di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Storage

Prevention for Applications

Prevention for Endpoints

Data Security: Powered by Deep Instinct

Deep Learning: Prevention-First Cybersecurity

Products

>99% Threat Accuracy

Prevent Ransomware

Prevent Zero-Day Attacks

Why Deep Instinct

Extend & Enhance EDR/XDR

+ Microsoft Defender

+ Tanium

Legacy AV

Enhance Existing Cyber Tools

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Events & Webinars

Resources

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick links

EXPLORE THE PREDICTIVE PREVENTION PLATFORM

End-to-end predictive prevention platform built on a deep learning framework that protects storage, applications, and endpoints.

Prevent >99% of zero-day exploits, ransomware, and unknown threats in your NAS and cloud storage repositories.

Proactively prevent malicious files from entering your storage environment through application uploads by customers, employees, and third parties.

Prevent known and unknown malware, zero-day exploits, ransomware, and script-based attacks before they execute on the endpoint – faster than a blink of an eye.

Leverage advanced predictive prevention technology to protect data across your entire environment.

Data Security: Powered By Deep Instinct

Deep Instinct is the only deep learning framework in the world built from the ground up for cybersecurity.

Unparalleled Prevention

Leverage deep learning to deliver highly accurate threat detection and reduce false positives in a rapidly evolving threat landscape.

Stop threats using real-time classification and prevention techniques to ensure robust and efficient cybersecurity.

Proactively stop zero-day threats in <20ms with unparalleled accuracy and minimal false positives.

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ MICROSOFT DEFENDER

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ TANIUM

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

LEGACY AV

Threat Research

Voice Of SecOps

Leadership Team

Board of Directors

Partners

Login

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

DI_Trellix_Blog.png

<h2>Deep Instinct wins in efficacy, scalability, speed, and total cost of ownership</h2>Enterprise data storage has become a lucrative attack vector for cybercriminals. The explosive growth of data, especially for large financial institutions that have deep stores of sensitive material, has made them attractive targets. Banks face numerous challenges in securing their storage environments, including the following:<ol><li>An ever-evolving threat landscape: Cybercriminals are constantly developing new and more sophisticated methods to infiltrate storage systems, particularly with the emergence of generative AI and LLM-aided malware tools.</li><li>Performance and latency issues: Traditional security solutions often struggle to efficiently scan large volumes of data without impacting system performance and causing unacceptable latency.</li><li>High infrastructure costs: Infrastructure costs can be expensive because of the sheer number of servers required to scan storage data.</li><li>Complexity of deployment and management: Implementing and managing storage security solutions can be cumbersome, especially when using products not purpose-built for the task.</li></ol>Deep Instinct, a leading provider of <a href="https://www.deepinstinct.com/why-deep-instinct">deep learning-based cybersecurity solutions</a>, recently had the opportunity to prove the value of its data storage protection capabilities to a top-five global bank facing these challenges. The bank needed a solution to secure its network attached storage (NAS) against the growing threat of ransomware and other malware. Deep Instinct’s prevention-first approach was especially intriguing.<h5>Bank puts Deep Instinct and Trellix head-to-head</h5>They evaluated <a href="https://www.deepinstinct.com/prevention-for-storage">Deep Instinct Prevention for Storage (DPS)</a> head-to-head against the incumbent, Trellix ENS (Endpoint Security). Trellix had been struggling to complete scans within designated maintenance windows, and the bank wanted to reduce its total infrastructure spend from running over 3,200 scanning servers while strengthening overall storage security.<blockquote>The bank compared DPS and Trellix across several key criteria: efficacy, scalability, scan speed, ease of deployment &amp; operation, and TCO. The evaluation used the latest versions of both products under identical conditions — the same hardware, network speed, and data set.</blockquote>Here are the results of the comparison.Efficacy: In the evaluation, Deep Instinct prevented &gt;99% of known and unknown threats across multiple file types and sizes. Trellix, on the other hand, had much lower efficacy. Additionally, Deep Instinct had a significantly lower false positive rate, enabling the bank’s security team to focus on real threats instead of chasing false positives.Scalability/Speed: DPS outperformed Trellix in terms of performance and scan speed, scanning files ~10x faster, on average. This is a significant advantage in network attached storage environments with inherent latency, as our local deep learning models don’t require cloud calls, making it extremely efficient. DPS’s remarkable speed enables full-volume scans that weren’t feasible with Trellix.Ease of Deployment: The bank gave high marks to DPS for ease of deployment and operation because it is purpose-built for storage security. This includes streamlined implementation and management, intuitive policy configuration, scan stats, and visibility. In contrast, Trellix ENS is essentially an endpoint security product repurposed for storage, making deployment and management cumbersome.Total Cost of Ownership: Based on the performance data, the bank determined that it could secure its storage environment with ~500 DPS servers versus the ~3,200 required by Trellix, an astonishing reduction of ~2,700 servers while offering superior, prevention-first cybersecurity. This reduction has a significant ROI upside — worth millions in infrastructure and licensing costs.<h5>The switch to Deep Instinct</h5>Upon completion of the head-to-head evaluation, the choice was clear: the bank decided to replace its Trellix solution and standardize on Deep Instinct Prevention for Storage across its NAS infrastructure.Here’s why. DPS is tough to beat for organizations securing their storage systems and data against known and unknown threats without compromising performance or driving up costs. It is purpose-built for storage and <a href="https://www.deepinstinct.com/why-deep-instinct">powered by a static analysis engine based on deep learning</a>, delivering unmatched efficacy, speed, efficiency, and ease of use.The hype around Deep Instinct’s cyberstorage offering is real — and is now validated in one of the world's largest and most demanding enterprise environments.<a href="https://info.deepinstinct.com/request-a-demo" target="_self">Request a demo</a> with us to see it for yourself.

Deep Instinct vs. Trellix: A Banking Giant Cyberstorage Bakeoff

Blog Image - Not All AI is Equal

<h2>Preventing Cyber Threats Requires Deep Learning, Not Just AI</h2>The rapid advancement of artificial intelligence (AI) is fundamentally reshaping the cybersecurity landscape. On one hand, AI-powered tools hold tremendous potential for automating threat detection and making security teams more efficient. However, these same technologies also empower threat actors to create increasingly sophisticated and hard-to-detect attacks. Organizations now face a critical challenge: leveraging “good” AI while also defending against this new breed of “bad” AI.On the positive side, AI can automate threat monitoring, reduce human error, and give time back to security operations (SOC) teams who are underwater chasing alerts, making prevention and detection more effective and efficient. Recent reports found that false positives from antiquated cybersecurity tools significantly strain these team members’ time, accounting for <a href="https://www.deepinstinct.com/voice-of-secops-reports">over two working days of lost productivity</a> per week.Conversely, AI makes it much easier for bad actors to create and manipulate malware that continuously changes to evade detection from traditional cyber tools – like <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">legacy Anti-Virus (AV)</a> – and steal sensitive data. According to the <a href="https://www.verizon.com/business/resources/reports/dbir/#industry-reports">Verizon 2023 Data Breach Investigation Report</a>, the success rate for attacks has escalated to more than 30% due to threat actors’ use of AI. These advancements in attack methods and the harsh realities of AI are making existing security measures obsolete.The potential for unlocking competitive advantage led <a href="https://www.deepinstinct.com/voice-of-secops-reports">69% of organizations</a> last year to adopt generative AI tools. However, with so much on the line, organizations need to understand the risks and limitations of AI and what’s required to get ahead of adversaries and predict advanced cyber threats.<h5>Evaluating the Challenges and Limitations of AI</h5>With the widespread availability of generative AI, new cyber threats are emerging daily, and much faster than in previous years. Recent examples include hyper-realistic deepfakes and phishing attacks. Threat actors are using tools like ChatGPT to craft well-written and grammatically correct emails, videos, and images that are difficult for spam filters and readers/viewers to catch. We’ve seen popular reports of deepfakes using high-profile figures such as <a href="https://streaklinks.com/BwzsOuG8vB-hEI-DrQZ7iCcv/https%3A%2F%2Fapnews.com%2Farticle%2Ffact-check-kelly-clarkson-weight-loss-gummies-702026826728%23%3A~%3Atext%3DCLAIM%253A%2520A%2520video%2520on%2520Kelly%2Cpromotions%2520for%2520the%2520diet%2520product.?email=kjohnson%40inkhouse.com">Kelly Clarkson</a>, <a href="https://fortune.com/2019/06/12/deepfake-mark-zuckerberg/">Mark Zuckerberg</a>, and <a href="https://fortune.com/2024/01/30/ai-policing-taylor-swift-porn-deepfakes-porn/">Taylor Swift</a>. We also saw <a href="https://www.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html">a hacker posing as a CFO</a> trick a finance worker at a multinational firm into transferring $25 million.Concerns with the use of large language models extend beyond phishing and social engineering techniques. There are widespread concerns about the unintended consequences of companies using these generative AI tools in typical business scenarios. For example, after a recent <a href="https://www.forbes.com/sites/siladityaray/2023/05/02/samsung-bans-chatgpt-and-other-chatbots-for-employees-after-sensitive-code-leak/?sh=73e2b17f6078">Samsung</a> breach, the company banned ChatGPT and other AI-based tools among its employees to cut back on potential security gaps if the technology – and the sensitive data shared on these platforms – were to fall into the wrong hands. In the Samsung case, a crackdown occurred after an accidental leak of sensitive internal source code was uploaded to ChatGPT by an engineer.We’re seeing similar complications with threat actors using tools like FraudGPT, WormGPT, and EvilGPT opening advanced attack techniques up to a broader audience of less sophisticated users. With these tools, a cybercriminal can perform an array of tasks to write new malware code, reverse engineer existing code, and identify vulnerabilities to generate novel attack vectors.&nbsp;As threat actors use AI to make their attacks smarter, stealthier, and quicker, we’ve seen more and more organizations deploy new solutions that tout AI capabilities. However, <a href="https://www.deepinstinct.com/blog/are-your-cybersecurity-vendors-really-fighting-ai-with-ai-">not all AI is created equal</a>, creating limitations with many solutions that claim to be powered by AI. Advanced adversarial AI can’t be defeated with basic machine learning (ML), the type of technology most vendors are leveraging and promoting (and calling it AI, generically). The cybersecurity community needs to shift away from a reactive, “assume breach” approach and turn to one focused on prevention.&nbsp;Furthermore, we’ve reached the notable <a href="https://www.idc.com/getdoc.jsp?containerId=US49349323">end of the Endpoint Detection and Response (EDR) honeymoon period.</a> EDR is too outdated, reactive, and ineffective against today’s sophisticated, adversarial AI-driven cyber threats. Most cybersecurity tools leverage ML models that present several shortcomings. For example, they are trained on limited subsets of available data (typically 2-5%), offer just 50-70% accuracy with unknown threats, and introduce an avalanche of false positives. ML solutions also require heavy human intervention and are trained on small data sets, exposing them to human bias and error.We’ve entered a pivotal time in the evolution of cybersecurity, one that can only be resolved by fighting AI with better, more advanced AI.<blockquote>“In this new era of generative AI, the only way to combat emerging AI threats is by using advanced AI – one that can prevent and predict unknown threats. Relying on antiquated tools like EDR is the equivalent of fighting a five-alarm fire with a garden hose. Assuming breach has been an accepted stance but the belief that EDR can get out ahead of threats is simply not true. A shift toward predictive prevention for data security is required to remain ahead of vulnerabilities, limit false positives, and alleviate security team stress.” -- <a href="https://www.deepinstinct.com/voice-of-secops-reports" target="_self">Voice of SecOps, 4th Edition 2023, The Power of Deep Learning</a></blockquote><h5>The Power of Deep Learning</h5>Due to AI advancements, we can now prevent ransomware and other cyber attacks rather than detect and respond to them afterward. Deep Learning (DL) is the most advanced form of AI and is the only way to deliver true prevention. When applied to cybersecurity, DL trains its neural networks to autonomously predict threats to prevent known and unknown malware, ransomware, and zero-day attacks.Traditional AI can’t keep pace with the sheer volume of data entering an organization. It only leverages a portion of the data to make high-level business decisions. With DL, data is never discarded, making it much more accurate and enabling it to predict and prevent known and unknown threats quickly.There are less than a dozen major DL frameworks in the world – and only one is dedicated fully to cybersecurity: the <a href="/platform" target="_self">Deep Instinct Prevention Platform</a>. It continuously <a href="https://www.deepinstinct.com/blog/congratulations-now-smarter-than-ever-we-got-a-new-brain">trains</a><a href="https://www.deepinstinct.com/blog/congratulations-now-smarter-than-ever-we-got-a-new-brain"> itself on millions of raw data points</a>, becoming more accurate and intelligent over time. Because DL models understand the building blocks of malicious files, it makes it possible to implement and deploy a predictive prevention-based security solution. This allows savvy cybersecurity teams to shift from an outdated “assume breach” mentality to a predictive prevention approach.Only deep learning has the power to match the speed and agility of this next-gen adversarial AI.

Watch Deep Learning Explainer

AI, Machine Learning and Deep Learning: What They Are and Why They Are Different?

Deep Instinct Provides Broad Protection Without Human Intervention

Solution-EPP-Reduce-Risk-Deep-Learning.svg

<h5>AI and the End of the "Assume Breach" Mentality</h5>2023 was the year when we saw AI burst onto the scene; 2024 will be the year AI alters the way threat actors create and deploy cyber-attacks, forcing organizations to emphasize prevention.At Deep Instinct, we firmly believe that the “assume breach” mentality is ineffective and extremely destructive to organizations. Businesses can – and should – protect themselves from advanced forms of attacks by leveraging a more sophisticated form of AI, such as deep learning, to fight against AI-driven threats.For more information about <a href="https://www.deepinstinct.com/blog/mit-explores-how-deep-learning-is-transforming-cybersecurity">how deep learning is transforming cybersecurity</a>, read our blog post.

Why All AI Isn’t Created Equally in Cybersecurity

Blog Image - 2024-predictions.png

Over the past 12 months, we have seen rapid changes in the cybersecurity landscape—and there are no signs of it slowing down in 2024. In fact, in our most <a href="https://www.deepinstinct.com/cyber-threat-reports">recent Cyber Threat Report</a>, we found that the total number of ransomware victims in 2023 increased significantly, with more victims in the first half of 2023 than in all of 2022.Attacks themselves were also more disruptive—the MOVEit data breach leaked the personal information of up to 11 million people while the FBI struggled to stop the cybergang behind the attacks on MGM and Caesars Entertainment. With sophisticated cyberattacks and techniques like <a href="https://www.deepinstinct.com/ransomware-protection-solution">ransomware</a>, <a href="https://www.deepinstinct.com/zero-day-attacks">zero-day exploits</a>, and other never-before-seen threats increasing, the status quo, “assume breach” mindset needs to get crushed in 2024.As we kick off 2024, members of our executive leadership team, including CEO Lane Bess, CPO Yariv Fishman, and CIO Carl Froggett, share their outlook on the new year and the relevant themes to keep a close eye on. This includes the shift to a prevention-first mindset, the impacts of AI on security, and a heightened awareness of vulnerable attack vectors.<h5>The Year of the Prevention-first Mindset</h5><a href="https://www.computerweekly.com/microscope/opinion/How-can-security-vendors-react-to-the-growing-AI-threat">TechTarget</a> shared Fishman’s perspective that this year we’ll see the “assume breach” mindset finally shift to prevention first.“Since the dawn of cybersecurity, organizations have operated with a ‘detect and respond’ approach to breaches. This also meant that they had an ‘assume breach’ mentality. The rapid advances in AI mark a turning point for organizations and the end of the Endpoint Detection and Response (EDR) honeymoon period, making way for a focus on prevention. It's high time to eliminate the ‘assume breach’ status quo. In 2024, organizations will start shifting towards a prevention-first mindset, utilizing Deep Learning (DL), the most advanced form of AI, which allows for increased prevention capabilities, reduction of Total Cost of Ownership (TCO), and tools to block and prevent future adversarial AI cyber-attacks.”Bess predicts that prevention will become a board-level imperative.“As cybersecurity becomes a critical topic amongst the C-suite in 2024, boards will prioritize threat prevention. There’s currently a board-level mandate for organizations to have detection and response capabilities within their security plans and portfolios; however, in the coming years, there will also be a prevention strategy mandate.”Bess strongly believes prevention against cyber attacks is possible, and agrees with Fishman that it requires a shift away from the status quo, “assume breach” mentality that has plagued the industry for far too long.<h5>The Impacts of AI on the Security Industry</h5><a href="https://www.computerweekly.com/microscope/opinion/How-can-security-vendors-react-to-the-growing-AI-threat">Fishman</a> foresees that adversarial AI will skyrocket in the new year.“Large Language Models (LLMs) hold a lot of promise—but they are nowhere near their maximum potential. In 2024, as public LLMs become more accurate and powerful, we'll simultaneously see an uptick in adversarial AI. LLMs can already perform standalone vulnerability research, exploit implementation, and execute attacks, including custom obfuscation and malware builders like never before. Existing tools have proven they cannot address zero-day threats, creating the need to fight AI with AI—specifically, a more advanced form of it, deep learning (DL). Only DL, the most sophisticated form of AI, is best positioned to combat these zero-day Adversarial AI threats.”Furthermore, the cybersecurity market will continue to consolidate, with AI being a catalyst for increased M&amp;A investments and innovation, as predicted by Bess.“The cybersecurity market is overcrowded with point solutions. In 2024, we’ll continue to see the larger platform players extend their capabilities via acquisition. The ideal targets are smaller security companies with great technology, especially advanced AI and ML capabilities that aren’t scaling year over year. Cybersecurity companies that solve significant problems in the industry will continue to thrive.”Lastly, quantum computing will continue to collide with AI, causing destruction, according to Froggett in a conversation with <a href="https://betanews.com/2023/12/21/faster-problem-solving-more-investment-and-time-travel-attacks-quantum-predictions-for-2024/">BetaNews</a>.“While there are still a lot of unknowns, the intersection of quantum computing and AI will take the cybersecurity and tech industry by storm—and blow traditional computing capabilities out of the water. Quantum computing is likely to become disruptive—if not destructive—the more it integrates with AI and gets into the hands of bad actors. Recently, the Cybersecurity and Infrastructure Security Agency, the National Security Agency, and the National Institute of Standards and Technology published a quantum ‘<a href="https://www.cisa.gov/news-events/news/cisa-nsa-and-nist-publish-new-resource-migrating-post-quantum-cryptography">fact sheet</a>’ to help industries prepare now for the inevitable future—which is coming sooner than we think.”<h5>A Heightened Awareness of Vulnerable Attack Vectors</h5>According to Bess, a heightened awareness of data in motion and at rest as a vulnerable attack vector will emerge.“Storage and cloud solution vendors will become more ambitious in ensuring their solutions offer adequate protection. Up until now, this has been the focus of the CISO within the enterprise. Moving forward, storage-focused decision-makers will join forces with their security counterparts to ensure the enterprise is secure from data breaches, and storage providers will shift to focus on offering security solutions.”Furthermore, Froggett predicts bad actors will leverage hyper-realistic deepfakes to breach organizations.“In 2023, threat actors manipulated AI to deploy more sophisticated malware and ransomware, as well as hyper-realistic deepfake and phishing campaigns. We’ve seen this in action with the MGM breach involving social engineering, as well as high-profile figure <a href="https://streaklinks.com/Bu2xRowFxfM3G2cTvw32Thxw/https%3A%2F%2Fapnews.com%2Farticle%2Ffact-check-kelly-clarkson-weight-loss-gummies-702026826728%23%3A~%3Atext%3DCLAIM%253A%2520A%2520video%2520on%2520Kelly%2Cpromotions%2520for%2520the%2520diet%2520product.?email=pditoppa%40inkhouse.com">Kelly Clarkson</a> being mimicked through deepfake technology. In 2024, bad actors will take these attack techniques to a new level, enacting more holistic end-to-end campaigns through AI and automation. As a result, traditional cybersecurity approaches to defend against these campaigns, including information security training and awareness, will need to be significantly updated, refreshed, or totally revamped.”While the road to an optimal security posture presents challenges in the year ahead, it also reveals solutions to protect a company’s greatest assets. By facing these challenges head-on and working to achieve a prevention-first approach to cybersecurity, companies can successfully work to protect against malicious actors and keep themselves safe and secure this new year.Be sure to follow the Deep Instinct blog for additional insights on emerging threats and solutions to overcome them as highlighted by the threat research team.

New Year, New Prevention-First Security Mindset: Predictions for 2024

blog-image-UAC-099-Ukraine.png

<h5>Key Takeaways</h5><ul><li>"UAC-0099" is a threat actor that has targeted Ukraine since mid-2022</li><li>Deep Instinct Threat Lab has identified new attacks by the threat actor</li><li>The threat actor was observed leveraging CVE-2023-38831</li><li>The threat actor targets Ukrainian employees working for companies outside of Ukraine</li></ul><h5>Introduction</h5>In May 2023, the Ukrainian CERT published advisory <a href="https://cert.gov.ua/article/4818341" target="_blank">#6710</a> about a threat actor dubbed “UAC-0099.” The advisory briefly details the threat actor’s activities and tools.Since the CERT-UA publication in May, Deep Instinct has identified new attacks carried out by “UAC-0099” against Ukrainian targets.This blog post will shed additional light on the threat group’s recent attacks, which feature common tactics, techniques, and procedures (TTPs), including the use of a fabricated court summons to bait targets in Ukraine into executing the malicious files.Important note: Some of the C2 servers related to these attacks are still active at the time of publication.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt08d3b2f2d7d67bbf" alt="fig1-Attack-flow.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt08d3b2f2d7d67bbf/65835d869fa6cf660e286cfd/fig1-Attack-flow.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: Overview of recent UAC-0099 activities.</figcaption></div></figure><h5>RAR SFX with LNK Infection Vector</h5>In early August, “UAC-0099” sent an email impersonating the Lviv city court using the ukr.net email service.The email was sent to a corporate email box of a Ukrainian employee working remotely for a company outside of the Ukraine.The attached is an executable file created by WinRAR, the Windows-based file archiver and compression utility that can compress a file as a self-extracting archive (SFX):<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt8c3feebcf5b30766" alt="fig2-SFX-Execution.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8c3feebcf5b30766/65835d85c3fb27179c19bffe/fig2-SFX-Execution.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: Prompt when executing the attached SFX file.</figcaption></div></figure>After extracting the contents of the archive, a new file is created with a double extension, in this case docx.lnk:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt52f1063996d6c6ac" alt="fig3-Double-extention-trick.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt52f1063996d6c6ac/65835d853ea3614ddc574a88/fig3-Double-extention-trick.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Double extension social engineering trick.</figcaption></div></figure>The file looks like a regular document file. However, it’s a LNK shortcut disguised as a DOCX file. Closer inspection reveals that the file uses the “WordPad” application icon instead of a DOCX icon. When opened, the specially crafted LNK file executes PowerShell with malicious content:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltdd7e45750fbc5e70" alt="fig4-Malicious-powershhell_wz.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltdd7e45750fbc5e70/65835d8671a55d4766cd1dea/fig4-Malicious-powershhell_wz.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: Malicious PowerShell commands inside the LNK file.</figcaption></div></figure>The malicious PowerShell code decodes two base64 blobs and writes the output into VBS and DOCX files. After that, the PowerShell code opens the DOCX file as a decoy while also creating a new scheduled task that executes the VBS file every three minutes.The VBS malware was named “LonePage” by CERT-UA. When executed, it creates a hidden PowerShell process that communicates with a hardcoded C2 URL to fetch a text file. The rest of the PowerShell code is executed only if the response from the C2 is greater than one byte. In that instance, the PowerShell script checks to see if the string “get-content“ is included in the text file. If the string is present, then the script executes the code from the server and saves it as an array of bytes. If the string is absent, the script executes a combination of commands inside the text file from the server and some hard-coded basic enumeration commands such as “whoami:”<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt45c12455f8d2218f" alt="fig5-LonePage-VBS.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt45c12455f8d2218f/65835d85b782f0f0c55838b3/fig5-LonePage-VBS.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: LonePage VBS script.</figcaption></div></figure>Regardless of the C2 response, the results of executing the commands inside the txt file or the hardcoded commands are sent back to the same C2 server. However, it is sent to a different port via HTTP POST method.The DOCX document is a decoy to trick the victim into thinking they’re opening a legitimate DOCX file containing a court summons instead of a malicious file:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltf72caabeacbb69dc" alt="fig6-DOCX-Content.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf72caabeacbb69dc/65835d86b0fbcbc10f626012/fig6-DOCX-Content.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: Contents of DOCX file.</figcaption></div></figure>In early November, another instance of this campaign was <a href="https://pastebin.com/rpFYCNPS" target="_blank">observed</a> using a different C2 address — 196.196.156[.]2.Since the threat actor controls the content of the “upgrade.txt” files, they can change it according to their objectives. As such, the content is not always the same and can vary.The following code was <a href="https://www.virustotal.com/gui/file/124c805af0ad7388f78fd0d048e4fadbc3217a897012615eb7aff7034d205c0b" target="_blank">observed</a> as a response from the C2 server at 2023-11-08 14:50:30 UTC.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt9bd8ef7a5cd0ea04" alt="fig7-GetScreen-Command.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9bd8ef7a5cd0ea04/65835d981f8952d579911826/fig7-GetScreen-Command.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: C2 Get-Screenshot command.</figcaption></div></figure>This PowerShell code is responsible for taking a screenshot. As mentioned above, the LonePage VBS sends the results back to the C2, allowing the threat actor to execute any PowerShell code on the infected computer and receive the response back.At the end of November 2023, another campaign instance was observed using the C2 address 2.59.222[.]98. In this case, the payload response from the C2 server aligns with what was described as “recon” activity in the <a href="https://web.archive.org/web/20231108142010/https:/pastebin.com/rpFYCNPS" target="_blank">pastebin</a>:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltfda9c4f87ac4975c" alt="fig8-Recon-Command.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfda9c4f87ac4975c/65835d98be5d263767657a9a/fig8-Recon-Command.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: Recon commands received from C2 server.</figcaption></div></figure>The decoy document is a PDF file instead of a DOCX. And instead of the usual court summons document, the PDF file shows a smudged document:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt13277171b51512f1" alt="fig9-Smudged-decoy-PDF.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt13277171b51512f1/6583613d0543c5286e8f08c9/fig9-Smudged-decoy-PDF.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: Smudged decoy PDF document.</figcaption></div></figure><h5>HTA Infection Vector</h5>In contrast to the LNK attack vector described earlier, this attack uses HTA. The HTA method is similar, but there are notable differences. Instead of an LNK file invoking PowerShell, the HTA file includes HTML code that contains a VBScript that executes PowerShell. The scheduled task cadence is also different — it runs every four minutes instead of three in the previous cases.While CERT-UA reported in their advisory that the HTA file drops an HTML file as a decoy, Deep Instinct observed a similar court summons DOCX decoy document, like what was observed in the LNK chain.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt1289482c7f012b60" alt="fig10-HTA-content.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1289482c7f012b60/65835d984135c46e76567bc0/fig10-HTA-content.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 10: HTA file content.</figcaption></div></figure><h5>CVE-2023-38831 Infection Vector</h5>In both attacks described below, “UAC-0099” exploited a known WinRAR vulnerability, <a href="https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/" target="_blank">identified</a> by Group-IB and traced back to April 2023.The vulnerability stems from how WinRAR processes ZIP files. The exploitation requires a user to interact with a specially crafted ZIP archive.Here’s how it works: the attacker creates an archive with a benign filename with a space after the file extension — for example, “poc.pdf .” The archive includes a folder with the same name, including the space (something that is not possible under normal conditions, since the operating system does not allow the creation of a file with the same name). The folder includes an additional file with the same name as the benign file, including a space, followed by a “.cmd” extension.When a user opens a ZIP file containing these files in an unpatched version of WinRAR and double-clicks on the benign file, the file with the “cmd” extension is executed instead.The vulnerability might produce higher infection rates because the attacks are disguised so well; even security-savvy victims can fall for the deception. Expecting to open a benign file, the user will inadvertently execute malicious code.You can find a POC for the vulnerability in <a href="https://github.com/deepinstinct/UAC-0099-Targeting_UA" target="_blank">GitHub</a>. A patched WinRAR (version 6.23) was released on August 2, 2023.Deep Instinct identified two ZIP files created by “UAC-0099" on August 5, 2023:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blte04762783408272b" alt="fig11-Malicious-cmd-inside-zip.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte04762783408272b/65835d98b0fbcb3e03626016/fig11-Malicious-cmd-inside-zip.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 11: Contents of malicious “cmd” file inside ZIP archive.</figcaption></div></figure>The malicious “cmd” file is different in the two files, each containing a different C2 URI path.The modification time between the two files is only two seconds, indicating that, most likely, the files were created in an automated fashion. This, combined with the fact that UAC-0099 started to exploit the vulnerability several days after the patch, shows the level of sophistication of the attackers.While Google TAG <a href="https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/" target="_blank">identified</a> several Russian threat actors using the vulnerability to attack Ukrainian targets, the UAC-0099 activity is absent in their blog.The CVE assignment and the Group-IB blog about the vulnerability were published after “UAC-0099” leveraged the attack technique, indicating they likely knew how to exploit it.The decoy used in this campaign was once again the “summon to court” document theme.<h5>Conclusions and Recommendations</h5>The tactics used by “UAC-0099” are simple, yet effective. Despite the different initial infection vectors, the core infection is the same — they rely on PowerShell and the creation of a scheduled task that executes a VBS file.Monitoring and limiting the functionality of those components can reduce the risk of “UAC-0099” attacks — and/or identify them quickly in the event of compromise.The WinRAR exploitation is an interesting choice. Some people don’t update their software in a timely fashion, even with automatic updates. WinRAR requires a manual update, meaning that even if a patch is available, many people will likely still have a vulnerable version of WinRAR installed.Please make sure you have the <a href="https://www.rarlab.com/download.htm" target="_blank">latest</a> version of WinRAR installed.IOCs and the POC for the CVE-2023-38831 can be found on our <a href="https://github.com/deepinstinct/UAC-0099-Targeting_UA" target="_blank">GitHub</a>.<h5>IOCs</h5>147.78.46[.]40196.196.156[.]22.59.222[.]98<table style="width: 100%;"><thead class="bg-grey"><tr><th>SHA256</th><th>Description</th></tr></thead><tbody><tr><td>d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6</td><td>SFX</td></tr><tr><td>0eec5a7373b28a991831d9be1e30976ceb057e5b701e732372524f1a50255c7</td><td>LNK</td></tr><tr><td>8aca535047a3a38a57f80a64d9282ace7a33c54336cd08662409352c23507602</td><td>VBS</td></tr><tr><td>2c2fa6b9fbb6aa270ba0f49ebb361ebf7d36258e1bdfd825bc2faeb738c487ed</td><td>Decoy</td></tr><tr><td>659abb39eec218de66e2c1d917b22149ead7b743d3fe968ef840ef22318060fd</td><td>SFX</td></tr><tr><td>0aa794e54c19dbcd5425405e3678ab9bc98fb7ea787684afb962ee22a1c0ab51</td><td>LNK</td></tr><tr><td>4e8de351db362c519504509df309c7b58b891baf9cb99a3500b92fe0ef772924</td><td>VBS</td></tr><tr><td>53812d7bdaf5e8e5c1b99b4b9f3d8d3d7726d4c6c23a72fb109132d96ca725c2</td><td>Decoy</td></tr><tr><td>38b49818bb95108187fb4376e9537084062207f91310cdafcb9e4b7aa0d078f9</td><td>HTA</td></tr><tr><td>a10209c10bf373ed682a13dad4ff3aea95f0fdcd48b62168c6441a1c9f06be37</td><td>VBS</td></tr><tr><td>61a5b971a6b5f9c2b5e9a860c996569da30369ac67108d4b8a71f58311a6e1f1</td><td>Decoy</td></tr><tr><td>86549cf9c343d0533ef80be2f080a7e3c38c77a1dfbde0a2f89048127979ec2a</td><td>SFX</td></tr><tr><td>762c7289fb016bbcf976bd104bd8da72e17d6d81121a846cd40480dbdd876378</td><td>LNK</td></tr><tr><td>39d56eab8adfe9eb244914dde42ec7f12f48836d3ba56c479ab21bdbc41025fe</td><td>VBS</td></tr><tr><td>f75f1d4c561fcb013e262b3667982759f215ba7e714c43474755b72ed7f9d01e</td><td>Decoy</td></tr><tr><td>986694cad425c8f566e4e12c104811d4e8b30ce6c4c4d38f919b617b1aa66b05</td><td>CVE-2023-38831 ZIP</td></tr><tr><td>54458ebfbe56bc932e75d6d0a5c1222286218a8ef26face40f2a0c0ec2517584</td><td>CVE Payload</td></tr><tr><td>96ab977f8763762af26bad2b6c501185b25916775b4ed2d18ad66b4c38bd5f0d</td><td>VBS</td></tr><tr><td>6a638569f831990df48669ca81fec37c6da380dbaaa6432d4407985e809810da</td><td>Decoy</td></tr><tr><td>87291b918218e01cac58ea55472d809d8cdd79266c372aebe9ee593c0f4e3b77</td><td>CVE-2023-38831 ZIP</td></tr><tr><td>f5f269cf469bf9c9703fe0903cda100acbb4b3e13dbfef6b6ee87a907e5fcd1b</td><td>CVE Payload</td></tr><tr><td>e34fc4910458e9378ea357baf045e9c0c21515a0b8818a5b36daceb2af464ea0</td><td>VBS</td></tr><tr><td>2a3da413f9f0554148469ea715f2776ab40e86925fb68cc6279ffc00f4f410dd</td><td>SFX</td></tr><tr><td>0acd4a9ef18f3fd1ccf440879e768089d4dd2107e1ce19d2a17a59ebed8c7f5d</td><td>LNK</td></tr><tr><td>6f5f265110490158df91ca8ad429a96f8af69ca30b9e3b0d9c11d4fef74091e8</td><td>VBS</td></tr><tr><td>736c0128402d83cd3694a5f5bb02072d77385c587311274e3229e9b2fd5c5af7</td><td>Decoy</td></tr></tbody></table>

Threat Actor 'UAC-0099' Continues to Target Ukraine

As the cybersecurity industry plays catch up, Deep Learning continues to be the only way to predict and prevent sophisticated AI threats.

DI-deeplearning.png

With the widespread availability of generative AI, new cyber threats are emerging daily. Dark AI tools like <a href="https://thehackernews.com/2023/07/new-ai-tool-fraudgpt-emerges-tailored.html" target="_blank">FraudGPT</a> and <a href="https://thehackernews.com/2023/07/wormgpt-new-ai-tool-allows.html" target="_blank">WormGPT</a> have opened advanced adversarial attack methods to a broader audience of less sophisticated actors.The threat landscape has fundamentally changed.As a result, traditional cybersecurity measures no longer work. Organizations need something more powerful and advanced to stay ahead of cybercriminals, to anticipate their next move before they make it, and to prevent ransomware, unknown, and zero-day threats from landing in the first place.Only deep learning has the power to match the speed and agility of this next-gen adversarial AI.There are less than 10 deep learning frameworks in the world – despite other cybersecurity vendors’ bold, false claims on their promises of AI protection. And there’s only one <a href="https://www.deepinstinct.com/why-deep-instinct?_ga=2.237779200.1255878901.1702848544-667067167.1702335063" target="_self">deep learning model dedicated to cybersecurity</a>: Deep Instinct.The power of Deep Instinct rests in our ability to understand and identify the DNA of an attack – detecting and stopping it before it can execute on an endpoint. Its ability to self-learn is extraordinary. It is unmatched in its speed and accuracy to autonomously predict, detect, and prevent threats.We’re fighting dark AI with deep learning.In contrast, most traditional cybersecurity vendors are attempting to advance their machine learning models to fight back against emerging AI-based threats. But not all AI is created equal. You can’t fight advanced adversarial AI with basic machine learning, the technology most cybersecurity vendors hang their hats on. It’s the most basic form of AI and is unsuitable for the task.On a recent <a href="https://www.cnbc.com/2023/11/29/crowdstrike-ceo-says-ai-can-help-prevent-ransomware-attacks.html" target="_self">Mad Money segment, CrowdStike’s CEO George Kurtz told Jim Cramer</a> that using AI to fight sophisticated ransomware attacks is critical to combat the growing threat of dark AI.To address it, Kurtz pointed to the important need for prevention-first technologies that don’t rely on traditional signatures. And he reminded listeners that CrowdStrike has incorporated AI into its product for years.But here’s the catch: the AI advancements from IT security vendors like CrowdStrike are more of the same – they’re still fundamentally based on basic machine learning models and are, therefore, incapable of stopping rapidly evolving, AI-powered cyber threats in the wild.To counter today’s advanced adversarial AI, you need deep learning, the most advanced form of AI. We’re playing chess while other vendors are playing checkers.To learn more, I’d welcome you to check out the following:<ol><li>Read about the <a href="https://www.deepinstinct.com/glossary/deep-learning" target="_self">power of deep learning</a>, and why it is our core differentiator.</li><li>Listen to Deep Instinct’s CEO, Lane Bess, talking about this firsthand with Steven Rosenbush at the <a href="https://www.deepinstinct.com/videos?wchannelid=ysjgh8jbc8&wmediaid=miqn8ruai3" target="_self">Wall Street Journal CIO Network Summit in this video</a>.</li><li>Download our most recent <a href="https://www.deepinstinct.com/cyber-threat-reports" target="_self">2023 Mid-Year Threat Report</a>, which includes predictions about the growing threat of LLMs.</li></ol>Don’t base your organization’s security posture on false promises, or legacy vendors who are still in “catch up” mode.<a href="https://www.deepinstinct.com/contact-us" target="_self">Contact us</a> to learn how deep learning-powered predictive prevention can help your organization stay ahead of adversarial AI, during a time when it’s needed most.

Are Your Cybersecurity Vendors Really Fighting AI with AI?

Conti was one of the most notable and well-documented threat groups. Learn about who they were, how they started, their notable successes, and ultimately, how they dissolved.

DI_ContiGroup.png

Ransomware is big business. In 2023, the average data breach cost organizations $4.45 million, while the average ransomware attack cost $4.54 million. For threat actor groups, there’s profit to be made. The most successful ransomware groups feature sophisticated operational structures, running like a business with HR, finance, and all the support teams you’d find in a legitimate enterprise.&nbsp;&nbsp;&nbsp;One of the most notable and well-documented threat groups is <a href="https://en.wikipedia.org/wiki/Conti_(ransomware)" target="_blank">Conti</a>, a Russian-affiliated organization formed in the late 2010s. While just one of many active threat groups, it was unique in its size, success (some estimates peg their earnings in the billions), and structure.&nbsp;&nbsp;The now famous Conti Leaks in February 2022, which came from disaffected Ukrainian affiliates following the Russian invasion of Ukraine, exposed its organizational structure and techniques, which precipitated its demise. &nbsp;How did the Conti group come to be, and what made it so successful? In this blog post, we’ll take a brief look inside Conti – who they are, how they started, their notable successes, and ultimately, how they dissolved.&nbsp;&nbsp;<h5>Who Was Conti?&nbsp;</h5>Although a direct link was never made explicit, Conti had clear ties to Russia. Group members corresponded in Russian and publicly supported Russian geopolitical interests, particularly after the initial invasion of Ukraine.&nbsp;According to the U.S. State Department, the group was responsible for more than a thousand attacks against the U.S. and international critical infrastructures. It targeted organizations and governments across the globe, including the Taiwanese chip manufacturer <a href="https://threatpost.com/conti-iot-chip-advantech-ransom-demand/161691/" target="_blank">Advantech</a>, <a href="https://www.sepa.org.uk/about-us/cyber-attack/" target="_blank">Scotland’s Environmental Protection Agency</a>, and <a href="https://cisomag.com/bank-indonesia-suffers-ransomware-attack-suspects-conti-involvement/#:~:text=According%20to%20a%20report%2C%20the,adding%20mitigation%20measures%20were%20undertaken." target="_blank">Bank Indonesia</a>, among others.&nbsp;Early builds of Conti were observed in late 2019. However, the first public report of Conti’s ransomware didn’t appear until mid-2020. The group was born from what most would consider a natural progression of the “big game hunting” methodology of the “TrickBot group” (a.k.a., ITG23, WizardSpider, FIN12, GOLD BLACKBURN, and DEV-0193).&nbsp;&nbsp;<figure style = "float: left;display: inline-block;margin:0;width: auto;max-width:auto;"><img asset_uid="bltc3f7ff5fff872fd8" alt="Figure 1-Conti_Timeline.png" inline="true" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc3f7ff5fff872fd8/65778d62f0a6886eee4b35d5/fig1-Conti_Timeline.png" height="auto" style="text-align: left;float: left;width: null;" /><figcaption style="text-align: center;" >Figure 1-Conti Timeline</figcaption></figure>&nbsp;<h5>Conti’s Tools and Techniques&nbsp;</h5>Most ransomware can be categorized as fully automated or semi-automated. Fully automated ransomware carries out the infection, lateral movement, encryption, and exfiltration autonomously. In contrast, semi-automated ransomware requires an operator to carry out some of these steps using various tools. The Conti group belonged to the latter category.&nbsp;Conti group’s operators most often gained access to a victim’s networks post-infection through malware operated by other groups with “friendly” relations to Conti, such as TrickBot, BazarLoader, Emotet, and IcedID.&nbsp;Conti group’s operators would hunt for and prioritize targets with elevated privileges, such as IT staff, system administrators, security professionals, or executives. Once a network was sufficiently compromised and access was obtained, Conti operators would shift their focus to data collection and exfiltration. After exfiltrating the data, the group delivered and executed its own malware, encrypting the victim’s network.&nbsp;<h5>Leaks That Lead to Conti’s Eventual Downfall&nbsp;</h5>When the group publicly declared its support for Russia in its war with Ukraine in February 2022, its troubles began. Conti’s internal chat logs and source code were leaked by former Ukrainian affiliates after the breakout of hostilities between the two countries.&nbsp;The published documents shed light on Conti’s day-to-day operations. While most don’t think of a ransomware threat group as a fully operating enterprise, that’s exactly what the Conti Leaks showed. Based on research from Deep Instinct, Conti featured a robust organizational structure, with approximately 80-105 employees across HR, Finance, Reverse Engineering, Research, and OSINT teams.&nbsp;The average monthly salary was $1,800 to $2,500 USD. Overall spending amounted to $140,000 to $165,000 for salaries and expenses per month, including transaction commissions and platform management (servers, proxy, recruitment). The evidence even showed that Conti, despite massive revenues, still suffered from cash flow issues in the same way you might see in any small tech startup.&nbsp;Not only did the leaks reveal financials and team dynamics, but they also provided views into the group’s “operational philosophy” including codified employee guides and working policies.&nbsp;<h5>Pressure, Pursuit, and Breakup&nbsp;</h5>Despite the leaks, Conti continued to orchestrate “numerous high-profile, high-impact incidents” after the onset of the Russia-Ukraine war. Unfortunately for Conti, the leaks put a target on their back and galvanized global law enforcement agencies to hunt its members.&nbsp;&nbsp;Conti’s attack against the Costa Rican government in April 2022 was the tipping point. This attack, which occurred roughly two weeks after a change of leadership, crippled Costa Rica’s government and forced it to declare a state of emergency.&nbsp;On August 11th, 2022, the U.S. State Department announced it had issued a $10 million USD reward for information that could lead to the identification of five key Conti members and their whereabouts.&nbsp;&nbsp;With the February 2022 leak of internal chats and malware source code, the high-profile attack on the government of Costa Rica, and the considerable “bounty” on their heads from law enforcement, the group’s leaders declared their “brand” had become “toxic” and ceased operations.&nbsp;<h5>The Lessons from Conti&nbsp;</h5>While Conti has disbanded, the bad actors and operators behind the group remain as active as ever, using increasingly sophisticated tools and techniques to attack vulnerable targets. Many of the group’s former leaders and affiliates set up operations under new monikers, including HIVE, BlackBasta, BlackByte, AlphV/BlackCat, AvosLocker, Quantum, and Zeon/Royal Ransomware.&nbsp;As they find success, their newly formed threat groups will grow, likely with improvements to their own security policies to prevent future leaks and stay under the radar from law enforcement authorities around the world.&nbsp;As long as there is money to be made, threat actors will continue to build sophisticated operational structures to maximize profits. Competing threat groups have learned from Conti how to operate in an organized fashion, at scale, using their proven techniques and methodologies. The biggest lesson is clear: the next Conti is already out there.&nbsp;&nbsp;Want to learn more about Conti, including member profiles and detailed internal chats? Check out our eBook, <a href="https://info.deepinstinct.com/conti-leaks-cyber-threat-reports" target="_blank">Threat Landscape Report Special Edition: Conti Group</a>. In addition to an exploration of Conti’s rise and eventual dissolution, its key figures, and major attacks, the eBook examines the exact tools and techniques Conti used to fuel their rise.

DOWNLOAD

Threat Landscape Report Special Edition: Conti Leaks

di_threat_landscape_report_special_edition_-_conti_group_final_720.png

Conti Group: An Inside Look

blog-image-muddyc2go.jpg

The contents of this blog post were originally scheduled to be presented during an upcoming cybersecurity conference. However, interest in this topic has heightened due to the war in Israel and a suspected ongoing attack against Israeli targets. As such, we have decided to publish the relevant findings from the presentation now.<h5>Executive Summary:</h5><ul><li>Deep Instinct’s Threat Research team has identified a previously unreported C2 framework suspected to be in use by MuddyWater</li><li>The C2 framework may have been in use by the MuddyWater group since at least 2020</li><li>The framework’s web component is written in the Go programming language – hence the name we gave it: MuddyC2Go</li><li>MuddyWater seems to have stopped using PhonyC2 and is now using MuddyC2Go instead</li></ul><h5>Background</h5>In June 2023, we published a report about <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">PhonyC2</a>, a custom C2 framework used by the MuddyWater APT group.While analyzing previous PhonyC2 infrastructure, Deep Instinct uncovered anomalies that indicated MuddyWater might be using an additional C2 framework.At that time, we lacked sufficient evidence to support this claim. However, after we published our PhonyC2 research, we observed two IP addresses previously related to MuddyWater, one of those addresses which was hosting PhonyC2 had switched to a different C2 framework delivering a PowerShell payload.This behavior heightened suspicions of a new C2 framework. However, without seeing and observing the initial payload, those IP addresses could have been internal tests by MuddyWater before fully deploying the C2.Recently, Deep Instinct observed similar C2 activity on a different cluster of IP addresses that has not been associated previously with MuddyWater.This new activity’s initial payload confirmed our assessment that this activity is related to MuddyWater.<h5>Current MuddyWater Activity Using MuddyC2Go</h5><a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Previous research</a> has shown typical MuddyWater TTPs include spear-phishing emails containing archives or links to archives that include various legitimate remote administration tools.If the receiving target opens the file inside the archive, it installs a remote administration tool that allows the attacker to execute additional tools and malware, including MuddyWater’s PhonyC2.Deep Instinct observed the following changes in recent activity:<ul><li>The archives are now password protected. This is done to evade email security solutions that scan files inside archives without a password.</li><li>Instead of using a remote administration tool where an operator executes a PowerShell script to connect to MuddyWater’s C2, a new executable is now being sent. This executable contains an embedded PowerShell script that automatically connects to MuddyWater’s C2, eliminating the need for manual execution by the operator.</li></ul>Let’s examine several examples of this new C2 framework.<h5>July 2023 – Attack Against Jordanian Company</h5>Deep Instinct identified a file named “offtec.exe” which is an executable. Offtec is also the name of a Jordanian company.When executed, it runs a PowerShell script which connects to a MuddyC2Go server located at the IP address 45.150.64[.]239.The executable was built using PowerGUI from Quest Software. This tool allows the user to generate an executable that runs an embedded PowerShell script that is provided by the user.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: PowerGUI logo" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2e55ad6e0e12cbe2/654af2a5b42e39040a69a428/fig1-PowerGUI-Logo.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: PowerGUI logo</figcaption></figure>After communicating with the C2, the communication is switched to dynamic DNS using the address “microsoftfice.ddns[.]net”The response from the C2 is again a PowerShell script that runs every 10 seconds and waits for commands from the operator using the C2:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt0f5f4af3edeedf94" alt="Figure 2: Part of the PowerShell code sent from the C2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0f5f4af3edeedf94/654af2a5b42e39040a69a424/fig2-Powershell-C2-Code.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: Part of the PowerShell code sent from the C2</figcaption></figure><h5>September 2023 – Attacks Against an Iraqi Telecommunications Provider</h5>In September, Deep Instinct identified additional variants of executables created with PowerGUI. The executables have been spread via password-protected RAR archives.The archives were uploaded from Iraq and their file name included the word “Korek.”<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltaca79be7f5b4795d" alt="Figure 3: KorekPro file on VT" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaca79be7f5b4795d/654af2a5b3460c040a0b095a/fig3-KorekPro-VT.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: KorekPro file on VT</figcaption></figure><a href="https://en.wikipedia.org/wiki/Korek_Telecom" target="_blank">Korek</a> is an Iraqi-Kurdish mobile phone operator. MuddyWater targeted Korek in <a href="https://mp-weixin-qq-com.translate.goog/s/NN_iRvwA6yOHFS9Z3A0RBA?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" target="_blank">2019</a>.In this attack, the C2 IP addresses and dynamic DNS were different: ghostrider.serveirc[.]com<h5>October 2023 – “Swords of Iron” War</h5>While Iranian involvement in the war is still being investigated, on October 11, the fourth day of the war, Deep Instinct identified a scan of the MuddyC2Go URL from Israel in VirusTotal.Because the URL is unique and responded with PowerShell, it likely indicates there was a recent attack against an Israeli target by MuddyWater. This is also supported by our recent discovery of <a href="https://www.deepinstinct.com/blog/muddywater-en-able-spear-phishing-with-new-ttps" target="_self">another active campaign</a> from MuddyWater against Israeli targets.Deep Instinct could not identify an associated PowerGUI executable for this attack, although there could have been a different initial access vector to the attack that didn’t rely on social engineering.The C2 IP address that was used this time is 94.131.109[.]65.<h5>Attribution</h5>While investigating the PhonyC2 framework (written in Python) and its infrastructure, Deep Instinct identified servers responding with a generic “web.go” header. This header suggests MuddyWater is using a web application written in the Go programming language.In 2022, Mandiant <a href="https://www.mandiant.com/resources/blog/telegram-malware-iranian-espionage" target="_blank">reported</a> that MuddyWater wrote malware using Go, showing they are capable of using this language. However, the malware is “client-side,” whereas the C2 framework is “server-side.” As such, they are likely unrelated.Deep Instinct was able to find traces of a Go-based C2 framework used by MuddyWater dating back to the beginning of 2020.Deep Instinct identified 162.223.89[.]11 as the first IP address publicly attributed to MuddyWater using MuddyC2Go.Both <a href="https://www.secureworks.com/blog/business-as-usual-for-iranian-operations-despite-increased-tensions" target="_blank">SecureWorks</a> and <a href="https://blog.talosintelligence.com/iranian-apt-muddywater-targets-turkey/" target="_blank">Talos</a> reported a malicious Excel file (63e404011aeabb964ce63f467be29d678d0576bddb72124d491ab5565e1044cf) in January and February. When this file is opened, the malicious execution chain eventually leads to the C2 server 162.223.89[.]11.In May 2020, this IP address was <a href="https://www.virustotal.com/gui/url/dfe4269ae77af4ebd2f20156c7d1fb0eff05af17c25de4acadfda1b8f64e352f/details" target="_blank">observed</a> using MuddyC2Go.The IP address 109.201.140[.]103 has not been previously associated with MuddyWater. However, multiple scans from January, including one from Egypt, which aligns with MuddyWater’s interests and timeframe of above reports, contains unique URLs that are used by MuddyC2Go. Additionally, there is <a href="https://www.virustotal.com/gui/url/44b00e2d17de6df7ff6bcd27cff9f932e6c41052e3dce4603a55cbf41e153aca/details" target="_blank">scan</a> for a file named ssf.zip on this IP. Secure Sockets Funneling (SSF) was mentioned in the SecureWorks report as a tool used by MuddyWater.SSF is a tool that has been <a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east" target="_blank">reported</a> by multiple security vendors to be part of MuddyWater’s arsenal.In February 2022, CISA <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a" target="_blank">published</a> indicators that signal MuddyWater activity, including the IP address 164.132.237[.]65.In March 2022, this address was <a href="https://www.virustotal.com/gui/url/39e38246cd33cd971ad6760207ad8faa7384536ef4a8cc487bcc4d4bc2d75390/details" target="_blank">observed</a> to be a MuddyC2Go server. It was previously <a href="https://www.security.ntt/blog/analysis-of-an-iranian-apts-e400-powgoop-variant" target="_blank">associated</a> with PowGoop.In April 2022, the IP address 141.95.177[.]130 was <a href="https://www.virustotal.com/gui/url/4a503712ccf32917b95fea40eb9d2ddc2f7c4e51552beb4cc179a6f1dd650f10/details" target="_blank">observed</a> hosting MuddyC2Go. Additionally, the passive DNS of this IP resolved to jbf1.nc1310022a[.]biz, a pattern that was already observed with PhonyC2 servers. A year later, in April 2023, Group-IB <a href="https://www.group-ib.com/blog/muddywater-infrastructure/" target="_blank">associated</a> this IP address to MuddyWater via a specific ETag header that was used in numerous MuddyWater servers.In the same report, Group-IB identified an LNK <a href="https://www.virustotal.com/gui/file/2528838a609aa143769efb37dff45af723868d4ed33eb1ce0e2d6ce64b2a1507/relations" target="_blank">file</a> from October 2022 that was communicating with the IP address 91.121.240[.]108. The <a href="https://www.virustotal.com/gui/url/c644ec1f939c1f072e7384ef6804f0a432f81b3c78acf8e0e9eedd44d6d0d55b/details" target="_blank">responses</a> from this IP indicate that it was MuddyC2Go. In addition, the LNK file was inside an archive named “request-for-service-no10102022.zip” The naming convention is very <a href="https://www.virustotal.com/gui/file/1670a59f573037142f417fb8c448a9022c8d31a6b2bf93ad77a9db2924b502af/details" target="_blank">similar</a> to the naming convention MuddyWater used in their <a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Syncro campaign</a>.Both Group-IB and Deep Instinct have <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">linked</a> the IP address 137.74.131[.]18 to MuddyWater. Deep Instinct initially observed PhonyC2 at this address, and after our publication, MuddyWater switched to MuddyC2Go on this IP address. Additionally, the IP address 137.74.131[.]20—which was previously reported by Group-IB —also started to host MuddyC2Go.<h5>Conclusion</h5>Due to the leak of PhonyC2 source code, MuddyWater stopped using the framework and switched to using a Go-based C2 framework. Since the actual source code of the new framework is not available, the full capabilities are unknown. However, based on past leaks and associated known activity, this is another framework that generates PowerShell payloads that MuddyWater uses in the “Actions on Objectives” phase in the “<a href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html" target="_blank">Cyber Kill Chain</a>.” PowerShell has always been the bread and butter of MuddyWater operations.We recommend disabling PowerShell if it is not needed. If it is enabled, we recommend close monitoring of PowerShell activity.While it is not trivial to fingerprint the MuddyC2Go framework, as it looks like any other generic web application written in Go, Deep Instinct managed to identify previous attacks dating back to 2020 due to unique URL patterns generated by the framework.Currently, Deep Instinct has identified all known active MuddyC2Go servers hosted at “Stark Industries,” a VPS provider known to host malicious activity. Deep Instinct identified additional suspected MuddyC2Go servers hosted at Stark Industries without any malicious activity or known URL pattern.Additional IOCs and information regarding Iranian Threat Actors can be found in our <a href="https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors" target="_blank">Git</a>.<h5>IOCs:</h5>Network<table style="width: 100%;"><thead class="bg-grey"><tr><th>IP Address</th><th>Description</th></tr></thead><tbody><tr><td>91.121.61[.]76</td><td>MuddyC2Go (2020)</td></tr><tr><td>109.201.140[.]103</td><td>MuddyC2Go (2020)</td></tr><tr><td>162.223.89[.]11</td><td>MuddyC2Go (2020)</td></tr><tr><td>164.132.237[.]65</td><td>MuddyC2Go (2022)</td></tr><tr><td>141.95.177[.]130</td><td>MuddyC2Go (2022) – (jbf1.nc1310022a[.]biz)</td></tr><tr><td>91.121.240[.]108</td><td>MuddyC2Go (2022)</td></tr><tr><td>137.74.131[.]18</td><td>MuddyC2Go (2023) – (qjk2.6nc051221c[.]co)</td></tr><tr><td>137.74.131[.]20</td><td>MuddyC2Go (2023)</td></tr><tr><td>45.150.64[.]239</td><td>MuddyC2Go (2023) – (microsoftfice.ddns[.]net)</td></tr><tr><td>95.164.46[.]35</td><td>MuddyC2Go (2023) – (ghostrider.serveirc[.]com)</td></tr><tr><td>45.67.230[.]91</td><td>MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>94.131.109[.]65</td><td>MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>95.164.46[.]199</td><td>MuddyC2Go (2023) – (Stark Industries</td></tr><tr><td>185.248.144[.]158</td><td>Suspected MuddyC2Go (2023) – (Stark Industries) – (mbcaction.hopto[.]org)</td></tr><tr><td>94.131.98[.]14</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>45.150.64[.]23</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>45.150.64[.]39</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>95.164.38[.]99</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr></tbody></table>File<table style="width: 100%;"><thead class="bg-grey"><tr><th>MD5</th><th>Description</th></tr></thead><tbody><tr><td>34212eb9e2af84eceb6a8234d28751b6</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>3c6486dfb691fc6642f1d35bdf247b90</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>55b99af81610eb65aabea796130a0462</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>d7ca8f3b5e21ed56abf32ac7cb158a7e</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>d3a2dee3bb8fcd8e8a0d404e7d1e6efb</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>4a70b1e4cb57c99502d89cdbbed48343</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>f08aa714fd59b68924843cbfddac4b15</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>db0e68d7d81f5c21e6e458445fd6e34b</td><td>offtec.exe (C2: 45.150.64[.]239)</td></tr><tr><td>dbcc0e9c1c6c1fff790caa0b2ffc2fe5</td><td>PowerShell script embedded in offtec.exe</td></tr><tr><td>e07adc4ee768126dc7c7339f4cb00120</td><td>PowerShell response from 45.150.64[.]239</td></tr><tr><td>feede05ba166a3c8668fe580a3399d8f</td><td>Performance.rar – Password protected archive</td></tr><tr><td>9894b84916f9264d897fe3b4a83bc608</td><td>KorekFile.rar – Password protected archive</td></tr><tr><td>9957250940377b39e405114f0a2fe84b</td><td>Performance/KorekFile.exe (C2: 95.164.46[.]35)</td></tr><tr><td>245c3ed373727c21ad9ee862b767e362</td><td>PowerShell script embedded in Performance/KorekFile</td></tr><tr><td>22971759adf816c6fb43104c0e1d89d6</td><td>PowerShell response from 95.164.46[.]35</td></tr><tr><td>5e0cc23a6406930a40696594021edb5f</td><td>KorekPro.rar – Password protected archive</td></tr><tr><td>79a638b2f2cc82bfe137f1d12534cda5</td><td>d.exe (C2: 95.164.46[.]35)</td></tr><tr><td>fc523904ca6e191eb2fdb254a6225577</td><td>PowerShell script embedded in d.exe</td></tr><tr><td>b867ec1cef6b1618a21853fb8cafd6e1</td><td>PowerShell response from 45.67.230[.]91</td></tr><tr><td>57641ce5af4482038c9ea27afcc087ee</td><td>PowerShell response from 94.131.109[.]65</td></tr><tr><td>fe5f94e5df19d95df26aaf774daad9df</td><td>PowerShell response from 95.164.46[.]199</td></tr></tbody></table>

MuddyC2Go – Latest C2 Framework Used by Iranian APT MuddyWater Spotted in Israel

MuddyWater Unleashed a New Social Engineering Campaign Against Israel During the Israel-Hamas War.

blog-muddywater-en-able.jpg

<h5>Executive summary:</h5><ul><li>Deep Instinct’s Threat Research team has identified a new campaign from the “MuddyWater” group</li><li>The campaign has been observed attacking two Israeli targets</li><li>The campaign exhibits updated TTPs to previously reported MuddyWater activity</li></ul><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: Campaign overview " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6790e59d9363b777/65426ffc4ed3b2001a90c710/fig1-muddywater-campaign-overview.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Campaign overview</figcaption></figure><h5>Introduction</h5><a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Previous</a> research showed that MuddyWater has sent spear-phishing emails, starting back in 2020, with direct links, as well as PDF, RTF, and HTML attachments containing links to archives hosted on various file-sharing platforms.Those archives contained installers for various legitimate remote administration tools.Before launching the new campaign during the Israel-Hamas war, MuddyWater <a href="https://twitter.com/k3yp0d/status/1719269176101990574" target="_blank">reused</a> previously known remote administration tools, utilizing a new file-sharing service called “<a href="https://www.storyblok.com/" target="_blank">Storyblok</a>.”On October 30th Deep Instinct identified two archives hosted on “Storyblok” containing a new multi-stage infection vector. It contains hidden files, an LNK file that initiates the infection, and an executable file designed to unhide a decoy document while executing <a href="https://www.n-able.com/features/advanced-monitoring-agent" target="_blank">Advanced Monitoring Agent</a>, a remote administration tool.This is the first public report about MuddyWater utilizing this remote administration tool.<h5>The Multi-stage Social Engineering Campaign</h5>While Deep Instinct could not verify the spreading mechanism of the new campaign, it most likely starts with a spear-phishing email, similar to previous campaigns.The content of the email lures the victim into downloading an archive hosted at “a.storyblok[.]com”In this analysis, we examine the “defense-video.zip” file.When the archive is extracted, several folders must be navigated until a LNK shortcut, which looks like another folder named “Attachments,” is found:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 2: LNK Shortcut" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte46c4bf1b082e1d5/65427050a67ffd001b94e1c9/fig2-muddywater-hidden-lnk-shortcut.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: LNK Shortcut</figcaption></figure>However, there are additional hidden folders and files extracted from the archive:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 3: Hidden folders" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltad15ce5115cba266/654270aa2149b10407ad84f5/fig3-muddywater-hidden-folders.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Hidden folders</figcaption></figure>When the victim opens the LNK file, the infection chain starts.By examining the LNK file, we can see that it executes an executable from one of the hidden directories:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 4: LNK command line arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt64dfe55de3f736ef/654270df7265fb04074f77da/fig4-muddywater-lnk-command-line-arguments.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: LNK command line arguments</figcaption></figure>The file “Diagnostic.exe” has been used in both archives Deep Instinct observed. The purpose of this file is to execute another executable called “Windows.Diagnostic.Document.EXE,” which is located in the hidden directory named “.end” under a “Windows.Diagnostic.Document” hidden directory.The file named “Windows.Diagnostic.Document.EXE” is a signed, legitimate installer for “Advanced Monitoring Agent.”In addition to executing the remote administration tool, “Diagnostic.exe” also opens a new Windows Explorer window of the hidden “Document” folder. This is done to fool the victim that opened the LNK file into thinking that it was indeed a folder.The decoy document is an official memo from the Israeli Civil Service Commission, which can be publicly downloaded from their <a href="https://www.gov.il/he/departments/news/disciplinary-treatment-statements-against-israel-wartime-news" target="_blank">website</a>.The memo describes what to do in case a government worker expresses opinions against the Israeli state on social networks:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 5: Decoy document" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc8cf7596101ee9db/654270fca184e7001b4f934b/fig5-muddywater-csc-decoy-document.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Decoy document</figcaption></figure><h5>Conclusion</h5>MuddyWater continues to attack Israeli targets in various ongoing campaigns.In this campaign, MuddyWater employs updated TTPs. These include a new public hosting service, employing a LNK file to initiate the infection, and utilizing intermediate malware that mimics the opening of a directory while executing a new remote administration tool.After the victim has been infected, the MuddyWater operator will connect to the infected host using the legitimate remote administration tool and will start doing reconnaissance on the target.After the reconnaissance phase, the operator will likely execute PowerShell code which will cause the infected host to beacon to a custom C2 server.MuddyWater has used <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">PhonyC2</a> in the past. However, Deep Instinct recently observed MuddyWater using a new C2 framework named MuddyC2Go – a detailed blog will be published soon, stay tuned.<h5>IOCs:</h5>File<table style="width: 100%;"><thead class="bg-grey"><tr><th>MD5</th><th>Description</th></tr></thead><tbody><tr><td>37c3f5b3c814e2c014abc1210e8e69a2</td><td>Archive containing Atera Agent</td></tr><tr><td>16923d827a440161217fb66a04e8b40a</td><td>Atera Agent Installer</td></tr><tr><td>7568062ad4b22963f3930205d1a14df7</td><td>Archive containing Atera Agent</td></tr><tr><td>39eea24572c14910b67242a16e24b768</td><td>Archive containing Atera Agent</td></tr><tr><td>2e09e53135376258a03b7d793706b70f</td><td>Atera Agent Installer</td></tr><tr><td>1f0b9aed4b2c8d958a9b396852a62c9d</td><td>Archive containing SimpleHelp</td></tr><tr><td>065f0871b6025b8e61f35a188bca1d5c</td><td>SimpleHelp Installer</td></tr><tr><td>146cc3a1a68be349e70b79f9115c496b</td><td>defense-video.zip</td></tr><tr><td>dd247ccd7cc3a13e1c72bb01cf3a816d</td><td>Attachments.lnk</td></tr><tr><td>8d2199fa11c6a8d95c1c2b4add70373a</td><td>Diagnostic.exe</td></tr><tr><td>04afff1465a223a806774104b652a4f0</td><td>Advanced Monitoring Agent Installer</td></tr><tr><td>6167f03c8b2734c20eb02d406d3ba651</td><td>Decoy Document (defense-video.zip)</td></tr><tr><td>e8f3ecc0456fcbbb029b1c27dc1faad0</td><td>attachments.zip</td></tr><tr><td>952cc4e278051e349e870aa80babc755</td><td>Decoy Document (attachments.zip)</td></tr></tbody></table>Network<table style="width: 100%;"><thead class="bg-grey"><tr><th>IP or URL</th><th>Description</th></tr></thead><tbody><tr><td>ws.onehub[.]com/files/7f9dxtt6</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/253959/x/b92ea48421/form.zip</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/255988/x/5e0186f61d/questionnaire.zip</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/259791/x/94f59e378f/questionnaire.zip</td><td>URL to Archive of SimpleHelp</td></tr><tr><td>146.70.149[.]61</td><td>MuddyWater’s SimpleHelp server</td></tr><tr><td>146.70.124[.]102</td><td><a href="https://twitter.com/MichalKoczwara/status/1719294254206288001" target="_blank">Suspected MuddyWater’s SimpleHelp server</a></td></tr><tr><td>37.120.237[.]204</td><td>Suspected MuddyWater’s SimpleHelp server</td></tr><tr><td>37.120.237[.]248</td><td>Suspected MuddyWater’s SimpleHelp server</td></tr><tr><td>a.storyblok[.]com/f/259837/x/21e6a04837/defense-video.zip</td><td>URL to Archive of Advanced Monitoring Agent</td></tr><tr><td>a.storyblok[.]com/f/259791/x/91e2f5fa2f/attachments.zip</td><td>URL to Archive of Advanced Monitoring Agent</td></tr></tbody></table>Additional IOCs regarding MuddyWater can be found in our GitHub page: <a href="https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors" target="_blank">https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors</a>

MuddyWater eN-Able spear-phishing with new TTPs

How we’re protecting organizations’ most valuable asset 

DI_DPS_Blog.jpg

As artificial intelligence (AI) transforms nearly every industry, it’s also changing how cybercriminals approach their work.Threats have steadily become more sophisticated and commonplace, and fresh avenues for attacks are becoming more accessible for organized cybercrime. AI is arming hackers, nation-state actors, and fraudsters with means to carry out complex and calculated attacks faster, more efficiently, and more easily than ever before.All of this is occurring with more data than ever before. The average large enterprise has between seven and 17 petabytes of data stored in hybrid, cloud, or on-prem databases. With more data available – and vulnerable – and with AI-enabled tools that help cybercriminals create malware and malicious code, it’s more critical than ever for organizations to protect stored data.Breaches can cost millions of dollars to remediate, erode corporate reputation, send share prices tumbling, and anger customers. For enterprises to effectively safeguard critical data, preventing malicious files from landing in their storage is imperative. In an ever-evolving, AI-driven digital landscape, Deep Instinct can protect organizations and the integrity of their data.<h5>Introducing Deep Instinct Prevention for Storage</h5>Traditional storage solutions – whether in cloud environments or through network attached storage (NAS) vendors – focus on storage, not protection. While these solutions are successful at housing data, they lack the adequate protection necessary to protect in an increasingly sophisticated threat landscape. The legacy tools many organizations implement to supplement this lack of protection react to threats only once they’re in the environment, or interrupt workflows by sanitizing essential files into flat copies. And the tools that claim to be AI or machine learning (ML)-driven only detect <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity" target="_blank">60 percent</a> of unknown attacks post-execution, allowing a zero-day threat or new malware variant time to execute and exhibit known bad behaviors before being caught. They also require human tuning and more time investment from security and IT teams. Organizations that take data protection seriously must leverage tools that actually protect their data. Deep learning (DL) is the solution.<a href="https://www.deepinstinct.com/prevention-for-storage" target="_self">Deep Instinct Prevention for Storage</a> (DPS) – part of our Deep Instinct Prevention Platform – applies a prevention-first approach to storage protection, stopping ransomware, known and unknown threats, and malware from reaching data and executing within the environment, wherever data is stored. Powered by Deep Instinct’s unique DL framework, DPS seamlessly integrates into NAS, hybrid, or public cloud environments while delivering unparalleled efficacy, accuracy, and enterprise-grade scalability. DPS provides proactive prevention that is scalable, saves time, offers ongoing security to comply with regulations, and quickly thwarts cyberthreats before they impact companies’ bottom line.With DPS, organizations can achieve the following:<ul><li>Improve SOC operations and lower TCO: DPS enables teams to reliably and quickly scan millions of documents per day, taking &lt;20 milliseconds per file – 750x faster than the fastest known ransomware can encrypt. It also helps teams confidently assess potential threats with a false positive rate of &lt;0.1% and &gt;99% efficacy in preventing unknown threats.</li><li>Manage solutions and maintain compliance: DPS natively integrates with storage infrastructure, including Dell CAVA and NetApp Vscan, and integration with SIEM and SOAR.</li><li>Streamline threat analysis: DPS automatically logs all file scans and generates detailed events for each malicious file, which are sent directly to the management console. Teams can control and manage remediation actions within storage, including quarantine or deletion of malicious files, as well as restore from quarantine, if needed. It also offers security status at-a-glance with single console management across all Deep Instinct products.</li><li>Ensure data privacy: Data never leaves an organization’s environment. They stay compliant with ensured data privacy and logs from every file scanned.</li></ul>As attacks increase in volume and velocity and emerging technologies like AI expand the threat landscape, a reactive or incomplete approach to data security is no longer sufficient. Organizations must continually scan data to account for the most advanced phishing, malware, and ransomware attacks. Only DL can offer that.You can learn more about this innovative new solution in the following ways:<ul><li>Read the new eBook, <a href="https://info.deepinstinct.com/ai-driven-cyberstorage" target="_blank">AI-driven Cyberstorage: Protecting Organizations’ Most Valuable Asset</a></li><li>Watch our webinar from Wednesday, November 1st, below:</li></ul>

Introducing Deep Instinct Prevention for Storage

DPA-Launch-PR.jpg

It’s officially Cybersecurity Awareness Month, a month-long collaborative effort led by the <a href="https://www.dhs.gov/CISA" target="_blank">Cybersecurity and Infrastructure Security Agency</a> and the <a href="https://staysafeonline.org/" target="_blank">National Cybersecurity Alliance</a> to raise awareness on how to stay secure online. This year, Deep Instinct is proud to be named an official Champion of Cybersecurity Awareness Month, a cause that further supports our mission of predicting and preventing known and unknown cyber threats.This Cybersecurity Awareness Month is unlike previous years due to the sudden rise of cyber attacks leveraging generative AI. Want proof? Our recent <a href="https://www.deepinstinct.com/voice-of-secops-reports">Voice of SecOps Report</a> found that 75% of security professionals witnessed an increase in attacks over the past 12 months, with 85% attributing this rise to bad actors using generative AI. This is a massive red flag for the C-suite and employees at large.<h5>Combatting AI Threats with Deep Learning</h5>Now, more than ever, attackers are leveraging AI to create new malware variants at an alarming pace. The issue is that current security mechanisms rooted in machine learning (ML) are ineffective against never-before-seen, unknown malware; they will only break down in the face of AI-powered threats.&nbsp;The only way enterprises can truly protect themselves against AI-generated threats is with a more advanced form of AI – specifically, Deep Learning. Any ML-based, legacy security solution is too reactive and latent to adequately fight back – especially legacy AV tools including Symantec, McAfee, BitDefender, TrendMicro, and Kaspersky. Learn more about why you should <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">get rid of your legacy and next-generation anti-virus (NGAV) tools</a>.What’s missing is a layer of Deep Learning-powered data security, sitting in front of your existing security controls, to predict and prevent threats before they cause damage. This is where Deep Instinct comes in – and the industry is taking note.<h5>An Award-Winning Predictive Prevention Approach to Security</h5>As a testament to our ability to predict and prevent cyber attacks before they happen, Deep Instinct has been honored with several industry awards over the past year. From product recognition to leadership honors, we are proud of our people, our technology, and our commitment to bolstering cybersecurity worldwide, through initiatives like Cybersecurity Awareness Month.Here are just a few notable 2023 recognitions for Deep Instinct:<ul><li>Deep Instinct was named the “<a href="https://aibreakthroughawards.com/2023-winners/" target="_blank">Best Deep Learning Company</a>” for the second consecutive year in the AI Breakthrough Awards, an award program that recognizes the top companies, technologies, and products in today’s global AI market.</li></ul><ul><li>Of the 18 vendors in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP) report, Deep Instinct was the <a href="https://www.deepinstinct.com/news/deep-instinct-included-in-the-2022-gartner-magic-quadrant-for-endpoint-protection-platforms-epp">only new vendor added</a> for its ability to execute and completeness of vision.</li><li>Deep Instinct was listed as <a href="https://www.crn.com/news/security/the-20-coolest-endpoint-and-managed-security-companies-of-2023-the-security-100/6?itc=refresh" target="_blank">one of the 20 coolest</a> endpoints and managed security companies of 2023 in CRN’s The Security 100.</li><li>The team was named a finalist in the <a href="https://cybersecurity-excellence-awards.com/2023-cybersecurity-company-awards-winners/" target="_blank">Most Innovative Cybersecurity Company in North America</a> and the top <a href="https://cybersecurity-excellence-awards.com/candidates/deep-instinct-prevention-platform/" target="_blank">Cybersecurity Product/Solution in Ransomware Protection</a> in the 2023 Cybersecurity Excellence Awards.</li><li>Deep Instinct was also recognized by the 2023 Global Cybersecurity Excellence Awards, winning gold and achieving the highest ranking for <a href="https://cybersecurity-excellence-awards.com/2023-cybersecurity-industry-solution-awards-winners/" target="_blank">The Cybersecurity Industry Solution Awards</a> for its Deep Instinct Prevention for Applications Platform in the software category for North America.</li><li>The company was <a href="https://www.prweb.com/releases/2023/5/prweb19362068.htm" target="_blank">recognized as a finalist</a> and earned an honorary mention in the 2023 Fortress Cyber Security Awards alongside the world’s leading companies and products working to keep the world’s data and electronic assets safe from growing threats and attack vectors.</li></ul>In this new era of AI, it’s critical that you prevent cyber attacks, not just detect and respond to them after the fact like EDR. That’s not nearly enough in this AI-driven threat landscape. That’s why it’s time to dump the “assume breach” status quo and demand more. Learn why <a href="https://www.deepinstinct.com/endpoint-detection-response">EDR is NOT enough</a>.We’re proud to be a leader in raising awareness of this issue, while helping to bolster organizations’ cybersecurity posture during a time when it’s needed most. For more information about Cybersecurity Awareness Month, please click <a href="http://staysafeonline.org/cybersecurity-awareness-month/" target="_blank">here</a>. To learn how Deep Instinct can help your organization combat AI threats, <a href="https://info.deepinstinct.com/request-a-demo">request a demo</a>.

Announcing Deep Instinct Prevention for Storage for cloud storage and NAS environments

Blog

Recent Blog Posts

Deep Instinct vs. Trellix: A Banking Giant Cyberstorage Bakeoff

Why All AI Isn’t Created Equally in Cybersecurity

New Year, New Prevention-First Security Mindset: Predictions for 2024

Threat Actor 'UAC-0099' Continues to Target Ukraine

Are Your Cybersecurity Vendors Really Fighting AI with AI?

Conti Group: An Inside Look

MuddyC2Go – Latest C2 Framework Used by Iranian APT MuddyWater Spotted in Israel

MuddyWater eN-Able spear-phishing with new TTPs

Introducing Deep Instinct Prevention for Storage

Deep Instinct Champions Cybersecurity Awareness Month 2023

Products

Why Deep Instinct

Enhance Existing Cyber Tools

Company

Resources

Quick links