Ransoms Without Ransomware, Data Corruption and Other New Tactics in Cyber Extortion

/0 Comments/in /by

Much like legitimate businesses, ransomware operators adjust their operational strategies to achieve results while managing time and resources, and defenders are required to track these shifting strategies to maintain effective protection. Presently, we are observing an evolution in how cyber criminals approach the business of extorting money from organizations.

Ransomware actors have turned toward data theft instead of time-expensive encryption, and importantly, the anatomy of modern extortion attacks involves operators taking different approaches to data destruction from full encryption to partial encryption to no encryption – and, thus, no ransomware – at all. What the cybersecurity industry generally refers to as ‘ransomware operators’ must now be thought of as a subset of a larger group of data extortion actors who occupy different positions on this spectrum of data destructiveness.

In this post, we describe this emerging spectrum of data-focused threat actors to help defenders better understand the continuing development of data extortion tactics, techniques, and procedures (TTPs).

Data Destructiveness | A Growing Spectrum

Starting first from opportunistic attempts for easy profit, ransomware has morphed into full-scale cybercrime syndicates targeting governments and critical infrastructures globally. Ransomware-as-a-Service (RaaS) programs are now prolific on the dark web, connecting low to mid-level actors with ransomware developers. Not only are these programs easy to access and cheap, they are also mature, operating like any other legitimate organization by offering technical support and flexible service models.

Thinking of ransomware as simple encryption of randomly stolen data, however, is not an accurate representation of the plethora of data extortion strategies we see today. Trends now indicate that full encryption of victim data is often too arduous and slow for many threat actors, and increases the risk of detection. With double and triple extortion becoming standard in the ransomware scene – the stolen data being the pivotal element  –  we see threat actors occupying different positions on a spectrum of data destructiveness.

At one end of the spectrum are threat actors that do not destroy data at all and therefore spend no time on this activity – they only steal data that is valuable to victims as a means to extort them. At the other end of this spectrum are actors that use traditional ransomware to do full, but relatively slow, encryption to destroy data completely. The rest of the spectrum is populated by actors that steal data and either partially or fully destroy it to damage their victim’s infrastructure, thus gaining additional leverage over them.

Data Destructiveness Spectrum
The data destructiveness spectrum

Ransoms Without Ransomware

This strategy is exemplified by two relatively recent threat groups, Karakurt and Lapsus$. Both leverage data extortion-only methods in their campaigns. Neither group deploys ransomware on compromised systems. Instead, they exfiltrate data and use the stolen data as leverage, joining the ranks of groups such as Marketo and Bl@ckT0r.

The Twitter profile @Mannus Gott introducing Marketo (source: Digital Shadows)
The Twitter profile @Mannus Gott introducing Marketo (source: Digital Shadows)

Karakurt typically gains access to networks through initial access brokers (IABs) or by exploiting vulnerabilities in internet-exposed network services such as outdated Fortinet FortiGate SSL VPN appliances. The threat group is considered to be the data extortion arm of the now defunct Conti syndicate. Karakurt has targeted victims across all industries and geographical regions.

Karakurt sends victim-specific emails to employees revealing that data has been stolen while threatening that the data will be leaked to competitors or auctioned online. The extortion note contains employee names and indicates that Karakurt has spent a considerable amount of time locating data that is valuable to the victim organization to ensure the group’s extortion leverage.

Karakurt extortion note
Karakurt extortion note (trimmed for brevity)

In contrast to Karakurt, Lapsus$ uses stolen credentials and phishing to gain initial access to networks. The group then uses SIM-swapping, social engineering, and solicitation methods to bypass multi-factor authentication (MFA).

Lapsus$ has recently targeted victims in the high-tech industry, notably Nvidia, Samsung, Okta, Microsoft, and Ubisoft. The threat group is also known to attack organizations specifically to gain access to their customers. Such has been the case with the Okta breach in early 2022. It is interesting to note that Lapsus$ conducts data extortion campaigns not only for financial gains, but also to increase their notoriety.

Extortion Through Data Corruption

Some ransomware operators are now implementing data destruction techniques that are more lightweight and time-efficient than data encryption. Through data corruption,  operators are capable of driving urgency in their victims as well as escalating their ransom request.

Exemplifying this is the new version of the Exmatter data exfiltration tool which corrupts data by replacing a data chunk of a file with a data chunk from another file. This change in the implementation of Exmatter strongly suggests the beginning of a new trend in ransomware operations where threat actors seek to corrupt data instead of encrypting it.

Exmatter corrupts a file
Exmatter corrupts a file (source: Stairwell)

Data corruption is faster than full encryption and the code is significantly easier to develop, since there is no need to worry about reversing the damage after the victim pays up. Data corruption further eliminates the possibility of security researchers developing decryptors that exploit flaws in ransomware encryption schemes, such as occurred with the Lorenz and MafiaWare666 ransomware strains. In short, corruption allows threat actors to save time and effort while improving their chances of a successful payout.

The Growing Trend of Partial Encryption

An increasing number of ransomware operations have joined the trend of partial or intermittent encryption that the LockFile ransomware started in mid-2021. A previous SentinelLabs article reviewed recent ransomware families that conduct intermittent encryption, such as BlackCat, BlackBasta, Agenda, and Qyick.

Royal ransomware is a new member of the ransomware scene which employs partial file encryption methods. This ransomware skips the encryption of file content blocks 10 times – the total number of the encrypted bytes between the blocks which amounts to the percentage that the ransomware operator has configured through the ep command-line parameter.

The new Royal ransomware conducts intermittent encryption (the null bytes represent non-encrypted file content)
The new Royal ransomware conducts intermittent encryption (the null bytes represent non-encrypted file content)

Partial encryption allows ransomware actors to destroy data faster than with full encryption. The gains in time are especially noticeable when it comes to encrypting large files, where the time spent on encryption per file is reduced in the order of minutes.

Partial encryption may also help threat actors to evade security mechanisms that detect ransomware by monitoring the intensity of file IO operations or by evaluating the similarity between non-encrypted and encrypted versions of a given file, for example, based on Chi-squared or data entropy measures.

What’s Next for Data Extortion?

Changes in the threat landscape have created differing trends in how data is leveraged to increase the chance of successful ransom. We predict that data extortion actors, including ransomware operators, will continue to occupy different positions on the data destructiveness spectrum.

Ransomware actors that steal data to extort their victims also aim to gain additional leverage by damaging the targeted infrastructure, disrupting business services and causing both reputational harm and financial loss. This type of actor will likely continue to resort to a combination of data destruction techniques, corrupting or partially encrypting large files where speed is of the essence, but continuing to fully encrypt others. Some actors may focus more on corruption to avoid potential implementation flaws in encryption schemes.

Meanwhile, extortion actors that seek to use the value of stolen data without conducting any encryption at all are set to gain further momentum within the threat landscape.

We also anticipate the emergence of a hybrid model amongst threat actors that will allow them to switch between conducting data theft only and using a more traditional data-destructive ransomware approach. At the core of this model is the value of the stolen data. Depending on its value, threat actors will evaluate whether or not it is sufficient as the only means of extortion leverage.

Conclusion

The profitability of the ransomware industry has given way to a multitude of extortion methods. What’s emerged is a spectrum of threat actors who are moving past traditional, time-consuming encryption focused on destroying all stolen data. Now, actors are seen prioritizing faster attacks either through data extortion, where the data is more or less preserved, or only partial corruption allowing them to move quickly and demand increasingly larger ransom demands.

This spectrum of attack methods is the result of a gradual process, influenced by the development of decryption and other malware-detection capabilities as well as the professionalization of malicious actors themselves. As demonstrated by the trends outlined in this post, actors have clear ambitions and continue to adjust their methodologies and tactics to capitalize on the most likely targets and payouts.

Building Blocks for Your XDR Journey, Part 2 | Why EDR Is the Cornerstone for Great XDR 

/0 Comments/in /by

XDR, or eXtended Detection and Response, has been gaining a lot of buzz and traction in recent years. XDR promises a comprehensive view of an organization’s security posture and the ability to quickly detect and respond to threats. This multi-part blog series provides an overview and guidance on developing a successful cybersecurity strategy for any organization implementing or planning to implement XDR.

In Part 1, we focused on why organizations need to extend protection beyond the endpoint to stay ahead of adversaries. In Part 2, we look at why Endpoint Detection and Response (EDR) is a foundation and a cornerstone for any XDR strategy an organization plans to implement.

Over the last few years, XDR has emerged as a simpler and more efficient way to deal with the broad array of threats that security teams currently face. It is not necessarily a product that customers buy but a strategy and a new way of managing security.

An XDR platform, in effect, aims to collect and correlate data across a broad array of network and security surfaces, including servers, endpoints, cloud workloads, network intrusion prevention systems, identity and access management products, email, and more. It analyses the data it collects, consolidates multiple alerts into a single incident, combines “weak” signals into detections, and then responds across multiple security tools.

That said, XDR is not a new idea. This is what older technologies, such as SIEM promised but were never able to truly deliver.

Why SIEM Tools Failed To Meet Expectations

SIEM tools are all about ingesting as much data as they can, often driven by compliance use cases rather than security. However, this is the very reason organizations struggle so much with SIEMs. With so much data being generated, it’s hard to sift through everything and find the needle in the haystack.

Why SIEM did not fit the bill revolves around a few key factors. Firstly, SIEM solutions are designed to ingest and aggregate log data from different sources. This data is then difficult to sift through and piece together, especially when trying to find the root cause of an issue. Secondly, some SIEM vendors have added rudimentary analytics functionality to their products, but this is not enough to address concerns accurately. Further, SIEM solutions are focused on analysis after an incident rather than detecting an incident and are often one-directional, without any ability to control or respond. Security teams are often forced to rely on manual intervention when using SIEM solutions, which can lead to errors and delays in addressing issues.

Given these challenges, it’s understandable that SIEM has failed to address modern security threat detection concerns effectively.

This is where XDR solutions come in. XDR is not about collecting as much data as possible. It’s about being strategic and only collecting the data that is most relevant. This way, you can more easily identify patterns and anomalies. Compared to older tools and technologies, XDR provides higher fidelity and confidence and allows security teams to identify and eliminate security vulnerabilities without adding extra tools or more people.

An XDR platform aims to solve the challenges of a SIEM tool by effective detection and response to targeted attacks. This is not to say that SIEM tools are not needed in an enterprise security stack. SIEMs have been and are useful in solving a number of use cases like log management, compliance, data aggregation, and analytics.

How Endpoint Threat Data Is Crucial for XDR

While XDR and SIEM are tangentially related, the new technology has more in common with EDR. In fact, XDR is an evolution of EDR that broadens the scope of detection far beyond endpoints. XDR builds on the threat detection and response capabilities of EDR and extends it across multiple security tools

“Good XDR lives and dies by the foundation of good EDR.”
– Forrester Report: Adapt or Die: XDR Is on a Collision Course with SIEM and SOAR

EDR-based XDR platforms provide security teams with the visibility and analytical capabilities needed to detect and contain advanced attacks. Endpoints are a critical part of any organization’s cybersecurity posture. They are often the first point of entry for attackers and can be used to move laterally through a network.

Endpoint telemetry is, therefore, essential for detecting compromised assets, correlating threat data across domains, and isolating complex attacks. Endpoints can provide visibility into all aspects of an attack, from the initial infiltration to the final data exfiltration. In order to effectively detect and respond to threats, organizations need to have a comprehensive endpoint security solution in place.  Endpoints are also where the majority of the “response” is needed.

XDR data is gathered from a variety of sources, including endpoint devices, network traffic, and user activity. EDR solutions use this data to identify malicious activity, track the progress of an attack, and determine the root cause of an incident. This information is essential for security teams to contain and remediate attacks quickly. And it’s just as important to extend the response across the entire security stack.

A Strong XDR Builds on the Power of Strong EDR

“I want to replicate what is working with EDR to other areas in my organization.” – Cybersecurity & Technology Leader Global Pharmaceuticals

XDR is taking what works currently in organizations with endpoints and extending it to other attack surfaces. It unifies visibility and control across all connected security platforms, which provides context around potential threats that make remediation efforts easier. It also allows security teams to react faster because of the correlation of data from multiple security vectors. With improved triage and automated contextual enrichment, teams can respond more quickly before the scope of the threat broadens. Out-of-the-box integrations and pre-tuned detection mechanisms across multiple different products and platforms help improve productivity, threat detection, and forensics.

SentinelOne’s Singularity XDR lets analysts take advantage of insights from aggregated event information gathered from multiple tools and services and combine it into a single, contextualized ‘incident.’ It also provides customers with a central enforcement and analytics layer point hub for complete enterprise visibility and autonomous prevention, detection, and response, helping organizations address cybersecurity challenges from a unified standpoint.

Parting Thoughts

To get the maximum out of XDR, it needs to be part of a larger strategy to improve security outcomes. XDR is a means to an end, and as part of the XDR journey, organizations should look at what outcomes they want to achieve with XDR. At a macro level, the XDR solution should, at minimum, help to:

  • Improve your security efficacy
  • Deliver a single plane for your security needs
  • Maximize the value of your existing security investments Improve SecOps efficiency
  • Deliver measurable outcomes

XDR is the natural progression of EDR, moving beyond the endpoint to the rest of the security infrastructure, including identity and cloud security. XDR can help organizations to improve their detection and response capabilities, but only if it is implemented correctly.

When implementing XDR, organizations should focus on their specific needs and objectives and choose the vendors, products, and services that will best meet those needs. In order to get the benefit from XDR, it’s vital to have a platform that can integrate existing tools to get the benefits early. Only then will they be able to fully leverage the power of XDR. SentinelOne provides that vision and strategy to help organizations deliver on the promise of XDR and protect the whole organization.

If you would like to learn more about SentinelOne Singularity XDR platform, contact us for more information or request a free demo.

SentinelOne Singularity XDR
Supercharge. Fortify. Automate. Extend protection with unfettered visibility, proven protection, and unparalleled response. Discover the power of autonomous with Singularity XDR.

Learn More

How Card Skimming Disproportionally Affects Those Most In Need

/0 Comments/in /by

When people banking in the United States lose money because their payment card got skimmed at an ATM, gas pump or grocery store checkout terminal, they may face hassles or delays in recovering any lost funds, but they are almost always made whole by their financial institution. Yet, one class of Americans — those receiving food assistance benefits via state-issued prepaid debit cards — are particularly exposed to losses from skimming scams, and usually have little recourse to do anything about it.

California’s EBT card does not currently include a chip. That silver square is a hologram.

Over the past several months, authorities in multiple U.S. states have reported rapid increases in skimming losses tied to people who receive assistance via Electronic Benefits Transfer (EBT), which allows a Supplemental Nutrition Assistance Program (SNAP) participant to pay for food using SNAP benefits.

When a participant uses a SNAP payment card at an authorized retail store, their SNAP EBT account is debited to reimburse the store for food that was purchased. EBT is used in all 50 states, the District of Columbia, Puerto Rico, the Virgin Islands, and Guam.

EBT cards work just like regular debit cards, in that they can be used along with a personal identification number (PIN) to pay for goods at participating stores, and to withdraw cash from an ATM.

However, EBT cards differ from debit cards issued to most Americans in two important ways. First, most states do not equip EBT cards with smart chip technology, which can make payment cards much more difficult and expensive for skimming thieves to clone.

Alas, it is no accident that all of the states reporting recent spikes in fraud tied to EBT accounts — including California, Connecticut, Maryland, Pennsylvania, Tennessee, and Virginia appear to currently issue chip-less cards to their EBT recipients.

The Massachusetts SNAP benefits card looks more like a library card than a payment card.  Oddly enough, both are reliant on the same fundamentally insecure technology: The magnetic stripe, which stores cardholder data in plain text that can be easily copied.

In September, authorities in California arrested three men thought to be part of a skimming crew that specifically targeted EBT cards and balances. The men allegedly installed deep insert skimmers, and stole PINs using tiny hidden cameras.

“The arrests were the result of a joint investigation by the Sheriff’s Office and Bank of America corporate security,” reads a September 2022 story from The Sacramento Bee. “The investigation focused on illegal skimming, particularly the high-volume cash-out sequence at ATMs near the start of each month when Electronic Benefits Transfer accounts are funded by California.”

Armed with a victim’s PIN along with stolen card data, thieves can clone the card onto anything with a magnetic stripe and use it at ATMs to withdraw cash, or as a payment instrument at any establishment that accepts EBT cards.

Skimming gear seized from three suspects arrested by Sacramento authorities in September. Image: Sacramento County Sheriff’s Office.

Although it may be shocking that California — one of America’s wealthiest states — still treats EBT recipients as second-class citizens by issuing them chip-less debit cards, California behaves like most other states in this regard.

More critical, however, is the second way SNAP cards differ from regular debit cards: Recipients of SNAP benefits have little to no hope of recovering their funds when their EBT cards are copied by card-skimming devices and used for fraud.

That’s because in the SNAP program, federal law bars the states from replacing SNAP benefits using federal funds. And while some of these EBT cards have Visa or MasterCard logos on them, it is not up to those companies to replace funds in the event of fraud.

Victims are encouraged to report the theft to both their state agency and the local police, but many victims say they rarely receive updates on their cases from police, and, if they hear from the state, it’s usually the agency telling them it found no evidence of fraud.

Maryland’s EBT card.

That’s according to Brenna Smith, a reporter at The Baltimore Banner who recently wrote about the case of a Maryland mother of three who lost nearly $3,000 in SNAP benefits thanks to a skimmer installed at a local 7-Eleven. Maryland [Department of Human Services] spokesperson Katherine Morris told the Banner there was evidence of “a nationwide EBT card cloning scheme.”

The woman profiled in Smith’s story contacted all of the retailers where her EBT card was used to buy thousands of dollars worth of baby formula. Two of those retailers agreed to share video surveillance footage of the people making the purchases at the exact timestamps specified in her EBT account history: The videos clearly showed it was the same fraudster making both purchases with a cloned copy of her EBT card.

Even after the police officer assigned to the victim’s case confirmed they found a skimmer installed at the 7-Eleven store she frequented, her claim — which was denied — is still languishing in appeals months later.

(Left) A video still showing a couple purchasing almost $1,200 in baby formula using SNAP benefits. (Right) A video still of a woman leaving from the CVS in Seat Pleasant. Image: The Baltimore Banner.

The Center for Law and Social Policy (CLASP) recently published Five Ways State Agencies Can Support EBT Users at Risk of Skimming. CLASP says while it is true states can’t use federal funds to replace benefits unless the loss was due to a “system error,” states could use their own funds.

“Doing so will ensure families don’t have to go without food, gas money, or their rent for the month,” CLASP wrote.

That would help address the symptoms of card skimming, but not a root cause. Hardly anyone is suggesting the obvious, which is to equip EBT cards with the same security technology afforded to practically everyone else participating in the U.S. banking system.

There are several reasons most state-issued EBT cards do not include chips. For starters, nobody says they have to. Also, it’s a fair bit more expensive to produce chip cards versus plain old magnetic stripe cards, and many state assistance programs are chronically under-funded. Finally, there is no vocal (or at least well-heeled) constituency advocating for change.

All Eyes on Cloud | Why the Cloud Surface Attracts Attacks

/0 Comments/in /by

Cloud environments have seen a meteoric rise in the past decade. What began as means of data storage has now become a full-scale computing platform, enabling a global shift in how businesses share, store, optimize, and manage information. However, threat actors have witnessed these changes and taken to targeting the cloud, knowing that more and more businesses continue to make the transition to hybrid workspaces and cloud technologies.

The same features that make cloud services beneficial to organizations are the same that make them attractive to threat actors. In recent years, attacks on cloud environments have surged as threat actors took advantage of the high volumes of sensitive data flowing between organizations and their cloud service providers. Opportunistic by nature, threat actors thrive off of weak credentials, misconfiguration, and human errors when it comes to planning their attacks on the cloud surface.

While the related security challenges haven’t slowed cloud adoption, organizations should be aware of their scope, significance, and how to secure against them. This blog post outlines why cloud has emerged as one of the most attacked surfaces and what security measures businesses can implement to safeguard their cloud environment and data.

Cloud Attacks Are Rising

The number of reported attacks on clouds has increased dramatically in the last few years, in part spurred on by the COVID-19 pandemic when businesses of all sizes needed to adapt quickly to alternative means of operation.

According to Gartner, the pandemic along with a surge in digital services have made cloud the “centerpiece of new digital experiences”, and global cloud revenue will total $474 billion this year – a $66 billion dollar increase from 2021. The research firm also predicts that more than 95% of new digital workloads will be deployed on cloud-native platforms resulting in a 30% increase from the year before.

Businesses need to plan beyond traditional security strategies to manage a widening enterprise attack surface as well as the risks associated with cloud services. The following statistics show the rise in cloud adoption and just how much clouds have come under attack in the last few years:

  • 69% of organizations have accelerated their cloud migration in the last 12 months. The percentage of organizations with most or all of their IT infrastructure in the cloud is expected to increase from 41% to 63% in the next 18 months (Foundry, 2022).
  • 49% of IT professionals reported that cloud-based attacks led to unplanned expenses.
  • 80% of CISOs surveyed by PurpleSec were unable to identify instances of excessive access to data in their cloud environments.
  • 79% of organizations have suffered at least one cloud-based data breach in the last 18 months. Further, 43% have reported 10 or more breaches within that same time frame (Emertic, 2021).
  • 83% of cloud breaches are derived from access-related vulnerabilities (CyberTalk.org, 2021).

Understanding Cloud Risks

Using cloud services inherently exposes organizations to new security challenges, often related to unauthorized access, insider threats, and supply chain risks. To a threat actor, cloud vulnerabilities are means of gaining access to exfiltrate data from the targeted organization’s network whether by service disruptions, ransomware, or unauthorized data transfer. More sophisticated threat actors may employ lateral movement and detection evasion techniques, or account takeovers to establish and maintain a long-term foothold within the targeted network before leveraging existing services and tools found within it.

Common cloud security risks include the following:

  • User Account Takeovers – Whether credentials are stolen through phishing, brute force, or malware, weak password policies often lead to compromised user accounts.
  • Misconfiguration – Cloud service providers offer different tiers depending on the needs of the organization. This allows the cloud to work to scale with the organization. However, many organizations lack the security posture needed to ensure the safety of these services, resulting in security risks in the deployment stage of implementation. Misconfigured servers are a leading cause of compromise when it comes to cloud-based attacks.
  • Vulnerable Public APIs – Public APIs allow trusted users to interact and operate within the cloud. If exploited, these APIs become a straightforward method for threat actors to gain access to the platform and exfiltrate sensitive data in the cloud database. Further, if the original configuration of the API harbors any vulnerabilities, this leaves threat actors with a backdoor for future exploits.
  • Insider Threats – Even organizations with a healthy cyber ecosystem can fall victim to a legitimate, malicious user with a mind to leak data. Malicious users often already have access to sensitive or critical data, and may also have the permissions to remove certain security protocols. The threat of malicious insiders is greatly minimized through zero-trust policies and identity and access management solutions.
  • Denial-of-Service (DoS) Attacks – Designed to overload a system and bar users from accessing services, DoS attacks are especially devastating to cloud environments. When the workload increases in a cloud environment, it will provide extra computational power to address the extra load. Eventually, the cloud slows down and legitimate users lose their access to any files in the cloud.
  • Third-Party Vendors – It is important for organizations to assess third-party risks when using vendor services. Clouds are susceptible to supply chain attacks when threat actors infiltrate a network through unsecured third-parties that work with the organization. Cyber risk is inherited when organizations choose to work with vendors who have more lax cybersecurity posture than their own.

Defending the Cloud – Cyber Hygiene Matters

Securing the cloud begins with the basics. Cloud environments require short and long-term security planning, implementation, and strategy, and practicing cyber hygiene is the first step of that strategy.

Organizations that have processes in place for strong password requirements, multi-factor authentication, patch management, software updates, and device security can impede threat actors from grabbing those low-hanging fruits and lessen the attack surface under target.

Cover the Bases with Zero Trust & Segmentation

There is no such thing as immunity from cyber attack, but implementing zero trust policies goes a long way when building a holistic defense against threat actors who are eyeing a vulnerable cloud. Threat actors cause the most damage when they are able to move laterally through a victim’s network and escalate privileges along the way.

Adopting zero trust makes life more difficult for threat actors. The zero trust principle works by eliminating the concept of ‘trust by default’. Implementation of zero trust requires each user and machine to authenticate before receiving only the specific access pre-determined for their role.

Network segmentation plays an important part in successful zero trust implementation as well. By segmenting networks into smaller subnets that each act like their own, independent network, administrators can better control and secure the flow of traffic between each one via granular rules. This approach breaks up the architecture of a network and allows administrators to pinpoint technical issues more easily and be able to improve monitoring efforts.

Develop a Cloud Operational Strategy

Clouds are, at their core, designed to help businesses scale and store data, not to provide security. For many organizations, clouds are managed by DevOps and CloudOps teams rather than the in-house security team. In siloed organizations, security measures may not be uniform across different teams and could cause discrepancies in how the cloud is protected.

Defending cloud infrastructure requires a joined-up strategy that looks at the organization’s cloud footprint with a holistic approach. Data needs to be collected and analyzed from all available sources in a way that security teams can ingest and understand.

Simplify the Challenges of Multi-Cloud Environments

Many organizations have multiple clouds deployed to optimize support for a larger data infrastructure. However, this scales up the complexity of the cloud infrastructure. Protecting multi-cloud environments means trying to find a common way to cover clouds that may each have a unique deployment, set of regulatory requirements, and policies.

A lack of uniformity here can be a big challenge for organizations, particularly if the organization does not have access to cloud security experts. Multi-cloud environments become even more complex if they are provided by different vendors. Integration between each of the cloud solutions may be difficult and result in a loss of visibility.

Dealing with these challenges involves considering the future as well as the present. Will technology investments made yesterday and today integrate with those of tomorrow? Many organizations have understood the need to move to an XDR platform, but only an open XDR platform that integrates existing solutions and can integrate with them, analyzing data, receiving alerts and automatically sending responses, can effectively address the challenges of a multi-cloud environment.

Conclusion

The widespread adoption of cloud technologies continues to re-shape the modern day workforce. A significant part of the digital transformation happening globally, cloud implementation has allowed businesses to lessen costs, increase organizational agility, and improve long-term scalability. Though the migration to cloud has benefited many businesses, it has come with a variety of new attack vectors for threat actors.

To get ahead of threat actors, organizations using cloud services must fully understand how the services are being implemented and maintained. Visibility within the cloud is critical to seeing how file sharing is being done, the type of data being stored and its security, and what applications are connected.

SentinelOne can help organizations improve their cloud security strategy through a combination of endpoint detection and response (EDR) capability, autonomous threat hunting, and runtime solutions that can defeat cloud-based threats without compromising agility or availability. Learn more about Singularity™ Cloud or contact us today for a demo.

Singularity™ Cloud
One home to secure VMs, servers, containers, and Kubernetes clusters across multi-cloud and datacenters. Prevent, detect, investigate, and respond to threats in the cloud in real time—without sacrificing performance.

Get a Demo

Anti-Money Laundering Service AMLBot Cleans House

/0 Comments/in /by

AMLBot, a service that helps businesses avoid transacting with cryptocurrency wallets that have been sanctioned for cybercrime activity, said an investigation published by KrebsOnSecurity last year helped it shut down three dark web services that secretly resold its technology to help cybercrooks avoid detection by anti-money laundering systems.

Antinalysis, as it existed in 2021.

In August 2021, KrebsOnSecurity published “New Anti Anti-Money Laundering Services for Crooks,” which examined Antinalysis, a service marketed on cybercrime forums that purported to offer a glimpse of how one’s payment activity might be flagged by law enforcement agencies and private companies that track and trace cryptocurrency transactions.

“Worried about dirty funds in your BTC address? Come check out Antinalysis, the new address risk analyzer,” read the service’s opening announcement. “This service is dedicated to individuals that have the need to possess complete privacy on the blockchain, offering a perspective from the opponent’s point of view in order for the user to comprehend the possibility of his/her funds getting flagged down under autocratic illegal charges.”

Antinalysis allows free lookups, but anyone wishing to conduct bulk look-ups has to pay at least USD $3, with a minimum $30 purchase. Other plans go for as high as $6,000 for 5,000 requests. Nick Bax, a security researcher who specializes in tracing cryptocurrency transactions, told KrebsOnSecurity at the time that Antinalysis was likely a clone of AMLBot because the two services generated near-identical results.

AMLBot shut down Antinalysis’s access just hours after last year’s story went live. However, Antinalysis[.]org remains online and accepting requests, as does the service’s Tor-based domain, and it is unclear how those services are sourcing their information.

AMLBot spokesperson Polina Smoliar said the company undertook a thorough review after that discovery, and in the process found two other services similar to Antinalysis that were reselling their application programming interface (API) access to cybercrooks.

Smoliar said that following the revelations about Antinalysis, AMLBot audited its entire client base, and implemented the ability to provide APIs only after a contract is signed and the client has been fully audited. AMLBot said it also instituted 24/7 monitoring of all client transactions.

“As a result of these actions, two more services with the name AML (the same as AMLBot has) were found to be involved in fraudulent schemes,” Smoliar said. “Information about the fraudsters was also sent to key market participants, and their transaction data was added to the tracking database to better combat money laundering.”

Experts say the founder of Antinalysis also runs a darknet market for narcotics.

The Antinalysis homepage and chatter on the cybercrime forums indicates the service was created by a group of coders known as the Incognito Team. Tom Robinson, co-founder of the blockchain intelligence firm Elliptic, said the creator of Antinalysis is also one of the developers of Incognito Market, a darknet marketplace specializing in the sale of narcotics.

“Incognito was launched in late 2020, and accepts payments in both Bitcoin and Monero, a cryptoasset offering heightened anonymity,” Robinson said. “The launch of Antinalysis likely reflects the difficulties faced by the market and its vendors in cashing out their Bitcoin proceeds.”

The Good, the Bad and the Ugly in Cybersecurity – Week 42

/0 Comments/in /by

The Good

Ask a security professional about the weakest link in any organization and the answer most commonly received is: users. A lack of awareness regarding threats as well as poor or absent cyber hygiene practices mean that phishing and social engineering are a threat actor’s favorite play.

It may come as a welcome surprise, then, to learn that according to a new survey, there’s been a marked improvement in cybersecurity awareness among the general public over the last three years. Coming after the pandemic and the large-scale shift to work from home, that can only be good news for enterprise security teams.

The survey found that in 2022, some 77% of respondents said they use MFA to log into online accounts compared to only 50% in 2019. An encouraging 88% said they now use strong passwords, up 12% from three years ago. In 2019, some 31% of people said they did not use any kind of security feature to unlock their smartphones. That number is down to 15% in 2022.

Cybersecurity awareness data
Source

What accounts for this rise in cybersecurity awareness? The report suggests that the coverage of cybersecurity issues and emerging digital threats in the media, the increase in data breaches, and the growing awareness of ‘cookies’ and third-party trackers on personal devices are all likely to have contributed to the general perception that cybersecurity is an issue that affects all of us, at home and at work.

The Bad

If it’s good news we’re all becoming more cyber aware, on the other side of the fence is the unwelcome news that threat actors are making it easier to create and conduct phishing campaigns with a new PhaaS (Phishing-as-a-Service) platform called Caffeine. While PhaaS’s are not an entirely new phenomenon, what makes Caffeine particularly troubling is that anyone can sign up for it on the public internet.

Typically, threat actors wanting to use a PhaaS need a recommendation from a current customer or must go through some kind of vetting process. Caffeine is a site hosted on the public internet which accepts applications from anyone with just an email address, researchers say. For as little as $250/month, subscribers can use the platform to create customized phishing kits, generate URLs to host malware payloads, and track their campaign’s progress.

Caffeine login page
Caffeine login page

Caffeine significantly lowers the barrier to entry to would-be threat actors, offering to take care of infrastructure, fake sign-in pages, website hosting, email templates and more. The service currently targets the theft of Microsoft 365 credentials via fake sign-in pages hosted on compromised WordPress sites. Researchers say they expect to see the service expand its targets as it develops.

With competing PhaaS offerings advertising services such as 2FA and MFA bypasses, it seems that threat actors have a wealth of easy options for getting new campaigns off the ground.

Whether Caffeine’s open registration and appearance on the public internet will survive scrutiny from security researchers and law enforcement remains to be seen, but even if the service eventually retreats underground, the onus is on users and security teams to bolster their defenses. The emergence of services like these is only likely to increase the already high volume of phishing attacks being seen by enterprise security teams.

The Ugly

Last week, Fortinet issued a private warning to its customers of a new authentication bypass flaw affecting its FortiOS, FortiProxy and FortiSwitchManager products. This week comes the unpleasant but not entirely unexpected news that the flaw, tracked as CVE-2022-40684, is being actively exploited in the wild.

The critical flaw allows an unauthenticated attacker to perform arbitrary operations on the products’ admin interface after sending maliciously-crafted HTTPS requests. These operations include modifying admin user’s SSH keys, adding new local users, updating network configurations to reroute traffic, and initiating packet captures.

CISA has added the bug to its database of Known Exploited Vulnerabilities (KEV), and FortiNet has advised organizations to hunt for the following IoC in device logs:

user=”Local_Process_Access”

In addition, those using the affected products should apply the available patches without delay. For those that cannot patch, Fortinet is advising admins to disable HTTP/HTTPS administrative interface or limit the range of IPs allowed to reach it.

In other bug-related news, Microsoft’s monthly ‘Patch Tuesday’ failed to offer fixes for the recently reported Exchange Server vulnerabilities commonly-known as ProxyNotShell but did fix 13 other critical flaws that could allow for privilege escalation, spoofing and remote code execution. Three critical RCEs affect Microsoft Office and Word. As always, Microsoft users are urged to patch at the earliest opportunity.

8220 Gang Cloud Botnet Targets Misconfigured Cloud Workloads

/0 Comments/in /by

In July of 2022 we reported on 8220 Gang, one of the many low-skill crimeware gangs we observe infecting cloud hosts through known vulnerabilities and remote access brute forcing infection vectors. We noted that 8220 Gang had expanded its cloud service botnet to an estimated 30,000 hosts globally.

In recent weeks, the group has rotated its attack infrastructure and continued to absorb compromised hosts into its botnet and to distribute cryptocurrency mining malware.

8220 Gang Cloud Botnet Targets Misconfigured Cloud Workloads

Misconfiguration Key to Infection Attempts

Exploit attempts from 8220 Gang continue at a pace consistent with our previous reporting. The majority of active victims are still operating outdated or misconfigured versions of Docker,  Apache, WebLogic, and various Log4J vulnerable services.

8220 Gang identifies targets via scanning for misconfigured or vulnerable hosts on the public internet. Victims are typically using cloud infrastructure such as AWS, Azure and similar with misconfigured instances that allow remote attackers to gain access. Publicly-accessible hosts running Docker, Confluence, Apache WebLogic, and Redis can easily be discovered and attacked with little technical know-how. 8220 Gang is known to make use of SSH brute force attacks post-infection for the purposes of lateral movement inside a compromised network.

The top victims recently communicating as miner bots are exposed Ubiquiti Unifi Cloud Keys running outdated Network Controller software or Prometheus container monitoring systems. The vulnerabilities exploited are usually far from fresh – such as with CVE-2019-2725 – the Oracle Weblogic vulnerability being exploited to download the installer script, e.g., 871f38fd4299b4d94731745d8b33ae303dcb9eaa. The objective of the infection attempts continues to be growing the botnet and expanding cryptocurrency hosts mining when possible.

8220 Gang Leverages PureCrypter

We have observed 8220 Gang using the PureCrypter Malware-as-a-service. PureCrypter is a loader service available for a low cost since 2021 and has been observed distributing a large variety of commodity malware. Windows systems targeted by 8220 Gang have been served by the PureCrypter downloader through the group’s traditional C2 infrastructure, most commonly 89.34.27[.]167. The downloader then beacons back following the injectors image extension URLs. The use of Discord URLs can also be observed for the download of illicit minors.

One clear example is the miner ee6787636ea66f0ecea9fa2a88f800da806c3ea6 being delivered post-compromise. This loader beacons to Discord:

https://cdn.discordapp[.]com/attachments/994652587494232125/1004395450058678432/miner_Nyrpcmbw[.]png

and downloads 833cbeb0e748860f41b4f0192502b817a09eff6a, ultimately beginning cryptomining on the victim host.

It is unsurprising to discover 8220 Gang experimenting with new loaders and miners alongside their traditional exploitation attempts against publicly exposed services. As the threat landscape evolves, we can expect threat actors to seek new methods to thwart defenses, hide their campaigns, and generally attempt to increase attack success. This is simply a new iteration of 8220 Gang attempting to do so.

Shifting Infrastructure

Since July, 8220 Gang shifted to using 89.34.27[.]167, and then in early September 2022 rotated its infrastructure to 79.110.62[.]23, primarily relying on two previously reported  domains letmaker[.]top and oracleservice[.]top.

8220 Gang also makes use of a miner proxy at 51.79.175[.]139. Hosts infected with illicit miners will communicate with the proxy as it acts as a pool to combine resources and avoid analysis of their cumulative mining metrics.

Visual Context of 8220 Gang Infrastructure Roles
Visual Context of 8220 Gang Infrastructure Roles

Thriving Abuse of Amateur Tooling

As we’ve reported in the past, the scripts, miners, and infrastructure surrounding the campaigns of 8220 Gang stem from the general reuse of known tools. “Script Kiddies” may be a more industry appropriate name. Analysis of the tools and vulnerabilities at a high level reveals a much wider set of illicit activity.

For example, through GreyNoise data we can see how common CVE-2019-2725 crawlers are over the last 30 days. 8220 Gang and other attackers make use of scanning for and exploiting similar n-day vulnerabilities with success. One theory may be that these types of attackers seek out easy to compromise systems like this as they are unlikely to be remediated quickly since they are not even meeting common updating practices. These attackers are operating with success, regardless of the state of vulnerability management. One could consider such attacks to be bottom feeders of targeting perhaps.

GreyNoise Trend of CVE-2019-2725 Crawlers
GreyNoise Trend of CVE-2019-2725 Crawlers

The loader script is also incredibly common to observe through publicly accessible hosts and honeypots running common cloud services. The script has evolved greatly even in a single year, with many variants, and it is no longer useful tracking as a single name (e.g., Carbine Loader). For example, searching VirusTotal for any shell scripts containing the go-to uninstall commands for common cloud security tools, plus unique variable names, leads to hundreds of recent results. 8220 Gang is only one of many abusing the same scripts to keep their botnets alive.

Conclusion

8220 Gang continues their botnet proliferation efforts, rotating to new infrastructure. The group continues to make use of the same mining proxy server, and defenders should investigate any continual traffic to that destination. Additionally, with the experimentation with PureCrypter MaaS, the group has clearly attempted to evolve their attack efforts. As cloud infrastructure and common publicly accessible services remain vulnerable, we expect 8220 Gang to continue growing into the future.

Indicators of Compromise

Communications
89.34.27.167 (From July into September 2022)
79.110.62.23 (Primary since September 2022)
51.79.175.139 (Miner Proxy)
198.23.214.117 (Miner Proxy)
work.onlypirate[.]top
a.oracleservice[.]top
b.oracleservice[.]top
pwn.oracleservice[.]top
c4k-ircd.pwndns[.]pw
jira.letmaker[.]top
https://cdn.discordapp[.]com/attachments/994652587494232125/1004395450058678432/miner_Nyrpcmbw[.]png

File Hashes SHA1
165f188b915b270d17f0c8b5614e8b289d2a36e2
528477d0a2cf55f6e4899f99151a39883721b722
557d729f8a7ba712a48885304280b564194406d3
58af7af0dbf079bafd8fae1a7b3a2230b2bcba31
740a1cdee7b7f4350eec53c1ca3022562ea83903
7477812278038e8d3606c433f1c4389b897012e2
75ea4b0b76a0b61bd0f8f4a491e5db918bc1df1c
7b128cd6cf092409fc9c71ddd27c66dd98002b1a
871f38fd4299b4d94731745d8b33ae303dcb9eaa (CVE-2019-2725 example)
9bc4db76ae77ea98fdcaa9000829840d33faba97
be53175a3b3e11c1e3ca7b87abb6851479453272
c1630af40f38f01e94eec2981c5f4f11481ba700
c22f9ae02601a52c9dca91c3b4cb3d2221f54b50
c537cf320e90a39e7f5e9846e118502802752780
c86349460658a994e517fede6773e650f8f3ac9b
d5138d1708d5d77ea86920a217c2033a2e94ad7e
ee6787636ea66f0ecea9fa2a88f800da806c3ea6

Microsoft Patch Tuesday, October 2022 Edition

/0 Comments/in /by

Microsoft today released updates to fix at least 85 security holes in its Windows operating systems and related software, including a new zero-day vulnerability in all supported versions of Windows that is being actively exploited. However, noticeably absent from this month’s Patch Tuesday are any updates to address a pair of zero-day flaws being exploited this past month in Microsoft Exchange Server.

The new zero-day flaw– CVE-2022-41033 — is an “elevation of privilege” bug in the Windows COM+ event service, which provides system notifications when users logon or logoff. Microsoft says the flaw is being actively exploited, and that it was reported by an anonymous individual.

“Despite its relatively low score in comparison to other vulnerabilities patched today, this one should be at the top of everyone’s list to quickly patch,” said Kevin Breen, director of cyber threat research at Immersive Labs. “This specific vulnerability is a local privilege escalation, which means that an attacker would already need to have code execution on a host to use this exploit. Privilege escalation vulnerabilities are a common occurrence in almost every security compromise. Attackers will seek to gain SYSTEM or domain-level access in order to disable security tools, grab credentials with tools like Mimkatz and move laterally across the network.

Indeed, Satnam Narang, senior staff research engineer at Tenable, notes that almost half of the security flaws Microsoft patched this week are elevation of privilege bugs.

Some privilege escalation bugs can be particularly scary. One example is CVE-2022-37968, which affects organizations running Kubernetes clusters on Azure and earned a CVSS score of 10.0 — the most severe score possible.

Microsoft says that to exploit this vulnerability an attacker would need to know the randomly generated DNS endpoint for an Azure Arc-enabled Kubernetes cluster. But that may not be such a tall order, says Breen, who notes that a number of free and commercial DNS discovery services now make it easy to find this information on potential targets.

Late last month, Microsoft acknowledged that attackers were exploiting two previously unknown vulnerabilities in Exchange Server. Paired together, the two flaws are known as “ProxyNotShell” and they can be chained to allow remote code execution on Exchange Server systems.

Microsoft said it was expediting work on official patches for the Exchange bugs, and it urged affected customers to enable certain settings to mitigate the threat from the attacks. However, those mitigation steps were soon shown to be ineffective, and Microsoft has been adjusting them on a daily basis nearly each day since then.

The lack of Exchange patches leaves a lot of Microsoft customers exposed. Security firm Rapid7 said that as of early September 2022 the company observed more than 190,000 potentially vulnerable instances of Exchange Server exposed to the Internet.

“While Microsoft confirmed the zero-days and issued guidance faster than they have in the past, there are still no patches nearly two weeks out from initial disclosure,” said Caitlin Condon, senior manager of vulnerability research at Rapid7. “Despite high hopes that today’s Patch Tuesday release would contain fixes for the vulnerabilities, Exchange Server is conspicuously missing from the initial list of October 2022 security updates. Microsoft’s recommended rule for blocking known attack patterns has been bypassed multiple times, emphasizing the necessity of a true fix.”

Adobe also released security updates to fix 29 vulnerabilities across a variety of products, including Acrobat and Reader, ColdFusion, Commerce and Magento. Adobe said it is not aware of active attacks against any of these flaws.

For a closer look at the patches released by Microsoft today and indexed by severity and other metrics, check out the always-useful Patch Tuesday roundup from the SANS Internet Storm Center. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: AskWoody.com usually has the lowdown on any patches that may be causing problems for Windows users.

As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.

S Ventures Invests in Laminar, a Cloud Data Security Pioneer

/0 Comments/in /by

S Ventures is excited to showcase our investment in Laminar, a pioneer in the cloud data loss prevention (DLP) and data security posture management industry.

Cloud adoption has grown rapidly in recent years, and was further accelerated by the COVID-19 pandemic. Worldwide end user spend on public cloud in 2023 is expected to reach $600 billion. On top of that, the amount of enterprise data continues to expand exponentially, having more than doubled from one petabyte to just over two petabytes from 2020 to 2022. More than 60% of this data is generated in the cloud.

As more organizations rely on the public cloud for their enterprise infrastructure and build their businesses to be cloud-native, it’s more important than ever before to mitigate data security and privacy risks accordingly.

The growing reliance on the cloud also breeds new cybersecurity and data challenges. Many companies embrace a multi-cloud environment which requires additional controls to be in place to protect sensitive data. Different environments have different built-in security controls and tools, making visibility and consistent protection difficult to achieve. Properly identifying and mitigating data risk requires understanding of data sensitivity, data security posture, and data exposure in one common view. That’s why Laminar is a meaningful addition to S Ventures’ portfolio of category-defining security and data companies.

Laminar’s plug-and-play platform spots data privacy and protection violations without any prior knowledge of the environment and without impacting performance. It autonomously and continuously discovers and classifies new datastores for complete visibility, prioritizes risk based on sensitivity and data risk posture, secures data by remediating weak controls, and actively monitors for egress and access anomalies. Laminar’s commitment to helping organizations securely modernize their businesses aligns with S Ventures’ goals and vision for a more secure future for all.

Since its emergence from stealth in November 2021, Laminar released general availability of its platform in February 2022 and has significantly grown its platform capabilities:

  • Data Catalog for Cloud Security (DCCS): Autonomous discovery and classification for all data across AWS, Azure, GCP, and Snowflake;
  • Data Security Posture Management (DSPM): Detection and alerting on data-centric security policy violations, prioritization of issues for resolution, and actionable remediation recommendations;
  • Cloud Data Access Control (CDAC): Mapping of what data is accessible to an entity, which entities have access to sensitive data, and which entity is actually accessing which data;
  • Cloud Data Detection and Response (CDDR): Monitoring and detection of anomalous access patterns that may indicate a data leak or potential breach of sensitive data.

Our customers, as well as organizations around the world, are prioritizing the need to control and protect sensitive data in the public cloud. We see Laminar’s approach as complementary in helping our customers secure data across public clouds and are excited to support Laminar in building a cloud data security platform to discover, protect, secure, and monitor everything built and run in the cloud.

Please visit www.laminarsecurity.com and the S Ventures page to learn more.

CISO Wins | Reducing Risk Across Endpoint, Identity and Cloud Surfaces

/0 Comments/in /by

2022 has, so far, shown us that data breaches, cyber threats, and privacy incidents are here to keep media outlets busy and news headlines stacked. The threat of cyberattack has permeated every layer of the global infrastructure from small businesses to large-scale enterprises. Even nation states have not been immune to cyber compromise.

Just this year, we saw the ransomware attack on the Costa Rican government that brought the country’s Ministry of Finance, public health services, and import and export sectors to a standstill. Data breaches were reported by two major international airlines in India and Turkey and, as the school year kicked-off, a disproportionately high number of attacks plagued U.S. schools, even resulting in the identity theft of minors.

Enterprises experienced their share of cyber dilemmas as well. Networking giant, Cisco, was hit with an identity-based attack through Active Directory, and ransomware gangs have zeroed in on nearly every critical sector including digital security firms, defense contractors, manufacturers, and information technology companies.

In all of these examples, there were security solutions in place. This blog post discusses the realities of the uphill battle enterprises are facing against cyber threats, their significance, and what actions they can take to better protect themselves.

Understanding Adversaries & Attack Surfaces

Today, businesses are asked to show they have reputable cybersecurity solutions in place before they can even get insurance coverage. As for threat actors, they have both evolved and expanded. Ransomware-as-a-Service (RaaS) business models have given non-technical criminals the ability to launch full-fledged campaigns. Double and triple extortion tactics are commonplace and ‘big game hunting’ targets high-value or high-profile organizations which have been identified as being able to pay large ransoms.

Not only have threat actors become more adept, attack surfaces are widening as businesses thrive in the age of more access, more connections, and more tools. The term ‘attack surface’ refers to the totality of vulnerabilities found in an environment. The term ‘attack vectors’ refers to ways that an unauthorized party can access the environment in question. Larger, more complex environments typically have a greater number of attack vectors and a larger attack surface to protect.

Observing the current threat landscape, three main attack surfaces come to the forefront: endpoints, cloud, and identity.

Attacks on Endpoints

The task of endpoint protection has grown more complex in recent years as more organizations adopt remote workers and BYOD (bring-your-own-device) policies. Endpoint-delivered threats usually start with malware-carrying devices that are then connected to the targeted network and spread infection, or social engineering tactics that trick unsuspecting users to install malware on their device.

Modern day work cultures allow endpoints to access sensitive data no matter where they are connected from, which increasingly puts the onus on the integrity of the endpoint itself. As endpoints are a critical part of every organization, their defense is a priority.

Attacks on Cloud

Security teams are starting to rethink their strategy as more businesses make the move from on-prem to hybrid and cloud environments. While cloud services offer an attractive boost in collaboration, scalability, and efficiency, they come with new risks that must be taken into account. Cloud computing requires businesses to secure virtual machines, containers, serverless workloads, and Kubernetes – all of which could be leveraged as potential attack vectors.

Cloud misconfigurations can easily expose businesses to cyberattack. Cloud environments are especially vulnerable to severe data loss, insider threats, supply chain attacks, and denial-of-service access.

Attacks on Identity

Identity-based attacks often involve the threat actor weaponizing legitimate tools and software used by their targeted victim. This year, Active Directory (AD) infrastructure continues to be an oft-exploited element in ransomware campaigns and post-compromise extortion efforts. For threat actors, targeting identity through sources such as compromised AD or access management is their quickest way to reaching their targets.

Since AD serves as a gateway to the rest of a company’s network, threat actors leverage the existing infrastructure to perform enumeration and move laterally through the rest of the network layers, escalating their privileges, obtaining access to sensitive files, and exfiltrating the data they are after.

Taking Care of Low Hanging Fruit

With low barrier entryways available and the possibility of generating high revenue, cyber adversaries will always look for easy ways into a targeted environment. It is crucial for businesses to identify and secure the attack vectors applicable to their network.

Not to be confused with attack surfaces, attack vectors are the means by which a threat actor gains unauthorized access to an environment. Common attack vectors include phishing and compromised credentials.

Existing infrastructure and solutions are also increasingly exploited by threat actors. Examples of these include:

  • Multi-Factor Authentication (MFA) – While enabling MFA is highly recommended, examples from this year showed attackers exploiting this essential protection layer. Adding rules and monitoring attempts can help enterprises prevent and detect abuse of MFA for malicious access.
  • Chrome & Browser Extensions – With the explosion of web applications, browser extensions have become essential for employees to perform their work. However when compromised, threat actors can perform data scraping techniques and see user behavior within the browser. Only approved extensions should be installed on company devices.
  • Unpatched Software – Outdated software is one of the easiest ways threat actors gain unauthorized entry into a targeted network. Patch management keeps endpoints and networks up to date with bug fixes against known exploits as well as bolstering protection via new safety features.

The Long-Term Security Play | How SentinelOne Can Help

From a strategic standpoint, enterprise leaders need to take stock of the attacks happening on various surfaces as well as trending threats seen in the threat landscape. Enterprises that can keep their security strategies agile are the ones that stay ahead of cyberthreats.

Improving the organization’s security posture is a long-term play based on three major pillars: people, process, and technology. It requires understanding and a coordinated effort from all parts of a business, smart investment in effective technology, and a willingness to embed cybersecurity best practices on the day-to-day level of operations.

People: Build a Strong Security Strategy & Team

Enterprises are toughening up their teams in order to withstand and counter sophisticated cyber threats. Many companies are bringing in Chief Information Security Officers (CISOs) to assess, plan, and maintain the safety and digital growth of a business.

Based on the fluctuating threat landscape, CISOs are responsible for reevaluating their security strategies and adjusting how their business monitors and responds to potential attacks. Experienced CISOs stay ahead of developing cyber trends and attack patterns to build best practices that make sense for their team. A CISO’s cybersecurity strategy does not only safeguard people and processes but can also drive new opportunities, increase operational efficiency, and build up their business’s authority in their industry.

Process: Securing Operations & Workflows

Cyber attackers are the ultimate opportunists, always looking for the path of least resistance in the form of unprotected servers, vulnerable devices, or even third-party vendors that have weak security practices. Threat actors have been known to use relatively straightforward social engineering and phishing attacks to gain entry and then abuse the infrastructure itself, such as Active Directory, to spread quickly into an environment. Implementing identity protection is critical to stopping the misuse and exploitation of existing infrastructure and software and securing sensitive data held within it.

Enterprises globally trust SentinelOne’s industry knowledge and experience with fighting back privileged escalation and lateral movement. Get comprehensive identity security as part of Singularity™ XDR for autonomous protection including:

  • Singularity™ Identity: End credential misuse through real-time infrastructure defense for Active Directory and deception-based endpoint protections. Singularity™ Identity defends Active Directory Domain & Azure AD Identities and domain-joined assets from adversaries aiming to gain privilege and move covertly.
  • Singularity™ Ranger® Active Directory Assessor: Uncover vulnerabilities in Active Directory and Azure AD with a cloud-delivered, continuous identity assessment solution. Ranger® AD Assessor delivers prescriptive, actionable insight to reduce Active Directory and Azure AD attack surfaces, bringing them in line with security best practices.
  • Singularity™ Hologram: Lure network and insider threat actors into engaging and revealing themselves with network-based threat deception. Singularity™ Hologram decoys stand at the ready, waiting to be engaged by adversaries and insiders. The resulting telemetry supports investigations and contributes to adversary intelligence.

Technology: Prepare to Invest In Tech

Security that stays relevant to developing cyber threats and also scales along with a business required investment in the right technology. Today, many businesses are adding artificial intelligence (AI) and machine learning (ML) to their security arsenal to better identify and respond to advanced persistent threats. When it comes to staying ahead of threats, speed is the differentiating factor – AI and ML both allow enterprises to combat emerging attacks by detecting patterns in real time. Many threat campaigns, particularly ones using ransomware, only last a few hours and actors are often already within a victim’s network just waiting to deploy. For context, major ransomware attacks from this year alone totaled over $236 million.

SentinelOne’s Endpoint Protection (EPP) and Endpoint Detection and Response (EDR) seamlessly combines automation with both AI and ML to detect and remediate modern attacks in real-time, at machine speed, and without extra intervention. This means that businesses can focus their resources on addressing operations-specific tasks. SentinelOne’s EPP solution also fully replaces legacy AV and AM solutions and can be scaled and tailored to fit a businesses’ specific requirements and processes.

Conclusion

While the headlines may make it seem like threat actors are winning in the ongoing cyber fight, enterprises can learn much from the attacks that have already happened and action them as lessons learned.

An adaptive and agile security strategy, team, and culture will take enterprises far in the uphill battle against growing cybercrime. Binding together people, process, and technology is key in taking a smarter, proactive approach to novel threats.

Enterprise businesses trust SentinelOne to help safeguard their critical attack surfaces by fusing together autonomous, AI-driven threat hunting and EDR capabilities. To learn more, request a demo or contact us for expert advice.

90 Days | A CISO’s Journey to Impact

Read the eBook