Darktrace’s AI recently neutralized an email attack exploiting a sense of urgency that evaded the organization’s gateway security tools.
E メール攻撃の背後にいるサイバー犯罪者達は人間の振る舞いや感情をよく研究しており、今話題 になっている情報や最新ニュースなどをすばやく利用して特定の反応を引き起こそうとします。当然、攻撃者が新型コロナウイルス感染症COVID-19を利用して、ユーザーに Eメールを開かせ、一見無害なリンク をクリックさせようとしていることは驚くに値しません。
最近の E メール攻撃の傾向は、CDC(米国疾病対策センター)を名乗る攻撃者が COVID-19 に 関する緊急情報に見せかけたメールを送るというものです。これは Darktrace が「フィア(fear:恐怖) ウェア」と呼んでいる最近の攻撃の典型例です。フィアウェアとは集団の恐怖と切迫感を利用して、ユ ーザーに悪意ある添付ファイルやリンクをクリックさせるものです。この戦術は共通していますが、実際の 攻撃にはそれぞれ独自の用語やコンテンツが含まれていました。これまで見られた E メールにはいくつ かのパターンがありましたが、用語を新たに定義することで偽陽性を発生させることなく E メールを止め られる具体的で簡単なルールを作成できるような、確実に予測可能なものはありませんでした。
これらの E メールの大部分、特に初期のものは、Mimecast、Proofpoint、Microsoft の ATP な ど、ほとんどの顧客の既存の防御システムを通過し、エンドユーザーの受信箱に直接配信することが 承認されていました。幸いなことに、これらの E メールは Darktrace が受信箱向けに開発した自動 対処テクノロジーである Antigena Email により即座に特定され、処理されました。
ゲートウェイ：現在のアプローチ
ほとんどの組織では Mimecast や Proofpoint 等の Secure Email Gateway(SEG)を採用してい ます。これは E メール送信者と、受信者の E メールプロバイダの間にインラインで設置されます。SEG はほぼ単なるスパム検知エンジンになっています。スパムメールは大量発生すれば簡単に特定できる からです。SEG は「手の届く果実」(たとえば悪意あるものとして簡単に検知可能な E メール)を見つ けることはできますが、攻撃がパーソナライズされたり、過去に見られた攻撃からほんのわずかでも変化 すると検知および対応ができません。
図 1: SEG がインラインに設置される位置
SEG は通常「既知の悪」である IP、ドメイン、ファイルハッシュのリストを使って E メールの脅威レベル を判断しています。そのため新しい IP、ドメイン、ファイルを使用し、悪としてトリアージまたはレポートさ れたことのない新種の攻撃の阻止は本質的にできません。
ゲートウェイテクノロジーにおいて異常検知や機械学習などの高度な検知手法が使用される場合、 これらは E メールが配信された後に実行されるものであり、また類似の E メールが大量にトリガーするこ とが条件となります。ほとんどの場合、最終的にこれらの E メールの一つから要素を取り出し、単にブ ラックリストに登録するだけになります。
SEG がこれらの要因に基づいて判断できない場合、サンドボックスというテクニックが使われることがあ ります。これは E メールに含まれているリンクや添付ファイルをテストするための隔離された環境を作成 する方法です。あるいは、基本的なレベルの異常検知テクニックを適用することもありますが、これらは E メール以外の文脈データが欠けているため不十分です。サンドボックス対策として、最も高度な脅威は、実行する前に一定の期間待機するアクティベーションタイムのような回避テクニックを使っていま す。これが使われると、サンドボックスを行っても無害なファイルが確認され、そのなかに潜んでいる休眠中の攻撃は認識されません。
図 2: このドメインは E メールが Darktrace により処理されるわずか 2 時間前に登録されました。
Darktrace の顧客環境で見られた COVID-19 メールの例では、さまざまなドメインが混在しておりパターン検知を回避しようとしていたように見えます。最初の E メールが来た時点で「既知の悪」ドメインリストにこれらのドメインを定義しておくことは不可能だったでしょう。E メールが受信されたのはドメインが登録されてからわずか 2 時間後だったのです。
図 3: 他の防御システムはこれらの E メールをブロックすることに失敗しましたが、Antigena Email は これらを即座に 100%異常とマークし、配信されないよう保留しました。
Darktrace Email は他のすべての防御システムの後に配置されます。つまりこれらの防御システムが 悪意ある E メールをブロックできなかった、または E メールを配信しても安全と判断した E メールだけを対象とします。上記の COVID-19 の事例では、最初の 5 通の E メールは MS ATP でスパム確信スコア 1 とマークされていました。つまり Microsoft は E メールをスキャンした結果クリーンであると判断 したのです。そのため Microsoft は何のアクションもとりませんでした。
いたちごっこ
サイバー犯罪者は常に流動的で、セキュリティチームを出し抜き現在の防御システムをすり抜けるために素早く行動します。E メールを組織への最も簡単な侵入点と認識している彼らは、既存のツールの 検知能力が不十分であることを逆手にとり、マシンを使って最小限の人手で調査、作成、送信を行 う工場のようなシステムによりパーソナライズされた E メールを大量生産しています。
人々がコンピュータ上で何をするかということと、彼らが送ったり受け取ったりする E メールの間にも明示的な関係が存在します。あるユーザーが Web サイトを訪問し、その直後同じドメインから E メール を受信することは、E メールに信ぴょう性を与えます。Web サイトを訪問し、メーリングリストに登録して数分後に E メールを受信することはよくあることです。対照的に、まったく新しい送信者から、組織 内の誰も訪問したことのないサイトへのリンクが含まれた E メールが送られてきた場合、このリンクはお そらくよくないものであり、ユーザーの受信箱からこの E メールを削除すべきであろうという根拠になります。
エンタープライズ全体の文脈
Darktrace Email はこのデータソース間の関係を受信箱にも拡大し、豊富なビジネス文脈を E メールの判断に活用し、独自の検知能力を提供します。
Darktrace Email の設計は、ツールの配置場所からデータの理解および処理の仕方に至るまで、E メールセキュリティに根本的な変化をもたらすものです。インラインに設置され E メールが最初に通過 するときのみ処理して以降は関与しない SEG とは異なり、Antigena Email は受動的にデータを取り込みます。Antigena Email テクノロジーはドメインのフィンガープリントが登録される、サンドボックスが作成される、または話題となっている有名な攻撃と関連付けられるまで待つ必要はありません。
Antigena Email はインラインに配置されないという特徴を E メールの再評価に利用し、E メールを 1 度のみならず数百万回でも処理し、配信の後々までもアクションを取ることが可能です。よく使われるリンクを含む一見無害な E メールであっても、エンタープライズ内で E メールに起因するイベントが発生したとき、たとえば信頼のおけるサイトに侵入が発生した場合などには、再評価の必要性が高まるかもしれません。Antigena Network はネットワーク上に発生した脅威を緩和するツールですが、 Antigena Email はその原因である E メールに見つかったリンクと関連するリンクを含む E メールを無害化することができます。
図 4: Darktrace Email は E メールツールとは離れて受動的に設置され、新しいデータに応じて絶えず再評価を行い更新されたアクションを発行します。
E メールが最初に到着すると、Darktrace Email は生のメタデータを抽出し、マシンスピードで複数回 処理しますが、その後も新しい証拠に応じて(多くの場合ビジネス内で見られたイベントに基づいて) 数百万回再処理します。システムは現在見ているものを、社内全体の環境でこれまで正常と理解されたものと照らし合わせて確認します。たとえば、ドメインがエンベロープ情報または E メール本文に含 まれるリンクから抽出されると、これをその企業のネットワーク上でのそのドメインの人気度と比較します。
図 5: 上に示されたリンクはエンタープライズに対して100%の未知度と判定されました。
COVID-19 についてのリンクを含む前述の E メールを吟味すると、Darktrace Email ユーザーインター フェイスに表示されるいくつかのデータから、Darktrace がなぜこの Eメールを異常であると考えたのかがわかります。まず、‘From’ アドレスのドメインが未知です。これは E メールだけではなく、ネットワーク データも含めた顧客のデジタル環境全体のデータから得られた追加的文脈情報です。この E メール の KCE、KCD、および RCE はこの送信者があらゆる E メールの中で最初に出現したことを示しています。つまりこの送信者とはこれまで何のやりとりもなく、この E メールアドレスはいずれの E メールの本文にも出現したことはありません。
Cyber AI は「良い」、「悪い」を区別するのではなく、イベントがその環境にとって当然のものかどうかの可能性を識別します。このテクノロジーはデータをひとえに学習した環境内のアクティビティのパターンと比較し、新しい E メールを(自ら評価したスコアとともに)組織の日常の文脈の理解に組み込みます。
「この E メールは自然か?」あるいは「送信者と受信者にこれまで関係があるか?」といった問いによ り、AI は受信した E メールの脅威度を見分け、その結果を以後のモデルに組み込みます。このモデル は、単にその企業が特定の送信者から多くの E メールを受信しているからといって、それらの E メール が環境にとって正常だと見なすようにはなりません。Cyber AI は E メールまたはドメインとの人間のや り取りを比較検討して数学モデリングへの再組み込みを判断することによりそのような仮定を行わず、 社内からこの送信者へ正当な連絡が行われていない限り正常とは見なしません。
受信箱はこれまで、組織への最も簡単な侵入口でした。しかし、Cyber AI がもたらす根本的なアプローチの違いにより、Darktrace Email はゲートウェイツールと比較してはるかに優れた検知能力を実現しています。そのため、E メールゲートウェイを設置している顧客も設置していない顧客も、 Antigena Email により E メール由来の問題が著しく低減されたことを確認しています。敵との終わりのないいたちごっこが続くなかで、Cyber AI で防御態勢を補強したセキュリティチームはついに優勢を取り戻しているのです。
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Dan Fein
VP, Product
Based in New York, Dan joined Darktrace’s technical team in 2015, helping customers quickly achieve a complete and granular understanding of Darktrace’s product suite. Dan has a particular focus on Darktrace/Email, ensuring that it is effectively deployed in complex digital environments, and works closely with the development, marketing, sales, and technical teams. Dan holds a Bachelor’s degree in Computer Science from New York University.
A Thorn in Attackers’ Sides: How Darktrace Uncovered a CACTUS Ransomware Infection
24
Apr 2024
What is CACTUS Ransomware?
In May 2023, Kroll Cyber Threat Intelligence Analysts identified CACTUS as a new ransomware strain that had been actively targeting large commercial organizations since March 2023 [1]. CACTUS ransomware gets its name from the filename of the ransom note, “cAcTuS.readme.txt”. Encrypted files are appended with the extension “.cts”, followed by a number which varies between attacks, e.g. “.cts1” and “.cts2”.
As the cyber threat landscape adapts to ever-present fast-paced technological change, ransomware affiliates are employing progressively sophisticated techniques to enter networks, evade detection and achieve their nefarious goals.
How does CACTUS Ransomware work?
In the case of CACTUS, threat actors have been seen gaining initial network access by exploiting Virtual Private Network (VPN) services. Once inside the network, they may conduct internal scanning using tools like SoftPerfect Network Scanner, and PowerShell commands to enumerate endpoints, identify user accounts, and ping remote endpoints. Persistence is maintained by the deployment of various remote access methods, including legitimate remote access tools like Splashtop, AnyDesk, and SuperOps RMM in order to evade detection, along with malicious tools like Cobalt Strike and Chisel. Such tools, as well as custom scripts like TotalExec, have been used to disable security software to distribute the ransomware binary. CACTUS ransomware is unique in that it adopts a double-extortion tactic, stealing data from target networks and then encrypting it on compromised systems [2].
At the end of November 2023, cybersecurity firm Arctic Wolf reported instances of CACTUS attacks exploiting vulnerabilities on the Windows version of the business analytics platform Qlik, specifically CVE-2023-41266, CVE-2023-41265, and CVE-2023-48365, to gain initial access to target networks [3]. The vulnerability tracked as CVE-2023-41266 can be exploited to generate anonymous sessions and perform HTTP requests to unauthorized endpoints, whilst CVE-2023-41265 does not require authentication and can be leveraged to elevate privileges and execute HTTP requests on the backend server that hosts the application [2].
Darktrace’s Coverage of CACTUS Ransomware
In November 2023, Darktrace observed malicious actors leveraging the aforementioned method of exploiting Qlik to gain access to the network of a customer in the US, more than a week before the vulnerability was reported by external researchers.
Here, Qlik vulnerabilities were successfully exploited, and a malicious executable (.exe) was detonated on the network, which was followed by network scanning and failed Kerberos login attempts. The attack culminated in the encryption of numerous files with extensions such as “.cts1”, and SMB writes of the ransom note “cAcTuS.readme.txt” to multiple internal devices, all of which was promptly identified by Darktrace DETECT™.
While traditional rules and signature-based detection tools may struggle to identify the malicious use of a legitimate business platform like Qlik, Darktrace’s Self-Learning AI was able to confidently identify anomalous use of the tool in a CACTUS ransomware attack by examining the rarity of the offending device’s surrounding activity and comparing it to the learned behavior of the device and its peers.
Unfortunately for the customer in this case, Darktrace RESPOND™ was not enabled in autonomous response mode during their encounter with CACTUS ransomware meaning that attackers were able to successfully escalate their attack to the point of ransomware detonation and file encryption. Had RESPOND been configured to autonomously act on any unusual activity, Darktrace could have prevented the attack from progressing, stopping the download of any harmful files, or the encryption of legitimate ones.
Cactus Ransomware Attack Overview
Holiday periods have increasingly become one of the favoured times for malicious actors to launch their attacks, as they can take advantage of the festive downtime of organizations and their security teams, and the typically more relaxed mindset of employees during this period [4].
Following this trend, in late November 2023, Darktrace began detecting anomalous connections on the network of a customer in the US, which presented multiple indicators of compromise (IoCs) and tactics, techniques and procedures (TTPs) associated with CACTUS ransomware. The threat actors in this case set their attack in motion by exploiting the Qlik vulnerabilities on one of the customer’s critical servers.
Darktrace observed the server device making beaconing connections to the endpoint “zohoservice[.]net” (IP address: 45.61.147.176) over the course of three days. This endpoint is known to host a malicious payload, namely a .zip file containing the command line connection tool PuttyLink [5].
Darktrace’s Cyber AI Analyst was able to autonomously identify over 1,000 beaconing connections taking place on the customer’s network and group them together, in this case joining the dots in an ongoing ransomware attack. AI Analyst recognized that these repeated connections to highly suspicious locations were indicative of malicious command-and-control (C2) activity.
Figure 1: Cyber AI Analyst Incident Log showing the offending device making over 1,000 connections to the suspicious hostname “zohoservice[.]net” over port 8383, within a specific period.
The infected device was then observed downloading the file “putty.zip” over a HTTP connection using a PowerShell user agent. Despite being labelled as a .zip file, Darktrace’s detection capabilities were able to identify this as a masqueraded PuttyLink executable file. This activity resulted in multiple Darktrace DETECT models being triggered. These models are designed to look for suspicious file downloads from endpoints not usually visited by devices on the network, and files whose types are masqueraded, as well as the anomalous use of PowerShell. This behavior resembled previously observed activity with regards to the exploitation of Qlik Sense as an intrusion technique prior to the deployment of CACTUS ransomware [5].
Figure 2: The downloaded file’s URI highlighting that the file type (.exe) does not match the file's extension (.zip). Information about the observed PowerShell user agent is also featured.
Following the download of the masqueraded file, Darktrace observed the initial infected device engaging in unusual network scanning activity over the SMB, RDP and LDAP protocols. During this activity, the credential, “service_qlik” was observed, further indicating that Qlik was exploited by threat actors attempting to evade detection. Connections to other internal devices were made as part of this scanning activity as the attackers attempted to move laterally across the network.
Figure 3: Numerous failed connections from the affected server to multiple other internal devices over port 445, indicating SMB scanning activity.
The compromised server was then seen initiating multiple sessions over the RDP protocol to another device on the customer’s network, namely an internal DNS server. External researchers had previously observed this technique in CACTUS ransomware attacks where an RDP tunnel was established via Plink [5].
A few days later, on November 24, Darktrace identified over 20,000 failed Kerberos authentication attempts for the username “service_qlik” being made to the internal DNS server, clearly representing a brute-force login attack. There is currently a lack of open-source intelligence (OSINT) material definitively listing Kerberos login failures as part of a CACTUS ransomware attack that exploits the Qlik vulnerabilities. This highlights Darktrace’s ability to identify ongoing threats amongst unusual network activity without relying on existing threat intelligence, emphasizing its advantage over traditional security detection tools.
Figure 4: Kerberos login failures being carried out by the initial infected device. The destination device detected was an internal DNS server.
In the month following these failed Kerberos login attempts, between November 26 and December 22, Darktrace observed multiple internal devices encrypting files within the customer’s environment with the extensions “.cts1” and “.cts7”. Devices were also seen writing ransom notes with the file name “cAcTuS.readme.txt” to two additional internal devices, as well as files likely associated with Qlik, such as “QlikSense.pdf”. This activity detected by Darktrace confirmed the presence of a CACTUS ransomware infection that was spreading across the customer’s network.
Figure 5: The model, 'Ransom or Offensive Words Written to SMB', triggered in response to SMB file writes of the ransom note, ‘cAcTuS.readme.txt’, that was observed on the customer’s network.
Figure 6: CACTUS ransomware extensions, “.cts1” and “.cts7”, being appended to files on the customer’s network.
Following this initial encryption activity, two affected devices were observed attempting to remove evidence of this activity by deleting the encrypted files.
Figure 7: Attackers attempting to remove evidence of their activity by deleting files with appendage “.cts1”.
結論
In the face of this CACTUS ransomware attack, Darktrace’s anomaly-based approach to threat detection enabled it to quickly identify multiple stages of the cyber kill chain occurring in the customer’s environment. These stages ranged from ‘initial access’ by exploiting Qlik vulnerabilities, which Darktrace was able to detect before the method had been reported by external researchers, to ‘actions on objectives’ by encrypting files. Darktrace’s Self-Learning AI was also able to detect a previously unreported stage of the attack: multiple Kerberos brute force login attempts.
If Darktrace’s autonomous response capability, RESPOND, had been active and enabled in autonomous response mode at the time of this attack, it would have been able to take swift mitigative action to shut down such suspicious activity as soon as it was identified by DETECT, effectively containing the ransomware attack at the earliest possible stage.
Learning a network’s ‘normal’ to identify deviations from established patterns of behaviour enables Darktrace’s identify a potential compromise, even one that uses common and often legitimately used administrative tools. This allows Darktrace to stay one step ahead of the increasingly sophisticated TTPs used by ransomware actors.
Credit to Tiana Kelly, Cyber Analyst & Analyst Team Lead, Anna Gilbertson, Cyber Analyst
The State of AI in Cybersecurity: How AI will impact the cyber threat landscape in 2024
22
Apr 2024
About the AI Cybersecurity Report
We surveyed 1,800 CISOs, security leaders, administrators, and practitioners from industries around the globe. Our research was conducted to understand how the adoption of new AI-powered offensive and defensive cybersecurity technologies are being managed by organizations.
Are organizations feeling the impact of AI-powered cyber threats?
Nearly three-quarters (74%) state AI-powered threats are now a significant issue. Almost nine in ten (89%) agree that AI-powered threats will remain a major challenge into the foreseeable future, not just for the next one to two years.
However, only a slight majority (56%) thought AI-powered threats were a separate issue from traditional/non AI-powered threats. This could be the case because there are few, if any, reliable methods to determine whether an attack is AI-powered.
Identifying exactly when and where AI is being applied may not ever be possible. However, it is possible for AI to affect every stage of the attack lifecycle. As such, defenders will likely need to focus on preparing for a world where threats are unique and are coming faster than ever before.
Are security stakeholders concerned about AI’s impact on cyber threats and risks?
The results from our survey showed that security practitioners are concerned that AI will impact organizations in a variety of ways. There was equal concern associated across the board – from volume and sophistication of malware to internal risks like leakage of proprietary information from employees using generative AI tools.
What this tells us is that defenders need to prepare for a greater volume of sophisticated attacks and balance this with a focus on cyber hygiene to manage internal risks.
One example of a growing internal risks is shadow AI. It takes little effort for employees to adopt publicly-available text-based generative AI systems to increase their productivity. This opens the door to “shadow AI”, which is the use of popular AI tools without organizational approval or oversight. Resulting security risks such as inadvertent exposure of sensitive information or intellectual property are an ever-growing concern.
Are organizations taking strides to reduce risks associated with adoption of AI in their application and computing environment?
71.2% of survey participants say their organization has taken steps specifically to reduce the risk of using AI within its application and computing environment.
16.3% of survey participants claim their organization has not taken these steps.
These findings are good news. Even as enterprises compete to get as much value from AI as they can, as quickly as possible, they’re tempering their eager embrace of new tools with sensible caution.
Still, responses varied across roles. Security analysts, operators, administrators, and incident responders are less likely to have said their organizations had taken AI risk mitigation steps than respondents in other roles. In fact, 79% of executives said steps had been taken, and only 54% of respondents in hands-on roles agreed. It seems that leaders believe their organizations are taking the needed steps, but practitioners are seeing a gap.
Do security professionals feel confident in their preparedness for the next generation of threats?
A majority of respondents (six out of every ten) believe their organizations are inadequately prepared to face the next generation of AI-powered threats.
The survey findings reveal contrasting perceptions of organizational preparedness for cybersecurity threats across different regions and job roles. Security administrators, due to their hands-on experience, express the highest level of skepticism, with 72% feeling their organizations are inadequately prepared. Notably, respondents in mid-sized organizations feel the least prepared, while those in the largest companies feel the most prepared.
Regionally, participants in Asia-Pacific are most likely to believe their organizations are unprepared, while those in Latin America feel the most prepared. This aligns with the observation that Asia-Pacific has been the most impacted region by cybersecurity threats in recent years, according to the IBM X-Force Threat Intelligence Index.
The optimism among Latin American respondents could be attributed to lower threat volumes experienced in the region, but it's cautioned that this could change suddenly (1).
What are biggest barriers to defending against AI-powered threats?
The top-ranked inhibitors center on knowledge and personnel. However, issues are alluded to almost equally across the board including concerns around budget, tool integration, lack of attention to AI-powered threats, and poor cyber hygiene.
The cybersecurity industry is facing a significant shortage of skilled professionals, with a global deficit of approximately 4 million experts (2). As organizations struggle to manage their security tools and alerts, the challenge intensifies with the increasing adoption of AI by attackers. This shift has altered the demands on security teams, requiring practitioners to possess broad and deep knowledge across rapidly evolving solution stacks.
Educating end users about AI-driven defenses becomes paramount as organizations grapple with the shortage of professionals proficient in managing AI-powered security tools. Operationalizing machine learning models for effectiveness and accuracy emerges as a crucial skill set in high demand. However, our survey highlights a concerning lack of understanding among cybersecurity professionals regarding AI-driven threats and the use of AI-driven countermeasures indicating a gap in keeping pace with evolving attacker tactics.
The integration of security solutions remains a notable problem, hindering effective defense strategies. While budget constraints are not a primary inhibitor, organizations must prioritize addressing these challenges to bolster their cybersecurity posture. It's imperative for stakeholders to recognize the importance of investing in skilled professionals and integrated security solutions to mitigate emerging threats effectively.
1. IBM, X-Force Threat Intelligence Index 2024, Available at: https://www.ibm.com/downloads/cas/L0GKXDWJ
2. ISC2, Cybersecurity Workforce Study 2023, Available at: https://media.isc2.org/-/media/Project/ISC2/Main/Media/ documents/research/ISC2_Cybersecurity_Workforce_Study_2023.pdf?rev=28b46de71ce24e6ab7705f6e3da8637e
![Cyber AI Analyst Incident Log showing the offending device making over 1,000 connections to the suspicious hostname “zohoservice[.]net” over port 8383, within a specific period.](https://assets-global.website-files.com/626ff4d25aca2edf4325ff97/662971c1cf09890fd46729a1_Screenshot%202024-04-24%20at%201.55.10%20PM.png)
