di_blog_post

Blog &#8211; Deep Instinct

Platform Overview

Endpoint Security

Beyond the Endpoint

Products

Deep Learning in Cybersecurity

Our Customers

Why Deep Instinct

Asset Library

ROI Calculator

Blog

Demo Videos

Resources

Preventing Ransomware

Improve EPP Efficacy

EDR is Not Enough

Prevent Zero-Day Attacks

Stop Fileless Attacks

Solutions

About Deep Instinct

Careers

Contact Us

Newsroom

Company

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Leadership Team

Board of Directors

content_block

posts_listing

Blog Listing

221B-blog.png

<p>Lance James doesn’t need an introduction. Lance and his world-renowned Unit 221B team are at the forefront of investigations and counterintelligence operations for the private and public sector. They are comprised of unique specialists in the fields of information security, cryptography, forensics, legal, investigations, law enforcement, and intelligence. And we had the great fortune to work with them over the past few months.</p><p>Unit 221B recently completed a comprehensive analysis of the Deep Instinct Prevention Platform. The team validated the core strengths and capabilities of the platform with a special emphasis on <a href="/zero-day-attacks" target="_self">preventing unknown and zero-day threats</a>.</p><p>We asked Lance for his insights into the project, his thoughts on some common (mis)perceptions, and his advice for those who work with him and his team.</p><h2>Q: What was the overall objective in testing the Deep Instinct platform? What methodology did you use in your testing?</h2><p>A: The project objective was two-fold:</p><p>1) Unit 221B assessed Deep Instinct’s claims that their <a href="/endpoint-protection-platforms" target="_self">Endpoint Protection Platform (EPP)</a> product can automatically prevent unknown threats by using deep learning to identify patterns indicative of malicious behavior prior to execution on the endpoint. This assessment evaluated the following claims:</p><ul><li>The platform automatically prevents malware execution with &gt;99% accuracy</li><li>The platform detects malware and attacks with &lt;0.1% false positives</li><li>The platform is adept at recognizing and automatically preventing previously unknown or custom (0-day) attacks</li></ul><p>Tests were conducted using both unknown and custom techniques and malware. Unknown attacks are techniques or malware that have not been publicly disclosed before the deployment of the tested version of the Deep Instinct “Brain.” Custom attacks are techniques and malware samples created by Unit 221B specifically for this assessment.</p><p>2) Unit 221B created a test environment to evaluate the Deep Instinct EPP. We then performed a battery of tests designed to measure the ability of Deep Instinct to detect and prevent unknown and custom variants of portable executables, documents, and ransomware.</p><p>The tools the testing team used were virtual machines to quickly create and restore operating system instances for rapidly conducting tests without introducing additional variables. Once a test had been conducted, the virtual machine could be reset to its initial state, and each test began from the same initial state. A disposable virtual machine was used as the malware sandbox. The sandbox was constructed using VMware ESXI configured with 8 GB of RAM and 120 GB of disk space.</p><p>To control for variables, Unit 221B restored snapshots of the machine between tests to ensure that they did not interfere with each other. A single snapshot, created once the machine was operational with Standard software, and then was reused as a control group throughout the duration of testing.</p><h2>Q: We see that you tested using “custom” attack vectors. Can you tell us a bit more about that?</h2><p>A: Custom attacks were designed by Unit 221B's red team in an attempt to get around Deep Instinct's engine. In many real-time red team scenarios against a target it is a catered or custom exploits and binaries that tends to bypass systems. We've seen this historically with Advanced Persistent Threat (nation-state) attackers, where they use zero-days and customized payloads to accomplish their goal. The customized mode for us is similar and would determine if their claims against zero-day attacks were valid.</p><p><em><strong>Deep Instinct successfully defended and prevented against our customized nation-state simulated attacks.</strong></em> You can find details in the Technical Report we wrote after our three-month <a href="/pdf/unit-221b-deep-instinct-product-assessment" target="_self">project product assessment</a>.</p><p>I have said this before, but our company is composed of professional skeptics and hackers that have a strong track record of bypassing security protocols and prevention systems, and we were happy to fail in this instance. It is through these thorough real-world evaluations like this one that enhance our ability to work together to solve the most challenging problems in cybersecurity. Deep Instinct was able to showcase why deep learning is a revolutionary technology for fighting and predicting the attacks of tomorrow, while maturing your security posture today.</p><h2>Q: Today’s IT leaders often take the stance of “presume breach” and are relying heavily on post-execution EDR type tools. What are your thoughts on “presume breach?”</h2><p>A: Given the history of what is going on with breaches this is a healthy mindset. Assuming you're breached will puts you down the path to be reactive and pursuing what needs to be done next. And why do we think this way? Because there isn't a vendor that is successful in stopping ALL threats. And to say there could be is an impractical ask as all environments aren't configured the same. I will caveat this, though - just because you assume a breach doesn't mean you shouldn't make the investment and have the ultimate goal to "prevent the breach." But I don't think either perspective is unrealistic, and I do think they can complement each other.</p><h2>Q: What is your advice to organizations that ask your team for help? (We realize that this is a very broad question.)</h2><p>A: Quite a broad question for sure and it varies, but I think the best way I can put this is we don't see the organizations that we work with as clients, but instead as partners. And with that mindset and culture, I can say that it's not about specific advice we give, but that we start out with them with a "let's work together on this problem" mindset. We also encourage a beginner's mindset through partnerships vs. ego and some company telling you what you did wrong or why you are vulnerable. With a partnership there is a level of respect and a shift in boundaries. In that way we become part of your team, not external to it, and that makes a huge difference.</p><p>For more information, read the full <a href="/pdf/unit-221b-deep-instinct-product-assessment" target="_self">Unit 221B Product Assessment report</a> and the <a href="/news/unit-221b-report-validates-deep-instinct-99-percent-zero-day-threat-prevention-accuracy" target="_self">Unit 221B Press Release</a>.</p>

Q&A with Unit 221B CEO Lance James: Insights into Custom Attack Vectors, Presumed Breach, and Working with Partners

zero-day-Unfolding-Follina-blog.png

<p>Zero-day vulnerabilities are among the most difficult threats to guard against because they are – by their very nature – unknown and unseen by threat researchers and most security tools. When these vulnerabilities are exploited, it is a race against the clock to identify them and plug the holes through which threat actors can launch attacks.</p><h2>What is the Follina vulnerability?</h2><p>On May 27, 2022, the cybersecurity community became aware of a new zero-day vulnerability in Microsoft Support Diagnostic Tool (MSDT) dubbed “Follina,” which was later given the CVE identifier “CVE-2022-30190.” Follina stems from a bug in MSDT that allows code execution. Under specific circumstances, an attacker can run PowerShell commands on a victim’s machine using a crafty Microsoft Office document or Rich Text Format (RTF) file.</p><p>In this post, we will go into a detailed explanation of the exploit, discuss the consequences of an attack, and provide counsel on how your organization can decrease the likelihood of falling victim to a Follina attack.</p><h2>Follina and the Microsoft Diagnostic Tool</h2><p>To understand this exploit, we must first understand the issue in MSDT. Normally, when MSDT is called, it asks for a passkey provided by a support professional to continue to the troubleshooting stage.</p><p></p><figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blte55e44b00d8ee87a" alt="   Example of a passkey request" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte55e44b00d8ee87a/62a221a4a9454a5197097b01/msdt_passkey_demand.png" /><figcaption >Example of a passkey request</figcaption></figure><p></p><p>This should provide some level of security and limit access to the troubleshooting utility’s functionality. However, under certain conditions and using a specific syntax, it is possible to execute PowerShell commands via MSDT without providing a passkey.</p>

<p><br/>This method allows an attacker to do anything from execute ransomware to open a reverse shell, from which they can run unlimited commands on a victim’s machine. The possibilities available in this scenario are virtually limitless.</p><p>However, this will only work if the HTML file’s size is at least 4096 bytes, something that can be easily achieved by adding hefty comments to the file.</p><h2>How do attackers use Microsoft to deliver Follina?</h2><p>Attackers do not simply cross their fingers and idly hope someone will land on the address in which their malicious HTML file is hosted. They lure victims into their trap – and this is where Microsoft Office documents and RTF files come into play.</p><p>As explained in this blog, by modifying the relationship file (RELS) of a <a href="/blog/how-your-regular-microsoft-office-file-is-open-to-manipulation" target="_self">Microsoft Office Open XML (OOXML) file</a>, a threat actor can cause the Microsoft Office document to open an HTML file hosted on the internet and execute a script if it contains one, without it being visible to the user. With a document like this in hand, the attacker can simply send the file to unsuspected users – for example as an email attachment – and persuade them to click it. Once this action is performed, MSDT will be called, and the malicious actor’s command will be executed.</p><p>Moreover, if the attacker chooses an RTF file instead of a Microsoft Office document as their initial point of access, things can get even scarier. In this scenario, the infection can occur even if a user just hovers over the file – they do not need to even open the file in order for the wheels to start rolling.</p><h2>How is Follina executed?</h2><p>Even though the code that runs via MSDT will probably not be visible to the users, attackers cannot hide the execution of the troubleshooter itself.</p><p>When “ms-msdt” is called, a troubleshooting wizard window will appear, informing users that it is working on detecting issues. Of course, this does NOT alert users that the real issue they should be concerned about is the malware that is currently running on their computer.</p><p>To those unfamiliar with Follina, this can be seen as relatively harmless, especially if they have encountered similar troubleshooters in the past. However, to someone who has heard of Follina, this should raise an immediate red flag.</p><img asset_uid="blt746c96d092ceb1f7" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt746c96d092ceb1f7/62a2501205f1d157f3a892e7/msdt_detecting_issues.png" height="auto"/><h2>Deep Instinct zero-day detection and prevention</h2><p>At the time of this writing, Microsoft has not issued a patch for “CVE-2022-30190” and only advised users to&nbsp;<a href="https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/" target="_self">disable the MSDT URL protocol</a>.</p><p>Deep Instinct prevents Follina and other zero-day threats, pre-execution. Using deep learning models to prevent malicious files from being executed, Deep Instinct can predict and prevent known, unknown, and zero-day threats in &lt;20 milliseconds, 750X faster than the fastest ransomware can encrypt. Our deep learning, prevention-first approach allows us to detect and prevent even the most advanced threats with &gt;99% zero-day accuracy.</p><p>If you’d like to learn more about our malware, ransomware, and <a href="/zero-day-attacks" target="_self">zero-day prevention capabilities</a> – including our industry-best $3M no-ransomware guarantee – we’d be delighted to <a href="/request-a-demo" target="_self">give you a demo</a>.</p><figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt1522c89054ccb4a5" alt="An RTF file that leverages Follina to execute malicious commands is prevented by the Deep Instinct agent before it gets a chance to run. " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1522c89054ccb4a5/62a221a44a98d755621a2783/static_prevention.png" /><figcaption >An RTF file that leverages Follina to execute malicious commands is prevented by the Deep Instinct agent before it gets a chance to run.</figcaption></figure><p></p><figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="bltd1d882404759bae7" alt="Malicious PowerShell code is prevented from being executed as an HTML file tries to leverage Follina to run it using MSDT" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd1d882404759bae7/62a221a41da2265851294c6b/dynamic_prevention.png" /><figcaption >Malicious PowerShell code is prevented from being executed as an HTML file tries to leverage Follina to run it using MSDT</figcaption></figure><p></p><h2>Further Reading</h2><ul><li><a href="/blog/how-your-regular-microsoft-office-file-is-open-to-manipulation" target="_self" isblock="true" isBlock="true">https://www.deepinstinct.com/blog/how-your-regular-microsoft-office-file-is-open-to-manipulation</a></li><li><a href="/blog/zero-day-vulnerability-what-it-is-and-how-it-works" target="_self" isblock="true" isBlock="true">https://www.deepinstinct.com/blog/zero-day-vulnerability-what-it-is-and-how-it-works</a></li><li><a href="/blog/hafnium-leveraging-multiple-zero-days-to-attack-microsoft-exchange" target="_self" isblock="true" isBlock="true">https://www.deepinstinct.com/blog/hafnium-leveraging-multiple-zero-days-to-attack-microsoft-exchange</a></li></ul>

Unfolding the Follina Zero-Day Vulnerability

emotet-blog.png

<p>Emotet malware started from humble beginnings as a banking Trojan in 2014. The threat actors behind Emotet have been credited as one of the first criminal groups to provide Malware-as-a-Service (MaaS). They successfully utilized their MaaS to create a massive botnet of infected systems and sold access to third parties, an enterprise that proved so effective it was soon being used by criminal entities such as the <a href="https://heimdalsecurity.com/blog/ryuk-ransomware/" target="_self" isblock="true" isBlock="true">Ryuk</a> and Conti ransomware gangs. Emotet also has a history of collaborating with Trickbot, famous for their info-stealing trojan, and Qakbot, another well-known banking trojan.</p><h2>Emotet Malware: Phishing for victims throughout the pandemic</h2><p>The Emotet group was prolific throughout the pandemic. They wreaked chaos throughout 2019 and 2020 taking advantage of hot topics as a ruse to convince unsuspecting victims to open malicious phishing emails. Topics included coronavirus information, political news, controversial issues, and supposed state and federal updates around mask mandates.</p><p>This all changed for Emotet in January 2021 when a joint task force took down the Emotet botnet infrastructure in a global operation involving eight countries led by Europol, the Netherlands, and the U.S.</p><h2>Is Emotet malware back from the dead? New Emotet variants emerge</h2><p>Ransomware gangs with millions in incentives to stay active are difficult to tamp down for long. As we’ve seen multiple times in the past, ransomware gangs — or at a minimum their source code — never seem to expire completely.</p><p>Historically, members of gangs that have been shut down or disbanded tend to flock to other criminal organizations. Ransomware gangs are criminals at the core, and as such their sole purpose is to make money. The Emotet group is no different. Initial reports show that Emotet had reemerged in Q4 of 2021 and really started making waves with reports of massive phishing campaigns targeting Japanese businesses in February and March of 2022. We’ve now seen several massive new malicious phishing campaigns in April and May targeting new regions.</p><p>In an interesting development, the TrickBot gang has been observed helping its longtime partner Emotet deploy to already infected machines in order to download the new Emotet variants. It has been  that Emotet detections have spiked upwards of 2700% in Q1 of 2022 compared to Q4 of 2021.</p><h2>Emotet 2022: New tricks and threats</h2><p>Looking at the new threats coming from Emotet in 2022 we can see that there has been an almost <a href="https://press.hp.com/us/en/press-releases/2022/emotet-rockets-into-pole-position-as-most-seen-malware-family.html" target="_self" isblock="true" isBlock="true">900%</a> increase in the use of Microsoft Excel macros compared to what we observed in Q4 2021. The attacks we have seen hitting Japanese victims are using <a href="https://www.jpcert.or.jp/english/at/2022/at220006.html" target="_self" isblock="true" isBlock="true">hijacked email threads</a> and then using those accounts as a launch point to trick victims into enabling macros of attached malicious office documents. One of the more troubling behaviors of this “new and improved” Emotet is its effectiveness in collecting and utilizing stolen credentials, which are then being weaponized to further distribute the Emotet binaries.</p><h2>Key Findings of Emotet’s Return in 2022</h2><p>Threat research teams, including Deep Instinct’s leading threat intel team, and HP’s Wolf Security, have identified the following key findings:</p><ul><li>9% of threats are unknown, never-before-seen threats </li><li>14% of the email malware has bypassed at least one email gateway security scanner before it was captured</li><li>45% of the malware detected were utilizing some type of office attachment</li><li>The most common attachments used to deliver malware were spreadsheets (33%), executables and scripts (29%), archives (22%), and documents (11%)</li><li>Emotet is now utilizing 64bit shell code, as well as more advanced PowerShell and active scripts</li><li>Almost 20% of all malicious samples were exploiting a 2017 Microsoft vulnerability (<a href="https://www.darkreading.com/operations/microsoft-office-bug-remains-top-malware-delivery-vector" target="_self" isblock="true" isBlock="true">CVE-2017-11882</a>)</li></ul><h2>Deep Instinct’s Solution for Combatting Emotet Malware</h2><p>While <a href="/blog/the-re-emergence-of-emotet" target="_self" isBlock="true">Emotet has reemerged</a> and is gaining strength, it still utilizes many of the same attack vectors it has exploited in the past. The issue is that these attacks are getting more sophisticated and are bypassing today’s standard security tools for detecting and filtering out these types of attacks.</p><p>But here’s the news you’ve been waiting for: here at Deep Instinct, we have a long history of predicting and preventing these types of attacks. While some of the latest attack vectors are new and never-before-seen threats, Deep Instinct has a proven track record of preventing even the newest attacks from Emotet as well as other sophisticated threat groups with technology that was developed and deployed months (and in some cases even years) before the threats were developed and deployed into the wild.</p><p>Deep Instinct takes a prevention-first approach to <a href="/ransomware-protection-solution" target="_self" isblock="true" isBlock="true">stopping ransomware</a> and other malware using the world’s first purpose-built, <a href="https://www.deepinstinct.com/why-deep-instinct" target="_self" isblock="true" isBlock="true">deep learning cybersecurity framework</a>. We predict and prevent known, unknown, and zero-day threats in &lt;20 milliseconds, 750X faster than the fastest ransomware can encrypt.</p><p>For more information, <a href="/contact-us" target="_self" isblock="true" isBlock="true">Contact Us</a> or <a href="/request-a-demo" target="_self" isblock="true" isBlock="true">Request a Demo</a>.</p>

Back From the Dead, Emotet Returns in 2022

great-resignation-IT-blog.png

<p>The latest edition of our annual<em> Voice of SecOps Report </em>shines a spotlight on the mounting pressures that senior cybersecurity leaders and practitioners are experiencing – stress that is causing nearly half of SecOps professionals to consider leaving the industry entirely.</p><p>Now in its third iteration, the global research study summarizes the findings of 1,000 respondents across the US, UK, Germany, and France. The core market verticals remain consistent with previous studies and include financial services, retail & eCommerce, healthcare, manufacturing, public sector, critical infrastructure, and technology/related advisory businesses.</p><h2>The findings</h2><p>Adopting a less technical and more human-centric lens, many of the major themes are centered on relative levels of stress between middle and upper cybersecurity management – highlighting the disconnects that are present between these tiers.</p><p>Certain cybersecurity teams, for example, see themselves in an unenviable position of being expected to stop every threat yet knowing this is an impossible expectation. Meanwhile, the C-Suite are focused on prioritizing security with a hybrid and remote workforce and ensuring continuity and threat mitigation in their ongoing digital transformation.</p><p>Several key highlights include the following:</p><ul><li><strong>SecOps professionals are near a breaking point</strong>. Nearly half of respondents admitted to considering leaving the security industry as a result of high stress levels.</li><li><strong>Ransomware remains a top concern of SecOps professionals.</strong> 48% of respondents cite ransomware as a top stressor.</li><li><strong>Paying ransoms ≠ problem solved</strong>. When ransoms have been paid, things rarely went “back to normal” – in fact, only 16% of respondents had no further issues after paying a ransom post-attack.</li></ul><p>The highly divergent pressures experienced by different management tiers is particularly illuminating, underscoring the need to take a nuanced approach to the unique challenges senior management face compared to SecOps practitioners. In parallel, the study looks at stresses caused by various types of attacks, and which are feared the most, such as supply chain, machine learning-driven, <a href="/ransomware-protection-solution" target="_self">ransomware</a>, <a href="/prevent-fileless-malware" target="_self">fileless</a>, and nation state threats.</p><p>The willingness to pay a ransom demand varies somewhat with our recently published <a href="/pdf/dangerous-disconnects-the-pitfalls-of-cfo-and-ciso-cyber-risk-misalignment" target="_self">UK-only CFO study</a>, but nonetheless reveals that at least one-third of respondents are willing to settle in return for a decryption key and exfiltrated data – despite this rarely being a “cure-all” to their ransomware issues. In addition, our research found that false positive alerts are rising with the sheer number of these notifications leading some SecOps teams to turn off alerts altogether because they are “too noisy” – a worrying state of affairs.</p><p>However, our research finds there is light at the end of the tunnel.</p><p>SecOps leaders and practitioners were optimistic about the impact new solutions will have on reduced alert volumes as well as benefits such as lowered business risk and improved data protection. Preventing advanced threats at the outset also was intriguing to many respondents with one CISO for a network of U.S. healthcare centres observing, “Prevention-first makes so much sense to me. I need something that prevents a malware file being downloaded, rather than something that tells me a file’s been downloaded after the event.”</p><p>Download the Voice of SecOps 3rd Edition in <a href="/voice-of-secops-reports" target="_self">infographic and full report form</a> to get the full picture of our findings.</p>

SecOps 3rd Edition Reveals Undercurrent of Stressors That Threaten Global Cybersecurity Sector

iranian-threat-actor-blog.png

Iranian Threat Actor Continues to Develop Mass Exploitation Tools

finance-cyber-risk-blog.png

<p>After years of being seen as a niche IT issue, cybersecurity is now a big talking point in boardrooms around the world. But that doesn’t mean that everyone has a seat at the table when it comes to cyber risk planning. CFOs like myself are often not given a voice when it comes to important security decisions despite the massive financial impact an attack may have on the organisation.</p><p>To get a more quantified look at the problem, we commissioned <em><strong>Sapio Research</strong></em> to survey how UK-based business leaders and decision-makers view cyber risk, and their role in key issues like ransomware payments.</p><p>The results highlighted some extremely dangerous disconnects in how senior management teams view and communicate about risk.</p><h2>Are CFOs getting the cold shoulder in critical security decisions?</h2><p>One of the strongest trends our research uncovered is that CFOs are rarely involved in key strategic decisions about cyber risk, often being relegated to the role of rubberstamping security budgets and little else. Just 12 percent of CFOs said they were actively involved in determining cyber risk and helping with plans to protect the organisation from threats.</p><p>CFOs non-presence at the table was particularly evident – and relevant – when it comes to ransomware. The decision on whether or not to pay a ransom is one of the toughest security judgements a business can make, with big implications for the company’s moral character and an even bigger impact on their bank balance. Yet despite the financial consequences, just 14 percent of CFOs were involved in the final decision on whether to pay.</p><p>This exclusion has a knock-on effect on calculating the financial risks of cyber threats. Just over one-third (38 percent) of all respondents across different roles were confident they could place a monetary value on their digital assets and the resulting financial impact of a breach. But nearly half (48 percent) were <em>not</em> confident, either because they were unsure of how accurate their assessments were or because they did not have an accurate assessment of the risk.</p><p>Our research also found a huge disconnect in the way the company’s risk preparedness is seen. Just 14 percent of CFOs said they were confident their business was well-prepared to withstand a cyber-attack. In stark contrast, 63 percent of CEOs and business owners were confident in their security capabilities.</p><p>This perspective from Glenn Murray, CEO at&nbsp;Sapien Cyber, in <a href="https://www.securitymagazine.com/articles/96093-the-role-of-the-cfo-in-enterprise-cybersecurity#:~:text=The%20Chief%20Financial%20Officer%20(CFO,systems%20to%20operational%20technology%20networks." target="_self"><em>Security Magazine</em></a> highlights the dangers of this trending disconnect:</p><p></p><blockquote class="ml-3 pl-3 border-l">“It is not uncommon for security teams or their executives to be rewarded based on reduction in expenditure vs budget, breeding an alarming culture of penny pinching each year. This short-term thinking is putting organizations in jeopardy, and at risk of everything from data breaches to system hacks. A boardroom, including the CFO, that recognizes the devastating effect a cyberattack can have, both financially and reputationally, will be better placed to protect their ‘crown jewels’ from this new age of cybercriminals.”</blockquote><p></p><h2>Most businesses are not prepared for ransom costs</h2><p>Ransomware was one of the most prominent examples of this mismatch in risk awareness and confidence. Sixty-one percent of respondents admit that their business has been hit by a ransomware attack, with 56 percent paying the ransom demand.</p><p>Those that did pay up were often unpleasantly surprised. On average, respondents said they would be willing to pay around £760,000 to restore their systems – but the actual average for those who did pay was just over £3m. Adding insult to injury, only a third (32 percent) of those who met the demand got all of their data back from the attackers.</p><h2>More intriguing insights</h2><p>Organisations and cyber criminals alike are fixated on the bottom line and their ability to make a profit. Getting hit by a serious cyberattack can have huge financial implications, with lost customers and operational time, regulatory fines and incident response costs quickly racking up huge costs – even before factoring in a potential six-figure ransom demand.</p><p>It’s not necessary for the CFO to be a cyber security expert, but they need to have a seat at the table if the organisation is to have a chance at gaining an accurate picture of their exposure to cyber threats, the financial impact of a potential breach, and the company’s level of risk exposure.</p><p>To find out more, view the full report's findings <a href="https://www.deepinstinct.com/pdf/dangerous-disconnects-the-pitfalls-of-cfo-and-ciso-cyber-risk-misalignment" target="_self">here</a>.</p>

Failing to Include Finance in Cyber Risk Planning Could be Costly

dropper-microsoft.png

Blame the Messenger: 4 Types of Dropper Malware in Microsoft Office & How to Detect Them

blog-event-logs.png

<p>Just when you thought MITRE had identified all attacker TTPs (tactics, techniques, and procedures) something new pops up! Most recently, <a href="https://threatpost.com/attackers-use-event-logs-to-hide-fileless-malware/179484/" target="_self">researchers have discovered a malicious campaign</a> utilizing a never-before-seen technique for quietly planting fileless malware on target machines. This attack hides malicious code in event logs by injecting it into the Windows Key Management Service event logging process (as well as other legitimate processes).</p><h2>Rise of fileless attacks</h2><p>This is yet another example of attackers innovating their attack techniques. In this case, it’s in the form of a <a href="/prevent-fileless-malware" target="_self">fileless attack</a>, an attack method that has become very popular because of its ability to evade exisiting security controls. Figure 1 below explains how prevalent these attacks have become.</p><p></p><figure style = "margin: auto; text-align: center;width: 600px;"><a href="https://www.infosecurity-magazine.com/opinions/fileless-attacks-malware/"><img asset_uid="bltb324628bc79621be" alt="Figure 1: Fileless attacks are growing in number and bypassing traditional endpoint security" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb324628bc79621be/6283be5f3b9b8554904a0888/figure-1-fileless-attacks-growing.png"/></a><figcaption  style = "text-align: center;" style="text-align: center;">Figure 1: Fileless attacks are growing in number and bypassing traditional endpoint security</figcaption></figure><h2>&nbsp;</h2><h2 style="text-align: left;">How are attackers using event logs to hide fileless malware?</h2><p>There are three stages that attackers are using to hide fileless malware in Windows Event Logs. We’ll describe each stage in depth below and show why Deep Instinct’s solutions are effective in combatting this new form of fileless attacks.</p><h3>Stage 1: Drive-by download</h3><p>While not a new method, drive-by downloads are still an effective technique to deliver malware to an endpoint.</p><p>In this particular case, attackers send victims to legitimate websites where they are tricked into downloading a compressed archive of two powerful commercial penetration testing tools, Cobalt Strike and SilentBreak. Each of these tools is armed with AES decryptors that are used to avoid detection. If Cobalt Strike sounds familiar, that’s because it has been used frequently in recent attack campaigns.</p><p><a href="/blog/cobalt-strike-post-exploitation-attackers-toolkit" target="_self">Cobalt Strike</a> is a legitimate toolkit for white hat hackers and penetration testers, and because of its ease of use and availability, it’s usage increased by <a href="https://www.bankinfosecurity.com/attackers-increasingly-using-cobalt-strike-a-16959" target="_self">161% between 2019 and 2020</a>—and continues to rise* (Figure 2).</p><h3>How does Deep Instinct help?</h3><p>For this particular phase of the attack, Deep Instinct’s static analysis provides a key protection—correctly identifying and preventing the threats within the archive, even if the payload were modified to avoid identification.</p><p></p><figure style = "margin: auto; text-align: center;width: 595px;"><img asset_uid="blt463134676b018b2a" alt="Figure 2: Number of organizations impacted by attacks using Cobalt Strike is increasing substantially" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt463134676b018b2a/6283bf44ce671353d507ccb0/figure-2-orgs-impacted-by-colbat-strike-chart.jpeg" /><figcaption  style = "text-align: center;" style="text-align: center;">Figure 2: Number of organizations impacted by attacks using Cobalt Strike is increasing substantially</figcaption></figure><h3>&nbsp;</h3><h3>Stage 2: Injecting the shellcode</h3><p>Once the tools are downloaded to the system, attackers utilize their capabilites to inject code into trusted system processes or applications. In this case, the Windows KMS (Key Management System) logging process is the perfect “trojan horse” because it is both “hiding in plain sight” and not a place threat hunters are accustomed to looking for malicious shellcode. The reason why it’s classified as fileless is that there are no portable executables or document files with macros. This is also why the detection process becomes very sticky for <a href="/endpoint-detection-response" target="_self">traditional endpoint security platforms</a> as the malicious code is injected into and runs within legitimate system processes. Nothing appears out of the ordinary in the normal operation of the system.</p><p>This type of attack also poses a <a href="/blog/8-reasons-why-edr-is-not-enough" target="_self">risk for Endpoint Detection and Response (EDR) solutions</a> because it’s written specifically to evade detection. Subsequently, EDR machine learning models must be re-trained to spot this activity and add it to their behavioral analysis engines. This is a human-led process that takes time to implement and requires an update to the core functionality of the security system.</p><p>Another concern is that EDRs are well-known for logging high rates of false positives, which means that many organizations put exceptions in place for well-known system processes and directories to avoid blocking legitimate business activity and cut down on help desk overhead.</p><h3>Deep Instinct’s approach to fileless attacks</h3><p>Deep Instinct takes a different approach to provide <a href="/prevent-fileless-malware" target="_self">prevention against fileless attacks</a> utilizing our built-in Memory Protection functionality. The self-learning nature of Deep Instinct means that we can predict and prevent never-before-seen attacks. Human intervention is not necessary to update our deep learning brain to protect against new attacker innovation. The end result is immediate, pre-execution prevention of known, unknown, and zero-day threats.</p><h3>Stage 3: The big pay(load)off</h3><p>In the final phase of this new fileless attack, attackers are doing what threat actors do: delivering one payload to rule them all.</p><p>The payload used in this particular campaign is one of two remote access trojans (RATs) designed to gain complete remote control over the infected system. In addition to using a new technique of hiding malicious code in event logs, the actual code used and elements of the remote access tools do not hold any similarities to past campaigns. This is yet another cause for concern for EPP/EDR solutions because their detection mechanisms are trained to look for code snippets that will tie back to existing campaigns to correctly classify and identify the threat group and take appropriate action early in the process.</p><h3>More accurate prevention with Deep Instinct</h3><p>Deep Instinct’s approach does not make decisions based on static-weighted, human-fed data points. The advantage is that the behaviors, code, and tools used in this attack will all be evaluated independent of any external influence. The result is a more accurate decision that can be made in a shorter amount of time to understand the threat and prevent damage.</p><h2>Fileless Malware finds its match in Deep Learning</h2><p>Fileless attacks pose a significant threat for security solutions like antivirus and EDR. Signature-based engines and machine learning decision models fall short in detecting unknown, never-before-seen attacks. New attacks can be predicted and prevented with a deep learning-based solution, which is exactly where Deep Instinct comes in. With the only <a href="/why-deep-instinct" target="_self">deep learning framework developed for cybersecurity</a>, Deep Instinct takes a multi-layered appraoch to prevent &gt;99% of unknown threats with a &lt;0.1% false positive rate.</p><p>For more information on how Deep Instinct can <a href="/prevent-fileless-malware" target="_self">prevent fileless attacks</a> <a href="/contact-us" target="_self">contact us</a>.</p><h2>Further reading:</h2><ul><li><a href="/blog/evading-antivirus-detection-with-inline-hooks" target="_self">https://www.deepinstinct.com/blog/evading-antivirus-detection-with-inline-hooks</a></li><li><a href="/blog/do-not-exchange-it-has-a-shell-inside" target="_self">https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside</a></li><li><a href="/blog/what-makes-powershell-a-challenge-for-cybersecurity-solutions" target="_self">https://www.deepinstinct.com/blog/what-makes-powershell-a-challenge-for-cybersecurity-solutions</a></li><li><a href="/blog/cobalt-strike-post-exploitation-attackers-toolkit" target="_self">https://www.deepinstinct.com/blog/cobalt-strike-post-exploitation-attackers-toolkit</a></li></ul><h2>Resources</h2><p><a href="https://threatpost.com/attackers-use-event-logs-to-hide-fileless-malware/179484/" target="_self">Attackers Use Event Logs to Hide Fileless Malware<br/></a>Researchers have discovered a malicious campaign utilizing a never-before-seen technique for quietly planting fileless malware on target machines.</p><p><a href="https://www.bankinfosecurity.com/attackers-increasingly-using-cobalt-strike-a-16959" target="_self">Attackers Increasingly Using Cobalt Strike<br/></a>Report: Pen Testing Tool a Favorite Among Lower-Level Threat Groups</p><p><a href="https://www.infosecurity-magazine.com/opinions/fileless-attacks-malware/" target="_self">Fileless Attacks: Addressing Evolving Malware Threats<br/></a>Unlike traditional malware attacks, fileless malware does not require installing code on software or systems. Fileless payloads are instead used to infect computer memory, using pre-installed system tools to execute a ‘living off the land’ attack.</p>

What’s Hiding in Your Event Logs?

ransomware-macos-windows.png

<p>While it may be true that macOS computers are more secure than Windows-based machines, the advantage is less than you might think. Apple has done a good job of building security into macOS to stop known attacks, but the real challenge is in stopping new, never-before-seen malware (the unknowns) that can lead to ransomware or zero-day attacks. To highlight this problem, Ponemon’s <em>Third Annual Study of Endpoint Risk</em> reported that <a href="https://www.morphisec.com/hubfs/2020%20State%20of%20Endpoint%20Security%20Final.pdf" target="_self">80% of breaches involved new or evolved malware variants </a>that infiltrate a system unrecognized or exploit undisclosed vulnerabilities.</p><h2>Increase of ransomware attacks on macOS</h2><p>In 2019, threat actors took a run at macOS and <a href="https://dnetc.net/mac-malware-threats-rise-60-in-quarter/" target="_self">threats jumped by 60%.</a> Since then, there have been repeated attempts and a few ransomware attacks aimed at macOS. Fortunately, we have not yet seen a major breach. In 2020, <a href="https://www.forbes.com/sites/daveywinder/2020/02/11/platform-wars-2020-apple-security-threats-outpace-microsoft-windows-for-first-time/?sh=4ea80adb7c5a" target="_self">Forbes reported that Mac malware outpaced Windows by 2 to 1</a>. In 2021, we saw an overall rise in malware developed to attack macOS like ElectroRAT, Silver Sparrow, and XLoader. These new malware strains have been paving the way for an increase in sophisticated and profitable attacks aimed at macOS, namely ransomware.<br/></p><blockquote class="ml-3 pl-3 border-l">“There is still a lingering misperception that Macs are inherently more secure than Windows systems, because of the raw numbers of attacks," Leichter says. That sentiment is largely a reflection of the current market share, where Windows still dominates. "Macs do have some security advantages, but these are becoming less significant because of two trends: malware is increasingly targeting browser plugins, not the underlying OS," he adds. In addition, he says, malware developers are increasingly creating cross-platform applications independent of the operating system.<br/><sub>-</sub><a href="https://www.darkreading.com/vulnerabilities-threats/new-mac-malware-samples-underscore-growing-threat" target="_self"><sub>Dark Reading</sub></a>, <sub>January 2022</sub></blockquote><p></p><p>According to the <a href="https://www.datto.com/blog/dattos-global-state-of-the-channel-ransomware-report-2018" target="_self">State of the Channel: Ransomware Report</a> from Datto, MSPs have seen a rise in ransomware on both macOS and iOS devices, equating to a 500% increase from the previous year. The problem is highlighted in the <a href="https://www.mandiant.com/m-trends" target="_self">2022 Mandiant M-Trends report</a>, where it was reported that ransomware-related intrusions have a median dwell time of five days compared to 36 days for non-ransomware intrusions.</p><p>What does this mean for defenders?</p><p>As ransomware gets faster, with the goal of quickly compromising the network and exfiltrating data, we can no longer ignore macOS. And with macOS-focused malware on the rise we predict a major successful ransomware attack in the near-term future.</p><p>Below, we highlight how and why it is necessary to plan for a future of increased attacks on macOS.</p><h2>The rise of macOS in the enterprise</h2><p>Perhaps the biggest reason to be concerned about a rise in attacks on macOS has to do with its increased adoption in the enterprise. Spurred by the pandemic and the move to remote work, <a href="https://www.computerworld.com/article/3644494/2021-the-year-apple-became-a-big-player-in-enterprise-tech.html" target="_self">Apple became a Big Player in Enterprise Tech</a> this past year — and a bigger footprint equals a larger attack surface.</p><p>Mobile device management vendor <a href="https://blog.kandji.io/hybrid-workforce-boosts-apple-adoption-in-the-enterprise-survey-finds" target="_self">Kandji</a> conducted a survey in 2021 that showed Apple device use had grown 76% over the past two years. Gartner reported that Mac shipments were up slightly in Q1 2022 as compared to a decline in overall PC shipments. And IDC numbers in 2021 show growth in enterprise adoption as well.</p><blockquote class="ml-3 pl-3 border-l">"Growth in Mac usage among business users, especially for employees working remotely and given their choice of PC device, is pushing more businesses to formally adopt management tools and strategies around macOS, along with iOS/iPadOS and tvOS,” said Phil Hochmuth, program vice president, Enterprise Mobility and Client Endpoint Management, IDC.<p><sub>- </sub><a href="https://www.idc.com/getdoc.jsp?containerId=US46965620" target="_self"><sub>IDC MarketScape</sub></a><sub>: Worldwide Unified Endpoint Management Software for Apple Devices 2021 Vendor Assessment</sub></p></blockquote><h2><br/>macOS & ransomware: It’s about the unknowns</h2><p>For known attacks, the <a href="https://en.wikipedia.org/wiki/Gatekeeper_(macOS)" target="_self">MacOS Gatekeeper</a> does a decent job at stopping threats that have already been exposed to the world. It’s the unknown, never-before-seen attacks that are the problem for any platform and operating system. Attackers are evolving their techniques to evade and bypass existing controls, including macOS, and they are succeeding.</p><p>There have been a few notable ransomware attempts on macOS starting with <a href="https://appleinsider.com/articles/16/03/06/malware-infected-transmission-29-app-threatened-os-x-users-stopped-by-xprotect" target="_self">KeRanger</a> in 2016 and <a href="http://appleinsider.com/articles/17/02/22/swift-based-ransomware-targets-macos-pirates-with-false-decryption-promise?mid=1" target="_self">Patcher</a> in 2017. Then, in 2020, ransomware distributed through pirated software, dubbed <a href="https://www.computerweekly.com/news/252485493/Mysterious-EvilQuest-macOS-ransomware-spreads-through-torrents" target="_self">EvilQuest</a>, began actively targeting macOS systems. EvilQuest encrypts victim's files, which some think is just a smokescreen, and installs a <a href="https://www.techtarget.com/searchsecurity/definition/keylogger" target="_self">keylogger</a> and a reverse shell to <a href="https://www.techtarget.com/whatis/definition/command-and-control-server-CC-server" target="_self">a command-and-control (C2) server</a> and can steal any files it finds related to cryptocurrency wallets.</p><p>Ransomware remains a significant concern:</p><ul><li>Ransomware will <a href="https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-250-billion-usd-by-2031/" target="_self">cost its victims around $265 billion (USD) annually by 2031</a> as ransomware perpetrators progressively refine their malware payloads and related extortion activities.</li><li>The <a href="https://www.paloaltonetworks.com/company/press/2022/ransomware-payments-hit-new-records-in-2021-as-dark-web-leaks-climbed--according-to-new-report-from-palo-alto-networks-unit-42" target="_self">average ransomware demand increased 144%</a>, while the average payment increased 78%.</li><li>Between January and March of 2022, <a href="https://www.digitalshadows.com/blog-and-research/q1-2022-ransomware-roundup/" target="_self">LockBit 2.0 and Conti were responsible for 58% of all incidents</a> and were the most active ransomware gangs so far this year.</li><li>The <a href="https://www.zdnet.com/article/this-is-how-fast-a-ransomware-attack-encrypts-all-your-files/" target="_self">fastest form of ransomware</a> is <a href="https://www.zdnet.com/article/a-deep-dive-into-the-operations-of-the-lockbit-ransomware-group/" target="_self">LockBit</a>, with a median time of just 5 minutes and 50 seconds to encrypt 100,000 files — and in one test it took only 4 minutes and 9 seconds.</li><li>The <a href="https://www.mandiant.com/m-trends" target="_self">2022 Mandiant M-Trends report</a>, stated that ransomware-related intrusions have a median dwell time of 5 days compared to 36 days for non-ransomware intrusions.</li></ul><p><a href="/blog/ransomware-unpatched-vulnerabilities" target="_self">Unpatched vulnerabilities</a> remain one of the top entry points to infiltrate a network. As attacks continue to grow in sophistication and frequency (a new attack occurs every two seconds) Apple will not be immune. In March 2022, Apple <a href="https://www.intego.com/mac-security-blog/apple-releases-macos-12-3-1-ios-15-4-1-watchos-8-5-1-and-more/" target="_self">patched</a> two “actively exploited” (i.e., in-the-wild, zero-day) security vulnerabilities for macOS Monterey, but the company had not released security updates for previous versions. This leaves "high confidence that CVE-2022-22674 likely affects both macOS Big Sur and macOS Catalina," and "nearly all vulnerabilities in the Intel Graphics Driver" have affected all versions of macOS.</p><p>The phrase “stop it before it does damage” is often used regarding ransomware or other malware. The trouble with this mentality is that the malware is already active inside your environment. Ransomware actors are getting smarter about when they exfiltrate data or encrypt systems to avoid detection by waiting until the final stage of the attack. Once the initial malware is executed, which could be a simple backdoor or a password stealer, the threat actor identifies the infected host as part of an organization's network. The threat actor then moves laterally across the network to deploy ransomware as the secondary attack, more potent than the first.</p><p></p><figure style = "margin: auto; text-align: center;width: autopx;"><a href="/pdf/whitepaper-malware-classifiation-in-threat-prevention" target="_blank"><img asset_uid="bltaf83ad4ea35a7eb5" alt="Deep classification breakdown." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaf83ad4ea35a7eb5/627ad19d7198441d81b3f3c7/deep-classification-breakdown.png"/></a><figcaption  style = "text-align: center;" style="text-align: center;">Example of a Deep Classification breakdown.</figcaption></figure><h2><br/>Mac ransomware protection: Deep Instinct’s advanced ransomware protection for macOS</h2><p>Deep Instinct’s prevention-first approach to ransomware and <a href="/zero-day-attacks" target="_self">zero-day threats</a> stops attacks before they can execute on the endpoint, meaning the attackers never get the chance to drop artifacts or exfiltrate your data. With a layered defense, the <a href="/platform" target="_self">Deep Instinct Prevention platform</a> will protect your organization at the endpoint as well as your custom applications from malicious file uploads.</p><p>The Deep Instinct Prevention Platform provides the following:</p><ul><li>Attack prevention in &lt;20ms, faster than the fastest ransomware can encrypt</li><li>False positive rate of &lt;0.1% so your team is only responding to high-fidelity alerts</li><li>&gt;99% unknown threat accuracy that protects your systems from new attacks and variants</li></ul><p>To learn more about how Deep Instinct’s unique deep learning framework provides unmatched prevention for unknown and <a href="/ransomware-protection-solution" target="_self">ransomware attacks</a>, check out this <a href="/videos?wchannelid=ysjgh8jbc8&wmediaid=vtilpp0rly" target="_self">video</a> or contact us for a demonstration.</p><h2>Further Reading</h2><ul><li><a href="/blog/3-reasons-ransomware-rollback-is-not-an-effective-strategy" target="_self">https://www.deepinstinct.com/blog/3-reasons-ransomware-rollback-is-not-an-effective-strategy</a><strong></strong></li><li><a href="/blog/ransomware-unpatched-vulnerabilities" target="_self">https://www.deepinstinct.com/blog/ransomware-unpatched-vulnerabilities</a></li><li><a href="/blog/healthcare-vs-hive-ransomware-how-to-protect-yourself" target="_self">https://www.deepinstinct.com/blog/healthcare-vs-hive-ransomware-how-to-protect-yourself</a></li><li><a href="/blog/deconstructing-the-revil-ransomware-attack-on-kaseya-vsa" target="_self">https://www.deepinstinct.com/blog/deconstructing-the-revil-ransomware-attack-on-kaseya-vsa</a></li><li><a href="https://info.deepinstinct.com/tof/ransomware-prevention?_ga=2.105606282.808318644.1651786112-1559688305.1620183151" target="_self">https://info.deepinstinct.com/tof/ransomware-prevention?_ga=2.105606282.808318644.1651786112-1559688305.1620183151</a></li></ul>

Ransomware: Is macOS more protected than Windows?

3 Reasons Why Ransomware Rollback is Not An Effective Strategy blog featured image

blog-3-reasons-rollback.png

<p>“You’re only as good as your last backup” is a phrase all too familiar to any security practitioner or system administrator. Backups have been at the core of disaster recovery plans for as long as they have existed. Whether the issue is a drive that crashes or a ransomware attack, the objective is the same: recover the data and get the organization back on its feet as quickly as possible.</p><p>But as anyone involved in this process can attest – this is easier said than done.</p><p>There is a misconception being touted that if you get hit by a ransomware attack or infected by other malware, and you stop it soon enough, perhaps after “only four files were encrypted,” you can simply rollback to your last known clean backup. Which begs the question: can you rollback without business impact and be assured that you have completely eradicated the threat?</p><h2>What is ransomware rollback remediation and what can go wrong?</h2><p>The concept of “rollback remediation” is an evolution of the classic backup strategy. In this context, organizations use copies of important files stored on the local drive or remote stores to rapidly recover, or “rollback,” unwanted changes. In cybersecurity, those unwanted changes are often the result of ransomware, known or unknown malware, or a fileless or script-based attack.</p><p>Endpoint security solutions often leverage shadow copies and use the Volume Shadow Copy Service (VSS). VSS was introduced by Microsoft in Windows Server 2003 to better manage the backup of running applications – but relying on VSS and shadow copies is problematic in cybersecurity. The problem is that backups take up valuable storage space, so the just-in-time nature of VSS turns into a game of cat-and-mouse where it's a race against time to capture the right snapshots before the ransomware (or other malware) begins to encrypt or compromise your systems. And if your shadow copies are deleted, you are left to restore from your master backup.</p><p>Some security vendors have followed Microsoft’s lead and created their own file restoration utilities to provide a similar service that creates copies of important files as a hedge against an attacker encrypting or destroying them. But this is more of a hedge, not a solution.</p><h2>3 Drawbacks to Ransomware Rollback</h2><p>Why is ransomware rollback not an effective solution? We’ve put together the top 3 reasons why you might want to reconsider rollback as a strategy.</p><h3>Ransomware Rollback Fact #1: The bad guys know about it, too</h3><p>The first challenge with a rollback remediation strategy – ransomware or otherwise – is that threat actors know it’s in your playbook and understand that organizations rely on it to avoid paying a ransom by quickly restoring files to recover from ransomware attacks. Malware authors have leveraged the ‘vssadmin’ command to delete existing shadow copies for years. In fact, it happens so often that MITRE has added the technique to their ATT&CK framework (see Fig. 1 below). In some cases, ransomware has been written to disable VSS and then wait to execute the encryption to make sure any remaining shadow copies are rendered useless. Security researcher Florian Roth <a href="https://twitter.com/cyb3rops/status/1312363071059488768?s=20" target="_blank">released</a> a program called <a href="https://github.com/Neo23x0/Raccine" target="_blank">Raccine</a> (ransomware vaccine), that looks for a process that tries to invoke ‘<em>vssadmin delete shadows</em>’ and kills the entire tree.</p><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt8cfe9209c4f29074" alt="Figure 1: MITRE ATT&CK technique for removal of shadow copies" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8cfe9209c4f29074/62686e2caacc645ccdba5b98/figure-1-mitre-attack-technique.png" /><figcaption  style = "text-align: center;" style="text-align: center;">Figure 1: MITRE ATT&CK technique for removal of shadow copies</figcaption></figure><p></p><p>There are several other methods by which attackers can delete shadow copies.</p><ul><li>Wmic.exe with command line <em>shadowcopy delete</em></li><li>PowerShell with command line <em>win32_shadowcopy</em></li><li>Vssadmin.exe with command line <em>resize shadowstorage</em></li></ul><p>The most common ransomware families, including WannaCry, REvil, Robbinhood, and Conti remove shadow copies and/or <a href="https://attack.mitre.org/techniques/T1490/" target="_blank">disable file recovery features</a>. The <a href="https://www.ivanti.com/lp/security/reports/ransomware-spotlight-year-end-2021-report" target="_blank">Ransomware Spotlight Year End 2021 Report</a> from Ivanti, (see Fig. 2) shows that 32 new ransomware families appeared in 2021 alone (an increase of 25% over the previous year). Every new ransomware family represents an increased risk to an organization’s security, regardless of their backup or rollback strategy.</p><p></p><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt2d5ebd3e33111edc" style="display:inline-block" alt="Figure 2: Ransomware continues its year-over-year rise" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2d5ebd3e33111edc/62683ac40796ef5b6c345715/figure-2-ransomware-rises.png" /><figcaption  style = "text-align: center;" style="text-align: center;">Figure 2: Ransomware continues its year-over-year rise</figcaption></figure><p></p><p>The recent and highly successful <a href="/blog/deconstructing-the-revil-ransomware-attack-on-kaseya-vsa" target="_self">REvil ransomware campaign</a> demonstrated this technique as it proliferated after compromising the Kaseya software distribution platform. As many as 1,500 organizations were affected by this campaign as REvil demanded a whopping $70 million ransom from Kaseya. And as previously mentioned, REvil relies on a mechanism to delete shadow copies, as do most ransomware families.</p><h3>Ransomware Rollback Fact #2: Restoring files may get you back in business, but the threat remains</h3><p>Killing the ransomware or other threat in progress and immediately restoring the damaged files is not a best practice. If you use rollback you may succeed in getting back to business with minimal downtime, but do you know if a backdoor was installed? And can you be sure you have eradicated the entire threat? Ransomware malware is not always how an attack is executed. Malware can contain a number of different suspicious threats beyond ransomware such as backdoors, potentially unwanted applications (PUA), and spyware, just to name a few. Any of those threats can be the entry point for ransomware, which is why malware <a href="/pdf/whitepaper-malware-classifiation-in-threat-prevention" target="_self">classification is critical to know what it is the attacker is installing</a>.</p><p>The prevalence of hybrid attacks that exfiltrate files for extortion before encrypting them brings this issue into sharp relief – just when you think the threat attackers are gone, can you be sure they won’t come back for more?</p><p>In the case of ransomware, file encryption is just the obvious final step for an attacker who’s already loose inside the environment. Once an attacker has successfully exerted control over an endpoint, there are many other actions they may have taken – and none of them are good.</p><p>When you look at an organization’s policies, nearly every incident response plan starts with “contain the breach,” not “restore the files.” Contain the breach means quickly identifying the attack, understanding its blast radius, and stopping its spread. If you roll back too soon you lose the opportunity to remove the entire threat and understand what else could possibly be affected. Establishing the timeline of point of entry is a critical step.</p><p>Once threat actors gain access to environment, a common attack strategy is to “break” the backup process while leaving the illusion that is still functioning properly. At times, attackers may wait 7 to 21 days to execute the attack or encrypt the files. This means that after a threat has been detected, organizations may have to go back days, weeks, or even months to restore systems back to their pre-infection state. The time to restore is measured in days, weeks, and months because servers, databases, and VMs must be rebuilt.</p><p>NIST’s <a href="https://us-cert.cisa.gov/sites/default/files/publications/Ransomware_Executive_One-Pager_and_Technical_Document-FINAL.pdf" target="_blank">incident response guidance</a> for a ransomware attack is clear – containing the entire attack is the first step. Securing backups to prevent corruption is another important early step. Restoring from those backups should only happen after the environment is no longer infected. The reality is that if the attacker still has a foothold, there is nothing stopping them from encrypting again and the next time, they will make sure they kill off the backups.</p><h3>Ransomware Rollback Fact #3: Ransomware is not the only threat to rollback</h3><p>When it comes to relying on rollback for remediation, ransomware deleting shadow copies is not the only threat that you need to be concerned with. Newer attacks are corrupting backups or changing the encryption keys of the backup to something unrecoverable. And organizations would be unaware this is taking place unless they performed a backup restoration test, which is rare. Recent attacks include fileless malware and script-based attacks, which are even more difficult to identify and stop because they don’t insert malicious code onto the endpoint, but instead rely on built-in utilities of the system itself.</p><p>Specifically, PowerShell and Windows Management Instrumentations (WMI) are two key targets for this type of attack because of their increased privileges on the system. With these toolkits at their fingertips, attackers can easily delete shadow copies, shutdown critical system services, and establish persistence – all without triggering standard anti-virus programs. As mentioned previously, threat actors have been known to make it appear that backups are still up and running, making the job of detecting them even harder.</p><h2>Preventing the attack avoids messy rollback scenarios</h2><p>By preventing malware, including ransomware, before it can execute and infect a system, the entire attack chain is broken before it can even begin. Since the malware never launches, it can’t exfiltrate files for future extortion, encrypt files, or take other destructive actions. There is no need to rollback or restore because the system wasn’t infected in the first place.</p><p>Traditional EDR solutions are reactive and look for behaviors post-execution, providing attackers with the time they need to begin to breach your environment. Threat actors are constantly developing new attacks that evade detection, and <a href="/endpoint-detection-response" target="_self">EDR is not enough</a> to stop attacks. For more information, check out the <strong>8 Reasons EDR is Not Enough</strong> <a href="/pdf/infographic-8-reasons-why-edr-is-not-enough" target="_self">infographic</a> and <a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough?_ga=2.132178824.724064347.1650899812-1559688305.1620183151" target="_blank">eBook</a>.</p><p>When an attack is prevented pre-execution, your organization avoids the downstream costs of an active threat, meaning the threat actor never gets inside to disable your backups. While backups are still a vital piece of the security stack, it is far better to prevent an attack before any damage can be done to an organization's systems and data than to rely on a rollback strategy.</p><p>Deep Instinct takes a <a href="/video/prevention-starts-with-deep-instinct" target="_self">prevention-first approach</a> to stopping ransomware, zero-day vulnerabilities, and other unknown malware pre-execution, reducing your reliance on flawed strategies like rollback. With innovative technology based on the only deep learning framework for cybersecurity, Deep Instinct can prevent &gt;99% of attacks pre-execution, lowering your false positive rate to &lt;0.1% and reducing your overall risk.</p><h2>Sources</h2><ul><li><span style="color: rgb(29, 28, 29);"><strong>docs.microsoft.com</strong><strong><br/></strong></span><a href="https://docs.microsoft.com/en-us/answers/questions/46408/volume-shadow-copy-service-deleted-after-ransomwar.html" target="_self">Volume Shadow Copy Service deleted after ransomware attack - Backup no longer working - Microsoft Q&A<strong><br/></strong></a><span style="color: rgb(29, 28, 29);">“Earlier this week the server was compromised by a ransomware attack. When I logged into the server the next day the shadow copies were all gone and also the windows server backup was not working anymore.”<br/></span></li><li><span style="color: rgb(29, 28, 29);"><strong>csoonline.com</strong><strong><br/></strong></span><a href="https://www.csoonline.com/article/3331981/how-to-protect-backups-from-ransomware.amp.html" target="_self">How to protect backups from ransomware | CSO Online<strong><br/></strong></a><span style="color: rgb(29, 28, 29);">Ransomware is getting smarter, attacking backups to prevent recovery. Prevent this from happening by taking a few simple steps.<br/></span></li><li><span style="color: rgb(29, 28, 29);"><strong>Born's Tech and Windows World</strong><strong><br/></strong></span><a href="https://borncity.com/win/2020/10/07/raccine-protect-volume-shadow-copies-from-ransomware/" target="_self">Raccine: Protect volume shadow copies from ransomware<strong><br/></strong></a><span style="color: rgb(29, 28, 29);">[English]Interesting story - a security researcher has developed a tool called Raccine as a simple protection against ransomware. This should prevent ransomware or other malware from deleting the volume shadow copies on Windows NTFS drives. Ransomware deletes VSS copies when a Windows system is infected.<br/></span></li><li><span style="color: rgb(29, 28, 29);"><strong>redcanary.com</strong><strong><br/></strong></span><a href="https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/" target="_self">It’s all fun and games until ransomware deletes the shadow copies<strong><br/></strong></a><span style="color: rgb(29, 28, 29);">A malicious batch (.bat) file executed a PowerShell command that downloaded and executed a remotely hosted payload on Pastebin to deploy ransomware. Additionally, it launched the Volume Shadow Service Administration Tool (vssadmin.exe) to remove local shadow copies.<br/></span></li><li><span style="color: rgb(29, 28, 29);"><strong>pkware.com</strong><strong><br/></strong></span><a href="https://www.pkware.com/blog/ransomware-plus-exfiltration-encrypt-your-data-before-someone-else-does" target="_self">Ransomware Plus Exfiltration: Encrypt Your Data Before Someone Else Does<strong><br/></strong></a><span style="color: rgb(29, 28, 29);">Starting in late 2019, a hybrid variety of cyberattack has emerged, in which traditional ransomware tactics are combined with data exfiltration.<br/></span></li><li><strong>Evading EDR</strong><strong><br/></strong><a href="https://vanmieghem.io/blueprint-for-evading-edr-in-2022/" target="_self">https://vanmieghem.io/blueprint-for-evading-edr-in-2022/</a></li></ul>

3 Reasons Why Ransomware Rollback is Not An Effective Strategy