Blog
‍

Inside the SOC

Walking through the front door: Compromises of Internet-facing systems

Apr 2022

In 2021 Internet-facing systems were some of the most heavily targeted for compromise. This blog explores four of the top zero-day vulnerabilities from the year and highlights how Darktrace was able to detect them.

By virtue of their exposure, Internet-facing systems (i.e., systems which have ports open/exposed to the wider Internet) are particularly susceptible to compromise. Attackers typically compromise Internet-facing systems by exploiting zero-day vulnerabilities in applications they run. During 2021, critical zero-day vulnerabilities in the following applications were publicly disclosed:

Microsoft Exchange
Confluence
GitLab
Log4j-using applications

Internet-facing systems running these applications were consequently heavily targeted by attackers. In this post, we will provide examples of compromises of these systems observed by Darktrace’s SOC team in 2021. As will become clear, successful exploitation of weaknesses in Internet-facing systems inevitably results in such systems doing things which they do not normally do. Rather than focusing on identifying attempts to exploit these weaknesses, Darktrace focuses on identifying the unusual behaviors which inevitably ensue. The purpose of this post is to highlight the effectiveness of this approach.

Exchange server compromise

In January, researchers from the cyber security company DEVCORE reported a series of critical vulnerabilities in Microsoft Exchange which they dubbed ‘ProxyLogon’.^[1] ProxyLogon consists of a server-side request forgery (SSRF) vulnerability (CVE-2021-26855) and a remote code execution (RCE) vulnerability (CVE-2021-27065). Attackers were observed exploiting these vulnerabilities in the wild from as early as January 6.^[2] In April, DEVCORE researchers reported another series of critical vulnerabilities in Microsoft Exchange which they dubbed ‘ProxyShell’.^[3] ProxyShell consists of a pre-authentication path confusion vulnerability (CVE-2021-34473), a privilege elevation vulnerability (CVE-2021-34523), and a post-authentication RCE vulnerability (CVE-2021-31207). Attackers were first observed exploiting these vulnerabilities in the wild in August.^[4] In many cases, attackers exploited the ProxyShell and ProxyLogon vulnerabilities in order to create web shells on the targeted Exchange servers. The presence of these web shells provided attackers with the means to remotely execute commands on the compromised servers.

In early August 2021, by exploiting the ProxyShell vulnerabilities, an attacker gained the rights to remotely execute PowerShell commands on an Internet-facing Exchange server within the network of a US-based transportation company. The attacker subsequently executed a number of PowerShell commands on the server. One of these commands caused the server to make a 28-minute-long SSL connection to a highly unusual external endpoint. Within a couple of hours, the attacker managed to strengthen their foothold within the network by installing AnyDesk and CobaltStrike on several internal devices. In mid-August, the attacker got the devices on which they had installed Cobalt Strike to conduct network reconnaissance and to transfer terabytes of data to the cloud storage service, MEGA. At the end of August, the attacker got the devices on which they had installed AnyDesk to execute Conti ransomware and to spread executable files and script files to further internal devices.

In this example, the attacker’s exploitation of ProxyShell immediately resulted in the Exchange Server making a long SSL connection to an unusual external endpoint. This connection caused the model Device / Long Agent Connection to New Endpoint to breach. The subsequent reconnaissance, lateral movement, C2, external data transfer, and encryption behavior brought about by the attacker were also picked up by Darktrace’s models.

A non-exhaustive list of the models that breached as a result of the behavior brought about by the attacker:

Device / Long Agent Connection to New Endpoint
Device / ICMP Address Scan
Anomalous Connection / SMB Enumeration
Anomalous Server Activity / Outgoing from Server
Compromise / Beacon to Young Endpoint
Anomalous Server Activity / Rare External from Server
Compromise / Fast Beaconing to DGA
Compromise / SSL or HTTP Beacon
Compromise / Sustained SSL or HTTP Increase
Compromise / Beacon for 4 Days
Anomalous Connection / Multiple HTTP POSTs to Rare Hostname
Unusual Activity / Enhanced Unusual External Data Transfer
Anomalous Connection / Data Sent to Rare Domain
Anomalous Connection / Uncommon 1 GiB Outbound
Compliance / SMB Drive Write
Anomalous File / Internal / Additional Extension Appended to SMB File
Anomalous Connection / Suspicious Read Write Ratio
Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB
Anomalous Connection / Sustained MIME Type Conversion
Unusual Activity / Anomalous SMB Move & Write
Unusual Activity / Unusual Internal Data Volume as Client or Server
Device / Suspicious File Writes to Multiple Hidden SMB Shares
Compromise / Ransomware / Suspicious SMB Activity
Anomalous File / Internal / Unusual SMB Script Write
Anomalous File / Internal / Masqueraded Executable SMB Write
Device / SMB Lateral Movement
Device / Multiple Lateral Movement Model Breaches

Confluence server compromise

Atlassian’s Confluence is an application which provides the means for building collaborative, virtual workspaces. In the era of remote working, the value of such an application is undeniable. The public disclosure of a critical remote code execution (RCE) vulnerability (CVE-2021-26084) in Confluence in August 2021 thus provided a prime opportunity for attackers to cause havoc. The vulnerability, which arises from the use of Object-Graph Navigation Language (OGNL) in Confluence’s tag system, provides attackers with the means to remotely execute code on vulnerable Confluence server by sending a crafted HTTP request containing a malicious parameter.^[5] Attackers were first observed exploiting this vulnerability towards the end of August, and in the majority of cases, attackers exploited the vulnerability in order to install crypto-mining tools onto vulnerable servers.^[6]

At the beginning of September 2021, an attacker was observed exploiting CVE-2021-26084 in order to install the crypto-mining tool, XMRig, as well as a shell script, onto an Internet-facing Confluence server within the network of an EMEA-based television and broadcasting company. Within a couple of hours, the attacker installed files associated with the crypto-mining malware, Kinsing, onto the server. The Kinsing-infected server then immediately began to communicate over HTTP with the attacker’s C2 infrastructure. Around the time of this activity, the server was observed using the MinerGate crypto-mining protocol, indicating that the server had begun to mine cryptocurrency.

In this example, the attacker’s exploitation of CVE-2021-26084 immediately resulted in the Confluence server making an HTTP GET request with an unusual user-agent string (one associated with curl in this case) to a rare external IP. This behavior caused the models Device / New User Agent, Anomalous Connection / New User Agent to IP Without Hostname, and Anomalous File / Script from Rare Location to breach. The subsequent file downloads, C2 traffic and crypto-mining activity also resulted in several models breaching.

A non-exhaustive list of the models which breached as a result of the unusual behavior brought about by the attacker:

Device / New User Agent
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / Script from Rare Location
Anomalous File / EXE from Rare External Location
Anomalous File / Internet Facing System File Download
Device / Initial Breach Chain Compromise
Anomalous Connection / Posting HTTP to IP Without Hostname
Compliance / Crypto Currency Mining Activity
Compromise / High Priority Crypto Currency Mining
Device / Internet Facing Device with High Priority Alert

GitLab server compromise

GitLab is an application providing services ranging from project planning to source code management. Back in April 2021, a critical RCE vulnerability (CVE-2021-22205) in GitLab was publicly reported by a cyber security researcher via the bug bounty platform, HackerOne.^[7] The vulnerability, which arises from GitLab’s use of ExifTool for removing metadata from image files, ^[8] enables attackers to remotely execute code on vulnerable GitLab servers by uploading specially crafted image files.^[9] Attackers were first observed exploiting CVE-2021-22205 in the wild in June/July.^[10] A surge in exploitations of the vulnerability was observed at the end of October, with attackers exploiting the flaw in order to assemble botnets.^[11] Darktrace observed a significant number of cases in which attackers exploited the vulnerability in order to install crypto-mining tools onto vulnerable GitLab servers.

On October 29, an attacker successfully exploited CVE-2021-22205 on an Internet-facing GitLab server within the network of a UK-based education provider. The organization was trialing Darktrace when this incident occurred. The attacker installed several executable files and shell scripts onto the server by exploiting the vulnerability. The attacker communicated with the compromised server (using unusual ports) for several days, before making the server transfer large volumes of data externally and download the crypto-mining tool, XMRig, as well as the botnet malware, Mirai. The server was consequently observed making connections to the crypto-mining pool, C3Pool.

In this example, the attacker’s exploitation of the vulnerability in GitLab immediately resulted in the server making an HTTP GET request with an unusual user-agent string (one associated with Wget in this case) to a rare external IP. The models Anomalous Connection / New User Agent to IP Without Hostname and Anomalous File / EXE from Rare External Location breached as a result of this behavior. The attacker’s subsequent activity on the server over the next few days resulted in frequent model breaches.

A non-exhaustive list of the models which breached as a result of the attacker’s activity on the server:

Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / EXE from Rare External Location
Anomalous File / Multiple EXE from Rare External Locations
Anomalous File / Internet Facing Device with High Priority Alert
Anomalous File / Script from Rare Location
Anomalous Connection / Application Protocol on Uncommon Port
Anomalous Connection / Anomalous SSL without SNI to New External
Device / Initial Breach Chain Compromise
Unusual Activity / Unusual External Data to New IPs
Anomalous Server Activity / Outgoing from Server
Device / Large Number of Model Breaches from Critical Network Device
Anomalous Connection / Data Sent to Rare Domain
Compromise / Suspicious File and C2
Unusual Activity / Enhanced Unusual External Data Transfer
Compliance / Crypto Currency Mining Activity
Compliance / High Priority Crypto Currency Mining
Anomalous File / Zip or Gzip from Rare External Location
Compromise / Monero Mining
Device / Internet Facing Device with High Priority Alert
Anomalous Server Activity / Rare External from Server
Compromise / Slow Beaconing Activity To External Rare
Compromise / Beaconing Activity To External Rare
Compromise / HTTP Beaconing to Rare Destination
Compromise / High Volume of Connections with Beacon Score
Anomalous File / Numeric Exe Download

Log4j server compromise

On December 9 2021, a critical RCE vulnerability (dubbed ‘Log4Shell’) in version 2 of Apache’s Log4j was publicly disclosed by researchers at LunaSec.^[12] As a logging library present in potentially millions of Java applications,^[13] Log4j constitutes an obscured, yet ubiquitous feature of the digital world. The vulnerability (CVE-2021-44228), which arises from Log4j’s Java Naming and Directory Interface (JNDI) Lookup feature, enables an attacker to make a vulnerable server download and execute a malicious Java class file. To exploit the vulnerability, all the attacker must do is submit a specially crafted JNDI lookup request to the server. The fact that Log4j is present in so many applications and that the exploitation of this vulnerability is so simple, Log4Shell has been dubbed the ‘most critical vulnerability of the last decade’.^[14] Attackers have been exploiting Log4Shell in the wild since at least December 1.^[15] Since then, attackers have been observed exploiting the vulnerability to install crypto-mining tools, Cobalt Strike, and RATs onto vulnerable servers.^[16]

On December 10, one day after the public disclosure of Log4Shell, an attacker successfully exploited the vulnerability on a vulnerable Internet-facing server within the network of a US-based architecture company. By exploiting the vulnerability, the attacker managed to get the server to download and execute a Java class file named ‘Exploit69ogQNSQYz.class’. Executing the code in this file caused the server to download a shell script file and a file related to the Kinsing crypto-mining malware. The Kinsing-infected server then went on to communicate over HTTP with a C2 server. Since the customer was using the Proactive Threat Notification (PTN) service, they were immediately alerted to this activity, and the server was subsequently quarantined, preventing crypto-mining activity from taking place.

In this example, the attacker’s exploitation of the zero-day vulnerability immediately resulted in the vulnerable server making an HTTP GET request with an unusual user-agent string (one associated with Java in this case) to a rare external IP. The models Anomalous Connection / Callback on Web Facing Device and Anomalous Connection / New User Agent to IP Without Hostname breached as a result of this behavior. The device’s subsequent file downloads and C2 activity caused several Darktrace models to breach.

A non-exhaustive list of the models which breached as a result of the unusual behavior brought about by the attacker:

Anomalous Connection / Callback on Web Facing Device
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / Internet Facing System File Download
Anomalous File / Script from Rare External Location
Device / Initial Breach Chain Compromise
Anomalous Connection / Posting HTTP to IP Without Hostname

Round-up

It is inevitable that attackers will attempt to exploit zero-day vulnerabilities in applications running on Internet-facing devices. Whilst identifying these attempts is useful, the fact that attackers regularly exploit new zero-days makes the task of identifying attempts to exploit them akin to a game of whack-a-mole. Whilst it is uncertain which zero-day vulnerability attackers will exploit next, what is certain is that their exploitation of it will bring about unusual behavior. No matter the vulnerability, whether it be a vulnerability in Microsoft Exchange, Confluence, GitLab, or Log4j, Darktrace will identify the unusual behaviors which inevitably result from its exploitation. By identifying unusual behaviors displayed by Internet-facing devices, Darktrace thus makes it almost impossible for attackers to successfully exploit zero-day vulnerabilities without being detected.

For Darktrace customers who want to find out more about detecting potential compromises of internet-facing devices, refer here for an exclusive supplement to this blog.

Thanks to Andy Lawrence for his contributions.

脚注

1. https://devco.re/blog/2021/08/06/a-new-attack-surface-on-MS-exchange-part-1-ProxyLogon/

2. https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

3. https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell

4. https://www.rapid7.com/blog/post/2021/08/12/proxyshell-more-widespread-exploitation-of-microsoft-exchange-servers/

5. https://www.kaspersky.co.uk/blog/confluence-server-cve-2021-26084/23376/

6. https://www.bleepingcomputer.com/news/security/atlassian-confluence-flaw-actively-exploited-to-install-cryptominers/

7. https://hackerone.com/reports/1154542

8. https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/

9.https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/

10. https://www.rapid7.com/blog/post/2021/11/01/gitlab-unauthenticated-remote-code-execution-cve-2021-22205-exploited-in-the-wild/

11. https://www.hackmageddon.com/2021/12/16/1-15-november-2021-cyber-attacks-timeline/

12. https://www.lunasec.io/docs/blog/log4j-zero-day/

13. https://www.csoonline.com/article/3644472/apache-log4j-vulnerability-actively-exploited-impacting-millions-of-java-based-apps.html

14. https://www.theguardian.com/technology/2021/dec/10/software-flaw-most-critical-vulnerability-log-4-shell

15. https://www.rapid7.com/blog/post/2021/12/15/the-everypersons-guide-to-log4shell-cve-2021-44228/

16. https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/

INSIDE THE SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

AUTHOR

ABOUT ThE AUTHOR

Sam Lister

SOC Analyst

Watch the NIS2 Webinar

この記事を共有

More in this series

該当する項目はありません。

Blog
‍

Inside the SOC

A Thorn in Attackers’ Sides: How Darktrace Uncovered a CACTUS Ransomware Infection

Apr 2024

What is CACTUS Ransomware?

In May 2023, Kroll Cyber Threat Intelligence Analysts identified CACTUS as a new ransomware strain that had been actively targeting large commercial organizations since March 2023 [1]. CACTUS ransomware gets its name from the filename of the ransom note, “cAcTuS.readme.txt”. Encrypted files are appended with the extension “.cts”, followed by a number which varies between attacks, e.g. “.cts1” and “.cts2”.

As the cyber threat landscape adapts to ever-present fast-paced technological change, ransomware affiliates are employing progressively sophisticated techniques to enter networks, evade detection and achieve their nefarious goals.

How does CACTUS Ransomware work?

In the case of CACTUS, threat actors have been seen gaining initial network access by exploiting Virtual Private Network (VPN) services. Once inside the network, they may conduct internal scanning using tools like SoftPerfect Network Scanner, and PowerShell commands to enumerate endpoints, identify user accounts, and ping remote endpoints. Persistence is maintained by the deployment of various remote access methods, including legitimate remote access tools like Splashtop, AnyDesk, and SuperOps RMM in order to evade detection, along with malicious tools like Cobalt Strike and Chisel. Such tools, as well as custom scripts like TotalExec, have been used to disable security software to distribute the ransomware binary. CACTUS ransomware is unique in that it adopts a double-extortion tactic, stealing data from target networks and then encrypting it on compromised systems [2].

At the end of November 2023, cybersecurity firm Arctic Wolf reported instances of CACTUS attacks exploiting vulnerabilities on the Windows version of the business analytics platform Qlik, specifically CVE-2023-41266, CVE-2023-41265, and CVE-2023-48365, to gain initial access to target networks [3]. The vulnerability tracked as CVE-2023-41266 can be exploited to generate anonymous sessions and perform HTTP requests to unauthorized endpoints, whilst CVE-2023-41265 does not require authentication and can be leveraged to elevate privileges and execute HTTP requests on the backend server that hosts the application [2].

Darktrace’s Coverage of CACTUS Ransomware

In November 2023, Darktrace observed malicious actors leveraging the aforementioned method of exploiting Qlik to gain access to the network of a customer in the US, more than a week before the vulnerability was reported by external researchers.

Here, Qlik vulnerabilities were successfully exploited, and a malicious executable (.exe) was detonated on the network, which was followed by network scanning and failed Kerberos login attempts. The attack culminated in the encryption of numerous files with extensions such as “.cts1”, and SMB writes of the ransom note “cAcTuS.readme.txt” to multiple internal devices, all of which was promptly identified by Darktrace DETECT™.

While traditional rules and signature-based detection tools may struggle to identify the malicious use of a legitimate business platform like Qlik, Darktrace’s Self-Learning AI was able to confidently identify anomalous use of the tool in a CACTUS ransomware attack by examining the rarity of the offending device’s surrounding activity and comparing it to the learned behavior of the device and its peers.

Unfortunately for the customer in this case, Darktrace RESPOND™ was not enabled in autonomous response mode during their encounter with CACTUS ransomware meaning that attackers were able to successfully escalate their attack to the point of ransomware detonation and file encryption. Had RESPOND been configured to autonomously act on any unusual activity, Darktrace could have prevented the attack from progressing, stopping the download of any harmful files, or the encryption of legitimate ones.

Cactus Ransomware Attack Overview

Holiday periods have increasingly become one of the favoured times for malicious actors to launch their attacks, as they can take advantage of the festive downtime of organizations and their security teams, and the typically more relaxed mindset of employees during this period [4].

Following this trend, in late November 2023, Darktrace began detecting anomalous connections on the network of a customer in the US, which presented multiple indicators of compromise (IoCs) and tactics, techniques and procedures (TTPs) associated with CACTUS ransomware. The threat actors in this case set their attack in motion by exploiting the Qlik vulnerabilities on one of the customer’s critical servers.

Darktrace observed the server device making beaconing connections to the endpoint “zohoservice[.]net” (IP address: 45.61.147.176) over the course of three days. This endpoint is known to host a malicious payload, namely a .zip file containing the command line connection tool PuttyLink [5].

Darktrace’s Cyber AI Analyst was able to autonomously identify over 1,000 beaconing connections taking place on the customer’s network and group them together, in this case joining the dots in an ongoing ransomware attack. AI Analyst recognized that these repeated connections to highly suspicious locations were indicative of malicious command-and-control (C2) activity.

Figure 1: Cyber AI Analyst Incident Log showing the offending device making over 1,000 connections to the suspicious hostname “zohoservice[.]net” over port 8383, within a specific period.

The infected device was then observed downloading the file “putty.zip” over a HTTP connection using a PowerShell user agent. Despite being labelled as a .zip file, Darktrace’s detection capabilities were able to identify this as a masqueraded PuttyLink executable file. This activity resulted in multiple Darktrace DETECT models being triggered. These models are designed to look for suspicious file downloads from endpoints not usually visited by devices on the network, and files whose types are masqueraded, as well as the anomalous use of PowerShell. This behavior resembled previously observed activity with regards to the exploitation of Qlik Sense as an intrusion technique prior to the deployment of CACTUS ransomware [5].

Figure 2: The downloaded file’s URI highlighting that the file type (.exe) does not match the file's extension (.zip). Information about the observed PowerShell user agent is also featured.

Following the download of the masqueraded file, Darktrace observed the initial infected device engaging in unusual network scanning activity over the SMB, RDP and LDAP protocols. During this activity, the credential, “service_qlik” was observed, further indicating that Qlik was exploited by threat actors attempting to evade detection. Connections to other internal devices were made as part of this scanning activity as the attackers attempted to move laterally across the network.

Figure 3: Numerous failed connections from the affected server to multiple other internal devices over port 445, indicating SMB scanning activity.

The compromised server was then seen initiating multiple sessions over the RDP protocol to another device on the customer’s network, namely an internal DNS server. External researchers had previously observed this technique in CACTUS ransomware attacks where an RDP tunnel was established via Plink [5].

A few days later, on November 24, Darktrace identified over 20,000 failed Kerberos authentication attempts for the username “service_qlik” being made to the internal DNS server, clearly representing a brute-force login attack. There is currently a lack of open-source intelligence (OSINT) material definitively listing Kerberos login failures as part of a CACTUS ransomware attack that exploits the Qlik vulnerabilities. This highlights Darktrace’s ability to identify ongoing threats amongst unusual network activity without relying on existing threat intelligence, emphasizing its advantage over traditional security detection tools.

Figure 4: Kerberos login failures being carried out by the initial infected device. The destination device detected was an internal DNS server.

In the month following these failed Kerberos login attempts, between November 26 and December 22, Darktrace observed multiple internal devices encrypting files within the customer’s environment with the extensions “.cts1” and “.cts7”. Devices were also seen writing ransom notes with the file name “cAcTuS.readme.txt” to two additional internal devices, as well as files likely associated with Qlik, such as “QlikSense.pdf”. This activity detected by Darktrace confirmed the presence of a CACTUS ransomware infection that was spreading across the customer’s network.

Figure 5: The model, 'Ransom or Offensive Words Written to SMB', triggered in response to SMB file writes of the ransom note, ‘cAcTuS.readme.txt’, that was observed on the customer’s network.

Figure 6: CACTUS ransomware extensions, “.cts1” and “.cts7”, being appended to files on the customer’s network.

Following this initial encryption activity, two affected devices were observed attempting to remove evidence of this activity by deleting the encrypted files.

Figure 7: Attackers attempting to remove evidence of their activity by deleting files with appendage “.cts1”.

結論

In the face of this CACTUS ransomware attack, Darktrace’s anomaly-based approach to threat detection enabled it to quickly identify multiple stages of the cyber kill chain occurring in the customer’s environment. These stages ranged from ‘initial access’ by exploiting Qlik vulnerabilities, which Darktrace was able to detect before the method had been reported by external researchers, to ‘actions on objectives’ by encrypting files. Darktrace’s Self-Learning AI was also able to detect a previously unreported stage of the attack: multiple Kerberos brute force login attempts.

If Darktrace’s autonomous response capability, RESPOND, had been active and enabled in autonomous response mode at the time of this attack, it would have been able to take swift mitigative action to shut down such suspicious activity as soon as it was identified by DETECT, effectively containing the ransomware attack at the earliest possible stage.

Learning a network’s ‘normal’ to identify deviations from established patterns of behaviour enables Darktrace’s identify a potential compromise, even one that uses common and often legitimately used administrative tools. This allows Darktrace to stay one step ahead of the increasingly sophisticated TTPs used by ransomware actors.

Credit to Tiana Kelly, Cyber Analyst & Analyst Team Lead, Anna Gilbertson, Cyber Analyst

付録

参考文献

[1] https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection

[2] https://www.bleepingcomputer.com/news/security/cactus-ransomware-exploiting-qlik-sense-flaws-to-breach-networks/

[3] https://explore.avertium.com/resource/new-ransomware-strains-cactus-and-3am

[4] https://www.soitron.com/cyber-attackers-abuse-holidays/

[5] https://arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/

Darktrace DETECT Models

Compromise / Agent Beacon (Long Period)

Anomalous Connection / PowerShell to Rare External

Device / New PowerShell User Agent

Device / Suspicious SMB Scanning Activity

Anomalous File / EXE from Rare External Location

Anomalous Connection / Unusual Internal Remote Desktop

User / Kerberos Password Brute Force

Compromise / Ransomware / Ransom or Offensive Words Written to SMB

Unusual Activity / Anomalous SMB Delete Volume

Anomalous Connection / Multiple Connections to New External TCP Port

Compromise / Slow Beaconing Activity To External Rare

Compromise / SSL Beaconing to Rare Destination

Anomalous Server Activity / Rare External from Server

Compliance / Remote Management Tool On Server

Compromise / Agent Beacon (Long Period)

Compromise / Suspicious File and C2

Device / Internet Facing Device with High Priority Alert

Device / Large Number of Model Breaches

Anomalous File / Masqueraded File Transfer

Anomalous File / Internet facing System File Download

Anomalous Server Activity / Outgoing from Server

Device / Initial Breach Chain Compromise

Compromise / Agent Beacon (Medium Period)

Compromise / Agent Beacon (Long Period)

IoC一覧

IoC - Type - Description‍

zohoservice[.]net: 45.61.147[.]176 - Domain name: IP Address - Hosting payload over HTTP

Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17763.2183 - User agent -PowerShell user agent

.cts1 - File extension - Malicious appendage

.cts7- File extension - Malicious appendage

cAcTuS.readme.txt - Filename -Ransom note

putty.zip – Filename - Initial payload: ZIP containing PuTTY Link

MITRE ATT&CK マッピング

Tactic - Technique - SubTechnique

Web Protocols: COMMAND AND CONTROL - T1071 -T1071.001

Powershell: EXECUTION - T1059 - T1059.001

Exploitation of Remote Services: LATERAL MOVEMENT - T1210 – N/A

Vulnerability Scanning: RECONAISSANCE - T1595 - T1595.002

Network Service Scanning: DISCOVERY - T1046 - N/A

Malware: RESOURCE DEVELOPMENT - T1588 - T1588.001

Drive-by Compromise: INITIAL ACCESS - T1189 - N/A

Remote Desktop Protocol: LATERAL MOVEMENT – 1021 -T1021.001

Brute Force: CREDENTIAL ACCESS T – 1110 - N/A

Data Encrypted for Impact: IMPACT - T1486 - N/A

Data Destruction: IMPACT - T1485 - N/A

File Deletion: DEFENSE EVASION - T1070 - T1070.004

著者について

Tiana Kelly

Deputy Team Lead, London & Cyber Analyst

Blog
‍

該当する項目はありません。

The State of AI in Cybersecurity: How AI will impact the cyber threat landscape in 2024

Apr 2024

About the AI Cybersecurity Report

We surveyed 1,800 CISOs, security leaders, administrators, and practitioners from industries around the globe. Our research was conducted to understand how the adoption of new AI-powered offensive and defensive cybersecurity technologies are being managed by organizations.

This blog is continuing the conversation from our last blog post “The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners” which was an overview of the entire report. This blog will focus on one aspect of the overarching report, the impact of AI on the cyber threat landscape.

To access the full report click here.

Are organizations feeling the impact of AI-powered cyber threats?

Nearly three-quarters (74%) state AI-powered threats are now a significant issue. Almost nine in ten (89%) agree that AI-powered threats will remain a major challenge into the foreseeable future, not just for the next one to two years.

However, only a slight majority (56%) thought AI-powered threats were a separate issue from traditional/non AI-powered threats. This could be the case because there are few, if any, reliable methods to determine whether an attack is AI-powered.

Identifying exactly when and where AI is being applied may not ever be possible. However, it is possible for AI to affect every stage of the attack lifecycle. As such, defenders will likely need to focus on preparing for a world where threats are unique and are coming faster than ever before.

a hypothetical cyber attack augmented by AI at every stage

Are security stakeholders concerned about AI’s impact on cyber threats and risks?

The results from our survey showed that security practitioners are concerned that AI will impact organizations in a variety of ways. There was equal concern associated across the board – from volume and sophistication of malware to internal risks like leakage of proprietary information from employees using generative AI tools.

What this tells us is that defenders need to prepare for a greater volume of sophisticated attacks and balance this with a focus on cyber hygiene to manage internal risks.

One example of a growing internal risks is shadow AI. It takes little effort for employees to adopt publicly-available text-based generative AI systems to increase their productivity. This opens the door to “shadow AI”, which is the use of popular AI tools without organizational approval or oversight. Resulting security risks such as inadvertent exposure of sensitive information or intellectual property are an ever-growing concern.

Are organizations taking strides to reduce risks associated with adoption of AI in their application and computing environment?

71.2% of survey participants say their organization has taken steps specifically to reduce the risk of using AI within its application and computing environment.

16.3% of survey participants claim their organization has not taken these steps.

These findings are good news. Even as enterprises compete to get as much value from AI as they can, as quickly as possible, they’re tempering their eager embrace of new tools with sensible caution.

Still, responses varied across roles. Security analysts, operators, administrators, and incident responders are less likely to have said their organizations had taken AI risk mitigation steps than respondents in other roles. In fact, 79% of executives said steps had been taken, and only 54% of respondents in hands-on roles agreed. It seems that leaders believe their organizations are taking the needed steps, but practitioners are seeing a gap.

Do security professionals feel confident in their preparedness for the next generation of threats?

A majority of respondents (six out of every ten) believe their organizations are inadequately prepared to face the next generation of AI-powered threats.

The survey findings reveal contrasting perceptions of organizational preparedness for cybersecurity threats across different regions and job roles. Security administrators, due to their hands-on experience, express the highest level of skepticism, with 72% feeling their organizations are inadequately prepared. Notably, respondents in mid-sized organizations feel the least prepared, while those in the largest companies feel the most prepared.

Regionally, participants in Asia-Pacific are most likely to believe their organizations are unprepared, while those in Latin America feel the most prepared. This aligns with the observation that Asia-Pacific has been the most impacted region by cybersecurity threats in recent years, according to the IBM X-Force Threat Intelligence Index.

The optimism among Latin American respondents could be attributed to lower threat volumes experienced in the region, but it's cautioned that this could change suddenly (1).

What are biggest barriers to defending against AI-powered threats?

The top-ranked inhibitors center on knowledge and personnel. However, issues are alluded to almost equally across the board including concerns around budget, tool integration, lack of attention to AI-powered threats, and poor cyber hygiene.

The cybersecurity industry is facing a significant shortage of skilled professionals, with a global deficit of approximately 4 million experts (2). As organizations struggle to manage their security tools and alerts, the challenge intensifies with the increasing adoption of AI by attackers. This shift has altered the demands on security teams, requiring practitioners to possess broad and deep knowledge across rapidly evolving solution stacks.

Educating end users about AI-driven defenses becomes paramount as organizations grapple with the shortage of professionals proficient in managing AI-powered security tools. Operationalizing machine learning models for effectiveness and accuracy emerges as a crucial skill set in high demand. However, our survey highlights a concerning lack of understanding among cybersecurity professionals regarding AI-driven threats and the use of AI-driven countermeasures indicating a gap in keeping pace with evolving attacker tactics.

The integration of security solutions remains a notable problem, hindering effective defense strategies. While budget constraints are not a primary inhibitor, organizations must prioritize addressing these challenges to bolster their cybersecurity posture. It's imperative for stakeholders to recognize the importance of investing in skilled professionals and integrated security solutions to mitigate emerging threats effectively.

To access the full report click here.

参考文献

1. IBM, X-Force Threat Intelligence Index 2024, Available at: https://www.ibm.com/downloads/cas/L0GKXDWJ

2. ISC2, Cybersecurity Workforce Study 2023, Available at: https://media.isc2.org/-/media/Project/ISC2/Main/Media/ documents/research/ISC2_Cybersecurity_Workforce_Study_2023.pdf?rev=28b46de71ce24e6ab7705f6e3da8637e

著者について

Our ai. Your data.

Elevate your cyber defenses with Darktrace AI

無償トライアルを開始

Darktrace AI protecting a business from cyber threats.

Check out this article by Darktrace: Walking through the front door: Compromises of Internet-facing systems

Blog
‍

Inside the SOC

Walking through the front door: Compromises of Internet-facing systems

Exchange server compromise

Confluence server compromise

GitLab server compromise

Log4j server compromise

Round-up

脚注

Like this and want more?

More in this series

Blog
‍

Inside the SOC

A Thorn in Attackers’ Sides: How Darktrace Uncovered a CACTUS Ransomware Infection

What is CACTUS Ransomware?

How does CACTUS Ransomware work?

Darktrace’s Coverage of CACTUS Ransomware

Cactus Ransomware Attack Overview

結論

付録

参考文献

Darktrace DETECT Models

IoC一覧

MITRE ATT&CK マッピング

Blog
‍

The State of AI in Cybersecurity: How AI will impact the cyber threat landscape in 2024

About the AI Cybersecurity Report

Are organizations feeling the impact of AI-powered cyber threats?

Are security stakeholders concerned about AI’s impact on cyber threats and risks?

Are organizations taking strides to reduce risks associated with adoption of AI in their application and computing environment?

Do security professionals feel confident in their preparedness for the next generation of threats?

What are biggest barriers to defending against AI-powered threats?

To access the full report click here.

参考文献

Elevate your cyber defenses with Darktrace AI

Additional Products

Blog‍

Inside the SOC

Walking through the front door: Compromises of Internet-facing systems

Exchange server compromise

Confluence server compromise

GitLab server compromise

Log4j server compromise

Round-up

脚注

Like this and want more?

Like this and want more?

More in this series

Blog‍

Inside the SOC

A Thorn in Attackers’ Sides: How Darktrace Uncovered a CACTUS Ransomware Infection

What is CACTUS Ransomware?

How does CACTUS Ransomware work?

Darktrace’s Coverage of CACTUS Ransomware

Cactus Ransomware Attack Overview

結論

付録

参考文献

Darktrace DETECT Models

IoC一覧

MITRE ATT&CK マッピング

Blog‍

The State of AI in Cybersecurity: How AI will impact the cyber threat landscape in 2024

About the AI Cybersecurity Report

Are organizations feeling the impact of AI-powered cyber threats?

Are security stakeholders concerned about AI’s impact on cyber threats and risks?

Are organizations taking strides to reduce risks associated with adoption of AI in their application and computing environment?

Do security professionals feel confident in their preparedness for the next generation of threats?

What are biggest barriers to defending against AI-powered threats?

To access the full report click here.

参考文献

Elevate your cyber defenses with Darktrace AI

Blog
‍

Blog
‍

Blog
‍