With more businesses relying on cloud computing to streamline operations and improve scalability, enterprise leaders are adopting a cloud-first approach, combining network, performance, security, endpoint management, and support all through cloud operations, or CloudOps. CloudOps combines both IT processes and DevOps principles to ensure the smooth operation, maintenance, and optimization of a cloud-based infrastructure and its applications.

As news headlines are increasingly occupied by data breaches and new security vulnerabilities pose significant risks to businesses, CloudOps has emerged as a crucial component for ensuring the safety and integrity of cloud-based systems. In this post, learn to build and automate a strong cloud-first strategy that can help keep organizations of all sizes safe from potential cloud security risks.

Emerging CloudOps | The Next Phase of Digital Business

According to Gartner, global end user spending on public cloud services is being forecasted to grow nearly 22% totalling $597.3 billion this year. Given its prevalence, security experts are viewing cloud as the driving force behind the next phase of digital business as its role as a highly strategic platform for digital transformation and services.

While cloud usage is near universal in the modern business landscape, many deployments remain poorly architected or are assembled ad hoc. Digital trends for 2023 indicate that cloud infrastructure optimization is one of the top priorities to pay attention to. The rise of cloud is clear and enterprise leaders are working to evolve their IT, engineering and development teams to build the right cloud security management and operating strategies for their business. This is where CloudOps comes into play.

CloudOps focuses on managing and optimizing cloud-based infrastructure, applications, and services. It takes into account the unique characteristics and capabilities of cloud computing, such as elasticity, scalability, and resource virtualization.

Many businesses have relied on traditional IT operations (ITOps) practices to manage their cloud deployments. However, as the complexity of cloud infrastructure has grown, forward-thinking enterprises have moved towards specialized expertise and dedicated processes to better handle their cloud-first systems.

CloudOps combines principles from other operational models such as ITOps and DevOps and makes them applicable to a cloud-based architecture. These principles, processes, and best practices help security teams across cloud architecture, security, compliance, and IT operations to manage the overarching infrastructure. Below are some key differences that make CloudOps unique.

• Managing & Optimizing Cloud – CloudOps focuses specifically on managing and optimizing cloud-based infrastructure, applications, and services. It takes into account the unique characteristics and capabilities of cloud computing, such as elasticity, scalability, and resource virtualization.
• Underlying Infrastructure – While IT operations primarily deal with physical hardware and data centers, CloudOps is centered around virtualized resources and cloud service providers.
• Security – Since cloud environments have unique security considerations, CloudOps focuses on implementing robust security measures, such as identity and access management, data encryption, and proactive threat monitoring; all specific to cloud-based systems.
• Scalability – CloudOps offers greater flexibility compared to traditional IT operations. Cloud environments allow businesses to scale resources up or down based on demand, whereas scaling in traditional IT operations often requires additional hardware procurement and deployment.
• Automation – CloudOps leverages automation tools and frameworks to streamline resource provisioning, configuration management, and application deployment in the cloud. This level of automation is typically more advanced and efficient compared to traditional IT operations.

Seizing Value Through CloudOps Services

As cloud technology continues to meet changing business needs, migrating from on-prem to the cloud is no longer enough to revolutionize business infrastructure. The rise of hybrid and multi-cloud structures has also multiplied the complexities and criticalities associated with the cloud.

To leverage more value from the cloud, enterprises have focused on driving cost efficiencies through shared services and flexible commercial models. Cloud-based Infrastructure-as-a-Service (IaaS), for example, plays a pivotal role in maintaining superior functionality and operational agility through automation, enabling businesses to optimize their operations.

In this context, CloudOps services have gained significant momentum. By managing software in a cloud computing environment, CloudOps ensures that enterprises are effectively harnessing the benefits of cloud-based systems. Since cloud operations services focus on optimizing performance and capacity, it validates best practices and processes that enable cloud platforms, applications, and internal data to perform optimally.

Increase Efficiency & Scalability

CloudOps optimizes resource utilization and reduces manual intervention, resulting in enhanced operational efficiency. With proactive monitoring and performance optimization, CloudOps teams can identify and resolve issues promptly, minimizing downtime and maximizing productivity.

CloudOps also enables scalability. When businesses scale their resources up or down based on demand, ensuring optimal performance without unnecessary resource allocation is key. By centralizing management and leveraging standardized practices, CloudOps streamlines operations, reduces complexity, and empowers organizations to focus on core business activities.

Cost Optimization

Cost optimization is a significant advantage of implementing CloudOps within organizations. CloudOps teams leverage automation, monitoring tools, and advanced analytics to optimize resource allocation and usage. Over time, security teams see cost savings as they continue to monitor resource consumption and apply scaling strategies based on demand. CloudOps also ensures that resources are provisioned efficiently, avoiding unnecessary expenses.

Improved Security

CloudOps plays a critical role in an enterprise’s cybersecurity strategy, keeping business-critical data safe from cloud-based security threats. CloudOps focuses on implementing robust security measures to protect sensitive data and ensuring the integrity of cloud-based systems. To do so, security teams continuously monitor the cloud environment for vulnerabilities, proactively detect and mitigate security risks, and also ensure compliance with industry regulations.

CloudOps employs various strategies and practices to secure a cloud environment effectively including:

• Identity and Access Management (IAM) – CloudOps implements robust IAM policies to manage user identities, roles, and access privileges. This ensures that only authorized individuals can access and modify resources within the cloud environment.
• Encryption – CloudOps utilizes encryption techniques to protect data at rest and in transit. Encryption safeguards sensitive information from unauthorized access, even if a breach occurs.
• Regular Security Audits – CloudOps teams conduct regular security audits to identify vulnerabilities and weaknesses in the cloud infrastructure. This allows them to proactively address potential security gaps and implement necessary patches or updates.
• Network Security – CloudOps implements network security measures such as firewalls, intrusion detection systems, and virtual private networks (VPNs) to monitor and protect the cloud environment from unauthorized access and malicious activities.
• Incident Response Planning – CloudOps develops and maintains robust incident response plans to effectively handle security incidents. This includes defining escalation procedures, conducting drills, and implementing measures to minimize the impact of potential security breaches.
• Compliance Management – CloudOps ensures compliance with industry-specific regulations and standards. This involves implementing controls and processes to meet data privacy requirements and maintain regulatory compliance.
• Ongoing Monitoring and Threat Detection – CloudOps teams continuously monitor the cloud environment, employing advanced monitoring tools and technologies to detect and respond to potential security threats promptly. This includes real-time monitoring of logs, network traffic, and system activities.

Operating In The Cloud | How To Effectively Implement CloudOps

CloudOps enables organizations to focus on their core competencies by streamlining the management of their cloud environments. Security teams can follow the below key steps when implementing CloudOps best practices.

Define Your Cloud Strategy & Objectives

Begin by assessing the existing IT infrastructure, applications, and business processes. Understand the strengths, weaknesses, and limitations of the current environment, as well as all business drivers for adopting cloud technology.

Then, clearly define the objectives and expected outcomes of implementing CloudOps within the organization. Determine the specific areas of focus such as efficiency, scalability, security, or cost optimization. These definitions allow senior leadership to tie the cloud strategy to business goals and narrow down specific requirements when selecting the right cloud service provider.

Design CloudOps Processes

It is also important to develop clear processes for CloudOps that align with the organization’s goals. This can include defining resource provisioning and configuration management procedures, performance monitoring, incident response protocols, and security practices.

Implement Automation and Orchestration

Automation helps the organization to scale and grow. Teams providing CloudOps services can leverage automation and orchestration tools effectively to streamline resource provisioning, configuration, and deployment processes.

Automation increases efficiency and minimizes the risk of human error. Further, automating the provisioning and de-provisioning of cloud resources enables the organization to be more agile in the face of changing business requirements.

Leverage Infrastructure as Code (IaC)

In CloudOps, Infrastructure as Code (IaC) enables the management and provisioning of cloud infrastructure using code-based configurations. With IaC, CloudOps teams can define the desired state of the cloud infrastructure, including virtual machines, networks, storage, security settings, and other resources, using code or configuration files. This code serves as a blueprint that specifies how the infrastructure should be provisioned and configured.

By treating infrastructure as code, CloudOps practitioners can leverage version control systems to track changes, perform code reviews, and collaborate effectively. This ensures consistency and repeatability across deployments and simplifies the process of managing complex cloud environments. IaC allows for rapid infrastructure deployment and scaling, as code-based configurations can be easily replicated and applied across multiple environments.

Establish Continuous Integration & Deployment (CI/CD)

Continuous Integration and Deployment (CI/CD) focuses on automating and streamlining the software development and deployment processes within a cloud environment. Within the CloudOps framework, CI/CD pipelines can be configured to trigger automatically whenever code changes are committed to the repository. These pipelines perform a series of predefined actions, such as code compilation, testing, vulnerability scanning, and packaging. Once the code passes all the necessary tests and checks, it is deployed to the cloud environment, making it available to end-users.

This enables security teams to accelerate the delivery of software updates while maintaining high quality and reducing the risk of deployment failures. CI/CD also promotes collaboration among development, operations, and testing teams, facilitates rapid feedback cycles, and enables teams to respond quickly to changing business requirements and customer needs.

Monitor For Optimal Performance

Performance monitoring in CloudOps involves the continuous monitoring and analysis of the cloud environment to assess the performance of various resources and applications. It helps ensure optimal performance, identify potential bottlenecks or issues, and take proactive measures to maintain a high level of efficiency. CloudOps teams typically monitor for the following key areas:

• Resources – Monitoring for cloud resources such as virtual machines, databases, storage, and network components. Monitoring metrics like CPU usage, memory utilization, network traffic, and disk I/O helps identify resource-intensive processes or potential performance degradation.
• Application performance – Monitor the performance of applications running in the cloud environment. This involves tracking response times, latency, throughput, and error rates to identify any performance issues or anomalies.
• Scalability – Assess the capacity of the cloud environment to handle increased workloads. Determine if the resources can scale dynamically to meet demand and identify potential limitations or constraints that may impact performance during peak periods.
• Alerts, notifications, and historical data – Performance monitoring tools generate alerts and notifications based on predefined thresholds or anomalies. This enables CloudOps teams to receive real-time alerts about performance issues and take immediate action to mitigate potential problems. These tools also collect data over time, allowing for historical analysis and reporting. Teams can use this data to identify trends, patterns, and performance patterns, enabling those responsible for providing CloudOps services to make informed decisions about resource optimization, capacity planning, and performance improvements.

Singularity Cloud | SentinelOne’s Strategy for Securing the Cloud

SentinelOne enables organizations to protect their endpoints across all cloud environments, public, private, and hybrid, through Singularity Cloud. With thousands of accounts spread across multiple clouds, organizations need the right security in place for their cloud infrastructure. Singularity Cloud works by extending distributed, autonomous endpoint protection, detection, and response to compute workloads running in both public and private clouds, as well as on-prem data centers.

• Enterprise-Grade EPP & EDR – Get full endpoint detection and response as well as container coverage in one SentinelOne agent. Singularity Cloud allows for complete container visibility with one agent per node and without pod instrumentation.
• Enterprise Management & Deployment – Choose to auto-deploy Kubernetes Sentinel Agent, a component of Singularity Cloud to EKS, AKS, and GKE clusters, or Linux and Windows Server Sentinel Agents to AWS EC2, Azure VM, and Google Compute Engine.
• AI-Powered Cloud Workload Protection – Behavioral AI detects unknown threats such as zero-day exploits and indicators of compromise consistent with novel ransomware and then quarantines them in real-time. Singularity Cloud protects runtime containers without container interference for Linux, Windows servers, and VMs.

Conclusion

The scalability and flexibility offered by the cloud come with inherent complexities. CloudOps addresses these challenges by providing organizations with the necessary tools and processes to monitor, manage, and optimize their cloud infrastructure. It enables businesses to streamline operations, reduce costs, and improve resource utilization while ensuring high availability and performance.

As businesses rapidly embrace cloud technology to drive innovation and scalability, leaders are prioritizing CloudOps implementation for its effective management of cloud environments. CloudOps brings a holistic approach to cloud management, combining technical expertise, automation, and best practices to optimize performance and build a long-term security posture.

As cloud technology continues to evolve, CloudOps keeps pace with the latest advancements. It embraces emerging technologies such as serverless computing, containerization, and artificial intelligence to drive innovation and unlock new possibilities. CloudOps also enables organizations to adapt quickly to changing business needs and leverage the full potential of cloud services.

SentinelOne can help organizations improve their cloud security strategy through a combination of endpoint detection and response (EDR) capability, autonomous threat hunting, and runtime solutions that can defeat cloud-based threats without compromising agility or availability. Learn more about Singularity Cloud by contacting us for a demo.

We believe that generative AI has the potential to generate massive value and disrupt existing industries and applications. We are now witnessing generative AI accomplish things on a daily basis that just a short time ago did not seem possible.

Generative AI has a meaningful role to play in cybersecurity, both for the good guys and the bad ones. Our motto at SentinelOne has been to be a “Force for Good”, and we intend to be a Force for Good in bringing advanced AI capabilities into cybersecurity as well.

At SentinelOne, AI has always been at the core of what we do – many years ago we introduced static AI detection models as part of our endpoint security platform that vastly improved the ability to detect potential threats versus the previous signature based approaches used in the market up to that point. At RSA 2023, we showcased the power of using generative AI in cyber with our introduction of Purple AI, which turns every security analyst into a super analyst. Purple AI significantly increases analyst productivity by reducing layers of complexity needed in generating insights and automating their ability to take action on threats and other issues surfaced via Purple.

Cybersecurity has a jobs issue, there are simply not enough trained cybersecurity professionals to meet the needs in the market – professionals who are trained to protect your favorite application, service, financial institution, utility, etc. Thus generative AI is just what cybersecurity needs – a force multiplier for security experts, for those on the good side of the equation.

What Have We Learned about Generative AI and Cybersecurity?

So what have we learned about generative AI and cybersecurity? We’ve said before that security is a data problem, and as it turns out, generative AI is ultimately a data problem as well. ChatGPT amazed the world because it provided a highly human compatible interface to the internet’s endless catalog of data. Since then we’ve seen many companies introduce “co-pilots” on top of their existing applications in many sectors – security, CRM, content creation, HR, etc.

The rapid adoption of Generative AI and LLMs technologies brings unique challenges and opportunities to the security space that will be felt in different ways than in other segments. In particular, at the same time that security analysts are gaining access to these productivity/force-multiplying tools, so are hackers and bad actors, which will in time allow them to create and execute attacks like never before. This will make it even more critical for companies to understand and adopt their own AI-based security strategy, in order to thwart a more sophisticated generation of attacks they are likely to see in the not-too-distant future.

Today’s co-pilot AI guides often use a combination of models – from open source, independent commercial LLMs, plus a vendor’s own proprietary models. These proprietary models can be tuned and trained by data specific to that vendor, often data that is gathered by the products and services it currently offers. The tuning and training performed on this data is what makes these models relevant and functional within a particular practice. The co-pilot approaches that ultimately graduate to being a Top Gun solution in their space will bring something truly transformative to their segment.

SentinelOne believes that transformational opportunities for generative AI will be driven by offerings that leverage a corpus of data that go well beyond a single vendor’s product and span an entire area or set of areas. After all, the data and information that defines a process or practice within an industry often spans multiple products.

For example, within security, it is not uncommon for an enterprise to be using between 50-100 different security tools. Today these tools define the customer’s security strategy, operations and collectively house the majority of data relative to this. GenAI’s ability to transform cybersecurity will depend in part on utilizing as much of this data as possible to introduce new capabilities never possible within a single set of tools.

Our goal with Purple AI is to do just that: provide enterprises a way to leverage the vast amount of security data spread across their security tools to create a new superpower against the evolving threat landscape, made possible through our Singularity Security DataLake.

How Does S Ventures Fit In?

So how does S Ventures fit in? We believe generative AI will give rise to an entire new tech stack, spanning core infrastructure, tools and services, and applications. LLMs will form a foundational component of the core infrastructure stack. Given the rarity of talent, funding requirements (for training and tuning new models) and ability to execute there will be a handful of players that can build a business around LLMs, perhaps most analogous to the emergence of AWS, GCP and Azure during the cloud era.

While many of these same players are also highly relevant in generative AI and LLMs today, many enterprise customers have a strong desire to avoid vendor lock-in and for a best of breed independent vendor that can cater to its specific business needs. These customers will want to establish their own unique value proposition with AI and will care about items such as customization, privacy, security, explainability and trust.

While some – particularly smaller and mid-sized customers – may be able to utilize off the shelf models, many larger customers will need more highly custom / configured models tuned for their environment. Customers may also require an enterprise level of support or engagement from their LLM provider, while others may have the sophistication to train and tune a combination of commercial and proprietary models themselves. Like in the previous cloud era, we believe both commercial and open source models will coexist alongside each other.

As part of this we are excited about our recent investment in Cohere, a leading LLM provider. Cohere has a mission – to help enable enterprises to adopt generational AI through the use of LLMs. The company has proven its ability to deliver top performing models. They have a world class technical team, that includes experts who came from GoogleBrain, DeepMind and Meta. As well as a great business team (including former operational execs from some of the largest tech companies in the world such as Google, Amazon, Apple, and Cisco) to help execute on their enterprise strategy.

Cohere understands what enterprises need – customization, data security, quality, a cloud agnostic approach and ability to deploy both on-prem and in the cloud. Cohere’s recent partnership with Oracle is a great early example of this.

We are excited about our investment in Cohere and their strong position to be one of the winners in the generative AI space.

Threat actors are constantly evolving, consistently developing the tools, tactics, and procedures (TTPs) they use in attacks. In today’s threat landscape, enterprises of all sizes and industries find themselves pitted against professional cybercriminal gangs, advanced persistent threat (APT) groups, and even nation-state actors – all of whom are leveraging faster attack methods than ever before.

In addition to sophisticated TTPs and how organized many cybercrime-as-a-service models have become, enterprises also face the reality of how quickly active threats can become full-blown incidents. Speed, in both cybersecurity and cyberattacks, is the key metric to pay attention to as it defines the success of either the attacker or the defender.

This blog discusses the metric of speed in context of modern threat actors, their methods, and how enterprise security teams can shave off critical seconds and minutes in their own detection and response processes.

Threat Actors Are Picking Up Their Speed

Technology has changed dramatically in the last few years alone, becoming smarter, faster, and more advanced. While enterprises use the latest software and tools to further their businesses, threat actors have done the same to level up their attack methods.

Ransomware Attacks

Consider one of the most significant takeaways from Mandiant’s latest M-Trends report: The global median dwell time – the time marking the beginning of an intrusion and the moment it is identified – is dropping year over year. At a mere 16 days of average dwell time for 2022, this may seem like a positive development as threat actors are spending less time inside a system post-entry. However, skyrocketing counts of ransomware attacks on global businesses give a good indication as to why average dwell times are on the decline.

Though some of the reduction in dwell time is attributed to improved detection and response capabilities, ransomware has become a digital pandemic, targeting victims in all industry verticals. Given its high earning potential for a relatively short attack time frame, ransomware attacks are highly lucrative for threat actors and are protected by security experts to continue rising in both frequency and severity.

Drive-By Download Attacks

As their name suggests, drive-by downloads are stealthy, fast, and often happen before the victim even knows what’s happening. This type of cyberattack is employed by cybercriminals to infect a victim’s device with malware without their knowledge or consent. It typically occurs when they visit a compromised website or click on a malicious link embedded in an email or advertisement.

The attack then takes advantage of vulnerabilities in web browsers, plugins, or operating systems, allowing the malware to be automatically downloaded and executed on the victim’s device. Drive-by downloads require only the bare minimum of a victim’s interaction, making them a potent tool for spreading malware, stealing sensitive information, and gaining unauthorized access to systems.

Mass Scanning For Vulnerabilities

Based on new research, security defenders have a real race against the clock to patch new vulnerabilities. Researchers have found that threat actors start to perform mass, internet-wide scans for vulnerable endpoints within just 15 minutes after a new CVE is disclosed. Threat actors consistently monitor vendor bulletins and software update channels for the latest announcements on vulnerabilities and proof of concepts that they can leverage in their next attack. Oftentimes, these fresh vulnerabilities provide them with the capability to perform remote code execution (RCE) and gain access to corporate networks.

Patch management is a continuous and, for many organizations, arduous task that requires security teams to try to keep up with all the latest security threats and issues in various operating systems. Since performing these internet-wide scans do not require a deep skill set, even low-level criminals are able to take advantage, sometimes even selling their scan results to more experienced actors.

Zero-Day Exploits

Threat actors are gaining momentum on how quickly they can exploit zero-days. In a recent Vulnerability Intelligence Report, researchers cited time-to-exploit as being the critical metric for security practitioners. Over the past three years, the time measured between disclosure and known exploitation has decreased steadily, going from 30% of vulnerabilities exploited in the wild within one week in 2020 to 56% found exploited within one week in 2022. Zero-days are most often exploited to provide initial access for ransomware gangs.

Growing Availability of Off-The-Shelf-Tools

Apart from APT groups, full-fledged ransomware gangs, and nation-backed threat actors, low-level cybercriminals are taking their shot on enterprises due to the widening availability of ready-to-use hacking tools. These tools, including exploit kits, infostealers, scanners, password crackers, and attack simulation tools, are commonly available on forums and darknet markets and significantly lower the barrier to launching serious cyberattacks.

As the market for selling pre-made tools continues to expand, cybercriminals with little to no technical expertise are now able to quickly find and purchase pre-existing scripts to launch attacks on computer systems and networks.

Deciphering How Actors Move Across The Cyber Attack Lifecycle

Though cyber threat actors are moving swiftly, there are ways for enterprise businesses to stay ahead and safeguard their critical data and systems. Understanding how actors maneuver before and during their attacks allows defenders to put in the right safeguards in place.

• Planning Phase – Before the act of attack, threat actors will select their target and work to identify exploitable aspects of their operations. This refers to any low hanging fruits such as unpatched vulnerabilities, misconfigurations, administrative users on unprotected devices, and more.
• Initial Intrusion – Based on the findings from the planning phase, threat actors tailor their intrusion technique based on the weaknesses of their victims.
• Enumeration Phase – Once inside, threat actors move fast to situate themselves within the system, understand the limits of their current permissions, and establish an estimate on what privileges they require to start moving laterally. Time is of the essence in this phase as actors start to establish their foothold and upgrade their access.
• Lateral Movement – Using their new credentials, the actors are able to spread deep into the affected system. Here, their main goal is to distribute their malware/toolset, exfiltrating and encrypting data as they go.
• Objective Completion – After deleting or corrupting backups and local files, actors prepare to ransom their victim.

Based on the cyberattack lifecycle, the intrusion and enumeration phases open up a critical window for proactive action by cyber defenders. During these initial stages, the attackers have not yet deeply infiltrated the compromised network or blended in with normal network traffic. If a threat actor manages to make it to the lateral movement phase, detection becomes much more challenging. Threat actors use evasion tactics to avoid detection, embedding themselves deeply within the network. Living-off-the-land techniques are most often used in this phase, leveraging legitimate processes and tools already present in the environment to strengthen their foothold.

Since the time span between intrusion and lateral movement is rapidly shrinking as threat actors become more sophisticated and well-equipped, the primary goal for cyber defenders is to focus on detecting the first signs of compromise during the enumeration phase and isolating the threat before it can cause significant damage.

Autonomous Tools Take the Toil Out of Triage

Managing such a challenge, however, is often beyond the resources of a security team tasked with manual triage of a flood of alerts and uncontextualized event data. That’s why autonomous, AI-powered EDR and XDR solutions are the new go-to tools for analysts, threat hunters and incident responders alike.

A modern security tool like SentinelOne Singularity not only autonomously deals with known malware threats – from detection right through to mitigation and even rollback in the case of a ransomware attack that gets through – but also provides incident responders with contextualized data to tackle targeted attacks.

With automated contextual enrichment from tools such as Singularity XDR, IR teams can take advantage of insights from aggregated event information that combines all related data gathered from multiple tools and services into a single ‘incident’, without adding extra tools or more people. Out-of-the-box integrations and pre-tuned detection mechanisms across the security stack help improve productivity, threat detection, and forensics.

SentinelOne Vigilance Respond | Our Approach to Managed Detection & Response (MDR)

While powerful, such tools can be supplemented by Managed Detection and Response services for an even higher level of security. Organizations across the globe rely on SentinelOne’s Managed Detection and Response (MDR) service, Vigilance Respond, to stop threat actors from reaching the lateral movement stage in attacks. Utilizing SentinelOne Singularity, Vigilance Respond defends networks against cyberattacks instantly and monitors customer environments 24/7/365, hunting for advanced threats and providing faster mean-time-to-response (MTTR) rates.

Vigilance Respond works by providing machine-speed detection technology run by dedicated analysts working around-the-clock. It also allows organizations to adapt instantly, and at scale, in today’s ever-shifting threat landscape, closing the gap between intrusion and lateral movement and neutralizing the threat actor before they can begin to spread deep into a target’s systems.

Vigilance Respond offers these services to ensure businesses are safeguarded:

• Active threat campaign hunting for APTs
• Alerting and remediation guidance for emerging threats
• Incident-based triage and hunting
• 24/7/365 monitoring, triage, and response
• Security Assessment (Vigilance Respond Pro)
• Digital Forensics Investigation & Malware Analysis (Vigilance Respond Pro)

Conclusion

In the realm of cybersecurity, speed matters. It can be the deciding factor between successfully thwarting an attack or suffering substantial damage. As technology evolves and threat actors become more adept at exploiting vulnerabilities, enterprise leaders are investing in strategies focused on swift and proactive cybersecurity response measures.

Ultimately, speed in cybersecurity is about staying one step ahead of the adversaries. It requires a proactive approach, continuous monitoring, and real-time threat intelligence. By prioritizing speed, organizations can enhance their ability to detect, respond to, and mitigate cyber threats, ensuring a stronger and more resilient security posture.

Learn more about how SentinelOne Singularity and Vigilance Respond can help safeguard your business by contacting us or requesting a demo.

In partnership with vx-underground, SentinelOne recently ran its first Malware Research Challenge, in which we asked researchers across the cybersecurity community to submit previously unpublished work to showcase their talents and bring their insights to a wider audience.

Today’s post marks the start of a series highlighting the best entries, beginning with the winner from Pol Thill.

This in-depth and meticulous research into a cybercrime threat actor targeting thousands of clients of financial institutions makes a significant contribution to our understanding of the cybersecurity landscape and is the worthy winner of our challenge.

Executive Summary

• Neo_Net has been conducting an eCrime campaign targeting clients of prominent banks globally, with a focus on Spanish and Chilean banks, from June 2021 to April 2023.
• Despite using relatively unsophisticated tools, Neo_Net has achieved a high success rate by tailoring their infrastructure to specific targets, resulting in the theft of over 350,000 EUR from victims’ bank accounts and compromising Personally Identifiable Information (PII) of thousands of victims.
• The campaign employs a multi-stage attack strategy, starting with targeted SMS phishing messages distributed across Spain and other countries, using Sender IDs (SIDs) to create an illusion of authenticity and mimicking reputable financial institutions to deceive victims.
• Neo_Net has established and rented out a wide-ranging infrastructure, including phishing panels and Android trojans, to multiple affiliates, sold compromised victim data to third parties, and launched a successful Smishing-as-a-Service offering targeting various countries worldwide.

Introduction

An extensive eCrime campaign has been observed targeting clients of prominent banks around the world from June 2021 to April 2023. Notably, the threat actors have predominantly focused on Spanish and Chilean banks, with 30 out of 50 targeted financial institutions headquartered in Spain or Chile, including major banks such as Santander, BBVA and CaixaBank. Banks targeted in other regions include Deutsche Bank, Crédit Agricole and ING. A complete list can be found in Appendix A at the end of this post.

Despite employing relatively unsophisticated tools, the threat actors have achieved a high success rate by tailoring their infrastructure to their specific targets. The campaign has resulted in the theft of over 350,000 EUR from victims’ bank accounts, along with the compromise of a significant amount of Personally Identifiable Information (PII), including telephone numbers, national identity numbers, and names from thousands of victims.

The mastermind behind this operation, known as Neo_Net, has established and rented out a wide-ranging infrastructure, including phishing panels, Smishing software, and Android trojans to multiple affiliates, sold compromised victim data to interested third parties, and has even launched a successful Smishing-as-a-Service offering that targets various countries worldwide. This report will provide a detailed overview of the campaign and delve into the background of Neo_Net, shedding light on his operations over the years.

eCrime Campaign against Financial Institutions

The campaign employed a sophisticated multi-stage attack strategy that commenced with targeted SMS phishing messages distributed across Spain using Neo_Net’s proprietary service, Ankarex. These messages leveraged Sender IDs (SIDs) to create an illusion of authenticity, mimicking reputable financial institutions in an attempt to deceive the victims.

The SMS messages employed various scare tactics, such as claiming that the victim’s account had been accessed by an unauthorized device or that their card had been temporarily limited due to security concerns. The messages also contained a hyperlink to the threat actor’s phishing page.

The phishing pages were meticulously set up using Neo_Net’s panels, PRIV8, and implemented multiple defense measures, including blocking requests from non-mobile user agents and concealing the pages from bots and network scanners. These pages were designed to closely resemble genuine banking applications, complete with animations to create a convincing façade:

Upon submission of their credentials, the victims’ information was surreptitiously exfiltrated to a designated Telegram chat via the Telegram Bot API, granting the threat actors unrestricted access to the stolen data, including the victims’ IP addresses and user agents.

Subsequently, the threat actors employed various techniques to circumvent the Multi-Factor Authentication (MFA) mechanisms commonly employed by banking applications. One such approach involved coaxing victims into installing a purported security application for their bank account on their Android devices.

However, this application served no legitimate security purpose and merely requested permissions to send and view SMS messages.

In reality, these Android trojans functioned as modified versions of the publicly available Android SMS spyware known as SMS Eye. Some threat actors further obfuscated the trojan using public packers to evade detection by anti-malware solutions. These Android trojans covertly exfiltrated incoming SMS messages to a distinct dedicated Telegram chat.

The exfiltrated messages could then be utilized to bypass MFA on the targeted accounts by capturing One-Time Passwords (OTPs). Additionally, the threat actors were also observed employing direct phone calls to victims, possibly to impersonate bank representatives and deceive victims into installing the Android spyware or divulging OTPs.

The threat actors employed this method to target clients of several prominent banks around the world.

The funds illicitly acquired from victims during the course of the year-long operation amounted to a minimum of 350,000 EUR. However, it is probable that the actual sum is significantly higher, as older operations and transactions that do not involve SMS confirmation messages may not be fully accounted for due to limited visibility.

Neo_Net

Neo_Net, the prominent actor responsible for the global cybercrime campaign, has been active in the cybersecurity landscape at least since early 2021. He maintains a public GitHub profile under the name “notsafety” and a Telegram account that showcases his work and identifies him as the founder of Ankarex, a Smishing-as-a-Service platform.

Through his contributions on Telegram, Neo_Net has been linked to the “macosfera.com” forum, a Spanish-language IT forum. Email addresses registered with the forum’s domain were found in relation to several phishing panels created by Neo_Net, targeting Spanish banks and other institutions. These email addresses were used as usernames for the panels, suggesting that Neo_Net may have collaborated with individuals from this forum to set up his infrastructure. The phishing panels also clearly indicate Neo_Net as the creator, with his signature on top of the php files.

Ankarex

Neo_Net’s main creation is the Ankarex Smishing-as-a-Service platform, which has been active since at least May 2022. The Ankarex News Channel on Telegram, which advertises the service, currently has 1700 subscribers and regularly posts updates about the software, as well as limited offers and giveaways.

The service itself is accessible at ankarex[.]net, and once registered, users can upload funds using cryptocurrency transfers and launch their own Smishing campaigns by specifying the SMS content and target phone numbers. Ankarex currently targets 9 countries but has historically operated in additional regions.

In addition to the Smishing service, Neo_Net has also offered leads, including victims’ names, email addresses, IBANs, and phone numbers for sale on the Ankarex Channel. He has also advertised his Android SMS spyware service to selected members. Notably, every channel created to exfiltrate the captured SMS messages has Neo_Net listed as an administrator, and several package names of the Android trojans allude to their creator with names such as com.neonet.app.reader. It is likely that Neo_Net rented his infrastructure to affiliates, some of whom have been observed working with him on multiple unique campaigns, allowing them to conduct phishing and funds transfers independently.

Throughout his year-long operation, Neo_Net has been traced back to several unique IP addresses, indicating that he currently resides in Mexico. Neo_Net primarily operates in Spanish-speaking countries and communicates predominantly in Spanish with his affiliates. Communication in the Ankarex channel is almost exclusively done in Spanish.

However, Neo_Net has also been observed collaborating with non-Spanish speakers, including another cybercriminal identified by the Telegram handle devilteam666. This particular operation involved the use of Google Ads targeting crypto wallet owners, and devilteam666 continues to offer malicious Google Ads services on his Telegram channel.

Conclusion

Despite employing mostly unsophisticated tools and techniques, such as simple SMS spyware and phishing panels, Neo_Net and his affiliates have managed to steal hundreds of thousands of euros and compromise the personally identifiable information (PII) of thousands of victims worldwide. The success of their campaigns can be attributed to the highly targeted nature of their operations, often focusing on a single bank, and copying their communications to impersonate bank agents. Furthermore, due to the simplicity of SMS spyware, it can be difficult to detect, as it only requires permission to send and view SMS messages.

Neo_Net has also been observed reusing compromised PII for further profit. A significant amount of eCrime against mobile users in Spain over the past two years can be directly traced back to Neo_Net’s operation, including his phishing panels, Smishing-as-a-Service platform, and Android trojans.

These campaigns highlight that while Multi-Factor Authentication is robust, it can be circumvented if it relies on SMS, and that physical tokens or external applications would provide better protection in such cases.

Acknowledgments

Special thanks go to @malwrhunterteam who posted about several samples used in this campaign on his Twitter account.

Appendix A: Targeted Financial Institutions

• Spain: Santander, BBVA, CaixaBank, Sabadell, ING España, Unicaja, Kutxabank, Bankinter, Abanca, Laboral Kutxa, Ibercaja, BancaMarch, CajaSur, OpenBank, Grupo Caja Rural, Cajalmendralejo, MoneyGo, Cecabank, Cetelem, Colonya, Self Bank, Banca Pueyo
• France: Crédit Agricole, Caisse d’Epargne, La Banque postale, Boursorama, Banque de Bretagne
• Greece: National Bank of Greece
• Germany: Sparkasse, Deutsche Bank, Commerzbank
• United Kingdom: Santander UK
• Austria: BAWAG P.S.K.
• Netherlands: ING
• Poland: PKO Bank Polski
• Chile: BancoEstado, Scotiabank (Cencosud Scotiabank), Santander (officebanking), Banco Ripley, Banco de Chile, Banco Falabella, Banco de Crédito e Inversiones, Itaú CorpBanca
• Colombia: Bancolombia
• Venezuela: Banco de Venezuela
• Peru: BBVA Peru
• Ecuador: Banco Pichincha
• Panama: Zinli
• USA: Prosperity Bank, Greater Nevada Credit Union
• Australia: CommBank

Appendix B

Indicators of Compromise

Phishing Domains

bbva.info-cliente[.]net
santander.esentregas[.]ga
bbva.esentregas[.]ga
correos.esentregas[.]ga

Appendix C: MITRE ATT&CK Tags