di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Threat Research

Voice Of SecOps

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

DPA-Launch-PR.jpg

It’s officially Cybersecurity Awareness Month, a month-long collaborative effort led by the <a href="https://www.dhs.gov/CISA" target="_blank">Cybersecurity and Infrastructure Security Agency</a> and the <a href="https://staysafeonline.org/" target="_blank">National Cybersecurity Alliance</a> to raise awareness on how to stay secure online. This year, Deep Instinct is proud to be named an official Champion of Cybersecurity Awareness Month, a cause that further supports our mission of predicting and preventing known and unknown cyber threats.This Cybersecurity Awareness Month is unlike previous years due to the sudden rise of cyber attacks leveraging generative AI. Want proof? Our recent <a href="https://www.deepinstinct.com/voice-of-secops-reports">Voice of SecOps Report</a> found that 75% of security professionals witnessed an increase in attacks over the past 12 months, with 85% attributing this rise to bad actors using generative AI. This is a massive red flag for the C-suite and employees at large.<h5>Combatting AI Threats with Deep Learning</h5>Now, more than ever, attackers are leveraging AI to create new malware variants at an alarming pace. The issue is that current security mechanisms rooted in machine learning (ML) are ineffective against never-before-seen, unknown malware; they will only break down in the face of AI-powered threats.&nbsp;The only way enterprises can truly protect themselves against AI-generated threats is with a more advanced form of AI – specifically, Deep Learning. Any ML-based, legacy security solution is too reactive and latent to adequately fight back – especially legacy AV tools including Symantec, McAfee, BitDefender, TrendMicro, and Kaspersky. Learn more about why you should <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">get rid of your legacy and next-generation anti-virus (NGAV) tools</a>.What’s missing is a layer of Deep Learning-powered data security, sitting in front of your existing security controls, to predict and prevent threats before they cause damage. This is where Deep Instinct comes in – and the industry is taking note.<h5>An Award-Winning Predictive Prevention Approach to Security</h5>As a testament to our ability to predict and prevent cyber attacks before they happen, Deep Instinct has been honored with several industry awards over the past year. From product recognition to leadership honors, we are proud of our people, our technology, and our commitment to bolstering cybersecurity worldwide, through initiatives like Cybersecurity Awareness Month.Here are just a few notable 2023 recognitions for Deep Instinct:<ul><li>Deep Instinct was named the “<a href="https://aibreakthroughawards.com/2023-winners/" target="_blank">Best Deep Learning Company</a>” for the second consecutive year in the AI Breakthrough Awards, an award program that recognizes the top companies, technologies, and products in today’s global AI market.</li></ul><ul><li>Of the 18 vendors in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP) report, Deep Instinct was the <a href="https://www.deepinstinct.com/news/deep-instinct-included-in-the-2022-gartner-magic-quadrant-for-endpoint-protection-platforms-epp">only new vendor added</a> for its ability to execute and completeness of vision.</li><li>Deep Instinct was listed as <a href="https://www.crn.com/news/security/the-20-coolest-endpoint-and-managed-security-companies-of-2023-the-security-100/6?itc=refresh" target="_blank">one of the 20 coolest</a> endpoints and managed security companies of 2023 in CRN’s The Security 100.</li><li>The team was named a finalist in the <a href="https://cybersecurity-excellence-awards.com/2023-cybersecurity-company-awards-winners/" target="_blank">Most Innovative Cybersecurity Company in North America</a> and the top <a href="https://cybersecurity-excellence-awards.com/candidates/deep-instinct-prevention-platform/" target="_blank">Cybersecurity Product/Solution in Ransomware Protection</a> in the 2023 Cybersecurity Excellence Awards.</li><li>Deep Instinct was also recognized by the 2023 Global Cybersecurity Excellence Awards, winning gold and achieving the highest ranking for <a href="https://cybersecurity-excellence-awards.com/2023-cybersecurity-industry-solution-awards-winners/" target="_blank">The Cybersecurity Industry Solution Awards</a> for its Deep Instinct Prevention for Applications Platform in the software category for North America.</li><li>The company was <a href="https://www.prweb.com/releases/2023/5/prweb19362068.htm" target="_blank">recognized as a finalist</a> and earned an honorary mention in the 2023 Fortress Cyber Security Awards alongside the world’s leading companies and products working to keep the world’s data and electronic assets safe from growing threats and attack vectors.</li></ul>In this new era of AI, it’s critical that you prevent cyber attacks, not just detect and respond to them after the fact like EDR. That’s not nearly enough in this AI-driven threat landscape. That’s why it’s time to dump the “assume breach” status quo and demand more. Learn why <a href="https://www.deepinstinct.com/endpoint-detection-response">EDR is NOT enough</a>.We’re proud to be a leader in raising awareness of this issue, while helping to bolster organizations’ cybersecurity posture during a time when it’s needed most. For more information about Cybersecurity Awareness Month, please click <a href="http://staysafeonline.org/cybersecurity-awareness-month/" target="_blank">here</a>. To learn how Deep Instinct can help your organization combat AI threats, <a href="https://info.deepinstinct.com/request-a-demo">request a demo</a>.

Deep Instinct Champions Cybersecurity Awareness Month 2023

blog-image-mitre-2023.jpg

The results are in! In this blog post we’ll outline the results of the 2023 MITRE Engenuity ATT&amp;CK Evaluations for Enterprise and cover the following:<ul><li>What the ATT&amp;CK Evaluations are and what it means for enterprises</li><li>The tactics, techniques, and procedures (TTPs) employed by Turla to perform an attack</li><li>How Deep Instinct’s platform prevents Turla attacks and protects your organization</li></ul>

Register Now

Peeling Back the Layers on MITRE Engenuity’s Latest Evaluations for Enterprise

About_Hero.png

<h5>Background: MITRE Engenuity ATT&amp;CK Evaluations</h5>The MITRE ATT&amp;CK Framework is an excellent tool for organizations to plan and understand their defense-in-depth strategy. Mapping the <a href="https://attack.mitre.org/tactics/enterprise/" target="_blank">tactics</a>, <a href="https://attack.mitre.org/techniques/enterprise/" target="_blank">techniques</a>, and procedures (TTPs) coverage to understand where your gaps lie is important to protecting your organization against cyber threats.<h5>MITRE Engenuity’s ATT&amp;CK Evaluation Results Released</h5>Earlier today MITRE Engenuity released the results from their latest round of <a href="https://attackevals.mitre-engenuity.org/enterprise/turla/" target="_blank">ATT&amp;CK Evaluations for Enterprise</a> that focused on complex, multi-stage, impact-focused attacks carried out by <a href="https://attack.mitre.org/groups/G0010/" target="_blank">Turla</a>, a sophisticated Russian-based threat group that has infected victims in over 45 countries. The group is known to target government agencies, diplomatic missions, military groups, and research and media organizations. Without the right tools and capabilities, defending against Turla is like wrestling a bear. That’s because Turla adopts novel and sophisticated techniques to maintain operational security, including the use of a distinctive command-and-control network in concert with their repertoire of open-source and in-house tools.In the past, MITRE Engenuity ATT&amp;CK Evaluations had been more focused on evaluating detection and response, post infection. This approach was tied closely with the reactive, “assume breach” mindset of the past decade which looks for anomalous behaviors to stop a breach after an attack has executed on the endpoint. Beginning in 2020, MITRE Engenuity added a protection portion to the test which aims to evaluate a solution’s ability to prevent attacks and not just provide breach details and rollback.This is fundamentally the difference between Deep Instinct’s predictive prevention, which keeps threats out, vs EDRs who are only enabling detection and response after a breach has occurred. Learn more here about why <a href="https://www.deepinstinct.com/endpoint-detection-response" target="_self">you need Deep Instinct even if you have an EDR</a>.In this most recent round of testing, which took place in Q2/Q3 of 2023, the results of the protection segment of the test validated the strength and robustness of Deep Instinct’s multi-layered, proactive predictive prevention and highlighted the value our customers are seeing every day. Deep Instinct also achieved exemplary detection coverage across various execution, persistence, and impact techniques emulated. These are exactly the results we would expect as a proactive prevention solution.4 Key Takeaways from Deep Instinct’s MITRE Engenuity participation:<ol><li>Deep Instinct provided excellent prevention, detection, and visibility into all 18 attack steps tested.</li><li>Deep Instinct’s prevention and detection engines achieved excellent detection coverage and visibility on all techniques included in the test including execution, persistence, privilege escalation, lateral movement, and more.</li><li>Deep Instinct’s detection engine improved tremendously compared to the 2022 MITRE evaluation with 90% detection (up from 70%).</li><li>The tests that were prevented by the D-brain static analysis (Deep Instinct’s patented deep learning technology engine) didn’t succeed in writing the file to the disk, which emphasizes our superior prevention capabilities based on AI.</li></ol><h5>The Importance of Prevention</h5>Prevention has an extremely positive impact on your overall security posture by filling the gaps that exist in your coverage while reducing reliance on the downstream impacts of detection and response. Defense-in-Depth is needed; with greater prevention you can lower security costs, improve efficiency, and reduce your overall risk. That way security teams can spend more time focusing on alerts that matter and less time chasing false positives. MITRE recognized this reality when they added protection testing.<blockquote>Michael Suby, IDC Research VP, Security &amp; Trust, states “There will be a rebirth in endpoint protection as organizations seek a better balance with detection and response capabilities and gravitate to vendor offerings that contain innovative leaps in endpoint protection efficacy.”</blockquote>MITRE Engenuity testing is important, but sometimes a customer evaluation can say it all.<blockquote>"I am now a believer of the capabilities of Deep Instinct as I had conducted my own pre-purchase trial where I tested some of the top vendors' engines and pitted them all against Deep Instinct (the competitors all lost badly in the detection phase of my testing). Deep Instinct handled many near zero-day threats that had been in the wild a much shorter time than Deep Instinct's detection engine's release date. It simply didn't matter to Deep Instinct. It found them all and stopped them at pre-execution. Since pre-execution was my strategic goal with a zero-defect mentality driving that concept — Deep Instinct rocketed to the top of my wish list. Other products I tested allowed some damage to occur or didn't detect a zero-day threat at all while they wreaked havoc in a sandboxed environment.” *</blockquote><h5>Conclusion</h5>Deep Instinct excels at proactively preventing unknown, never-before-seen threats. Our innovative approach allows organizations to proactively prevent &gt;99% of ransomware, zero-days, and other known and unknown malware. Deep Instinct also lowers false positives to &lt;0.1%, reducing the burden on your security team and improving your ability to detect the most advanced threats. And proactive prevention can lower downstream costs, improve the efficiency of your SOC, and lower your overall risk.We found significant value in participating in the MITRE Engenuity testing, but in reality, we do it every day. Our customers are our real proof points as they benefit from a true prevention-first approach with Deep Instinct, lowering the resource requirements of their security professionals by reducing false positives and improving investigation and remediation. When the next unknown threat hits, you need the best preventative solution to keep the attackers out and ensure you can automate responses with your EDR. This approach delivers the best of both worlds.We invite you to <a href="https://info.deepinstinct.com/request-a-demo" target="_self">request a demo</a> and test us out to see the positive impact a prevention-first approach will have on your organization’s security posture.For further reading please see our <a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough" target="_self">EDR is Not Enough eBook</a> and Deep Instinct’s latest <a href="https://www.deepinstinct.com/voice-of-secops-reports" target="_self">Voice of SecOps Report</a>.*Gartner Peer Insights reviews constitute the subjective opinions of individual end users based on their own experiences and do not represent the views of Gartner or its affiliates.<h5>Learn More</h5><a href="https://www.brighttalk.com/webcast/16681/595246" target="_self">Register</a> for our webinar, Peeling Back the Layers on MITRE Engenuity’s Lates Evaluations for Enterprise, on Wednesday, October 4th at 2 PM ET / 11 AM PT to hear members of our Research &amp; Development Teams review what the MITRE ATT&amp;CK Evaluations truly are and walk through the best ways to interpret the results, including details about how the tests are performed.<h5>About MITRE Engenuity ATT&amp;CK® Evaluations</h5>ATT&amp;CK® Evaluations is built on the backbone of MITRE’s objective insight and conflict-free perspective. Cybersecurity providers turn to the Evaluations program to improve their offerings and to provide defenders with insights into their product’s capabilities and performance. Evaluations enable defenders to make better informed decisions on how to leverage the products that secure their networks. The program follows a rigorous, transparent methodology using a collaborative, threat-informed, purple-teaming approach that brings together providers and MITRE experts to evaluate solutions within the context of ATT&amp;CK. In line with MITRE Engenuity’s commitment to serve the public good, Evaluations results and threat emulation plans are freely accessible.<h5>About MITRE Engenuity</h5>MITRE Engenuity, a subsidiary of MITRE, is a tech foundation for public good. MITRE’s mission-driven teams are dedicated to solving problems for a safer world. Through our public-private partnerships and federally funded R&amp;D centers, we work across government and in partnership with industry to tackle challenges to the safety, stability, and well-being of our nation.MITRE Engenuity brings MITRE’s deep technical know-how and systems thinking to the private sector to solve complex challenges that government alone cannot solve. MITRE Engenuity catalyzes the collective R&amp;D strength of the broader U.S. federal government, academia, and private sector to tackle national and global challenges, such as protecting critical infrastructure, creating a resilient semiconductor ecosystem, investing in pandemic preparedness, accelerating use case innovation in 5G, and democratizing threat-informed cyber defense. <a href="https://mitre-engenuity.org/" target="_blank">https://mitre-engenuity.org</a>.

Deep Insight Results: 2023 MITRE Engenuity ATT&CK Evaluations for Enterprise

blog-image-rusty-flag.jpg

Key takeaways:<ul><li>The Deep Instinct Threat Lab has discovered a new operation against Azerbaijanian targets</li><li>The operation has at least two different initial access vectors</li><li>The operation is not associated with a known threat actor; the operation was instead named because of their novel malware written in the Rust programming language</li><li>One of the lures used in the operation is a modified document that was used by the Storm-0978 group. This could be a deliberate “false flag”</li></ul><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: Attack Flow" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc500e8e577b407b5/65028d348606a8f21cc873d7/fig1-AttackFlowRusty.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Attack Flow</figcaption></figure><h5>LNK Vector:</h5>Deep Instinct Threat Lab observed a malicious LNK file with low detections named “1.KARABAKH.jpg.lnk.”The file has a double extension to lure the victim to click an image that is related to a military incident in <a href="https://en.wikipedia.org/wiki/Nagorno-Karabakh" target="_blank">Nagorno-Karabakh</a>.The LNK downloads and executes an MSI installer hosted by DropBox:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 2: LNK arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt72f719f046aed339/65028d5ef41335980a8918e4/fig2-LNK-Arguments.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 2: LNK arguments</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 3: OSINT information about MSI uploader from Dropbox" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcdb6b050e52030ad/65028d8d7960981affb2dee1/fig3-osint-about-MSI-uploader-Dropbox.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 3: OSINT information about MSI uploader from Dropbox</figcaption></figure>The MSI file drops an implant written in Rust, an xml file for a scheduled task to execute the implant, and a decoy image file:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 4: Decoy image file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6930cc293aa4cf67/65028dc568d8e111ac604833/fig4-decoy-image.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Decoy image file</figcaption></figure>The image file includes watermarks of the <a href="https://mod.gov.az/en" target="_blank">symbol</a> of the Azerbaijanian MOD.<h5>Office False Flag Vector:</h5>Once we identified the LNK campaign the Deep Instinct Threat Lab attempted to identify additional, related files.Deep Instinct Threat Lab quickly found another MSI file hosted on DropBox that drops a different variant of the same Rust implant; however, the identification of the initial access vector for this campaign was trickier.The DropBox URL was masked with a URL shortener (hxxps://t[.]]ly/8CYQW) and the evidence showed that this URL was invoked via exploitation of Microsoft Equation Editor CVE-2017-11882.Deep Instinct Threat Lab identified a file named “Overview_of_UWCs_UkraineInNATO_campaign.docx” that was invoking the request to this shortened URL; however, this filename and its content are known to be associated with a <a href="https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/" target="_blank">Storm-0978</a> campaign utilizing CVE-2023-36884.The identified file even had a comment on VirusTotal that it is related to the Storm-0978 campaign:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 5: VT comment" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte13eea8de10129de/65028e2f9e7ba645b2cabbf9/fig5-VT_comments.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: VT comment</figcaption></figure>After further investigation it was revealed that this is a different file, not related to the Storm-0978 campaign. The embedded “afchunk.rtf” file has been replaced and CVE-2023-36884 is not used. Instead, CVE-2017-11882 is used to download and install the MSI file.This action looks like a deliberate false flag attempt to pin this attack on Storm-0978.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 6: OSINT information about MSI uploader for Office vector" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0ad88745f4ac3c5a/65028e6ba26337c73b96b6af/fig6-osint-information-msi-uploaderd.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 6: OSINT information about MSI uploader for Office vector</figcaption></figure>Even though the initial lure is an Office file, the delivered MSI file also open a decoy file, this time a PDF invoice:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 7: PDF decoy dropped by Office vector" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfb1f227360da24a9/6502909f1c72d8a20e8b120c/fig7-PDF-decoy-droppedPDF.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 7: PDF decoy dropped by Office vector</figcaption></figure><h5>MSI Analysis:</h5>While the initial vectors are different, the execution is the same and it is done by invoking msiexec with URL to DropBox.Using a Linux file command or msitools it seems that the MSI files were created by “MSI Wrapper” <a href="https://www.exemsi.com/" target="_blank">https://www.exemsi.com/</a>, which is often used by threat actors to drop malicious files.The MSI installers are dropping and executing the Rust implant along with a decoy file and xml file for scheduled task.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 8: MSI Metadata" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a1c244f60882ab6/650291e21709f57bfebf53c1/fig8-msi-metadata.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: MSI Metadata</figcaption></figure><h5>Rust Implant Analysis:</h5>Each attack had its unique file names and metadata. One of the file Rust Implants named “WinDefenderHealth.exe” is written in Rust. It is expected to gather information and send it to the attacker server, which is still active at the time of this research.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte9120922332ab068" alt="Figure 9: Metadata of the Rust malware" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte9120922332ab068/6502913d3a3d4841e1f6efba/fig9-Rust-defender-healthCheckmetadataVT.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: Metadata of the Rust malware</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 10: Rust compiler" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9e4e043348197e65/65029386f4133504258918f5/fig10-Rust-malware-compiler.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: Rust compiler</figcaption></figure>Rust is becoming more popular among malware authors. Security products are not yet detecting Rust malware accurately, and the reverse engineering process is more complex. The Rust standard library is not familiar to tools like IDA and Ghidra. It results in tagging large portions of the code as unknown, and it is difficult to differentiate the code of the standard library from the code of the malware. To overcome this, the plugin GhidRust was used, but it didn't detect the functions of the standard library. In addition, BinDiff was used. A simple Rust binary was compiled and compared against the malware, but very little code was shared. Some open projects for Rust were used in the malware such as Tokio (a runtime for writing reliable, asynchronous, and slim applications with the Rust programming language), hyper (a fast and correct HTTP implementation for Rust) and Serde JSON (a framework for serializing and deserializing Rust data structures efficiently and generically). After that part, we moved on to dynamic analysis.Once the file is executed it goes to sleep for 12 minutes. This is a known method to avoid security researchers and sandbox’s easy analysis.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 11: “Sleep” for 12 minutes" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt70fbe3ef467a938d/650293edeb5afe09bc4a7884/fig11-sleep-12-minutes-to-avoid-easy-reversing.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 11: “Sleep” for 12 minutes</figcaption></figure>Then it starts collecting information about the infected machine:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 12: “Collect” information" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt43287626dd55bb8c/650321cc796098004ab2e260/fig12-Collect-information.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 12: “Collect” information</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 13: Processes collecting information about the PC" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3d7dc9d84a471c52/650295df1c72d858748b1217/fig13-ExfilProccesses.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 13: Processes collecting information about the PC</figcaption></figure>The malware then reads the output of the above executions by redirecting their StdOut to a named pipe. It is notable that the values of StdIn, StdOut, and StdErr match the handles of the processes to the named pipes.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 14: “Read” the collected information" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbb4b1a45002b971a/650297073a3d489d5af6efd7/fig14-tsdoutNamedPipes.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 14: “Read” the collected information</figcaption></figure>The information is gathered leveraging the following template:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 15: Sample of the collected info before encryption" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6497946a4527cebe/6502975576c8e45ee3b5f637/fig15-collected-info.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 15: Sample of the collected info before encryption</figcaption></figure>The above information is then encrypted and sent to the attacker server using an uncommon, hardcoded port 35667:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 16: Encrypted information being sent to the server" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt474685ab5f698b32/6502977d9bf26140fd6bcd01/fig16-encrypted-information-sent-toC2.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 16: Encrypted information being sent to the server</figcaption></figure>We have built a script to decrypt the information, available in our <a href="https://github.com/deepinstinct/Rusty-Flag-DecryptData" target="_blank">Git</a>, that the malware is sending.All analyzed files above have a low detection rate on VT at the time. There are zero detections on first seen and most of the detections are generic ones.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 17: Detections of the RUST implant in VT. All detections are generic." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt831a4c472c34a419/650297c50433c0d28e25462b/fig17-VT_Detections.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 17: Detections of the RUST implant in VT. All detections are generic.</figcaption></figure>While the other Rust implant still has zero detections:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 18: 2nd Rust implant VT detections" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3926fc166ca5accf/65029808a8cf8b810b3e0b3f/fig18-sengforVTDet.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 18: 2nd Rust implant VT detections</figcaption></figure><h5>Conclusion:</h5>Deep Instinct Threat Lab could not attribute these attacks to any known threat actor. There is a possibility that these files are part of a red team exercise.Regardless of the above statement, the fact that both Rust implants had zero detections when first uploaded to VirusTotal shows that writing malware in esoteric languages can bypass many security solutions.<h5>MITRE:</h5><table><thead class="bg-grey"><tr><th>Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Discovery</td><td>T1082 System Information Discovery</td><td>The malware executes systeminfo.exe to gain information about the infected computer</td><td>systeminfo.exe</td></tr><tr><td>Discovery</td><td>T1016 System Network Configuration Discovery</td><td>Gain detailed information about the network interfaces on the system</td><td>ipconfig.exe /all</td></tr><tr><td>Discovery</td><td>T1033 System Owner/User Discovery</td><td>Gain user, group, and privileges information for the users</td><td>Whoami.exe /all</td></tr><tr><td>Discovery</td><td>T1087 Account Discovery</td><td>Gain information about local or domain accounts on a system</td><td>Net.exe user</td></tr><tr><td>Discovery</td><td>T1057 Process Discovery</td><td>Gain a list of currently running processes, including detailed information about each one</td><td>Tasklist.exe /v</td></tr><tr><td>Persistence</td><td>T1053 Scheduled Task/Job</td><td>Create a scheduled task using the xml file</td><td>Schtasks.exe</td></tr><tr><td>Command and Control</td><td>T1132 Data Encoding</td><td>Encrypted communication</td><td>Encrypted information sent to the C2. A tool for decrypting the information is provided in our Git.</td></tr></tbody></table><h5>IOC:</h5>78.135.73[.]140<table><thead class="bg-grey"><tr><th>SHA256</th><th>Description</th></tr></thead><tbody><tr><td>463183002d558ec6f4f12475cc81ac2cb8da21549959f587e0fb93bd3353e13e</td><td>Archive containing malicious Office file</td></tr><tr><td>edc531d255b9ae8ae6902dc676f24e95a478576cad297e08e2bbc0b8fe03e4ce</td><td>Malicious Office file</td></tr><tr><td>1546bb5bfc25741434148b77fe51fed7618432a232049b3f6f7210e7fb1f3f0e</td><td>MSI file from hxxps://t[.]ly/8CYQW</td></tr><tr><td>387304b50852736281a29d00ed2d8cdb3368d171215f1099b41c404e7e099193</td><td>SangforUD.EXE Rust implant</td></tr><tr><td>0742cd9b92661f23f6b294cc29c814de027b5b64b045e4807fc03123b153bcd5</td><td>Decoy PDF file</td></tr><tr><td>04725fb5a9e878d68e03176364f3b1057a5c54cca06ec988013a508d6bb29b42</td><td>Malicious LNK file</td></tr><tr><td>35f2f7cd7945f43d9692b6ea39d82c4fc9b86709b18164ad295ce66ac20fd8e5</td><td>MSI file from LNK vector</td></tr><tr><td>5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db</td><td>WinDefenderHealth.EXE Rust implant</td></tr><tr><td>e508cafa5c45847ecea35539e836dc9370699d21522839342c3f3573bf550555</td><td>Decoy JPEG file</td></tr></tbody></table>

Operation Rusty Flag – A Malicious Campaign Against Azerbaijanian Targets

blog-cover-image-contain-yourself-v2.jpg

Contain Yourself: Staying Undetected Using the Windows Container Isolation Framework

blog-image-nofilter-defcon-v3.jpg

#NoFilter - Abusing Windows Filtering Platform for Privilege Escalation

blog-phonyc2-muddywater.jpg

PhonyC2: Revealing a New Malicious Command & Control Framework by MuddyWater

pindos-js-dropper-blog.jpg

Deep Instinct’s Threat Research Lab recently noticed a new strain of a JavaScript-based dropper that is delivering Bumblebee and IcedID. The dropper contains comments in Russian and employs the unique user-agent string “PindOS”, which may be a <a href="https://en.wikipedia.org/wiki/Anti-American_sentiment_in_Russia#Pindos" target="_blank">reference</a> to current (and past) anti-American sentiment in Russia.Bumblebee is a malware loader first discovered in March 2022. It was associated with <a href="https://info.deepinstinct.com/conti-leaks-cyber-threat-reports" target="_self">Conti group</a> and was being used as a replacement for BazarLoader. It acts as a primary vector for multiple types of other malware, including ransomware.IcedID is a modular banking malware designed to steal financial information. It has been seen in the wild since at least 2017 and has recently been <a href="https://www.bleepingcomputer.com/news/security/new-icedid-variants-shift-from-bank-fraud-to-malware-delivery/" target="_blank">observed</a> shifting some of its focus to malware delivery.<h5>Bumblebee’s Dilemma – PowerShell or JavaScript?</h5><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltac10f75989680347" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltac10f75989680347/6493347d48e15a005746c1ff/fig00-bumble_meme.jpg" style="text-align: center;"/></figure>Bumblebee’s primary modus operandi, including its most recent <a href="https://www.secureworks.com/blog/bumblebee-malware-distributed-via-trojanized-installer-downloads" target="_blank">major campaign</a>, involves a PowerShell-based first stage with very characteristic obfuscation (“elemXXX”). This serves as a wrapper and loading routine for an embedded 64-bit payload .DLL. Our analysis of this flow can be found <a href="/blog/the-dark-side-of-bumblebee-malware-loader" target="_self">here</a>.The possible switch to JavaScript instead of PowerShell marks a significant change in Bumblebee’s well-established TTP’s.<h5>IcedID – From Banker to Loader?</h5>As recent reports indicate, IcedID appears to be partially following in Emotet’s footsteps and may be abandoning its banking and financial functionalities in favor of becoming a more generalized loader-type malware. An association with a new JavaScript type of dropper can be seen as another step in this direction.<h5>PindOS JavaScript Technical Analysis</h5>Once de-obfuscated, the dropper is surprisingly simple. It consists of a single function, “exec,” which gets four parameters:<ul><li>“UserAgent” – The user-agent string to be used when downloading Bumblebee’s .DLL</li><li>“URL1” – First address to download from</li><li>“URL2” – Second address to download from</li><li>“RunDLL” – Payload .DLL exported function to call</li></ul>When executed, the dropper will attempt to download the payload initially from URL1 and execute it by calling on the specified export directly via rundll32.exe. If this fails, the dropper will attempt to download the payload from URL2 and execute it using a combination of PowerShell and rundll32.exe.The downloaded payload is saved to %appdata%/Microsoft/Templates/&lt;6-char-random-number&gt;.dat<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt310d8e627d3469ad" alt="Figure 1 – PindOS' main function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt310d8e627d3469ad/6493347db9a076b80b92866c/fig01-pindos-main-function.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 1 – PindOS' main function</figcaption></figure>The function is then called twice, with four separate URLs:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt94b88382eb4426e4" alt="Figure 2 – exec function call from Bumblebee dropper" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt94b88382eb4426e4/6493347dd5b9a5988d6de2e6/fig02-exec-function-call-from-bumblebee-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 2 – exec function call from Bumblebee dropper</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt2ccea6ece70d6aef" alt="Figure 3 – exec function call from IcedID dropper" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2ccea6ece70d6aef/6493347d1fb2d3643c496f99/fig03-exec-call-from-icedid-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 3 – exec function call from IcedID dropper</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltf4668bbd24eb05b8" alt="Figure 4 – Payload download" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4668bbd24eb05b8/6493347df7411b69d437e201/fig04-payload-download.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 4 – Payload download</figcaption></figure>The retrieved payloads are generated pseudo-randomly “on-demand” which results in a new sample hash each time a payload is fetched. This is commonly done to avoid signature-based detection. However, in Bumblebee’s case, this seems somewhat ineffective compared to the previous flow (which did not write the payload directly to disk), as the samples are fairly <a href="https://www.virustotal.com/gui/file/28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523/detection/f-28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523-1686560298" target="_blank">well detected</a> even on “first-seen”. This is likely due to the generated payload’s exports and several other indicators which remain constant and do not vary across the different generated samples.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt9a6ab350a777b88a" alt="Figure 5 – A generalized comparison of Bumblebee’s infection flows - “older” on the right; “newer” on the left." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a6ab350a777b88a/64933d2de66699a1d52eb992/fig05-a-generalized-comparison-of-bumblebees-infection-flows.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 5 – A generalized comparison of Bumblebee’s infection flows - “older” on the right; “newer” on the left.</figcaption></figure>According to Virus Total, on “first-seen” PindOS droppers have mostly received very low detection rates:<img asset_uid="blt5a182e8e00749668" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5a182e8e00749668/64933d2d1fb2d36df6496fcb/fig06-vt-first-seen-detection-pindos-virus.png"/><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt6e2212907fb50273" alt="Figures 6 & 7 – VT first-seen detection for PindOS droppers" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6e2212907fb50273/64933d2d48a8ff009c477fde/fig07-vt-first-seen-detection-pindos-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figures 6 &amp; 7 – VT first-seen detection for PindOS droppers</figcaption></figure><h5>Bumblebee DLL Payload Analysis Highlights</h5>The DLL payload is slightly different from the one previously encountered. Dynamically, it is very similar, with the addition of a few layers of obfuscation. It’s anti-debugging and anti-VM/sandbox features remain the same but with some additional “legitimate looking” strings taken from the <a href="https://github.com/FFmpeg/FFmpeg/blob/1617d1a752d5e97d5e74f6c384609c027c884553/libavutil/error.c" target="_blank">FFmpeg project open-source</a> project’s “error.c” file and a few other files from the same project added for distraction purposes:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt64d2e5ce682d4b38" alt="Figure 8 – Strings found in Bumblebee DLL" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt64d2e5ce682d4b38/6493347d9601bc69e508214d/fig08-strings-found-in-bumblebee-dll.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 8 – Strings found in Bumblebee DLL</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltff29e3f9d11aa98a" alt="Figure 9 – FFmpeg project source, “error.c” file." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff29e3f9d11aa98a/6493347dea50bc3ffabea7f4/fig09-ffmpeg-project-source-error.c-file.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 9 – FFmpeg project source, “error.c” file.</figcaption></figure>Another point of differentiation is that previously Bumblebee DLLs had two main export functions, while the new one has four.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt3c905274f728fa88" alt="Figure 10 – “New” Bumblebee DLL Exports" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3c905274f728fa88/6493347dd2420473b31cd636/fig10-new-bumblebee-dll-exports.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 10 – “New” Bumblebee DLL Exports</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltcb5ad0e83176edf1" alt="Figure 11 – “Old” Bumblebee DLL exports, with main “SetPath” function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcb5ad0e83176edf1/6493347d75c2ae82940617e7/fig11-old-bumblebee-dll-exports-with-main-setpath-function.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 11 – “Old” Bumblebee DLL exports, with main “SetPath” function</figcaption></figure>Further examination of the DLL brings us to the same main function as the previous variant.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltec80d5d7fc0f0819" alt="Figure 12 – “SetPath” in the “new” Bumblebee DLL." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltec80d5d7fc0f0819/6493347ee6669913502eb96f/fig12-setpath-in-the-new-bumblebee-dll.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 12 – “SetPath” in the “new” Bumblebee DLL.</figcaption></figure><h5>Conclusion</h5>Bumblebee’s latest “experiment” attempts to leverage pseudo-random sample generation as a means of reducing the risk of detection. This has been used by threat actors in the financial/banking malware landscape for years, including IcedID, which “shares” the PindOS dropper.Whether PindOS is permanently adopted by the actors behind Bumblebee and IcedID remains to be seen. If this “experiment” is successful for each of these "companion” malware operators it may become a permanent tool in their arsenal and gain popularity among other threat actors.As Bumblebee and <a href="https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/" target="_blank">IcedID</a> are known to deliver ransomware, we recommend that security teams take note of these IOCs. You can find updated lists of IOCs on our <a href="https://github.com/deepinstinct/PindOS-JS-Dropper" target="_blank">GitHub page</a>.<h5>IOCs</h5><ul><li>Network Artifact User-Agent: PindOS</li><li>Bumblebee infection URLs hxxps://qaswrahc.com/wp-content/out/mn[.]php hxxp://tusaceitesesenciales.com/mn[.]php hxxp://carwashdenham.com/mn[.]php hxxps://intellectproactive.com/dist/out/mn[.]php</li><li>Bumblebee .JS dropper SHA256 bcd9b7d4ca83e96704e00e378728db06291e8e2b50d68db22efd1f8974d1ca91 07d2cb0dc0cd353fb210b065733743078e79c4a27c42872cd516a6b1fb1f00d1 00ec8f3900336c7aeb31fef4d111ee6e33f12ad451bc5119d3e50ad80b2212b0 15da5b0a65dd8135273124da0c6e52e017e3b54642f87571e82d2314aae97eec 180a935383b39501c7bdf2745b3a334841f01a7df9d063fecca587b5cc3f5e7a</li><li>Bumblebee DLL payload SHA256 24dd5c33b8a5136bdf29d0c07cf56ef0e33a285bb12696a8ff65e4065cb18359 76c9780256e195901e1c09cb8a37fb5967f9f5b36564e380e7cf2558652f875b 28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523 ac261ac26221505798c65c61a207f3951cc7dce2e1014409d8a765d85bfd91d4</li><li>IcedID infection URLs hxxps://masar-alulaedu.com/wp-content/woocommerce/out/berr[.]php hxxps://egyfruitcorner.com/wp-content/tareq/out/berr[.]php hxxps://tech21africa.com/wp-content/uploads/out/berr[.]php hxxps://www.posao-austrija.at/images/out/lim[.]php hxxps://logisticavirtual.org/wp-content/out/lim[.]php hxxps://adecoco.us/wp-content/out/lim[.]php hxxps://acsdxb.net/wp-content/out/lim[.]php</li><li>IcedID .JS dropper SHA256 92506fe773db7472e7782dbb5403548323e65a9eb2e4c15f9ac65ee6c4bd908b c84c84387f0b9e7bc575a008f36919448b4e6645e1f5d054e20b59be726ee814 7355656f894ae26215f979b953c8fa237dc39af857a6b27754a93adb1823f3b6 8f40ff286419eb4b0c4d15710dc552afb2c2a227a180f4b4f520d09b05724151</li><li>IcedID DLL payload SHA256 9101975f7aca998da796fc15a63b36ab8aa0fe0aed0b186aaed06a3383d5f226 4f0c9c6fc1287ef16f4683db90dd677054a1f834594494d61d765fa3f2e1352c cb307d7fa6eaac6a975ad64ff966ff6b0b0fdd59109246c2f6f5e8d50a33e93c 361b0157ef63d362fdd4399288f5f6a0e1536633dfb49c808a3590718c4d8f10 e71c9ac9ddd55b485e636840da150db5cd2791d0681123457bd40623acd8311c 8ae3be9f09f5fc64ec898a4d6467b2f6e50eaaa26fc460a4f1a9b9566e97a9a7</li></ul><h5>MITRE ATT&amp;CK</h5><table><thead><tr><th style="width: 13%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Execution</td><td>Command and Scripting Interpreter: JavaScript – T1059.007</td><td>Adversaries may abuse various implementations of JavaScript for execution.</td><td>.JS Droppers</td></tr><tr><td>Defense Evasion</td><td>System Binary Proxy Execution: Rundll32 – T1218.001</td><td>Adversaries may abuse rundll32.exe to proxy execution of malicious code.</td><td>Rundll32.exe usage</td></tr><tr><td>Defense Evasion</td><td>Obfuscated Files or Information – T1027</td><td>Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.</td><td>Obfuscated JS, “Random” generated payloads</td></tr></tbody></table>

PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID

blog-image-moveit-file-transfer.jpg

MOVEit encrypts data at rest and in motion and provides IT security controls for sensitive business data. It is used by both the public and private sector, as well as individuals for personal use.A zero-day vulnerability, dubbed CVE-2023-34362, has been discovered in the file transfer tool. The severity of this threat is still under investigation. As such, it does not have an assigned CVSS score as of this writing.When it was first discovered the zero day had already been exploited by a threat actor known to be operating the <a href="https://attack.mitre.org/software/S0611/" target="_blank">Clop ransomware</a> extortion site. In this article, we cover what is currently known.<h5>The What</h5><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34362" target="_blank">CVE-2023-34362</a> is a SQL injection vulnerability in MOVEit Transfer’s web application that allows malicious individuals to gain access to MOVEit Transfer’s database without the need for authentication.MOVEit is often used to transfer sensitive data, such as employee PII. By exploiting this vulnerability, attackers can use this private information for a multitude of purposes, including selling it on the dark web or using the data to extort breached organizations.<h5>The Who</h5>The threat actors behind this attack are believed to be members of the notorious threat group FIN11, also known as Lace Tempest. This threat group is not new to this type of attack. Just last month FIN11 stole millions of patient records using a vulnerability in the GoAnyware file transfer software. In July 2021, they exploited a vulnerability in the file transfer software formerly known as Accellion.<a href="https://attack.mitre.org/groups/G0046/" target="_blank">FIN11</a> is believed to have strong ties to the (presumably) Russian ransomware group Clop. FIN11 has published stolen data on Clop’s leak website in the past and is likely to do it again if they find the recently stolen data worthy of extortion.<h5>The Victims</h5>The breach is believed to have affected numerous organizations. Only a few have come forward to date. Among the proclaimed victims is Zellis, a UK-based payroll and HR solutions provider with multiple clients of its own, a fact that only enlarges the pool of potential victims. Among Zellis’ clients are the BBC and British Airways, both of whom have also come forward as victims of the breach. The British airline giant also confirmed that some of its employees’ data had been stolen during the attack but did not disclose how many of its’ 35,000 employees were affected.As the breach is very recent, and the wounds are relevantly fresh, it is likely that more victims will come forward soon, willingly or otherwise.<h5>What’s next?</h5>There are currently more than 3K exposed servers. We recommend that organizations scan their environment for the <a href="https://github.com/deepinstinct/MOVEit_CVE-2023-34362_IOCs" target="_blank">IOCs</a> and patch the vulnerable versions immediately:2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1).Deep Instinct is following these events closely and will update this post as new details become available.See the CISA Advisory issued on June 7, 2023 <a href="https://www.cisa.gov/news-events/alerts/2023/06/07/cisa-and-fbi-release-stopransomware-cl0p-ransomware-gang-exploits-moveit-vulnerability" target="_blank">here</a>.

The Zero-Day Attack on the MOVEit File Transfer Software

blog-image-bpfdoor-malware.jpg

<h5>What is BPFdoor?</h5>BPFdoor is a Linux-specific, low-profile, passive backdoor intended to maintain a persistent, long-term foothold in already-breached networks and environments and functions primarily to ensure an attacker can re-enter an infected system over an extended period of time, post-compromise.The malware gets its name from its usage of a <a href="https://en.wikipedia.org/wiki/Berkeley_Packet_Filter" target="_blank">Berkley Packet Filter</a> – a fairly unique way of receiving its instructions and evading detection, which bypasses firewall restrictions on incoming traffic.The malware is associated with a Chinese threat actor, Red Menshen (AKA Red Dev 18), which has been observed targeting telecommunications providers across the Middle East and Asia, as well as entities in the government, education, and logistics sectors since 2021.When it was first discovered, approximately one year ago, BPFdoor was noted for its effective and elegant design and its high emphasis on stealth – an essential element in maintaining undetected long-term persistence.Recently, Deep Instinct’s threat lab observed and analyzed a previously undocumented and fully undetected new variant of BPFdoor.<h5>New, Stealthier Variant</h5>Several key differences that make this new variant even stealthier compared to the previous version include the following:<table class="text-center"><thead class="bg-grey"><tr><th style="width: 24%;">&nbsp;</th><th style="width: 38%;">“New stealthy” 2023 variant</th><th>“Old” 2022 variant</th></tr></thead><tbody><tr><td>Encryption</td><td>Static library encryption</td><td>RC4 Encryption</td></tr><tr><td>Communication</td><td>Reverse-Shell</td><td>Bind shell and iptables</td></tr><tr><td>Commands</td><td>No hardcoded commands – all commands are sent through the reverse-shell</td><td>Hardcoded commands</td></tr><tr><td>Filenames</td><td>Not hardcoded</td><td>Hardcoded</td></tr></tbody></table>One of the most significant differences compared to the previous variant lies in the removal of many of its hardcoded indicators, making the newer version more difficult to detect. Since first seen on VirusTotal in February 2023, the new variant remained undetected and is still undetected as of this writing.<h5>BPFdoor Technical Analysis</h5>When executed, the BPFdoor sample will attempt to create and get a lock on a runtime file at “/var/run/initd.lock” and will exit if it fails using that file as a makeshift mutex.<figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt6b1f7a605acf0d71" alt="Figure 1 - BPFdoor " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6b1f7a605acf0d71/645bce382f97ad6087afc2a7/fig01-lock-mutex.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 1 - BPFdoor "mutex" check</figcaption></figure></figure>If successful, BPFdoor will fork itself and continue to run as a child process and in this context will close its stdin, stdout, and stderr streams, and set itself to ignore the following operating system signals:<table class="text-center"><thead class="bg-grey"><tr><th style="width: 16%;">Signal Number</th><th style="width: 21%;">Signal Name</th><th>Signal Description</th></tr></thead><tbody><tr><td>1</td><td>SIGHUP</td><td>SIGHUP ("signal hang-up") is a signal sent to a process when its controlling terminal session is closed.</td></tr><tr><td>2</td><td>SIGINT</td><td>SIGINT (“signal interrupt”) is a signal sent when a user interrupts a program (Ctrl + C)</td></tr><tr><td>3</td><td>SIGQUIT</td><td>SIGQUIT is a signal sent to terminate a process.</td></tr><tr><td>13</td><td>SIGPIPE</td><td>SIGPIPE is a signal sent when a pipe breaks.</td></tr><tr><td>17</td><td>SIGCHLD</td><td>SIGCHLD is a signal sent when a child process exits.</td></tr><tr><td>21</td><td>SIGTTIN</td><td>SIGTTIN is a signal sent to a process attempting to read from the same terminal session and is blocked.</td></tr><tr><td>23</td><td>SIGTTOU</td><td>SIGTTOU is a signal sent to a process attempting to write to the same terminal session and is blocked.</td></tr></tbody></table>Ignoring these signals hardens BPFdoor against tampering with its processes.Having set up the above, BPFdoor then allocates a memory buffer and creates a socket as follows:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltb66f26dd618af2fe" alt="Figure 2 - Socket arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb66f26dd618af2fe/645bce386d595aca93fa2ebf/fig02-socket-args.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 2 - Socket arguments</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blte9215556a7459197" alt="Figure 3 - Socket creation" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte9215556a7459197/645bce388a8445ca97101283/fig03-call-socket.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 3 - Socket creation</figcaption></figure>It will proceed to specify the following socket options using setsockopt:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltff07360ec7be9930" alt="Figure 4 - Setsockopt options" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff07360ec7be9930/645bce388dbb82c3c233f5f4/fig04-setsockopts.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 4 - Setsockopt options</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt0e81a161934c6431" alt="Figure 5 - Call to setsockopt" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0e81a161934c6431/645bce38e4e69e5cbc037449/fig05-call-setsockopts.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 5 - Call to setsockopt</figcaption></figure>And will read from it in a loop (further described below) using recvfrom:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt7a59c922701ee083" alt="Figure 6 - Recvfrom arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7a59c922701ee083/645bce38065c95739056107a/fig06-recvfrom.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 6 - Recvfrom arguments</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt811bbcab6a1bb954" alt="Figure 7 - Recvfrom call" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt811bbcab6a1bb954/645bce38367cefb5428f68a2/fig07-loop-call-recvfrom.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 7 - Recvfrom call</figcaption></figure>An interesting point in the above-described flow is that the “addr” parameter is zeroed out in the call to recvfrom; it should point to a specific address from which to read data. The socket is not connected and no bind or listen calls have been made. So, what exactly is going on here?Interpreting the exact arguments that are used to create the socket reveals that the call is structured as follows:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt36f6534323294019" alt="Figure 8 - Socket call" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt36f6534323294019/645bce38367cefe17b8f689e/fig08-socket_eth.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 8 - Socket call</figcaption></figure>This creates the socket as a special packet sniffing socket which is able to read every packet that is sent to the machine from the ethernet layer and above without being bound to any specific protocol.BPFdoor employs this type of packet sniffing socket to read data with recvfrom, even without an “addr” parameter, by using the loop below to search for a specific “magic” byte sequence:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltf3c3312b0751a812" alt="Figure 9 - Looped search for " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf3c3312b0751a812/645bce388929af83080777c5/fig09-read-loop.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 9 - Looped search for "magic" byte sequence (highlighted)</figcaption></figure>“Magic” byte sequence: \x44\x30\xCD\x9F\x5E\x14\x27\x66Once found, the loop will break and BPFdoor will continue to Its next phase of operation.But, that creates quite a lot of traffic that BPFdoor will need to go through.Let’s examine the usage of setsockopt a bit further. When parsing its arguments, we arrive at the following code:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt734c1601420f27c9" alt="Figure 10 - Setsockopt attaches BPF" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt734c1601420f27c9/645bce4b7e7e7b9bafe70a08/fig10-setsockopt-args.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 10 - Setsockopt attaches BPF</figcaption></figure>This is where BPFdoor gets its name from. The above code that attaches a <a href="https://en.wikipedia.org/wiki/Berkeley_Packet_Filter" target="_blank">Berkley Packet Filter</a> to the socket; this is the very same mechanism that underpins infosec staples such as libpcap and allows BPFdoor to filter out “uninteresting” types of data coming through its socket.A Berkley Packet Filter can be defined as in the example below, which allows TCP over IPv4:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt89210974b140db77" alt="Figure 11 - BPF example" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt89210974b140db77/645bce4b065c95264056107e/fig11-bpf-example.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 11 - BPF example</figcaption></figure>By setting the socket option SO_ATTACH_FILTER and pointing filter to the following sock_filter_code:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt3a9b0cf5b5fbc758" alt="Figure 12 - BPF sock_filter_code" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3a9b0cf5b5fbc758/645bce4b1f0a4c5876e36beb/fig12-sock-filter-codev3.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 12 - BPF sock_filter_code</figcaption></figure>BPFdoor guides the kernel to set up its socket to only read UDP, TCP, and SCTP traffic coming through ports 22 (ssh), 80 (http), and 443 (https).Because of its positioning at such a low level, BPFdoor does not abide by any firewall rules, and can bypass any firewall restrictions on incoming traffic and listen for packets that otherwise wouldn't have surfaced to the machine's user mode.When BPFdoor finds a packet containing its “magic” bytes in the filtered traffic it will treat it as a message from its operator and will parse out two fields and will again fork itself.The parent process will continue and monitor the filtered traffic coming through the socket while the child will treat the previously parsed fields as a Command & Control IP-Port combination and will attempt to contact it.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt59a3decfdb9a8b40" alt="Figure 13 - Connect to Command & Control" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt59a3decfdb9a8b40/645bce4b8a84453a7a101287/fig13-connect-c2.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 13 - Connect to Command & Control</figcaption></figure>An interesting point to note, this variant of BPFdoor contains a pre-compiled version of <a href="https://github.com/libtom/libtomcrypt" target="_blank">libtomcrypt</a>, an open-source encryption library, as can be seen in the sample’s contained strings, which also offer a few additional insights:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt8e6c0a33246bf7b3" alt="Figure 14 - Contained strings" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8e6c0a33246bf7b3/645bce4b291ca448ab7458bf/fig14-libtom-strings.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 14 - Contained strings</figcaption></figure>We can see that the library was compiled at the beginning of October 2022 using GCC on a system running Red Hat Linux. This may suggest that this variant has been operational significantly earlier than its first appearance on VirusTotal.By compiling our own version of the library in similar fashion and using bindiff to compare against BPFdoor we can see its statically linked exports:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt816a0cb45cfa1a28" alt="Figure 15 - Libtomcrypt bindiff snippet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt816a0cb45cfa1a28/645bce4b2f97ad7a76afc2ab/fig15-libtom-bindiff.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 15 - Libtomcrypt bindiff snippet</figcaption></figure>Having made the comparison, we determined that BPFdoor is using libtomcrypt functionality to set up a secure and encrypted “reverse-shell” session with its Command & Control. This replaced its previous mechanism.After this session is established, BPFdoor will begin a loop that can be described by the following:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltb2ff1c169f93cb84" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb2ff1c169f93cb84/645bce3822f9986ff5c5974b/BPFDOORv2Flow.png" style="text-align: center;"/></figure><h5>Conclusion</h5>BPFdoor retains its reputation as an extremely stealthy and difficult-to-detect malware with this latest iteration.Regardless of whether one considers the encryption library compilation time (October 2022) or its initial submission to VirusTotal (February 2023) as indicative of when this sample was first put into use, it is truly amazing how long it has remained fully undetected.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt93ffef0dee975742" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt93ffef0dee975742/645d25159c40aa50cb074137/fig16-vt-0detectionv3.png" style="text-align: center;"/></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt940800074dbf8141" alt="Figure 16 & 17 - 0 VirusTotal detections, 7 different scans." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt940800074dbf8141/645bce4b32acc8af715ee19b/fig17-vt-many-scans.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 16 & 17 - 0 VirusTotal detections, 7 different scans.</figcaption></figure><h5>IOCs</h5>afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7 – BPFDoor ELF SHA256 /var/run/initd.lock – BPFDoor "mutex”<h5>MITRE ATT&CK:</h5><table class="text-center"><thead class="bg-grey"><tr><th style="width: 20%;">Tactic</th><th>Technique</th><th>Description</th><th style="width: 20%;">Observable</th></tr></thead><tbody><tr><td>Command and Control Defense Evasion Persistence</td><td>T1205 - Traffic Signaling</td><td>Attacker employs “magic” values to trigger response.</td><td>“Magic” byte sequence</td></tr><tr><td>Command and Control Defense Evasion Persistence</td><td>T1205.002 - Traffic Signaling: Socket Filters</td><td>Attacker attaches filter to a network socket.</td><td>Usage of Berkley Packet Filter</td></tr><tr><td>Command and Control</td><td>T1573 - Encrypted Channel</td><td>Attacker employs encrypted Command & Control communication.</td><td>Usage of libtomcrypt</td></tr><tr><td>Execution</td><td>T1106 – Native API</td><td>Attacker calls upon native OS APIs in order to execute behaviors.</td><td>Usage of popen</td></tr></tbody></table>Earlier variant analysis: <a href="https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor" target="_blank">https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor</a>Deep Instinct takes a prevention-first approach to stopping ransomware and other malware using the world’s first and only purpose-built, deep learning cybersecurity framework. We prevent ransomware, zero-day threats, and previously unknown malware in &lt;20 milliseconds, 750x faster than the fastest ransomware can encrypt. Deep Instinct has &gt;99% zero-day accuracy and promises a &lt;0.1% false positive rate. The Deep Instinct Prevention Platform is an essential addition to every security stack – providing complete, multi-layered protection against threats across hybrid environments.

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

dirty-vanity-blog.jpg

Dirty Vanity: A New Approach to Code Injection & EDR Bypass

Deep Instinct Included in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP)