Microsoft Patch Tuesday, December 2023 Edition

/0 Comments/in /by

The final Patch Tuesday of 2023 is upon us, with Microsoft Corp. today releasing fixes for a relatively small number of security holes in its Windows operating systems and other software. Even more unusual, there are no known “zero-day” threats targeting any of the vulnerabilities in December’s patch batch. Still, four of the updates pushed out today address “critical” vulnerabilities that Microsoft says can be exploited by malware or malcontents to seize complete control over a vulnerable Windows device with little or no help from users.

Among the critical bugs quashed this month is CVE-2023-35628, a weakness present in Windows 10 and later versions, as well as Microsoft Server 2008 and later. Kevin Breen, senior director of threat research at Immersive Labs, said the flaw affects MSHTML, a core component of Windows that is used to render browser-based content. Breen notes that MSHTML also can be found in a number of Microsoft applications, including Office, Outlook, Skype and Teams.

“In the worst-case scenario, Microsoft suggests that simply receiving an email would be enough to trigger the vulnerability and give an attacker code execution on the target machine without any user interaction like opening or interacting with the contents,” Breen said.

Another critical flaw that probably deserves priority patching is CVE-2023-35641, a remote code execution weakness in a built-in Windows feature called the Internet Connection Sharing (ICS) service that lets multiple devices share an Internet connection. While CVE-2023-35641 earned a high vulnerability severity score (a CVSS rating of 8.8), the threat from this flaw may be limited somewhat because an attacker would need to be on the same network as the target. Also, while ICS is present in all versions of Windows since Windows 7, it is not on by default (although some applications may turn it on).

Satnam Narang, senior staff research engineer at Tenable, notes that a number of the non-critical patches released today were identified by Microsoft as “more likely to be exploited.” For example, CVE-2023-35636, which Microsoft says is an information disclosure vulnerability in Outlook. An attacker could exploit this flaw by convincing a potential victim to open a specially crafted file delivered via email or hosted on a malicious website.

Narang said what makes this one stand out is that exploitation of this flaw would lead to the disclosure of NTLM hashes, which could be leveraged as part of an NTLM relay or “pass the hash” attack, which lets an attacker masquerade as a legitimate user without ever having to log in.

”It is reminiscent of CVE-2023-23397, an elevation of privilege vulnerability in Microsoft Outlook that was exploited in the wild as a zero day and patched in the March 2023 Patch Tuesday release,” Narang said. “However, unlike CVE-2023-23397, CVE-2023-35636 is not exploitable via Microsoft’s Preview Pane, which lowers the severity of this flaw.”

As usual, the SANS Internet Storm Center has a good roundup on all of the patches released today and indexed by severity. Windows users, please consider backing up your data and/or imaging your system before applying any updates. And feel free to sound off in the comments if you experience any difficulties as a result of these patches.

Beyond Illusion | Addressing the Cybersecurity Impact of Deepfakes and Synthetic Media

/0 Comments/in /by

In the last few years, slowly but steadily, the boundary between reality and fiction in the digital realm has become increasingly blurred thanks to the advent of deepfake technology.

Sophisticated, AI-powered synthetic media has evolved from a novel concept in Hollywood to a practical tool used daily by politically-motivated threat actors and cybercriminals for misinformation and fraud.

Since we last wrote about deepfakes a lot has changed. There are new powerful actors, with both old and new grievances, and of course, an explosion in the availability and capabilities of AI. Our trust in the veracity of what we see online has never been lower, nor more fragile.

In this post, we delve into the world of deepfakes as we see it today, exploring the nature, risks, real-life impacts, and measures needed to counter these advanced threats.

What Are Deepfakes?

Deepfakes are artificially-created media, typically video and audio, that purport to show events or people engaging in behaviors that never in fact occurred. They leverage sophisticated artificial intelligence (AI) and machine learning technologies, in particular generative adversarial networks (GANs).

GANs involve two AI models: one that generates content (the generator) and another that evaluates its authenticity (the discriminator). The generator creates increasingly realistic fake videos or audio, while the discriminator continuously assesses the content’s verisimilitude, leading to a rapid improvement in the quality and believability of the generated fakes.

Originally, deepfakes found their place in entertainment and social media, providing novel ways to create content, like superimposing celebrities’ faces onto different bodies in videos or enabling realistic voice impersonations. However, this technology’s potential for creating highly convincing forgeries soon transitioned from mere novelty to a potent tool for misinformation and manipulation.

The Cybersecurity Risks of Deepfakes | A Broad Spectrum

From political disinformation to financial deception, the ramifications of deepfakes are far-reaching and multifaceted. Let’s explore some key examples to understand the breadth and depth of these risks.

Political Disinformation

Deepfakes pose a significant risk to political stability by spreading false narratives and manipulating public opinion, particularly when they are used to create misleading representations of political figures. The first notable example occurred in 2018, when BuzzFeed released a deepfake of President Obama.

Since then, many others have come to light; a deepfake video of Ukrainian President Volodymyr Zelensky falsely portrayed him as conceding defeat and urging Ukrainians to surrender to Russia. Aimed at misleading and demoralizing the public, the video was identified as fake due to discrepancies such as the mismatched size of Zelensky’s head to his body.

Corporate Espionage

In the corporate world, deepfakes have emerged as tools for fraud and deception with the potential to cause substantial financial losses. Such scams can be particularly effective when impersonating high-level executives. A UK-based energy firm lost €220,000 after AI software was used to imitate the voice of the CEO of the firm’s German parent company and instruct the UK CEO to urgently transfer funds.

Personal Identity Theft and Harassment

Personal rights and privacy are, of course, highly susceptible to harm from fake media when it is used to commit identity theft and harassment. Malicious media creations can be alarmingly realistic. In Germany, the government was so concerned about the threat of deepfakes that it released an ad campaign to highlight the dangers, warning parents about the risks associated with these technologies.

Financial Market Manipulation

Beyond harm to individual persons or organizations, deepfakes can disrupt entire financial markets by swaying investor decisions and market sentiments with false narratives. An illustrative case was the deepfake video depicting a supposed explosion near the Pentagon, which briefly impacted the US stock markets.

Legal and Judicial Misuse

In the legal domain, deepfakes can be used to fabricate evidence, potentially leading to miscarriages of justice and undermining the integrity of judicial processes. Although a specific widespread instance in legal settings is yet to occur, the potential for deepfakes to be used in this manner raises concerns about the reliability of video and audio evidence in courtrooms and the need for enhanced verification measures to ensure judicial integrity.

Detecting and Combating Deepfakes | On the Cybersecurity Frontline

As with any tool, AI can be used for both good and bad, and there are efforts underway to develop AI-driven methods to detect and combat the threat of deepfakes. Many of these efforts focus on analyzing facial expressions and voice biometrics to spot subtle anomalies that are undetectable to the human eye and ear. This involves using machine learning models and training them on extensive datasets containing both genuine and manipulated media in order to effectively distinguish between the two.

Blockchain technology, more typically associated with cryptocurrencies, is also emerging as a useful tool in this fight. Blockchain provides a way to verify the source and authenticity of media files and confirm whether they have been altered. So-called “smart contracts” can be used both to verify the authenticity of digital content and to trace how it is interacted with, including any modifications. Combined with AI that can flag media content as potentially inauthentic, a smart contract can trigger a review process or alert relevant authorities or stakeholders.

Other tools are being developed to ensure that content created by AI platforms can be detected as artificial. For example, Google’s SynthID can embed inaudible “watermarks” in AI-generated audio content. Methods like SynthID are intended to ensure that content generated by AI tools remains reliably detected as artificially generated even after it has been manipulated by humans or other editing software.

As in other areas of cybersecurity, education and awareness campaigns have an important part to play in combating the threat of deepfakes. Educating individuals and organizations about deepfakes, how to spot them, and their potential impact will be essential. Collaborations between technology companies, cybersecurity experts, government agencies, and educational institutions will prove to be vital over the next few years as we strive to develop more comprehensive strategies to combat artificially-generated content used for ill ends.

Best Practices for Organizations and Individuals in the Era of Deepfakes

As the threat landscape shaped by deepfakes continues to evolve, it is increasingly important to adopt strategies to mitigate risks associated with the misuse of AI technology. Here is our guide to current best practices and measures to enhance resilience against deepfake-related security threats.

Raising Awareness and Training

Education is the cornerstone of defense against deepfakes. Conducting regular training sessions for employees to recognize deepfakes can significantly lower the risk of deception. This training should focus on the subtleties of synthetic media and keep abreast of the latest developments in deepfake technology.

Cultivating a verification culture within organizations, where any unusual or suspicious communication, particularly involving sensitive information, is cross-verified through multiple channels, is also crucial.

Implementing Robust Verification Processes

For critical communications, especially in financial and legal contexts, implementing multi-factor authentication and rigorous verification processes is indispensable. For instance, voice and video call confirmations for high-stake transactions or sensitive information sharing can be effective. Such practices can prevent incidents similar to the aforementioned case in which a CEO’s voice was faked for fraudulent activities.

Utilizing Advanced Cybersecurity Solutions

We can leverage AI to defeat AI by incorporating advanced cybersecurity solutions with deepfake detection capabilities. Tools employing AI and machine learning to analyze and flag potential deepfakes add an important layer of security.

Regular Software and Security Updates

Maintaining up-to-date software, including security solutions, is vital for cybersecurity. Updates often contain patches for newly identified vulnerabilities that could be exploited by deepfakes and other cyber threats. A proactive stance on software updates can significantly reduce the likelihood of security breaches.

Collaborating with External Experts

For organizations, particularly those with limited in-house cybersecurity capabilities, partnering with external security experts can offer enhanced protection. These professionals can provide insights into the latest threats and assist in crafting strategies specifically designed to counter deepfakes and other emerging cyber risks.

Personal Vigilance

As individuals, it is important for all of us to maintain vigilance when engaging with media. This includes maintaining a healthy skepticism towards sensational or controversial content and verifying sources before sharing or acting on such information.

Utilizing tools and browser extensions that assist in detecting deepfakes can also contribute to stronger personal cybersecurity practices.

It’s also worth remembering that, like any other creation, deepfakes come with varying degrees of quality and attention to detail from the creator. That means in some cases it is still possible to spot less-advanced or sophisticated deepfakes. Some things to watch out for include:

  • Unnatural Eye Movements: AI-generated images or videos can fail to accurately replicate intricate and natural eye movements. This discrepancy can manifest as unusual blinking patterns or a lack of natural eye movement.
  • Audio-Video Sync Issues: Some deepfakes can fail to sync spoken words and lip movements, leading to noticeable discrepancies.
  • Color and Shadow Inconsistencies: AI often struggles with consistently rendering colors and shadows, especially in varying lighting conditions. Look out for inconsistencies in skin tones or background colors. Shadows might appear misplaced or of the wrong intensity.
  • Unusual Body Movements: AI might also struggle to maintain the consistency of body shapes, leading to noticeable distortions or irregularities. This might include jerky, unnatural movements or expressions that don’t align with how a person typically moves or reacts.

In short, combating deepfakes requires a multi-faceted approach, combining education, robust verification processes, advanced technology, software maintenance, expert collaboration, and personal vigilance. These practices form an integral part of a comprehensive strategy to counter the growing sophistication of deepfakes in the cybersecurity landscape. As a bonus, they will also help protect against other kinds of cybersecurity threats and serve to encourage the security mindset individuals and organizations need in today’s digital-centric world.

The Future of Deepfakes and Cybersecurity

The deepfake genie is out of the bottle and we cannot wish it away. Rather, as deepfakes become increasingly prevalent and ever-more subtle, we will need to evolve effective responses. This will entail development in certain key areas.

Aside from continued development of advanced authentication tools, industry leaders, including AI developers like OpenAI and cybersecurity firms, will need to steer the development and application of AI technologies to both establish ethical guidelines and ensure robust defense mechanisms against deepfake threats.

New legislation and regulations will also be required to prohibit and penalize the creation and dissemination of deepfakes for harmful purposes. Due to the transnational nature of digital media, international collaboration in legal frameworks will also be needed to effectively combat deepfakes.

As we’ve noted above, educating the public about deepfakes and enhancing media literacy are an integral part of countering the threat of manipulated media. Technology and regulation alone cannot win the fight across the broad spectrum of online surfaces in which misinformation can be disseminated.

The inevitable proliferation of deepfakes demands a multi-dimensional approach, combining technological innovations, ethical industry practices, informed legislative measures, and public education. We are only at the mercy of technology when we fail to take the time to understand its implications or develop the appropriate controls. When it comes to AI and deepfakes, we still have meaningful opportunities to do both.

The Good, the Bad and the Ugly in Cybersecurity – Week 49

/0 Comments/in /by

The Good | Co-Founder of Criminal Crypto Exchange Pleads Guilty to Money-Laundering Schemes

Anatoly Legkodymov (aka “Gandalf” or “Tolik”), co-founder of the Bitzlato cryptocurrency exchange, has pleaded guilty to his role in aiding ransomware gangs and other cybercriminals in laundering over $700 million. Legkodymov has agreed to disband Bitzlato and forfeit his claim to approximately $23 million in seized assets, according to the terms of his plea agreement.

Source: Forbes

Bitzlato reportedly saw widespread illicit activity on its platform. The exchange promoted a user registration process with minimal identification requirements, explicitly stating that neither selfies nor passports were necessary. According to the DoJ, this lax approach led to Bitzlato becoming a haven for criminal proceeds and funds intended for a variety of malicious activities.

Reports on cryptocurrency-related illicit activity revealed that Bitzlato conducted over $2 billion in cryptocurrency transactions between 2019 to 2021 alone. Nearly 48% of this amount, approximately $966 million, was associated with high-risk cryptocurrency transactions and deemed illicit. The exchange received funds totaling $206 million from darknet markets, $224.5 million from scams, and $9 million from ransomware attackers.

The crypto exchange was also known to be particularly entwined with the Hydra Market, facilitating more than $700 million worth of cryptocurrency exchanges until the dark market was shut down by U.S. and German law enforcement in April 2022. The exchange also received millions in ransomware proceeds, despite repeated warnings to Legkodymov that the routed cryptocurrency represented the proceeds of crime and was intended for illicit transactions.

Dismantling Bitzlato’s digital infrastructure and the subsequent seizure of its domains was a collaborative effort from Europol and authorities in France, Spain, Portugal, and Cyprus. After his initial arrest in Miami earlier this year, Legkodymov now faces a maximum sentence of five years in prison for his role in the illicit activities associated with Bitzlato.

The Bad | APT28 Actors Re-Use Old Outlook Vulnerability to Access Polish Exchange Accounts

Security researchers have identified the Russian state-sponsored actor, APT28 (aka Fancy Bear or Sofacy), exploiting a recently-patched flaw (CVE-2023-23397) in Microsoft Outlook to gain unauthorized access to accounts within Exchange servers. Before it was fixed in March, targets spanned critical sectors in the United States, Europe, and the Middle East. Based on the new wave of attacks, Polish Cyber Command’s (DKWOC) reports that the attacker’s goal now is to obtain unauthorized access to mailboxes belonging to public and private entities that have yet to patch their instances.

CVE-2023-23397 is a critical-level (CVSS score: 9.8) elevation of privilege (EoP) vulnerability triggered by a specially-crafted email message that is sent to a targeted user. Once the message is opened, the user’s Net-NTLMv2 hash is transmitted to the attacker, allowing them to manipulate the access permissions of specific mailboxes and steal sensitive information and/or credentials.

Source: Microsoft

The state-sponsored group linked to APT28 has been active since 2008, known most widely for interfering in the 2016 U.S. presidential election and their engagement in various hack-and-leak operations. Their victims are typically high-value, coming from governments, military, and private sectors. Just two months ago, the National Cybersecurity Agency of France (ANSSI) pinned a cluster of attacks on agencies, universities, think tanks, and research institutions onto the threat group, where they leveraged a combination of flaws, including CVE-2023-23397, to deploy stealers in prominent web browsers.

APT28 commonly employs other known vulnerabilities as part of their attack methods, such as CVE-2023-38831 or CVE-2021-40444. The recent incidents underscore the persistent challenges posed by sophisticated state-sponsored threat actors and the importance of promptly applying security patches to mitigate the risk of exploitation.

The Ugly | Unidentified Actors Exploit Adobe ColdFusion Flaw to Breach U.S. Government Servers

Threat actors are actively exploiting a high-severity vulnerability found in Adobe’s ColdFusion to gain initial access into U.S. government servers. According to CISA’s latest warning on the mounting attacks, the flaw tracked as CVE-2023-26360 presents an improper access control issue that could lead to arbitrary code execution.

Source: CISA

The advisory highlights two incidents of exploitation where CVE-2023-26360 was utilized to compromise federal agency systems. Both instances involved outdated server software vulnerable to various CVEs, with threat actors leveraging the vulnerability to deploy malware through HTTP POST commands to the ColdFusion-associated directory path.

During the first incident, attackers breached a server running Adobe ColdFusion v2016.0.0.3. They performed process enumeration, network checks, and installed a web shell for code injection into a ColdFusion configuration file to extract credentials. The attackers then followed with tactics such as file deletion and creation in specific directories to conceal their activities.

The second incident involved attackers exploiting the flaw on a server running Adobe ColdFusion v2021.0.0.2. After gathering user account information, they deployed a remote access trojan in the form of a text file. Attempts were made to exfiltrate Registry files and security account manager (SAM) information, utilizing security tools to access a directory on domain controllers. Fortunately, both attacks were detected and thwarted before any data exfiltration or lateral movement occurred, with compromised assets removed from critical networks within 24 hours.

CISA categorizes these incidents as reconnaissance efforts, although it remains uncertain whether the same threat actor is responsible for both intrusions. To mitigate risks, CISA recommends updating ColdFusion to the latest version, implementing network segmentation, configuring firewalls or web application firewalls (WAFs), and enforcing policies for signed software execution.

ICANN Launches Service to Help With WHOIS Lookups

/0 Comments/in /by

More than five years after domain name registrars started redacting personal data from all public domain registration records, the non-profit organization overseeing the domain industry has introduced a centralized online service designed to make it easier for researchers, law enforcement and others to request the information directly from registrars.

In May 2018, the Internet Corporation for Assigned Names and Numbers (ICANN) — the nonprofit entity that manages the global domain name system — instructed all registrars to redact the customer’s name, address, phone number and email from WHOIS, the system for querying databases that store the registered users of domain names and blocks of Internet address ranges.

ICANN made the policy change in response to the General Data Protection Regulation (GDPR), a law enacted by the European Parliament that requires companies to gain affirmative consent for any personal information they collect on people within the European Union. In the meantime, registrars were to continue collecting the data but not publish it, and ICANN promised it would develop a system that facilitates access to this information.

At the end of November 2023, ICANN launched the Registration Data Request Service (RDRS), which is designed as a one-stop shop to submit registration data requests to participating registrars. This video from ICANN walks through how the system works.

Accredited registrars don’t have to participate, but ICANN is asking all registrars to join and says participants can opt out or stop using it at any time. ICANN contends that the use of a standardized request form makes it easier for the correct information and supporting documents to be provided to evaluate a request.

ICANN says the RDRS doesn’t guarantee access to requested registration data, and that all communication and data disclosure between the registrars and requestors takes place outside of the system. The service can’t be used to request WHOIS data tied to country-code top level domains (CCTLDs), such as those ending in .de (Germany) or .nz (New Zealand), for example.

The RDRS portal.

As Catalin Cimpanu writes for Risky Business News, currently investigators can file legal requests or abuse reports with each individual registrar, but the idea behind the RDRS is to create a place where requests from “verified” parties can be honored faster and with a higher degree of trust.

The registrar community generally views public WHOIS data as a nuisance issue for their domain customers and an unwelcome cost-center. Privacy advocates maintain that cybercriminals don’t provide their real information in registration records anyway, and that requiring WHOIS data to be public simply causes domain registrants to be pestered by spammers, scammers and stalkers.

Meanwhile, security experts argue that even in cases where online abusers provide intentionally misleading or false information in WHOIS records, that information is still extremely useful in mapping the extent of their malware, phishing and scamming operations. What’s more, the overwhelming majority of phishing is performed with the help of compromised domains, and the primary method for cleaning up those compromises is using WHOIS data to contact the victim and/or their hosting provider.

Anyone looking for copious examples of both need only to search this Web site for the term “WHOIS,” which yields dozens of stories and investigations that simply would not have been possible without the data available in the global WHOIS records.

KrebsOnSecurity remains doubtful that participating registrars will be any more likely to share WHOIS data with researchers just because the request comes through ICANN. But I look forward to being wrong on this one, and will certainly mention it in my reporting if the RDRS proves useful.

Regardless of whether the RDRS succeeds or fails, there is another European law that takes effect in 2024 which is likely to place additional pressure on registrars to respond to legitimate WHOIS data requests. The new Network and Information Security Directive (NIS2), which EU member states have until October 2024 to implement, requires registrars to keep much more accurate WHOIS records, and to respond within as little as 24 hours to WHOIS data requests tied everything from phishing, malware and spam to copyright and brand enforcement.

The 2023 Counter Ransomware Initiative Summit | Stepping Up Global Collaboration in Cybersecurity

/0 Comments/in /by

Ransomware’s transformation from a targeted cybercrime to a significant threat to national security has increasingly drawn attention at international forums like the Counter Ransomware Initiative (CRI) Summit. The 2023 Summit, which brought together representatives from 50 countries, signifies a growing, yet cautious, acknowledgment of the need for collaborative strategies in tackling this complex issue.

In this post, we discuss the key findings emerging from the Summit, shedding light on the collective approach adopted by nations to combat the surge in ransomware attacks. We’ll delve into the role of advancing technologies such as Artificial Intelligence (AI) in fortifying cybersecurity measures, the pivotal role of information sharing in preempting attacks, and the strategic policy initiatives aimed at undermining the operational frameworks of ransomware syndicates.

Furthermore, we’ll reflect on the real-world challenges in countering adaptive cyber threats and highlight the recent law enforcement breakthroughs against notable ransomware groups. This post explores the steps being taken at an international level to address the ransomware menace and the ongoing efforts to shape a more resilient global cybersecurity infrastructure.

Building Collective Resilience Against Ransomware

Member countries gathered in Washington D.C. on October 31 to November 1 to reinforce the need for a global front against the escalating ransomware crisis. Some of the key areas of discussion to emerge were:

  • Strengthening International Cooperation to Undermine Ransomware Operations:
    • The Summit emphasized the importance of unified efforts across nations. Recognizing that ransomware networks often transcend borders, it called for enhanced cross-border law enforcement collaboration.
    • Delegates discussed the standardization of legal frameworks and law enforcement protocols to ensure swift and coordinated action against ransomware syndicates.
    • The Summit also highlighted the need for streamlined processes for sharing intelligence and cyber forensics across countries to facilitate faster identification and neutralization of ransomware threats.
  • Tackling the Financial Underpinnings of the Ransomware Ecosystem:
    • A lot of discussion centered on disrupting the financial networks that fuel ransomware operations.
    • Experts and policymakers deliberated on strategies to trace and block the flow of ransom payments, which often involve cryptocurrencies and unregulated digital payment platforms.
    • There was a consensus on increasing collaboration with financial institutions and regulatory bodies to monitor and report suspicious transactions linked to ransomware activities.
  • Enhancing Public-Private Partnerships to Combat Ransomware Threats:
    • Recognizing the critical role of the private sector, particularly technology and cybersecurity firms, the Summit pushed for stronger partnerships between governments and private entities.
    • Discussions were held on creating frameworks for regular information exchange and threat intelligence sharing between public agencies and private companies.
    • The Summit also saw proposals for joint initiatives in developing advanced cybersecurity technologies, focusing on AI and machine learning, to stay ahead of ransomware tactics.

The Summit’s approach to building collective resilience against ransomware was multi-dimensional, acknowledging that tackling such a complex issue requires a blend of legal, financial, technological, and cooperative strategies. Concerted effort is needed to create a more robust and unified defense against the burgeoning threat of ransomware, which continues to challenge global security and economic stability.

The Evolving Role of AI in Cybersecurity

During the event, a significant spotlight was cast on using Artificial Intelligence (AI) and Machine Learning (ML) in the fight against ransomware. This focus underscores a broader shift in cybersecurity tactics, moving towards more proactive and adaptive defense mechanisms.

AI and ML: Enhancing Threat Detection and Response

  • Advanced Threat Detection: AI and ML algorithms can sift through vast data, identifying patterns and anomalies that may indicate a cybersecurity threat. This allows for early detection of potential ransomware attacks, even before they fully manifest.
  • Automated Response Systems: Integrating AI into cybersecurity systems creates the potential for automated responses to detected threats. This not only speeds up the reaction time but also helps mitigate the impact of attacks, especially in scenarios where every second counts.
  • Adapting to Evolving Threats: The dynamic nature of cyber threats, particularly ransomware, requires tools that can adapt and evolve. AI systems, with their learning capabilities, are well-positioned to meet this need. However, the effectiveness of these AI models in real-world applications is a continuous journey of refinement and improvement, given the ever-advancing tactics of cybercriminals.

Sharing Information | Building a Proactive Defense Network

The CRI Summit also underscored the importance of information sharing in building a collective defense against ransomware.

Rapid Exchange of Threat Data

  • International Information Sharing Platforms: The establishment of platforms for quick and efficient sharing of threat intelligence among CRI members is a step towards a more unified global response to cyber threats.
  • Enhancing Anticipatory Capabilities: With timely access to shared intelligence, countries and organizations can better anticipate and prepare for potential ransomware attacks.
  • Real-World Application: The true test of these information-sharing initiatives lies in their implementation and effectiveness in diverse real-world scenarios. Ensuring these platforms are accessible, efficient, and secure will be crucial in maximizing their impact.

Policy Initiatives and Ransomware Financing | Striking at the Core

A key outcome of the Summit was the formulation of decisive policy initiatives aimed at disrupting the financial lifeline of ransomware operations.

Disincentivizing Ransom Payments

  • No Ransom Payments: The CRI’s collective stance against paying ransoms aims to weaken the financial incentive for cybercriminals. This policy needs global support and enforcement to be effective.
  • Tracking Illicit Financial Transactions: The U.S. Treasury’s commitment to monitor and share information on illicit financial transactions is a strategic move to disrupt the economic foundations of ransomware operations.
  • Global Enforcement Challenges: Implementing these policies on a global scale presents challenges, particularly in jurisdictions with varying levels of cybercrime laws and enforcement capabilities. The effectiveness of these initiatives hinges on the cooperative efforts and compliance of all member states of the CRI.
Discussions highlighted the need for collective effort against ransomware, underscored the importance of AI in cybersecurity, the power of shared intelligence, and the need for robust policy measures. As these strategies are implemented, their real-world effectiveness and adaptability will play a crucial role in shaping the global response to the ransomware threat.

Conclusion

The 2023 Counter Ransomware Initiative (CRI) Summit marks a step in the right direction towards global collaboration against cyber threats. However, the reality remains that many organizations and critical infrastructures are still vulnerable, continuing to fuel the ransomware industry. Despite the advancements and strategic discussions at the Summit, the prevalence of these threats highlights the urgent need for comprehensive and proactive measures.

At SentinelOne, we have been harnessing the power of AI and machine learning for over a decade, staying ahead in the cybersecurity landscape. These technologies, crucial in the fight against ransomware, must be complemented by a stronger alliance between private and public sector leaders. Setting a new standard in cybersecurity and working towards eliminating ransomware as a viable attack method requires a unified effort that transcends individual strategies and recommendations.

If you are ready to experience the advanced protection that SentinelOne offers, our dedicated team is here to assist you. Request a demo and see firsthand how our solutions can safeguard your digital landscape against the evolving cyber threats of today and tomorrow.

SentinelOne Singularity XDR
Supercharge. Fortify. Automate. Extend protection with unfettered visibility, proven protection, and unparalleled response.

Learn More

AWS re:Invent 2023 Highlights | Showcasing the Latest Advances in Cloud Security and Innovation

/0 Comments/in /by

Last week’s AWS re:Invent 2023, held in Las Vegas, was a milestone event showcasing the latest innovations in cloud security. This year, the focus was on the transformative role of Generative AI in cloud computing, a theme that resonated throughout the conference’s keynotes, breakout sessions, and hands-on labs.

In this post, we unpack the essential takeaways from AWS re:Invent 2023. We explore the significant advancements in AI and machine learning (ML) and delve into some of the important new integrations and collaborations announced.

The Rise of Generative AI in Cloud Computing

The standout theme at AWS re:Invent 2023 was unmistakably Generative AI, encapsulated by AWS CEO Adam Selipsky’s keynote. The introduction of Amazon Q marked a significant milestone: a generative AI-powered assistant designed to revolutionize how businesses operate across various sectors. Additionally, the launch of Guardrails for Amazon Bedrock represents a commitment to ensuring the secure and responsible scaling of generative AI applications.

In his keynote, Adam explored AWS’s strategic vision to leverage Generative AI across three key areas:

  1. Infrastructure for AI Training and Inference: Highlighting the need for robust infrastructure to support AI and ML models, AWS offers solutions to cater to fluctuating demands and ensure high-performance outcomes.
  2. Tools for Building with Large Language Models (LLMs): AWS is investing in tools that enable seamless integration and utilization of LLMs and foundational models (FMs) in cloud computing.
  3. AI-Driven Applications: The focus here is on creating applications that leverage FMs, tailoring AI to meet specific business needs and operational requirements.

SentinelOne at AWS re:Invent | Educating on AI in Cloud Security

SentinelOne played a pivotal role at AWS re:Invent with a compelling breakout session led by Field CISO Mani Keerthi Nagothu and Technical Field Leader Jeremy “Howie” Howerton.

Their presentation, “The Challenges of AI in Cloud Security,” provided an in-depth look at AI models, their practical applications in cloud security, and best practices for solution evaluation. The session also featured a real-world case study on a ransomware attack, showcasing SentinelOne’s expertise and drawing a highly engaged audience.

SentinelOne and Snyk Integration | Enhancing Cloud-Native Application Security

The recently announced collaboration between SentinelOne and Snyk is more than just a technological advancement; it’s a strategic move towards closing the loop in cloud-native application security. By covering both the build and runtime aspects of application security, this partnership ensures a more robust and resilient security posture for cloud-native applications.

The value and depth of this partnership to both developer and security teams were validated by re:Invent attendees, with the technical demos and joint talks in both the SentinelOne and Snyk booths at capacity.

Snyk’s role in this partnership focuses on the early stages of application development. Its Container image vulnerability scanning empowers developers and DevOps teams to detect and prioritize vulnerabilities right from the outset.

By embedding security into the DevOps pipeline, Snyk Container ensures that potential vulnerabilities are addressed before the application goes live, effectively minimizing risks in the production environment. This proactive approach is crucial in today’s fast-paced development cycles, where security can no longer be an afterthought.

Real-Time Threat Detection and Response with SentinelOne’s CWPP and Cloud Data Security

SentinelOne has lots to offer when it comes to devops-friendly security for cloud environments, with both workload and cloud data security options being showcased at re:Invent. By focusing on simple, cloud-native deployment approaches, backed by powerful detection engines and deep threat hunting capabilities, these solutions caught the attention of attendees.  Complementing Snyk’s build-time focus, SentinelOne’s CWPP comes into play during the application’s runtime. It excels in identifying and mitigating real-time threats such as ransomware, zero-day exploits, and advanced persistent threats.

The spotlight on SentinelOne’s CWPP at AWS re:Invent underscores its importance in the current cybersecurity landscape. As organizations increasingly migrate to the cloud and embrace digital transformation, the need for robust, real-time security solutions becomes paramount.

SentinelOne’s CWPP offers a powerful, flexible, and intelligent solution to protect cloud workloads against a wide array of cyber threats, making it an essential tool for businesses looking to secure their cloud infrastructure.

For organizations looking to enhance their cloud security posture, exploring the capabilities of SentinelOne’s CWPP could be a critical step towards achieving a secure and resilient cloud infrastructure.SentinelOne’s Singularity Cloud Data Security is a newer offering, with options to provide automated malware scanning for Amazon S3, and NetApp, directly in the customer’s environment. This solution helps customers identify suspicious and malicious files within their environment, and can remove and quarantine them quickly. With most modern applications leveraging S3, it’s critical for organizations to protect applications (both using the buckets and downstream) from threats within their storage.

Visibility of resources, especially when being spun up and spun down quickly, and data sovereignty were common topics of discussion when it came to protecting cloud data. Cloud Data Security addresses visibility by inventorying all S3 buckets connected to an account, and by applying policy based controls and rules at time of creation. When it comes to data sovereignty, SentinelOne does all scanning of the objects within the customers bucket- the object never leaves their environment, meeting key guidelines and regulations for many industries.

Networking and Entertainment | Fostering Connections and Fun

AWS re:Invent 2023 wasn’t just about the latest in cloud technology; it also offered ample opportunities for networking and entertainment. The event’s social highlight was the after-party at Juliet Cocktail Lounge, co-hosted with tech partners like Snyk and NinjaOne. This event stood out for its great music, engaging discussions, and a chance for attendees to relax and network in a more informal setting.

Additionally, the “Take the Wheel On Your AWS Applications” event provided a unique and interactive experience outside the usual conference environment, while the Recovery Breakfast at The Yardbird offered a quieter but equally engaging atmosphere for morning discussions. These events underscored the importance of balancing professional learning with fun and networking at tech conferences.

Booth Highlights | SentinelOne’s Showcase of Innovation

SentinelOne’s presence at AWS re:Invent 2023 was marked by a flurry of innovation and expertise, with the booth emerging as a focal point of technological showcase. The booth functioned as a hub of activity with a series of informative presentations, demonstrations, and interactive sessions that highlighted SentinelOne’s leading role in cloud security and AI.

In-Depth Session on Purple AI

Holly Bittinger’s talk on Purple AI delved into the nuances of Purple AI, explaining how it accelerates threat investigations and simplifies security operations.

Purple AI  allows analysts to identify, analyze, and mitigate threats using conversational prompts and interactive dialog, leveraging large language models (LLMs) to supercharge threat detection and response. By demonstrating Purple AI’s capabilities, Holly showcased SentinelOne’s commitment to enhancing AI’s role in cybersecurity.

Snyk and SentinelOne Integration | A Practical Demo

The integration between Snyk and SentinelOne was another highlight, drawing attention to their collaborative efforts in cloud-native application security. The live demonstration provided a practical insight into how the integration enhances security from build-time to runtime, effectively addressing cloud vulnerabilities through an in-depth analysis of the IceFire ransomware attack.

The demonstration offered attendees a glimpse into the complexities of modern cybersecurity challenges and SentinelOne’s adeptness in addressing them.

Singularity Cloud Demos | Cloud Rogues and eBPF

The Singularity Cloud demos were exceptionally popular, attracting a large audience interested in the latest cloud security innovations. These demos highlighted key features such as Cloud Rogues and the benefits of extended Berkeley Packet Filter (eBPF), emphasizing SentinelOne’s forward-thinking approach in cloud security.

The interactive nature of these demos allowed attendees to experience firsthand the efficiency and effectiveness of SentinelOne’s solutions. Participants gained valuable insights into how SentinelOne’s technologies can be applied in various scenarios, offering practical knowledge that goes beyond theoretical understanding.

Looking Ahead | Continuing the Cloud Security Conversation

As AWS re:Invent 2023 was a fantastic experience showcasing the convergence of innovation and community in cloud technology. We’re already looking forward to next year’s AWS re:Invent and the opportunity to connect again with the cloud computing community.

Looking forward, we’re excited to continue exploring the evolving landscape of cloud security. Join us at our upcoming webinar on December 14th for an in-depth look at the latest trends, particularly the impact of AI in cloud security.

Contact us to learn more about what SentinelOne is doing to evolve the cyber defense industry or book a demo to get more in-depth experience with our newest integrations and security offerings.

Navigating the AI-Driven Landscape of Cloud Security | Trends and Insights
Thursday, December 14 at 10:00 a.m. PST / 1:00 p.m. EST

Save My Spot

The Good, the Bad and the Ugly in Cybersecurity – Week 48

/0 Comments/in /by

The Good | Ukrainian Ransomware Gang Busted By Cyber Cops

A ransomware gang operating out of Kyiv, Ukraine has been taken down by European police, it was announced this week. It is estimated the gang had attacked more than 250 servers across 71 countries during its active lifetime and caused losses of several hundred million euros.

A joint police task force raided 30 locations and seized over a hundred devices, resulting in the arrest of four individuals and the alleged ringleader of the gang. Europol said that the gang broke into networks using phishing emails, brute force attacks, SQL injection and stolen credentials. Once inside a network, they deployed tools such as Cobalt Strike and TrickBot to further their access. They would then remain hidden, sometimes for months, before deploying various kinds of malware, including LockerGoga, MegaCortex, HIVE and Dharma ransomware to lock files and extract payment from victims.

The gang ransomed multiple global organizations located in France, Norway, Germany, The Netherlands, Canada and the U.S. In one example, they demanded 450 BTC (around $17m today) from a leading chemical company in the Netherlands.

The raids, which took place on November 21, were part of a long-standing operation that began in 2019 to identify and disrupt cyber criminal activity in Ukraine. Previous arrests in 2021 led authorities to develop decryptors for some of the gang’s ransomware tools. The operation continues as authorities continue to hunt for other associates of the arrested suspects.

The Bad | Hacktivists Target U.S. Water Treatment Plants

CISA is warning critical infrastructure organizations to be on the alert this week after Iranian-backed threat actors were found to be attacking U.S. water treatment plants and other organizations with embedded Unitronics PLCs.

A Pro-Hamas “Hacktivist” group calling itself “Cyber Av3ngers” has perpetrated intrusions into a number of U.S. organizations by exploiting weak or default passwords in the Israeli-made ICS devices. Aliquippa’s Municipal Water Authority was breached by the threat actor as was a brewery in Pittsburgh. The attackers use network scanning tools to hunt for vulnerable devices connected to the public internet and then attempt to brute force entry through known or weak passwords.

Source: BeaverCountain.com

Cyber Av3ngers is known to be an arm of the Iranian IRGC, with a history of attacking industrial targets in relatively unsophisticated attacks. It makes much use of social media to broadcast sometimes false and often exaggerated claims about high-profile hacks. It has been suggested that the group’s social media persona is linked to another threat actor known as Soldiers of Solomon. Other groups that appear to be conducting campaigns against industrial infrastructure include GhostSec.

Although the damage caused in the cases seen so far appears to have been minimal and mitigation relatively quick, the fact that critical infrastructure appears to be easily compromised and is currently being targeted by active groups is a cause for concern. CISA advises all admins of embedded industrial control systems to change default settings, use strong passwords and take other mitigating measures as outlined here.

The Ugly | 3 More Zero Days Found in Chrome & Apple OSes

It’s that time of the month again. Not quite ‘Patch Tuesday’, but the increasingly frequent warning “Apple is aware of a report” that a new zero day (or two) “may have been exploited” in the wild is upon us once more. Users are being urged to update all their Apple things – and Chrome too, while they’re at it – after Google’s TAG team reported three critical severity zero days in its own and Apple’s products.

Tuesday saw Google release patches for seven vulnerabilities in Chrome including CVE-2023-6345. Few details were disclosed about the bug other than that it involves an integer overflow in the Skia Graphics Engine. Skia is used in Chrome to handle tasks such as drawing shapes, text and images on web pages. What Google did say, importantly, is that it was “aware that an exploit for CVE-2023-6345 exists in the wild.”

Meanwhile, on Thursday, Apple issued updates across its desktop and mobile platforms for two vulnerabilities in its WebKit browser engine. On Apple’s mobile platforms, WebKit is used by all browsers, not just Safari. CVE-2023-42916 is an out-of-bounds read issue that could be used to leak sensitive information when processing web content. CVE-2023-42917 is a memory corruption bug that could result in arbitrary code execution when processing web content.

Both flaws were credited to the same Google TAG researcher that reported CVE-2023-6345, suggesting that their discovery was linked. Apple said it was aware of reports that the bugs may have been exploited against versions of iOS before 16.7.1.

As 2023 begins to draw to a close, it’s worth noting that it’s been a record year for Apple zero days, with 19 reported as being ‘actively exploited’ in the wild to date. It’s a sign not only of the company’s products’ popularity but also of their vulnerability.

Apple’s closed mobile ecosystem makes malware detection and remediation challenging for even the most technical of users, while many among its macOS user base still subscribe to the outdated thinking that ‘Macs don’t get malware’. Such folks need to update both their devices and their understanding of the modern cyber threat landscape if they wish to avoid calamity down the road.

Iran-Backed Cyber Av3ngers Escalates Campaigns Against U.S. Critical Infrastructure

/0 Comments/in /by

Earlier this week, CISA released an advisory warning of active exploitation of Programmable Logic Controllers (PLCs) used in Water and Wastewater treatment plants following intrusions into two U.S. critical infrastructure installations. The advisory and attacks come in the wake of increased public threats made by the Iran-backed Cyber Av3ngers “hacktivist” group to target industries using Israeli-manufactured OT and ICS equipment.

In this post, we describe the background to these attacks and detail recent Cyber Av3ngers activity, exploring the wider implications for critical infrastructure security and how organizations can mitigate these cyber risks.

Intrusion at the Municipal Water Authority of Aliquippa

On November 25, 2023, The Municipal Water Authority of Aliquippa disclosed an attack in which it lost control of one of the booster stations for the area. The attackers appear to have compromised a Unitronics PLC by exploiting weak or default passwords along with targeting the default and well-documented programming port for these devices.

The attackers renamed the PLC to “Gaza” and defaced the user interface.

Source: BeaverCountain.com

In addition, federal officials have indicated that a number of other water authorities on the east coast of the United States have been impacted by the Cyber Av3ngers, as well as at least one aquarium and a brewery. The Full Pint Beer brewery in Pittsburgh shared images on social media on 28th November showing similar defacement of a Unitronics PLCs in use as part of their control system.

Who Are Cyber Av3ngers?

Cyber Av3ngers is an IRGC-aligned threat actor whose primary mission is to sow discord and create a sense of heightened risk from technically unsophisticated hacks. The group has a history of making false claims such as breaching the Dorad power station. Attacks by the similarly-named Cyber Avengers, active since 2020, have been claimed by those operating the Cyber Av3ngers social media channels.

The recent attacks follow weeks of social media posturing by Cyber Av3ngers. On October 29, 2023, the group posted a promotional ‘countdown’ style video indicating that the group would be unveiling “one of the greatest cyber attacks on Israel infrastructure” within 24 hours.

CyberAv3ngers October 29th warning Telegram post

On October 30th, the Cyber Av3ngers initiated a series of posts across their Telegram and Twitter/X communication channels claiming to have infiltrated “10 Water treatment stations” across Israel. Prior to that, the same channels had been used to post a small set of files they claim had been exfiltrated from these targets.

Throughout the following weeks, the group maintained its social media campaign with threats to “wipe and destruct all industrial equipment such as SCADA systems, PLCs and HMIs”. However, it was only on 26th November that the group’s threats expanded to include targeting of all critical infrastructure, including plants in the U.S., found to be using equipment manufactured in, or associated with, Israel.

Targeting and Tooling

The current campaign targets Unitronics PLCs exposed to the public internet. A high-level search via Shodan indicates approximately 1800 Unitronics PLC devices are reachable globally. Around 280 of those are of the type in use by the Municipal Water Authority of Aliquippa.

Threat actors are scanning for exposed Unitronics devices listening on TCP port 20256, and when discovered, interrogating and where possible connecting to the vulnerable endpoint.

Cyber Av3ngers are known to use open source to conduct scanning, discovery and exploitation of OT and ICS devices. In particular, they leverage scripts specific to PCOM/TCP to query systems using Unitronics PLCs.

Industrial Control Systems equipment often comes with default passwords and backdoor ‘service’ or ‘admin’ accounts for remote administration. These are documented in publicly available operation manuals and represent a vulnerability if the installer or maintainer of the equipment did not take steps to change passwords and generally harden the devices against external attack.

Screenshots shared by the group on social media show the use of such open-source tools for scanning a range of exploitable ICS devices, including Siemens and SCADA devices.

Cyber Av3ngers & mr_soul_controller

The group has also previously exploited CVE-2023-28130, a remote command execution vulnerability in CheckPoint’s GAIA.

Cyber Av3ngers targeting CheckPoint GAIA

Additional Targeting of OT/ICS Equipment

The nature of many ICS/OT installations means they are often exposed to vulnerabilities and weak or unchanged default passwords. This, combined with their service-critical use, means they are both an easy and attractive target for threat actors.

Unsurprisingly, we find that Cyber Av3neger are neither the only nor the first group to target such systems. Unitronics PLCs, in particular, have also recently been singled out for targeting by another Gaza-related hacktivist group called ‘GhostSec’.

On October 13, 2023, GhostSec posted messages claiming to have hacked a number of Unitronics devices along with 27 Aegis devices used to control water pumps.

Mitigating Risks to Unitronics PLCs and Other ICS Devices

In order to harden exposed devices, administrators are urged to follow CISA’s recommendations:

  • Change the Unitronics PLC default password and validate that the default password “1111” is not in use.
  • Require MFA for remote access to the OT network, including from the IT network and external networks.
  • Disconnect the PLC from the open internet. If remote access is necessary, implement a Firewall/VPN in front of the PLC to control network access to the remote PLC. A VPN or gateway device can enable MFA if it is not supported by the device. Unitronics also has a secure cellular based longhaul transport device that is secure to their cloud services.
  • Back up the logic and configurations on any Unitronics PLCs to enable fast recovery. Become familiar with the process for factory resetting and deploying configurations to a device in the event of being hit by ransomware.
  • If possible, utilize a TCP port that is different from the default port TCP 20256. If available, use PCOM/TCP filters to parse out packets.
  • Update PLC/HMI to the latest version provided by Unitronics.

Conclusion

Groups escalating their presence and activities following the onset of the Israel-Hamas war are flooding social media with elaborate claims and grand threats of massive intrusions. Though inevitably exaggerated, groups like Cyber Av3ngers do present risk to critical infrastructure installations, albeit at present one that remains of low-impact. It is also important to see Cyber Av3ngers in the context of being an aspect of the IRGC. The goal here may be as much to do with Iranian-aligned propaganda as it is to do with causing material harm.

However, defenders should take such activity as an opportunity to understand weaknesses that need to be mitigated before more serious harm can be done. From a technical perspective, awareness continues to be paramount. Mitigating known risks will stop such opportunistic attacks from impacting devices and minimize the potential of service disruption.

To learn about how SentinelOne can help protect your organization from cyber threats, contact us or request a free demo.

Okta: Breach Affected All Customer Support Users

/0 Comments/in /by

When KrebsOnSecurity broke the news on Oct. 20, 2023 that identity and authentication giant Okta had suffered a breach in its customer support department, Okta said the intrusion allowed hackers to steal sensitive data from fewer than one percent of its 18,000+ customers. But today, Okta revised that impact statement, saying the attackers also stole the name and email address for nearly all of its customer support users.

Okta acknowledged last month that for several weeks beginning in late September 2023, intruders had access to its customer support case management system. That access allowed the hackers to steal authentication tokens from some Okta customers, which the attackers could then use to make changes to customer accounts, such as adding or modifying authorized users.

In its initial incident reports about the breach, Okta said the hackers gained unauthorized access to files inside Okta’s customer support system associated with 134 Okta customers, or less than 1% of Okta’s customer base.

But in an updated statement published early this morning, Okta said it determined the intruders also stole the names and email addresses of all Okta customer support system users.

“All Okta Workforce Identity Cloud (WIC) and Customer Identity Solution (CIS) customers are impacted except customers in our FedRamp High and DoD IL4 environments (these environments use a separate support system NOT accessed by the threat actor),” Okta’s advisory states. “The Auth0/CIC support case management system was also not impacted by this incident.”

Okta said that for nearly 97 percent of users, the only contact information exposed was full name and email address. That means about three percent of Okta customer support accounts had one or more of the following data fields exposed (in addition to email address and name): last login; username; phone number; SAML federation ID; company name; job role; user type; date of last password change or reset.

Okta notes that a large number of the exposed accounts belong to Okta administrators — IT people responsible for integrating Okta’s authentication technology inside customer environments — and that these individuals should be on guard for targeted phishing attacks.

“Many users of the customer support system are Okta administrators,” Okta pointed out. “It is critical that these users have multi-factor authentication (MFA) enrolled to protect not only the customer support system, but also to secure access to their Okta admin console(s).”

While it may seem completely bonkers that some companies allow their IT staff to operate company-wide authentication systems using an Okta administrator account that isn’t protected with MFA, Okta said fully six percent of its customers (more than 1,000) persist in this dangerous practice.

In a previous disclosure on Nov. 3, Okta blamed the intrusion on an employee who saved the credentials for a service account in Okta’s customer support infrastructure to their personal Google account, and said it was likely those credentials were stolen when the employee’s personal device using the same Google account was compromised.

Unlike standard user accounts, which are accessed by humans, service accounts are mostly reserved for automating machine-to-machine functions, such as performing data backups or antivirus scans every night at a particular time. For this reason, they can’t be locked down with multifactor authentication the way user accounts can.

Dan Goodin over at Ars Technica reckons this explains why MFA wasn’t set up on the compromised Okta service account. But as he rightly points out, if a transgression by a single employee breaches your network, you’re doing it wrong.

“Okta should have put access controls in place besides a simple password to limit who or what could log in to the service account,” Goodin wrote on Nov. 4. “One way of doing this is to put a limit or conditions on the IP addresses that can connect. Another is to regularly rotate access tokens used to authenticate to service accounts. And, of course, it should have been impossible for employees to be logged in to personal accounts on a work machine. These and other precautions are the responsibility of senior people inside Okta.”

Goodin suggested that people who want to delve further into various approaches for securing service accounts should read this thread on Mastodon.

“A fair number of the contributions come from security professionals with extensive experience working in sensitive cloud environments,” Goodin wrote.

Leveraging the Law, Exposing Incriminating Data and Other New Tactics in Cyber Extortion

/0 Comments/in /by

A little over a year ago, we described how ransomware operators had evolved their tactics from simple file locking to more sophisticated forms of extortion in Ransoms Without Ransomware, Data Corruption and Other New Tactics in Cyber Extortion. Since then, cybercrime actors have not stood still, and we are currently seeing the emergence of a brace of new tactics to wrest funds out of organizations and their clients in the wake of a business network compromise.

We observe that data theft and data destruction continue to be primary tools in the cybercriminal’s arsenal, along with partial and full file encryption. Added to that, however, we have begun to see the use of new levers that attempt to shame, blame or otherwise coerce victims into paying the ransom demanded by attackers.

In this post, we describe the emergence of these new tactics in cyber extortion to help defenders better understand the continuing development of threat actor behaviors.

Extortion Through Leveraging the Law

In mid-2023, the United States Securities and Exchange Commission approved updated requirements around cybersecurity incident reporting. These new requirements require that all companies disclose cybersecurity incidents, along with all the pertinent details, with the SEC within four days of becoming aware of a breach incident.

The new rules will require registrants to disclose on the new Item 1.05 of Form 8-K any cybersecurity incident they determine to be material and to describe the material aspects of the incident’s nature, scope, and timing, as well as its material impact or reasonably likely material impact on the registrant. An Item 1.05 Form 8-K will generally be due four business days [our emphasis] after a registrant determines that a cybersecurity incident is material. 

The new requirements are set to take effect from 18th December, 2023 for larger organizations and from June 2024 for all others. However, some ransomware operators have already adopted tactics that seek to leverage the new rules about breach disclosure to threaten victims even before they have taken effect.

On November 7th, the ALPHV gang breached MeridianLink in a data theft operation that did not involve the deployment of ransomware. The victim – a large financial services enterprise with dealings in mortgage lending, credit unions and banking products and services – subsequently stated that they became aware of the breach on November 10th.

According to the attackers, the victim was threatened with being reported to the SEC if they failed to pay within 24 hours.

On November 15, ALPHV added MeridianLink to its TOR-based data leaks website along with excerpts and screenshots of the complaint they filed to the SEC alleging that the enterprise had failed to report the breach within four days.

Source: databreaches.net

Although in this case the rules were not in force at the time, it is clear that going forward threat actors will use this as a tactic to pressure victims. The aim would appear to be to prevent organizations stalling for time while trying to mitigate the damage, negotiate the payment amount, or otherwise avoid revealing the disclosure to their partners, clients and other affected parties.

The Threat of Exposing Incriminating Data

While the threat of exposing stolen data has now been used for some time as an additional form of leverage, there have been few cases where the nature of the data itself has been used to pressure a victim to pay. Where those have occurred, they have centered around sensitive, proprietary data that companies would not wish to fall into the hands of competitors.

However, a recent breach by affiliates of the Rhysida ransomware operation was followed by a threat to publish data that itself constitutes a criminal offense for the victim to possess. In this case, the ransomware operators allege that data stolen from Mount St. Mary’s Seminary, a school that prepares “candidates for the Catholic priesthood”, contained “child erotica”.

“Ready to provide evidence of child erotica stored on this network. Willing to cooperate with detectives and journalists. These materials will not be published on our site.”

The implications here are complex and concerning. Even the allegation of such threatens the reputation of the victim organization, even if untrue. It is easy for threat actors to make damaging claims and refuse to provide the evidence. As a tactic, threatening to publicize such claims can exert pressure on victim organizations, particularly if they cannot verify for themselves whether such data exists.

If true, there are obvious legal implications and reputational consequences for the organization even if the crime is the sole responsibility of a single individual. In such circumstances, threat actors can ramp up the pressure on victims to pay in the hope that the data will not be exposed to law enforcement.

While the specific nature of the incriminating data in this incident may not be (one would like to think) something widely found on business networks, the greater lesson is that threat actors can and will leverage not only business data but also personal employee data that may be stored on compromised business computers.

Enterprises need to ensure that strict policies are in place to prevent employees using organizational computers for personal use, and that these policies are enforced, along with ensuring all endpoints are properly protected against compromise.

Trading Victims Off Against GDPR & Other Regulators

Ever since 2018, GDPR and similar regulations have had an important impact on the way companies store and retain data. Backed by the threat of heavy financial penalties, GDPR is a powerful motivator to ensure organizations prioritize data privacy in their operations.

Threat actors have leveraged the threat of penalties for breaching GDPR rules in the past. For example, in 2021, DoppelPaymer successor Grief (aka PayorGrief) cited GDPR violations to exert pressure on victims.

Grief victim portal referencing GDPR regulations (from May 2021)

However, more forceful GDPR-related threats have been observed in 2023. The previously mentioned ALPHV gang attempts to pressure victims by scaring their customer base. On  November 14, 2023, the organization “Naftor and Groupa Pern” was added to the ALPHV blog with scare text claiming the company did not observe GDPR rules and that its customers’ data could be leaked as a result.

WARNING!

COOPERATION WITH NAFTOR AND GRUPA PERN MAY RESULT IN THE LEAKAGE OF YOUR DATA. THESE COMPANIES DO NOT COMPLY WITH THE LAWS OF THE EUROPEAN UNION AND IN PARTICULAR THE GDPR. YOU MAY INCUR LEGAL AND FINANCIAL RISKS BY WORKING WITH THEM!

More direct leverage of GDPR was recently seen as a tactic used by the short-lived and now-defunct Ransomed.VC gang. This group threatened victims with disclosure of GDPR violations in the event they did not conform to the ransom demands. The extortion demands would be purposefully set at a price lower than the potential GDPR fines in an attempt to entice the victim to pay by offering a less financially-painful option.

Ransomed.VC  site banner
Ransomed.VC  site banner

Conclusion

Legal frameworks such as the SEC’s new cybersecurity incident reporting rules, GDPR regulations and standing laws on prohibited data are being exploited to exert further pressure on vulnerable organizations. These latest cyber tactics attempt to force victims into meeting ransom demands by raising fears of both legal liability and reputational damage.

The emergence of such tactics underscores the need for organizations to strengthen their cybersecurity posture, ensure compliance with regulatory requirements and to remain prepared for the evolving nature of today’s cyber threats. Cybercriminals are highly motivated to develop new and creative ways to extort businesses, and cyber defenders need to remain vigilant and adaptive in their strategies to defend against these evolving threats.

To learn about how SentinelOne can help protect your organization from ransomware and other threats, contact us or request a free demo.