2012 is a prime example.
• Election Interference – Russian interference in U.S. elections through cyber means including the 2016 U.S. Presidential Election has been well-documented, highlighting the potential for cyber espionage to influence democratic processes.
• Supply Chain Compromises – The SolarWinds attack, attributed to Russia, affected thousands of organizations, including U.S. government agencies, demonstrating the vulnerability of global supply chains.

Blurring the Lines | Overlaps Between APTs & Cybercrime

The lines between APT and cybercrime have become increasingly vague. This shift has been influenced by a combination of factors, including the increasing sophistication of cybercriminals, evolving motivations, and the lucrative nature of certain cyber activities.  While APTs were historically associated with state-sponsored espionage and sophisticated attacks on political or strategic targets, they now exhibit a broader range of activities resembling cybercrime tactics.

Motivations have diversified, with state-backed groups engaging in cybercriminal activities to generate revenue and fund their ongoing operations. Some APT groups have embraced ransomware attacks, sometimes exploiting the profitability of extorting victims for financial gain but also as a technique of misattribution, disguising stealthy nation-state activity behind a front of common cybercrime. In this context, it is worth noting that cyber criminals themselves have learned from the APT playbook, displaying more advanced and targeted techniques akin to APTs, reflecting their growing ability to source advanced tools and breach high-profile targets.

The availability of advanced tooling through leaks such as Shadow Brokers has also played a pivotal role, enabling cybercriminals to harness APT-like tools and tactics. Access to sophisticated malware, zero-day exploits, and advanced social engineering toolkits and services through dark markets has empowered threat actors of all stripes to execute attacks once the exclusive domain of state-sponsored actors.

The blurring of these lines underscores the complex and dynamic nature of the cyber threat landscape. Traditional distinctions between APTs and cybercrime are changing and this crystallizes the challenge of the cybersecurity community to adopt a more holistic and adaptive approach to defense.

Conclusion | Guarding Against State-Sponsored Cyber Attacks

State-sponsored cyber attacks have evolved into a critical, global issue due to their potential to disrupt economies, compromise national security, and manipulate geopolitical dynamics. A cyber attack in one corner of the world can quickly reverberate across borders, affecting governments, industries, and individuals worldwide.

In response, various international policies and agreements have been established such as the Paris Call for Trust and Security In Cyberspace. The United Nations (UN) has also discussed norms of responsible state behavior in cyberspace, encouraging cooperation and restraint. Additionally, regional organizations and alliances, such as the European Union (EU) and NATO, have developed cyber defense strategies and mechanisms for organizations to share critical information.

Governments have also intensified their efforts to prevent and mitigate cyber espionage risks. The private sectors are investing heavily in cybersecurity measures, including threat intelligence sharing and vulnerability management. Various countries have implemented laws and sanctions to deter cyber espionage, promising to take legal action against state-sponsored cyber activities.

Enterprises facing the rippling effects of cyber espionage must adopt a multi-layered defense approach. Investing in robust cybersecurity measures, such as advanced, autonomous detection and response solutions, encryption, and regular security assessments, is crucial.

Outside of choosing the right tech, collaboration with cybersecurity partners and industry peers to share threat intelligence and best practices helps to enhance the community’s overall resilience. As technology continues to evolve, an adaptive mindset, continuous monitoring, and a commitment to cybersecurity readiness can safeguard enterprises against the far-reaching impacts of cyber espionage.

Enterprises worldwide have turned to SentinelOne’s Singularity Platform to proactively resolve modern risks at machine speed. Learn how SentinelOne works to more effectively manage risk across user identities, endpoints, cloud workloads, IoT, and more. Contact us or book a demo today.

What a few days it was at this year’s BlackHat cyber event in sunny Las Vegas! The stunning SentinelOne booth welcomed thousands of visitors who came to learn about PurpleAI, our newly launched Ranger Insights console, and all the ways the Singularity platform helps organizations protect their endpoints, secure their cloud, and unify their data.

We’ve connected with so many of our customers, prospects, partners, as well as our executive and R&D teams over the last few days. For those who couldn’t join us live at the event this time around, our blog today will cover everything that happened on Day 2 of Black Hat USA 2023.

PurpleAI | AI-Driven Threat Hunting, Analysis & Response for the Modern Enterprise

On Thursday, the SentinelOne Theatre beckoned visitors for another full day of presentations and live product demonstrations. In particular, folks were drawn to our demos of PurpleAI, SentinelOne’s recently launched generative AI platform, dedicated to threat-hunting, analysis and response. PurpleAI, not surprisingly, piqued the interest of many in line with this years’ event theme surrounding Generative AI and its growing presence within the cybersecurity community.

In the packed theater, Joseph Poyner, Director of Sales Engineering and Solution Engineering at SentinelOne showcased how PurpleAI accelerates the offensive strategies and response levels of your Security Operations Center (SOC). Before presenting the PurpleAI demo, Poyner explained some of the industry problems that we set out to solve when we created PurpleAI from the ground up.

Before PurpleAI came to life, we considered some of the hard facts about the current climate. It’s been reported that our industry is millions of analysts short in dealing with the current cybersecurity workload. For the workforce we do have, they’re fighting against both new and sophisticated cyberattack TTPs, which are fueling the rise in ransomware, software supply chain attacks, and more. As single-layer, reactive security solutions are no longer enough to keep up with increasingly skilled cybercriminals, enterprises now have to stack multi-layered, proactive solutions together to build a robust defense posture.

In analyzing SentinelOne customer data and telemetry, we also found that many of the customer queries in our platform are surprisingly simple. Why aren’t people writing complicated queries, we asked? Why aren’t they pulling insights from this large pool of data? The reason, we found, is that most analysts are new to their role and still honing their skill set. Given the reality of these observations, we set about building PurpleAI, which Poyner then demoed through a Capture the Flag (CTF)-like game.

“Rather than an hour-long investigation, we’re going to cut that down to five to 10 minutes,” he explained during the CTF demo. “The other thing is [PurpleAI] never sleeps. This is going to programmatically go through your queries.”

Poyner also highlighted how PurpleAI and your queries can integrate with other popular SaaS tools like Okta.

“You don’t even have to be an analyst. You just have to understand what type of data you want. You can just ask PurpleAI those queries and supercharge your SOC.”

Test drive PurpleAI for yourself with this interactive demo. Interested in learning more? Connect with a SentinelOne expert to find out how PurpleAI can benefit your organization.

It’s Day 2 of #BlackHat 2023. Here are all the ways to connect with SentinelOne today.

First and perhaps foremost, don’t miss your chance to speak with one of our product experts. Ask to see a demo of PurpleAI and our new Singularity Ranger Insights, announced yesterday.… pic.twitter.com/z0bZVx0mdT

— SentinelOne (@SentinelOne) August 10, 2023

Presentation Highlight | Mandiant On Combining Cyber Threat Intel

For a second day, we also welcomed partners and fellow security leaders in our industry to give in-booth presentations. In one notable instance, Mandiant’s esteemed Head of Managed Defense Consulting, Alan White, shared his thoughts in a series of slides on why SentinelOne and Mandiant are truly better together for customers.

“We’re talking about taking really great powerful technology that SentinelOne has with a really powerful Mandiant service. Combined with that threat intelligence, it’s unstoppable,” White told us after his presentation.

Consider this: Without this SentinelOne-Mandiant advantage, organizations would face the expensive and difficult challenge of staffing a team of 24/7 security analysts to achieve the same level of protection. By leveraging SentinelOne XDR technology with Mandiant’s leading MDR service, intelligence, and expertise, customers receive around-the-clock support, proactive threat hunting, and the unification of security across their existing tools.

“You’re going to find evil quickly, you’re going to detect it quickly, and you’re going to leverage the technology to reduce the threat as fast as possible,” White told us. “At the end of the day, I can’t think of a better way to tell a client, ‘If you can’t manage your own environment 24/7, then the partnership that we bring together is the way to go.”

Learn more about how SentinelOne and Mandiant can benefit your organization here. We’re also excited to join Mandiant at its mWISE conference in Washington D.C. next month.

Noetic Cyber | Automating Asset Management With Endpoint Context

SentinelOne partner and S Ventures portfolio company, Noetic Cyber, announced on Day 2 of Black Hat the next phase of its integration with us. In their latest blog post, Noetic Cyber outlines its plans to extend its market-leading cyber asset attack surface management (CAASM) platform to support new use cases.

The company focuses on providing a proactive approach to cyber asset and controls management to help security professionals better understand the cyber risks within their environments, map the relationships between all of their assets and entities, and tie together context and insights to enable faster, more accurate decisions.

“SentinelOne is excited to expand the use cases with Noetic Cyber and the value that will deliver to joint customers,”  SentinelOne’s SVP Corporate Development & S Ventures Rob Salvagno said in a statement. “Together, we deliver a comprehensive solution to help security teams better understand their endpoint, cloud, network, and vulnerability risk.”

The integration of SentinelOne Singularity XDR and the Noetic Continuous Cyber Asset and Controls platform allows security teams to extend the visibility, detection, and endpoint insights of SentinelOne into a wider asset inventory and management architecture. By ingesting high-fidelity endpoint telemetry and incident data from SentinelOne, the Noetic platform can correlate with insights from other security and IT management tools to provide full visibility into all assets within an environment and the cyber relationships between them. Customers can look forward to the following updates to the bi-directional Noetic-SentinelOne Singularity Connector.

Enriched Vulnerability Findings & Prioritization

Noetic has added support for SentinelOne’s new Application Risk capability which leverages the SentinelOne agent to scan the endpoint for third-party applications and list them in the inventory. The agent then maps the inventory with vulnerability data from NIST NVD regularly, associating it with relevant applications and endpoints.

Support for Network Discovery with Singularity Ranger

Noetic’s new integration with Singularity Ranger works by ingesting the results of Ranger scans into the Noetic platform, providing vital context into Ranger-discovered devices. Security teams can quickly see whether devices are on a restricted network range or have access to sensitive datasets or which services they support, for example. This considerably reduces the analyst workload by simplifying the review process.

Extended Support for Cloud & Container Use Cases

The latest version of the Noetic connector has also added support for Singularity Cloud Workload Protection. Data collected by SentinelOne is aggregated with information from AWS, Azure, and Google Cloud, giving security teams the ability to discover security coverage gaps across containers and Kubernetes clusters so that they can drive remediation processes.

Read our joint solution brief or eBook for more information and reach out today to learn how Noetic can support any tool in your stack, driving rapid time to value.

A Peek Into the S Ventures Happy Hour

It was our thorough pleasure to co-host an exclusive happy hour for our S Ventures portfolio companies, partners, and friends in close partnership with Okta Ventures, B Capital, and SYN Ventures! More than 130 attendees gathered at Citizen Kitchen & Bar in Mandalay Bay to enjoy hors d’oeuvres, cocktails, and great conversations about the future of cybersecurity.

“Events like this showcase S Ventures and our partner’s commitment to guiding and scaling the next generation of innovative security and data companies,” said Salvagno. “By fostering connections within and across our mutual networks, we empower these companies to grow and make more of an impact across the ecosystem.”

What Can We Say…We Like To Party!

If you were at our RSAC FOMO afterparty this year, then you know that we love to throw a good party. What we love even more though is enjoying a great party thrown by our friends! To round out a full days’ worth of learning and networking, the SentinelOne team was proud to sponsor both GuidePoint Security and Optiv’s Black Hat afterparties this year.

On Tuesday, GuidePoint hosted the event of the night in the Skyfall Lounge at Mandalay Bay, taking advantage of its surreal, panoramic views of the Las Vegas Strip. Just imagine looking down at the lights and buzz of Vegas from the 64th floor of Delano. We had a great time, GuidePoint.

Thursday was the quintessential Black Hat afterparty that you’d expect when in Vegas. What we’ll say is that Optiv threw a banger of an event at DAYLIGHT beach club at Mandalay Bay complete with bubble sphere dancers in the pool, live music, and acrobatic routines performed above the party goers. What a way to close out Black Hat USA 2023. Thanks, Optiv!

Conclusion

The team at SentinelOne is so grateful for another amazing year at Black Hat USA. We’d like to thank all of the people who took time to visit our iconic Tree of Life booth and theater space and chatted with us about new ways to iterate collaboratively towards the next level of cybersecurity.

These events always renew our passion for keeping those we protect safe from advancing threats and show just how many dedicated people are out there making this happen daily. We already can’t wait for next year’s event but until then, let’s keep the energy up, the conversations flowing, and our channels of communication open for exciting ideas yet to be explored.