di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

Follow along with Security and Threat Research Team Leader Mark Vaitzman as he gives a brief history of LLMs and describes step-by-step how LLMs can empower attack lifecycles, making cyberthreats more dangerous.

Robot_1200x627.png

Large Language Models (LLMs) are rapidly evolving, and their capabilities are attracting the attention of threat actors. This blog explores how malicious actors are utilizing LLMs to enhance their cyber operations and then delves into LLM-based tools and an advanced stealer managed by artificial intelligence (AI).While LLMs hold immense potential for improving cybersecurity through threat detection and analysis, their power can also be wielded for malicious purposes. Recent reports suggest that cybercriminals and nation-state actors are actively exploring LLMs for different tasks such as code generation, phishing emails, scripts, and more. We’ll elaborate on just a few examples in this blog.The last times we saw such significant technological changes influencing everyday life were the four industrial revolutions (1765 – Oil, 1870 – Gas, 1969 – Electronics and Nuclear, and 2000 – Internet and Renewable Energy). Many believe that AI—and LLMs, which are part of AI—is the next industrial revolution, capable of reshaping industries, including crime, as new cyber threats emerge.Cybersecurity is a very dynamic field, but there are still a few basic aspects that haven’t changed – one of which is the attack lifecycle. The cyber attack lifecycle, often referred to as the Cyber Kill Chain, includes the following stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives.First, I’ll give a brief history of AI and then, using LLMs, I will provide a full attack lifecycle and demonstrate how threat actors could employ them, the risk they pose, and their potential future uses. LLM-based tools can play a significant role in various stages of the cyber attack lifecycle, including fully managing the final stage of the Payload and C2 – and that’s the most interesting part of this blog. The bottom line is that AI as a whole, and LLMs in particular, are very powerful and will get better with time. In the wrong hands, they will cause significant damage. The only way to fight the abuse of LLMs is with AI and advanced Deep Learning prevention alogorithms.<h5>The Long Way to the Present Day LLM</h5>Let's start with an introduction to AI and LLMs before they became mainstream. I started working with AI when I built my first Prolog app, which is a declarative programming language designed for developing logic-based AI applications.Prolog is based on four main elements: Facts, Rules, Variables, and Queries. The original version is 52 years old and even the most current version is 24 years old. At the time of its creation there was not enough data for the facts, and the queries had to be pre-defined and barely customized during usage. Despite that, it was used for building chatbots like Zamia AI.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt4cacfae68c0a2bc8" width="583" alt="Figure 1: Zamia AI" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4cacfae68c0a2bc8/67855a294ac08c6dd62a053f/fig1-Zamia-AI-main.png" height="789" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: Zamia AI</figcaption></div></figure><figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt8f3c53a01e1f6b06" width="548" alt="fig2-Zamia-AI-Chat.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8f3c53a01e1f6b06/67855a29b33932b1322143ac/fig2-Zamia-AI-Chat.png" height="298" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: Zamia AI Chat</figcaption></div></figure>When we think about AI today, we envision complex systems and advanced chatbots like ChatGPT equipped with complicated infrastructure and powerful problem-solving skills. However, AI was not always so advanced. Early examples of AI often took the form of chatbots. They seem simple now, but they were groundbreaking innovations that ushered new concepts and tools into the world.Let’s look at some of them:Eliza (1966) - This first-ever chatbot was developed by MIT professor Joseph Weizenbaum in the 1960s. Eliza was programmed to act as a psychotherapist to users.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt39109eebae6dd559" width="674" alt="fig3-Eliza-chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt39109eebae6dd559/67855a299c8312d204b48ed5/fig3-Eliza-chatbot.png" height="350" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Eliza Chatbot 1966</figcaption></div></figure>Parry (1972) - A natural language program that simulated the thinking of a paranoid individual. Parry was constructed by American psychiatrist Kenneth Colby in 1972.ChatterBot (1988) - British programmer&nbsp;<a href="https://en.wikipedia.org/wiki/Rollo_Carpenter">Rollo Carpenter</a> created the Chatterbot in 1988. It evolved into Cleverbot in 1997.&nbsp;Fun fact– ChatterBot was active until 2023. <a href="https://www.cleverbot.com/">Cleverbot</a> is still operating and accessible today.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltb6ebe6bd89db5d9f" width="368" alt="fig4-CleverBot-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb6ebe6bd89db5d9f/67855a29a840ac66f7d5161e/fig4-CleverBot-Chatbot.png" height="298" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: CleverBot Chatbot</figcaption></div></figure>DR SBAITSO (1992) - This chatbot was created by Creative Labs for MS-DOS in 1992. It is one of the earliest chatbots to incorporate a full voice-operated chat program. You may try it out with an <a href="https://classicreload.com/dr-sbaitso.html">MS-DOS emulator</a>.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt75aad27671c9d80c" width="778" alt="fig5-DR-Sbaitso-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt75aad27671c9d80c/67855a2926c6b42b6a3efe55/fig5-DR-Sbaitso-Chatbot.png" height="326" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: DR SBAITSO Chatbot</figcaption></div></figure>&nbsp;A.L.I.C.E. (1995) – A universal language processing chatbot that uses heuristic pattern matching to carry conversations. Richard Wallace pioneered the construction of ALICE in 1995.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltc341c7a55fbb99f1" width="1378" alt="fig6-ALICE-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc341c7a55fbb99f1/67855a297854593beb60b083/fig6-ALICE-Chatbot.png" height="460" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: ALICE Chatbot</figcaption></div></figure>The evolution of AI and its applications is ongoing. Despite the popularity AI now has, researchers have been studying and experimenting with it for decades. Natural Language Processing, Machine Learning, and Deep Learning technologies have all existed for years. And, as shown by the timeline above, assistant-like chatbots were already popular –&nbsp; by combining the idea of an AI assistant with actual AI technology, chatbots with voice recognition burst onto the scene. Later, refining and evolving what we created, we developed the almighty LLMs:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt2099abc03b83a316" width="822" alt="fig7-Chatbots-evolution.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2099abc03b83a316/67855a2a5dc3c373fb1dff58/fig7-Chatbots-evolution.png" height="260" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: Chatbots and recent LLMs</figcaption></div></figure>Now that you have a better understanding of the timeline of AI, chatbots, and LLMs, let’s get into how the unique capabilities of LLMs can help facilitate a cyber attack.<h5>Not all Chatbots are LLMs</h5>LLM is an evolution of Natural Language Processing (NLP), but there are some key differences, as shown in the following graphic:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img width="1052" alt="Screenshot_2025-01-14_at_2.32.10_PM.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt127f601c1983a0c4/6786bbcbbd2b7423333152ef/Screenshot_2025-01-14_at_2.32.10_PM.png" height="551" style="max-width: 1052px;width: 1052px;height: 551px;" max-width="1052" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: NLP vs LLM</figcaption></div></figure>There are multiple capabilities unique to LLMs that enable the attack flow POC I’m about to describe.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blta1391ffcefcf764f" width="849" alt="fig9-LLM-capabilities.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta1391ffcefcf764f/67855a2a66c78759deba45d0/fig9-LLM-capabilities.png" height="396" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: LLM Capabilities for the Attack Flow POC</figcaption></div></figure><h2>Building an LLM Attack Lifecycle</h2><h5>Understanding the Attack Lifecycle</h5>In order to begin, we have to understand why the attack lifecycle is the perfect methodology to prove that LLMs can perform a full multistage attack on their own. The term “Attack lifecycle” represents the stages in a cyber attack flow, also known as the Attack Kill Chain. These stages, when executed correctly, can lead to a successful attack. Therefore, there are multiple security products that are expected to stop the attack in each stage and kill the chain, disrupting the attack.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt9478e1de7b400c6d" width="1200" alt="fig10-Attack-lifeCycle.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9478e1de7b400c6d/67855a2a9f3ffe210a1d7029/fig10-Attack-lifeCycle.png" height="413.63" /><figcaption style="text-align: center;" style="text-align: center;">Figure 10: Attack Lifecycle</figcaption></div></figure>The Attack Lifecycle follows these steps:<ul><li>Recon: Gathering information about the target (e.g., network topology, employees, vulnerabilities) to identify weaknesses or valuable entry points.</li><li>Weaponization: Creating a malicious payload (such as a virus, malware, or exploit) and preparing it to be delivered to the target system.</li><li>Delivery: Transmitting the weaponized payload to the target, typically through methods like email attachments, malicious links, or infected websites.</li><li>Exploitation: Triggering the payload to exploit a vulnerability in the target system (e.g., executing a malicious code or exploiting a software flaw).</li><li>Installation: Installing the malware or exploit onto the target system, often establishing persistence so the attacker can maintain access over time.</li><li>Command and Control (C2): Establishing a remote connection between the compromised system and the attacker’s infrastructure to control and issue commands to the infected system.</li><li>Actions on Objective: Carrying out the attacker’s primary goals, such as stealing data, spreading malware, disrupting operations, or further exploiting the network.</li></ul><h5>Initial Reconnaissance</h5>LLMs can automate the process of gathering information from publicly available sources such as social media and technical forums about target systems and individuals.After choosing the victim or the sector, one of the most important stages begins: Initial Reconnaissance. This phase is where information gathering and identification of potential entry points happens.Even though this stage is already fairly simple due to powerful search engines like Google and scanning services like Shodan and Censys, LLMs have made it even easier and faster.For our POC, we’ll start by identifying a possible pool of initial vectors and their victims – a chatbot can help with that.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt60e639ae21c4bfc7" width="525" alt="fig11-vulnerabilities-chatGPT.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt60e639ae21c4bfc7/67855a49baaf228ec928af43/fig11-vulnerabilities-chatGPT.png" height="535" /><figcaption style="text-align: center;" style="text-align: center;">Figure 11: ChatGPT Query and Vulnerability Explanation</figcaption></div></figure>Censys, a well-known worldwide internet scanning platform, helps information security practitioners discover, monitor, and analyze devices. When integrated with an LLM chat it makes the search even easier and provides an actual pool of potential victims.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt481611daa29e50c3" width="434" alt="fig12-Censys-search-GPT-results.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt481611daa29e50c3/67855a49532fd65fdc5a29ba/fig12-Censys-search-GPT-results.png" height="446" /><figcaption style="text-align: center;" style="text-align: center;">Figure 12: Censys search results</figcaption></div></figure>Additionally, there are tools made specifically for OSINT that can automate the reconnaissance and scanning process. In fact, there are several LLMs built and trained specifically for that purpose, such as PentestGPT (originally known as HackerGPT).

Figure 46: Full flow agent idea demonstration We’re almost done! Next, I wanted to see what my LLM-guided malware can do with unrestricted LLMs. What would happen if I left the agent to run for a bit while I had some coffee?It tried to download and execute several tools but failed to do so since I tested the malware on an empty and new Linux VM. The agent tried to fix the errors by installing the missing common libraries.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt5de6dbc9602d702c" width="1161" alt="fig47-llm-guided-attempts-to-fix-missing-libraries.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5de6dbc9602d702c/67855aa538abf9e29d1f08df/fig47-llm-guided-attempts-to-fix-missing-libraries.png" height="738" /><figcaption style="text-align: center;" style="text-align: center;">Figure 47: LLM-Guided Malware Attempts to Install Additional Libraries to Avoid Failures</figcaption></div></figure><h5>Takeaways and Follow Ups</h5>Today, LLMs are already capable of making attacks faster and much more frequent.<ul><li>We could add the following to the POC to make it even more effective:<ul><li>Rewrite into a more efficient and less common language – Rust / GO</li><li>Build a packer for better and longer evasion</li><li>Try with local Tiny LLMs to work without the need of an external LLM server&nbsp;</li><li>Make the agent perform the request for the malware to be generated and compiled on request during the initial LLM communication using a polymorphic algorithm</li><li>Hunt for LLM-based malware – which can be tricky (keep an eye out for another blog on this topic)</li><li>Research and move the idea into BLM (Behavior Large Models – often developed for future robots) – DO NOT TRY AT HOME</li></ul></li></ul>Underestimated research – Recently, Claude announced that their latest version of <a href="https://www.anthropic.com/news/3-5-models-and-computer-use">Claude 3.5 “Sonnet”</a> will be able to follow user’s commands to move a cursor, click on relevant locations, and input information via a virtual keyboard to emulate the way people interact with their own computer. This capability is exactly what I was missing to make my LLM-guided malware even more efficient. Just after that, OpenAI announced “<a href="https://www.bloomberg.com/news/articles/2024-11-13/openai-nears-launch-of-ai-agents-to-automate-tasks-for-users">Operator</a>” with similar abilities. Finally, information was leaked that Google’s <a href="https://www.theverge.com/2024/10/26/24280431/google-project-jarvis-ai-system-computer-using-agent">Jarvis AI</a> can use a computer to take actions on a person's behalf.<h5>Conclusion</h5>My view of how LLMs will affect cyber attacks has evolved throughout my research; the cyber threats posed by LLMs are not a revolution, but an evolution. There’s nothing new there, LLMs are just making cyber threats better, faster, and more accurate on a larger scale. As demonstrated in this blog, LLMs can be successfully integrated into every phase of the attack lifecycle with the guidance of an experienced driver. These abilities are likely to grow in autonomy as the underlying technology advances.&nbsp;Defending against this evolution requires a corresponding evolution in the prevention methods. In order to break down the attack, defenders are only required to break down two of the stages (on average). It can be done. But defenders need the right tools to do it.We'll update this blog soon with video from the DeepSec Conference where this research was presented.If you are a cybersecurity professional who wants to fight AI with the best AI, then <a href="https://info.deepinstinct.com/request-a-demo">request your free scan</a> to see the power of cybersecurity’s only deep learning framework for yourself.Referenceshttps://github.com/MythicAgents/Medusastopwatch.iohttps://github.com/GreyDGL/PentestGPTCensys.comChatGPT.comGemini.comhttps://github.com/PhonePe/mantishttps://github.com/fin3ss3g0d/evilgophishhttps://github.com/kingridda/voice-cloning-AIhttps://github.com/nomic-ai/gpt4allhttps://github.com/kgretzky/evilginx3huggingface.comOllama.comWhiteRabbitNeo.comhttps://github.com/jasonacox/TinyLLMhttps://github.com/katanaml/sparrow

Beyond Flesh and Code: Building an LLM-Based Attack Lifecycle With a Self-Guided Malware Agent

Join Deep Instinct Security Researcher Eliran Nissan as he exposes a powerful new DCOM lateral movement attack that remotely writes custom payloads to create an embedded backdoor.

DCOM_1200x627.jpg

Forget PSEXEC: DCOM Upload & Execute Backdoor

Follow along with David Trigano, Deep Instinct's Director of Product Management, as he explains how DSX for Cloud - Amazon S3 fills the gaps in cloud data security left by legacy tools.

Shield_full.png

I have dedicated my career to safeguarding organizations’ most critical data assets. Throughout this journey, I’ve observed a recurring challenge: many organizations underestimate the risks of cloud storage, assuming their cloud providers secure their data in the cloud. The reality is that cloud providers protect their infrastructure, not customers’ data. They also don’t protect against misconfigurations, insufficient access controls, or overlooked permissions that leave sensitive data vulnerable. These gaps present significant risks from external attackers or insider threats, underscoring the need for a proactive, shared-responsibility approach to cloud security.Cloud storage is a vital data management tool and a significant target for cybercriminals, positioned in the middle of a quickly escalating technological battle. As the data storage market evolves and rapidly expands, organizations face increasing challenges from exponential data growth and a deluge of zero-day attacks generated using Dark AI. And the native security capabilities of cloud storage providers aren’t enough to stop these sophisticated threats.<h5>The Issue with Legacy Cybersecurity Tools</h5>Amazon S3, the world’s largest cloud storage provider, dominates the enterprise data storage market. With this massive scale comes critical vulnerabilities for organizations, especially when using <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">legacy cybersecurity tools</a> that can’t keep pace. These tools foster a false sense of confidence and leave blind spots. For example, attacks like malware time-bombs are designed to evade detection by traditional signature-reliant tools. They can sit undetected in storage until triggered, catching most security tools off guard. Simultaneously, a flood of AI-generated attacks is exposing any gap in the perimeter, and legacy tools aren’t advanced enough to stop them. The pressure is mounting. The danger is growing.&nbsp;Fortunately, there is a path forward.<h5>Solving a Massive Problem: Our Work with Amazon S3</h5>Introducing Deep Instinct’s <a href="https://www.deepinstinct.com/dsx/dsx-cloud-amazon-s3">Data Security X (DSX) for Cloud – Amazon S3</a>, a purpose-built solution providing Zero-Day Data Security (ZDDS) to defend Amazon S3 cloud storage environments against threats and preemptively neutralize malware.After a quick and easy deployment, DSX for Cloud – Amazon S3 scans files at rest or in motion before they can execute. An industry-best scan speed of &lt;20ms per file allows for scanning, categorization, quarantine of malicious files, and immediate alerts to security teams. And by reducing security events and minimizing infrastructure costs, DSX for Cloud contributes to a lower total cost of ownership (TCO). Best of all, it’s certified by AWS and works natively with Amazon S3.Importantly, these scan speeds leverage our <a href="https://www.deepinstinct.com/dsx-brain">deep learning framework</a>, which features &gt;99% efficacy against known and unknown threats and a &lt;0.1% false positive rate. Instead of just comparing files to a checklist of known threats, DSX for Cloud examines every file and determines if it's malicious, even if the code has never been seen before, by any service. With lightning-fast speeds, it can quickly scan your full S3 storage environment – something legacy tools can’t do – and scale with your storage needs. Put another way, DSX for Cloud effectively stops threats that other tools can’t find.<h5>Fighting AI with the Best AI: Available Now</h5>In the fight against zero-day threats and unknown malware, <a href="https://www.deepinstinct.com/dsx/dsx-cloud-amazon-s3" target="_self">DSX for Cloud – Amazon S3</a> is the only solution on the market capable of preventing Dark AI-generated malware, regardless of the novelty or volume of attacks. The ability to prevent attacks is a necessity in high data volume environments. Deep Instinct levels the playing field, enabling you to fight AI with better AI.DSX for Cloud – Amazon S3 is now available in the <a href="https://aws.amazon.com/marketplace/seller-profile?id=seller-2vxjapmpeczok" target="_self">AWS Marketplace</a>, enabling buyers to integrate the payment process with their existing AWS billing system and streamline their procurement experience.

Leveraging Deep Learning for Zero-Day Data Security in Cloud Storage

Deep Instinct security researchers Ron Ben-Yizhak and David Shandalov share the research they presented at DEF CON 32: an in-depth exploration of two different attack methods. Explore the methods they presented and follow along as they explain how they work.

DEFCON Speaker Image.jpg

SHIM Me What You Got: Manipulating Shim and Office for Code Injection

Last week, Black Hat and DEF CON took Las Vegas by storm and Deep Instinct was there to join the fun. It was an exhilarating week, packed with networking events, speaking sessions, and a lively crowd. Here are our main takeaways and notable highlights you may have missed.

Blackhat_930x400_3.png

<h5>As Vendors Continue to Tout “AI” Capabilities, Let’s Talk About Real AI</h5>Unsurprisingly, artificial intelligence (AI) continued to dominate onsite conversations, and similar to the RSA Conference earlier this year, both legacy and early-stage cybersecurity vendors felt compelled to tout “AI capabilities” in their marketing and booth collateral. But not all AI is created equal, and it sparked a conversation about the differences and nuances in AI technologies.Many cybersecurity vendors promoted generative AI capabilities that are tacked onto existing technologies, a marketing tactic used to remain relevant in today’s AI conversations. But AI is not their core competency, and it never will be – at the end of the day, their AI explains how you were breached, but doesn’t prevent it.We challenged booth visitors to ask vendors the hard-hitting questions about AI: Is it built on an archaic framework? Can it be air gapped? Is it the most advanced form of AI (deep learning), or just <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity?_ga=2.51158817.941771334.1715708232-1517144758.1706129447">basic ML</a>? The answers will tell you everything you need to know about vendors’ AI promises.Deep Instinct is different from any other vendor in the market. Our deep learning (DL) cybersecurity framework prevents and explains unknown zero-day threats, so that security teams can both stop a breach before it happens and learn to predict the next attack. We’re a zero-day data security platform using the most advanced form of AI – developed before AI became a hot topic – to protect storage, applications, and endpoints, so your data remains secure regardless of where it resides.<h5>Proven Prevention: Deep Instinct Wins CRN Award During Black Hat</h5>During Black Hat, <a href="https://www.deepinstinct.com/prevention-for-storage">Deep Instinct’s </a><a href="https://www.deepinstinct.com/prevention-for-storage">Prevention for Storage (DPS)</a> product was recognized by CRN in its <a href="https://www.crn.com/news/channel-news/2024/the-2024-tech-innovator-awards">2024 Tech Innovator Awards</a>. From more than 320 applicants, DPS rose to the top. DPS provides data storage threat prevention across NAS and cloud storage environments, preventing &gt;99% of zero-day exploits, ransomware, and unknown threats in these storage repositories.<h5>Highlighting Our Two Speaking Sessions at Black Hat and DEF CON</h5>Capping off a memorable week were our two speaking sessions during Black Hat and DEF CON. First, our CIO and CISO, Carl Froggett, joined our VP of Global Sales Engineering, Brian Black, in a Black Hat session titled, “<a href="https://www.blackhat.com/us-24/sponsored-sessions/schedule/index.html#the-future-of-cybersecurity-embracing-prevention-first-strategies-in-the-age-of-edge-ai-42167">The Future of Cybersecurity: Embracing Prevention-First Strategies in the Age of Edge AI</a>.” The duo discussed the new era of localized large language models (LLMs) amid the advent of neural processing units (NPUs) and neural engines in devices from Qualcomm and Apple. They also walked attendees through the implications of edge AI and localized LLMs, while highlighting the urgent need for prevention-focused approaches to safeguard against these evolving threats.Then during DEF CON, Deep Instinct researchers Ron Ben-Yizhak and David Shandalov presented “<a href="https://defcon.org/html/defcon-32/dc-32-speakers.html">SHIM Me What You Got - Manipulating Shim and Office for Code Injection</a>,” introducing a novel and stealthy technique to apply malicious shims on a code injection process that does not require registry modification or SDB files and leaves no traces on the disk.“Hacker summer camp” is always an exciting time, but what made this year even more memorable was the meteoric rise in AI visibility, and discussions centered on how to fight AI with better AI. The answer is deep learning. See for yourself what’s possible by <a href="https://info.deepinstinct.com/request-a-demo?_ga=2.123317326.470551219.1723466942-635130100.1705001786&_gac=1.88354281.1722959687.CjwKCAjwk8e1BhALEiwAc8MHiIGA96vDs3I1qyodZhPZHrwQ9pTgxWo5NEpFFArfiOucUXEX-lSRCRoCAdcQAvD_BwE">requesting a Deep Instinct demo today</a>.

"Hacker Summer Camp" Recap: Black Hat, DEF CON, and the Growing AI Arms Race

Follow along with Deep Instinct on a postmortem of the 2023 MGM attacks. Learn what went wrong, what could have been done to prevent the attack, and what having Deep Instinct would have changed.

MGM_930x400.png

In late 2023, MGM Resorts experienced the beginning of a ransomware cyberattack that would cost them nearly $100M USD. The multi-stage attack was launched by ShatteredSpider, a subgroup of AlphV, and progressed quickly from infiltration to exploitation. By taking advantage of social engineering tactics, injection, and inadequate security practices, ShatteredSpider pulled off one of the highest profile attacks in years. And it didn’t have to happen.&nbsp;<h5>The MGM Attack&nbsp;</h5>In the first phase of the attack, ShatteredSpider (<a href="https://therecord.media/mgm-hack-teenager-arrest-britain">who recently had a 17-year-old member arrested</a> in connection with the MGM hack) used LinkedIn to gather information about an MGM employee and then impersonated that employee on a call to MGM’s IT helpdesk. Using that access, ShatteredSpider was able to convince the helpdesk to grant them access, bypassing every existing security control. The attackers then quickly established persistence, installed sniffers, and exfiltrated key admin credentials for Azure, Windows, and Okta. MGM was, at this point, a very securely stuck fly in ShatteredSpider’s web. Because the credentials had already been exfiltrated, MGM’s subsequent attempt to stop the cyberattack by shutting down critical infrastructure was too little, too late.&nbsp;As soon as services came back online, ShatteredSpider was able to use the exfiltrated credentials and persistence to attack their main objective. They identified critical MGM business services running on VMware with 100 ESXi Hypervisors. Hitting this one target caused massive disruption to their hotel reservation systems, gambling, slot machines, digital key room access, and so much more - achieving their desired outcome. Having established Internet communication to their cloud services, they exfiltrated MGM customer data/PII, and deployed ransomware to 100 ESXi VMware Hypervisors: MGM’s entire Virtual Server and some virtual desktop environments. That, kids, is the ballgame.&nbsp;<h5>Rewriting a Successful Attack&nbsp;</h5>Learning the right lessons after a cyberattack is an important part of both remediation and preparation for the next attack. When a high-profile attack like MGM happens, the entire cybersecurity industry gets the chance to analyze, dissect, and ultimately battle game the attack to see what would have worked and what wouldn’t. Everyone should be admitting the same thing about the first phase of the attack: there is not a policy in place, a training you could give, or a tool available that can remove the human element from an attack. The tools malicious actors use are complex, effective, and malleable. With the rise of AI, they’ve only become more dangerous. AI voice and video impersonations are an excellent example of this danger.&nbsp;Initial infiltration was just step one. The real battle took place in the hours and days following the vishing. The attackers installed sniffers and compromised critical infrastructure. The strategy of ‘detect and respond’ falls short here: how much time does it take to detect an attack and how much more time does it take to adequately respond?&nbsp;It’s during that ‘detect and respond’ period that Deep Instinct could have been a difference maker, not just slowing the attack, but preventing it altogether. ShatteredSpider were smart about their attack. The payload was delivered directly to the hypervisor layer; it wasn’t staged on end points, in storage, or delivered via email, thus avoiding several detection and prevention layers. This leaves two points to prevent the attack: the hypervisor layer and the internet delivery. In our tests, Deep Instinct was able to secure both points.&nbsp;<a href="https://www.deepinstinct.com/endpoint-security" target="_self">Deep Instinct EPP</a> running on the hypervisor layer detected and quarantined the payload before it could execute. Similarly, <a href="https://www.deepinstinct.com/prevention-for-applications" target="_self">Deep Instinct Prevention for Applications (DPA)</a> integrated into the internet layer via API or ICAP would have also prevented the payload.&nbsp;&nbsp;<h5>Debrief, DIANNA, Do-Over&nbsp;</h5>MGM lost control of their situation the moment the social engineering attack was successful. Their lack of hypervisor partition, secondary credentials, scanning capabilities, and other industry-standard security controls meant that once the attackers had established persistence and exfiltrated admin credentials they would have free run of the place. Having those defenses would have at least hardened MGM as a target but they would not necessarily have prevented the attack completely.&nbsp;Unfortunately, much of the cybersecurity industry’s value-prop isn’t true prevention, it’s disaster mitigation. The biggest success of most tech stack configurations would be that they stopped the bleeding. This cybersecurity philosophy can be cynically distilled into one key question: How much are you willing to lose? At a large enterprise like MGM, even successfully defending against a cyberattack can be costly.&nbsp;Where Deep Instinct makes a difference is the focus on prevention. Barring the human element that allowed access to critical infrastructure, Deep Instinct DPE and DPA would have prevented the actual substantive parts of the MGM attack. The bleeding didn’t have to happen, and the “success” of only a small number of accounts being affected didn’t have to happen. The malicious payload used in the MGM attack could have been immediately caught, quarantined, and deleted pre-execution when scanned by Deep Instinct. Using DIANNA, MGM could have immediately figured out why the payload was caught and deleted.&nbsp;<a href="https://www.deepinstinct.com/news/deep-instinct-introduces-dianna">DIANNA, our generative AI powered cybersecurity companion</a>, was able to tell us nearly instantly (okay, seven seconds) in real language why the Alphv ransomware was malicious, including the markers it used to make that determination. In short order we had both stopped the attack and developed a framework for investigating the attack. In addition to stopping the attack, there are other key benefits for some groups:&nbsp;<ul><li>SOC Teams: In terms of both efficacy and stress, SOC teams are a main beneficiary of effective prevention-first cybersecurity. Given rising rates of burnout among SOC professionals, tools that support their mission are invaluable. Read more about the rates of burnout among SOC professionals in our <a href="https://www.deepinstinct.com/voice-of-secops-reports">2024 Voice of SecOps report</a>.&nbsp;</li></ul><ul><li>MGM: Better cybersecurity reduces organizational risk and increases confidence. A prevention-first approach eliminates the death-by-a-thousand-cuts damage to organizational reputation and budget caused by the current cybersecurity paradigm.&nbsp;</li></ul><ul><li>MGM Customers: Having personal data stolen is incredibly dangerous for consumers and puts them at risk for fraud, identity theft, and other targeted attacks. Not allowing a breach to occur at all increases confidence and mitigates the legal and personal ramifications of allowing personal data to be stolen.&nbsp;</li></ul>Novelty is a weapon. Most of the time it’s a very effective one. The introduction of deepfakes has revolutionized social engineering attacks. Malicious AI has similarly revolutionized cyberattacks. There are more methods than ever for bad actors to gain access to secure systems. AI-powered mutations allow attacks to constantly refresh and renew themselves in novel ways to evade existing cybersecurity. To keep up, defenders need tools that make them equally responsive.<a href="https://info.deepinstinct.com/request-a-demo">Get a demo</a> to see the power of a prevention-first approach for yourself.&nbsp;

Would Have, Could Have, Should Have: Dissecting the 2023 MGM Hack

Take a deep dive into BlackSuit ransomware and explore its capabilities, deployment, and some current targets. Explore how Deep Instinct is able to detect and prevent BlackSuit from taking advantage of your data.

BlackSuit_900x400_2.png

Five weeks ago, the KADOKAWA corporation began to experience service outages affecting multiple websites. The outages spread to other operations and were identified as a <a href="https://www.bleepingcomputer.com/news/security/blacksuit-ransomware-gang-claims-attack-on-kadokawa-corporation/">ransomware attack</a> by the BlackSuit ransomware group. BlackSuit claimed responsibility and threatened the public release of stolen information on July 1st unless their ransom demands were met.&nbsp;&nbsp;BlackSuit's ransomware is very similar to the Royal ransomware strain, which itself is considered the successor to the notorious Conti group. This suggests potential connections or shared developers. This connection can be explained in more detail in some of our older material that has been published on the subject: we examined both <a href="https://info.deepinstinct.com/conti-leaks-cyber-threat-reports">Conti</a> and <a href="https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence">BlackBasta</a>, a Conti offshoot.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt360d20b0f113f264/6696f82b06a674d134c5a4ee/fig1-blacksuit-victims.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: BlackSuit ransomware victims</figcaption></div></figure>Based on our analysis, we found that Deep Instinct prevents&nbsp;all new Blacksuit Windows Ransomware samples with an eight-month-old brain. Across the industry, however, these samples have a much lower detection rate than earlier sample versions of BlackSuit. As demonstrated in the graph above, that lower detection rate matches the sudden growth of BlackSuit ransomware victims.&nbsp;The samples BlackSuit is using are well designed for infiltration of legacy systems. Let’s take a closer look.&nbsp;<h5>Latest samples analysis:</h5>Newer samples of BlackSuit’s code mainly added additional layers of complications like encoding strings and imported DLLs for Anti-Analysis. They also added a mandatory ID argument to bypass automatic emulation, making the new samples more evasive.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2084d114ec3f8209/6696f82b77a7809e9044a25f/fig2-strings-encryption.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: String decryption</figcaption></div></figure>For example, according to VirusTotal, even though old Blacksuit samples have a high detection rate, the new samples from recent months have a much lower detection rate, indicating significant changes.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5bed08ab64e581fe/6696f82cd0c0ef789ec561b6/fig3-VT-detection-rate.png" width="auto" height="auto" style="text-align: center;max-width: auto;width: auto;height: auto;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Detection rate in VirusTotal of new Blacksuit samples when first submitted</figcaption></div></figure>One of the more impactful changes allowed the threat actor to mask the ransomware as a legitimate part of a known free antivirus, Qihoo 360, including false watermarking. This masking has drastically lowered detection. The ransomware is hidden deep inside the legitimate looking application and only has to be executed with a token in the command line to operate as a ransomware.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteae79a1729b07bfd/6696f82c77a780582d44a263/fig4-embedded-legitimate-urls.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: Embedded URLs</figcaption></div></figure><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4e96f1780d57f20a/6696f82c6c1019fd6f39795e/fig5-fake-metadata.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: Fake Metadata</figcaption></div></figure>The masquerade file is not signed, indicating this is not the real Qihoo application. The functionality post infiltration remained the same as the other new samples, including the same mutex used.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3971600a651708d4/6696f82c79f2042205390cf0/fig6-VT-detectio-rate-stealthy-sample.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: VirusTotal detection rate.</figcaption></div></figure>

The main portion of the executable is nearly identical to Qihoo's real QHAccount.exe file, resulting in security software evasion.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="image003.jpg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5dac21065b6f0d02/66990ac7d316c70da3b3419f/image003.jpg" height="auto" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: Side by side comparison of BlackSuit and Qihoo executables</figcaption></div></figure>Disclaimer: The official Qihoo 360 is not in any way involved with BlackSuit. The masking is the work of bad actors assuming Qihoo’s identity.&nbsp;<h5>Behaviors:</h5>The common behavior shared with all Windows samples didn’t change much and the main functionality remained the same, though some commands have changed:<table><tbody><tr><td>-p&nbsp;</td><td>Specifies the target directory where the ransomware will encrypt files&nbsp;</td></tr><tr><td>-killvm&nbsp;</td><td>Terminates the virtual machine (VM), preventing analysis&nbsp;</td></tr><tr><td>-allfilesEncrypt&nbsp;</td><td>Encrypts all accessible files, maximizing damage&nbsp;</td></tr><tr><td>-networkEncrypt&nbsp;</td><td>Encrypts files on connected network drives, spreading the attack&nbsp;</td></tr><tr><td>-localEncrypt&nbsp;</td><td>Restricts encryption to the local machine storage, limiting immediate impact&nbsp;</td></tr><tr><td>-percentEncrypt&nbsp;</td><td>Encrypts a specified percentage of files, potentially increasing performance&nbsp;</td></tr><tr><td>-demonoff&nbsp;</td><td>Operates in stealth mode, making detection harder&nbsp;</td></tr><tr><td>-list {file}&nbsp;</td><td>A targeted list of files to be included in the encryption process&nbsp;</td></tr><tr><td>-delete&nbsp;</td><td>The ransomware deletes itself after execution, hindering investigation&nbsp;</td></tr><tr><td>-thrcount {number}&nbsp;</td><td>Specifies the number of threads used for encryption, impacting both performance and resource usage.&nbsp;</td></tr><tr><td>-skip {file}&nbsp;</td><td>A list of files to be excluded from encryption&nbsp;</td></tr><tr><td>-noprotect&nbsp;</td><td>Disables self-protection mechanisms, allowing termination of the ransomware&nbsp;</td></tr></tbody></table>&nbsp;The new samples have encoded strings to complicate analysis, and need to be supplied with -id &lt;32 characters&gt;. They can also receive additional instructions, such as:&nbsp;&nbsp;<table><tbody><tr><td>-ep&nbsp;</td><td>(like the previous percentEncrypt) sets a percentage of each file that will be encrypted. Partial encryption&nbsp;</td></tr><tr><td>-path&nbsp;</td><td>Specific directory to encrypt&nbsp;</td></tr><tr><td>-localonly&nbsp;</td><td>(an addition to the previous networkEncrypt) without network drives&nbsp;</td></tr><tr><td>-networkonly&nbsp;</td><td>(an addition to the previous networkEncrypt) without local files&nbsp;</td></tr><tr><td>-aavm&nbsp;</td><td>(like the previous allfilesEncrypt) encrypts everything&nbsp;</td></tr></tbody></table>&nbsp;BlackSuit ransomware also boasts a few other functionalities:&nbsp;<ul><li>Initiates Asymmetric Key Exchange to get the secret encryption key.&nbsp;</li></ul><ul><li>Deletes shadow copies, in order to disable easy local restore:&nbsp;</li></ul><ul><ul><li>vssadmin delete shadow /all /quiet&nbsp;&nbsp;</li></ul></ul><ul><li>Encrypts&nbsp;</li></ul><ul><ul><li>Appends .blacksuit to the encrypted files&nbsp;</li></ul></ul><ul><li>Skips:&nbsp;</li></ul><ul><ul><li>Various file types like executables, drivers, and installers to avoid breaking the system.&nbsp;</li></ul></ul><ul><ul><li>Already encrypted files and the ransom note.&nbsp;</li></ul></ul><ul><li>Eventually, BlackSuit’s ransomware is capable of disabling safe mode and shutting down the system:&nbsp;</li></ul><ul><ul><li>bcdedit /deletevalue {current} safeboot&nbsp;&nbsp;</li></ul></ul><ul><ul><li>shutdown /r /t 0&nbsp;</li></ul></ul><ul><li>Drops ransom note: Usually named readme.blacksuit.txt. The content text is encrypted to avoid signature detection for the ransom note. The note includes a link for communication with the threat actor for ransom negotiations.</li></ul><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt771fca19a69b58a1" alt="fig7-ransom-note.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt771fca19a69b58a1/6696f82de13bf8b63bf84456/fig7-ransom-note.png" width="auto" height="128" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: BlackSuit’s ransom note</figcaption></div></figure><h5>Infection chain</h5>The common initial attack vectors are RDP (possibly with stolen credentials), VPN and firewall vulnerabilities, Office email attachments (Macros), Torrent websites, Malicious ads, and various 3rd-party trojans. And the attackers have also used tools like CobaltStrike, WinRAR, PUTTY, Rclone, Advanced IP Scanner, Mimikatz, and GMER. The variety of attack vectors opens the possibility for infection across a much broader target group, endangering large amounts of data.&nbsp;<h5>Leak and news site</h5>The BlackSuit group operates a news and leak site on the DarkWeb that includes all the known victims of the threat actors. Once the timer for the ransom payment ends, the exfiltrated data is published.&nbsp;Alleged victims of BlackSuit ransomware have their data published under a profile featuring key information about their organization, including industry, number of employees, revenue, and contact information.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Figure 8: An example of an alleged victim's profile on BlackSuit's leak site " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6451cbdff41a7b39/6697d044d0c0efef3ec5697e/fig9-darkweb-leak_redact_WB.png" width="auto" height="auto" style="width: auto; height: auto;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: An example of a victim profile on BlackSuit's leak site</figcaption></div></figure><a href="https://info.deepinstinct.com/request-a-demo">Request a demo</a> to see how Deep Instinct can protect you from BlackSuit ransomware.&nbsp;Explore the BlackSuit IOCs below.<h5>IOCs</h5>f1684fb118d4d8fc56653fcc49e12a659b64c4459ba037fa94f21783235cc6ba&nbsp;dede96fd44c0f78eb79ceb63b898874e8922efc59d8bfb9f86505b1992bc00a3&nbsp; 6a2e454942cfeebb1140e1a28cb05fd49461d07792e97663378399c719fbc9ee&nbsp;79ab73a0e9dd8eac045c00fd1bd172a7f359588901f93c83e6740157eb21e7df&nbsp;7f09c2e35783fca69f0e12f31d767cecf8a98567f2b6f1e2d81d2b2e93fe6307&nbsp;60a9785ec20ec08b6792e304fc4b363abd54b8a7a2945dca9f97ee07783c4759&nbsp;5aeaa5c4f4100b2084814be72a695a5bf4a95fdb8a0c65704523608baa79b726&nbsp;d96ff4b3e188f7ff96ed28c1381a6318dd76bb1fbd6ca02c6ab0236e1c7f35aa&nbsp;3be3a3c2c1abc1d401e845a2b8952f4f3e55b510f3d6c1eb2a4503c7be09bec1&nbsp;90ae0c693f6ffd6dc5bb2d5a5ef078629c3d77f874b2d2ebd9e109d8ca049f2c&nbsp;6ad8215bd6b52d897dcfa0a9829720d0532adc741460ecb4b8f00c4427b6141c&nbsp;8605dec4ae4bd9f51297d1f244d0647bc0637d6ce6a957a5f810c64ae63276cb&nbsp; 2adcf43d221de2f72ba5088dac3a3193219412882df711d095f04e3f5b40767c&nbsp;&nbsp;readme.blacksuit.txt&nbsp;.blacksuit&nbsp;vssadmin delete shadows /all /quiet&nbsp;Mutex: WLm87eV1oNRx6P3E4Cy9&nbsp;

Deep Dive: Exposing Stealthy New BlackSuit Ransomware

Explore how Deep Instinct integrated Deep Instinct Prevention for Applications (DPA) with our internal Microsoft SharePoint and OneDrive and strengthened our security. 

PracticeWhatWePreach_900x400_1.png

Deep Instinct is well-versed in the need for speed. The unique pressures of the startup environment necessitate near-constant communication and filesharing between employees and our eco-system of partners to meet the needs of our customers. Those files need to be two things: secure and speedy.&nbsp;&nbsp;
To address our needs, we’ve developed the capability to integrate <a href="https://www.deepinstinct.com/prevention-for-applications">Deep Instinct Prevention for Applications (DPA)</a> with our internal Microsoft SharePoint and OneDrive. Let’s look at what this means for us at Deep Instinct and how you can benefit from the same integration.&nbsp;
Exciting things first: this integration isn’t theoretical — it's already live for Deep Instinct and is delivering four key benefits that help us achieve more as a company:&nbsp;&nbsp;
<ul>
 <li>Real-time threat prevention&nbsp;</li>
 <li>Event-driven actions&nbsp;</li>
 <li>Seamless user experience&nbsp;</li>
 <li>Privacy&nbsp;</li>
</ul>
These benefits accelerate our already fast-paced environment and help safeguard the file sharing capabilities we rely on. Now we can be certain when we send or receive files via SharePoint or OneDrive, they’re not malicious.&nbsp;&nbsp;
<h5>Real-Time Threat Prevention&nbsp;</h5>
By integrating Deep Instinct Prevention for Applications with our SharePoint and OneDrive deployments, we scan and classify every file in the environment, quickly quarantining malicious files and stopping them in their tracks. (Of course, those malicious files are coming from outside our organization; we use <a href="https://www.deepinstinct.com/endpoint-security" target="_self">Deep Instinct Prevention for Endpoints</a> to ensure we're not the ones spreading malware.)
Because the scan process happens in near real time, users sharing and receiving files won’t notice the it taking place. Instead of waiting for a file to be scanned and returned, interrupting the flow of work, files scanned by DPA are available immediately, when we need them.
Regardless of size, DPA integrated in your organization would function much the same. It would give you the same real-time threat prevention capabilities without disrupting workflows. In addition to the regular benefits of a Deep Instinct deployment, your organization would no longer need to rely on inconsistent, cumbersome, and slow tools or worry about blind spots in the data estate. One of our biggest customers scans billions of files a month across their organization in a “real-time” data/file collaboration use case. Deep Instinct works on a huge scale.&nbsp;
<h5>Decide How You Defend&nbsp;</h5>
We see the efficacy of this integration every day at Deep Instinct. Clarity into file delivery and scanning gives us peace of mind, while automatic deletion and notification streamlines the security process – still letting people know why a file may not have arrived.&nbsp;
Rather than introducing a laborious identification and remediation process, users can choose to allow Deep Instinct to automatically delete malicious files and notify the recipient, or just issue an alert without deleting the file. Instead of waiting for a breach to happen or leaving you in the dark about the status of a file you’ve requested, this method empowers you to choose your next steps to defend against this attack and the next.
Sole reliance on endpoint security solutions should be a last resort. This integration gives us another layer of security before we have to rely on EDR and prevents bad actors from ever reaching the endpoint in the first place. We keep ourselves safe using the same combination of solutions and tools we use to protect our customers.
And when this integration is combined with <a href="https://www.deepinstinct.com/news/deep-instinct-introduces-dianna">DIANNA, the industry’s first generative AI cyberassistant to provide malware analysis</a> on known and unknown threats, our security teams can easily examine any quarantined and deleted file to determine in seconds why it was flagged, not hours or days.
<h5>Seamless User Experience</h5>
This integration continues to offer the seamless Deep Instinct user experience that only we can offer. It’s an experience we trust and that we’re happy to integrate into our own environment and security posture. The combination of speed, accuracy, and information makes Deep Instinct an invaluable tool for our own teams and accelerates our business processes and yours.
<h5>Privacy</h5>
Deep Instinct is focused on privacy, which is why users are always in control of their own data. Microsoft allows users to “bring your own keys” meaning only the “keyholder” can see the file content. In this case, users control the encryption of SharePoint and OneDrive, not Microsoft. Deep Instinct doesn’t need users to send their data elsewhere to be effective, meaning the chain of custody, encryption, and privacy isn’t broken by a third party. Unlike legacy scanning tools, file provenance can be safeguarded by keeping it within your environment.
The DPA + SharePoint and OneDrive integration is an excellent example of how Deep Instinct implements our products in our own environment. It also illustrates how we can integrate with the same tools your organization already uses to provide a better, safer experience.
Ready to dive deeper? Effective prevention and cybersecurity relies on speed and accuracy. Deep Instinct uses deep learning to prevent threats with more accuracy and speed than any other solution. <a href="https://www.deepinstinct.com/blog/defeat-AI-cyber-threats-with-deep-learning">Learn why deep learning powered threat prevention is at the forefront of the cybersecurity battle</a>.
Security doesn't end with just one tool. Defense in depth is a strategy to keep your organization safe using multiple tools to build an effective wall against breach and attack. <a href="https://info.deepinstinct.com/file-upload-security?_ga=2.109077509.1025104848.1720546918-1577162200.1714240296&_gac=1.238305844.1718135387.EAIaIQobChMIq7m80N3xhQMVc6VaBR19bAn5EAAYASAAEgIJRPD_BwE" target="_self">Explore how Deep Instinct secures your file uploads</a> to see another step you can take to secure your organization.
And if you're ready to take the next step, <a href="https://info.deepinstinct.com/request-a-demo?_ga=2.215978322.475833869.1717446548-1577162200.1714240296&_gac=1.208487718.1716560633.EAIaIQobChMIq7m80N3xhQMVc6VaBR19bAn5EAAYASAAEgIJRPD_BwE">request a demo</a> with one of our knowledgable team to see what Deep Instinct can do for you.

Practicing What We Preach: Preventing Threats in SharePoint and OneDrive

RSCA_Blog_Recap.jpg

<h2>Another exciting, whirlwind <a href="https://www.rsaconference.com/marketplace/search/Deep-Instinct-1632843795585001DKrw" target="_blank">RSA Conference</a> (RSAC) has officially wrapped, and the cybersecurity industry is still buzzing over some of the vendor news over the past week. In case you missed it, here are some of our top highlights and key takeaways from RSAC 2024.</h2><h5>Not All AI is Created Equal: Deep Learning in the Spotlight</h5>Generative AI was a hot topic of discussion at RSAC and numerous vendors showcased new capabilities and implementations. But, despite all the excitement, it’s important to note that not all AI is created equal. Our Deep Instinct leadership team spent time with customers, prospects, press, and industry peers to raise greater awareness of our differentiated deep learning (DL) cyber capabilities. In contrast to many machine learning (ML) tools, our technology uses a far more sophisticated set of algorithms that traditional ML models cannot match – which is what makes our <a href="https://www.deepinstinct.com/platform" target="_self">Predictive Prevention Platform</a> so effective.From a media breakfast panel on the topic, to more intimate one-on-one conversations, our team was intent on evangelizing how the only way to effectively combat increasingly sophisticated AI-powered cyber threats is with DL.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><a href="https://www.scmagazine.com/podcast-segment/12856-2024-rsac-3"><img asset_uid="blt789c574cea57f38d" alt="Fig 1_RSAC_Carl and Security Weekly.jpg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt789c574cea57f38d/6645438e16e6bf59d758f418/Fig_1_RSAC_Carl_and_Security_Weekly.jpg" width="auto" height="auto" style="text-align: center;"/></a><figcaption style="text-align: center;" style="text-align: center;">Our CIO Carl Froggett explains how DL combats cyber threats during his sit-down podcast interview with Security Weekly.</figcaption></div></figure><h5>Legacy Vendors Tout New AI Promises Based on False Claims</h5>It seemed every vendor felt compelled to promote their newest AI-based offerings, announcing a plethora of AI-related products and advancements, echoing past rushes to adopt and market new tech. While legacy vendors tack on generative AI capabilities to remain relevant, it is not their core competency; they merely use it to augment their existing solution set. In truth it only explains how you were breached. It doesn’t stop it.This short-sighted approach means the next breach will inevitably happen, forcing security teams to respond, over and over again. Instead of preventing incidents, these AI solutions still operate reactively, allowing disruptions to occur before attempting to mitigate the damage. This “assume breach” mindset is outdated and ineffective, contributing to industry fatigue and defender burnout.Cybersecurity buyers are jaded and skeptical. They’ve been burned before and can see that innovation is lacking. <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity?_ga=2.51158817.941771334.1715708232-1517144758.1706129447" target="_self">Basic ML</a>, the type of technology nearly all vendors leverage and promote, cannot keep pace with rapidly evolving AI-powered threats, leaving investments feeling stale almost immediately after purchase.According to Gartner, global IT spending in 2024 is set to grow by 8% to $5.1 trillion, with 80% of CIOs planning to increase cybersecurity budgets to $215 billion – a 14.3% increase from the $188 billion spent in 2023. This surge in spending underscores the pressing need for more effective solutions.Here’s the grim truth: 2023 was the worst year on record for defenders, with ransomware payments hitting an all-time high of over $1.1 billion – and we’re on pace to break that mark this year. Despite spending the most as an industry, by any measure, we had the worst year ever. It’s time to wake up and realize our current methods are not working. The cybersecurity community needs to move away from the traditional reactive approach and turn to one rooted in prevention.<h5>Meet DIANNA, the Industry’s Only Prevention-First AI Cyber Companion</h5>In the lead up to RSAC, <a href="https://www.deepinstinct.com/dianna-ai-cyber-companion" target="_self">Deep Instinct’s Artificial Neural Network Assistant (DIANNA)</a> made its grand debut as the industry’s first DL-based cybersecurity companion to provide explainability into unknown threats. DIANNA is like having a virtual team of malware analysts and incident response experts that provide security teams with deep analysis into known and unknown attacks, explaining the techniques of attackers and behaviors of malicious files. What takes a senior SOC analyst hours using multiple tools, DIANNA does in seconds. Our new offering was also featured in CRN’s list of "<a href="https://www.crn.com/news/ai/2024/10-hot-ai-cybersecurity-tools-at-rsac-2024?page=10" target="_blank">10 Hot AI Cybersecurity Tools At RSAC 2024</a>.”No other technology vendor on the market today can replicate this level of analysis and explainability, further underscoring our prevention-first approach to cybersecurity. Given its uniqueness, DIANNA was the talk of the town at our busy RSAC booth.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltcc1a937c79745430" alt="Fig 2_RSAC_Deep Instinct Booth.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcc1a937c79745430/6645438f16e6bf2bf558f41c/Fig_2_RSAC_Deep_Instinct_Booth.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">The Deep Instinct Team on the floor at RSAC.</figcaption></div></figure>RSAC made it clear – Deep Learning is the answer to the question of how to predict and prevent the next cyber threat, before it becomes a problem. Deep Instinct can help organizations adopt a proactive, prevention-first approach to cybersecurity, leaving the “assume breach” mindset of EDR in the past once and for all.Want to see DIANNA and the Deep Instinct Prevention Platform for yourself? <a href="https://info.deepinstinct.com/request-a-demo" target="_self">Request a demo</a>.

Blog

Recent Blog Posts

Beyond Flesh and Code: Building an LLM-Based Attack Lifecycle With a Self-Guided Malware Agent

Forget PSEXEC: DCOM Upload & Execute Backdoor

Leveraging Deep Learning for Zero-Day Data Security in Cloud Storage

SHIM Me What You Got: Manipulating Shim and Office for Code Injection

"Hacker Summer Camp" Recap: Black Hat, DEF CON, and the Growing AI Arms Race

Would Have, Could Have, Should Have: Dissecting the 2023 MGM Hack

Deep Dive: Exposing Stealthy New BlackSuit Ransomware

Practicing What We Preach: Preventing Threats in SharePoint and OneDrive

RSAC Reflections: AI Takes Center Stage, But Deep Learning Reigns Supreme

Uncorking Old Wine: Zero-Day from 2017 + Cobalt Strike Loader in Unholy Alliance