Tag Archives: Detect

Catch Threat Actors Using Cobalt Strike

Cobalt Strike is a legitimate, commercial penetration testing tool mostly used by red teams and for security trainings. However, it is widely used as cracked by threat actors for intrusion and lateral movement in their victims’ networks.

Google Cloud has released some open source YARA rules for detecting Cobalt Strike components dating back to 2012. This Yara rules set is including 165 detection signatures to scan more than 300 different Cobalt Strike binaries.

We are releasing to the community a set of open-source YARA Rules and their integration as a VirusTotal Collection to help the community flag and identify Cobalt Strike’s components and its respective versions. Since many threat actors rely on cracked versions of Cobalt Strike to advance their cyberattacks, we hope that by disrupting its use we can help protect organizations, their employees, and their customers around the globe” Google Cloud said in their post.

Cobalt Strike includes several features like discovery, payload creation, MS Office macro creation, website cloning, and so on. Many threat actors in the field have been observed using Cobalt Strike.

A Glimpse into AI and the SOCs of the Future

About twenty years ago, antivirus, IPS and firewall were managed by security teams – mostly organizations had only one information security team, and the most important thing was getting up to date IPS signatures and antivirus database. But, SOCs are growing year by year because of new attack techniques and new security controls to prevent them. Today, an enterprise organization has more than fifty different security technologies to defend against these complex attacks. But, a SOC has two core elements: Security controls and people.

With the increasing number of devices, the logs of all these devices need to be analyzed and interpreted. And the log size that needs to be analyzed has reached enormous amounts. As data grows, human resources must also increase in direct proportion. Meanwhile, one of the biggest problems of the sector is to find trained analysts. We see that many organizations are trying to continue their SOC operations with less personnel than they need. And, these personnel is not only responsible for incident response, but also for red teaming, purple teaming, threat hunting, threat intelligence, and others.

The task of an analyst is not only to examine that log, but also to analyze the logs of other devices with the findings he/she detects after the examination. While the log size increasing day by day, it may take hours in some cases to analyze all these logs for only one incident. Because of these situations, many SOC analysts are experiencing burnout on the job and most of the organizations cannot response to alerts as fast as it should be.

At this very point, AI, the most popular technology of recent years, comes to the aid of SOCs. The use of AI powered autonomous platforms – as an example, Mandiant’s Automated Defense and DarkTrace’s Cyber AI Analyst – have become widespread and looks like it will have a bigger role in future SOCs. These devices can collect logs, analyze, determine and keep analyzing other system’s logs to decide whether the alert is false positive or a real incident. With AI, all these processes are done at machine speed and analysts can get the results in a very short time. So, this provides SOC teams to respond as fast as possible. Additionally, AI makes fewer mistakes than human analysts. In recent years, we saw many cases that although there were logs showing an attack, it was marked as false positive by analysts and closed.

AI is still evolving. As in all other fields, it is obvious that it will add a lot to us in the field of information security in the future. And with this evolving AI, in future SOCs, team member will focus on threat hunting, threat intelligence and red teaming works more. This situation will enable people to do better quality work and to educate themselves.

Parrot is Used to Conduct Malicious Campaigns

Parrot TDS (Traffic Direction System) has infected various web servers hosting more than 16,500 websites, ranging from adult content sites, personal websites, university sites, and local government sites.

The situation discovered by Avast and is currently being used to run a campaign called FakeUpdate that distributes the NetSupport Remote Access Trojan (RAT) via fake browser update notifications.

FakeUpdate Campaign (From Avast’s post)

Parrot TDS acts as a gateway for further malicious campaigns to reach potential victims. Attackers buy TDS services to filter incoming traffic and send it to the final destination serving malicious content.

According to Avast analysts, activity in TDS servers increased in February 2022 by detecting suspicious JavaScript files on compromised web servers.

A detailed technical analysis shared by Avast here.

Verify Your WhatsApp Code

Last week, Meta announced that they developed a web browser add-on – Code Verify – to verify the code being served to browser. As the reason of developing this extension, more and more people are using WhatsApp Web day by day after introduced multi-device capability last year. The company thinks this is another layer of security.

Instead of a mobile application, a web browser application may cause more security concerns. “There are many factors that could weaken the security of a web browser that don’t exist in the mobile app space, such as browser extensions” said in the post that announcing the add-on of Meta.

Developing the extension is a partnership with Meta and Cloudflare to provide independent, third-party, transparent verification of the code.

You can find download links and more information on how it works here.

Will Cyber Attacks Spread from Ukraine to the Whole World?

Russian troops entered Ukraine, the whole world is watching this situation with surprise and sadness. Before the invasion, numerous Ukrainian organizations getting hit with a sophisticated new disk-wiping malware. Mandiant is tracking this threat as ‘NEARMISS’ and ESET is tracking as ‘HermeticWiper’ and they reported that they found traces of the malware in hundreds of systems in Ukraine. According to their statement, ESET observed the first sample around 14h52 UTC on 23th of February. “The PE compilation timestamp of one of the sample is 2021-12-28, suggesting that the attack might have been in preparation for almost two monthsESET explained.

According to researches, malware being deployed against organizations in several industries in Ukraine and designed solely to damage the Master Book Record (MBR) on Windows systems, making them unbootable once compromised. The malware does not contain any propagation functionality and, according to several reports. The attackers used a genuine code-signing certificate issued to a Cyprus-based company called Hermetica Digital Ltd., hence the wiper’s name (MD5: 94bc2ff3969d9775de508e1181318deb).

In January, Microsoft reported another similar malware targeting organizations in Ukraine. This malware was designed to overwrite and destroy the MBR too.

Currently, while the invasion continues, cyber attacks continue too. And most of the world stands against Russia about this attacks. Also the sanctions are increasing against Russia and with these situation, it is easy to understand that other nations will be the target of these cyber attacks. “Russia and its allies will conduct cyber espionage, information operations, and disruptive cyber attacks during this crisis. Though cyber espionage is already a regular facet of global activity, as the situation deteriorates, we are likely to see more aggressive information operations and disruptive cyber attacks within and outside of UkraineMandiant says about that.

All organizations and security teems should be aware of these threat. Events and incidents should be followed closely. We should work together with strong intelligence services that closely monitor threat groups to follow situation closer.

IoCs:

MD5 – 84ba0197920fd3e2b7dfa719fee09d2f

SHA-1 – 912342f1c840a42f6b74132f8a7c4ffe7d40fb77

SHA-256 – 0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da

MD5 – 3f4a16b29f2f0532b7ce3e7656799125

SHA-1 – 61b25d11392172e587d8da3045812a66c3385451

SHA-256 – 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591

Retired Ransomware Developers Release Decryption Keys

Decryption keys for Egregor, Sekhmet and Maze shared by someone claiming to be the developer of all three malware.

The keys were published in BleepingComputer forum. As stated in the forum post, this was a planned leak and is not related to the recent law enforcement against attackers. Again, according to the post, none of their team members will ever return to ransomware attacks and the source code of the malware has been destroyed.

The post was containing a link to download a 7zip file with four archives containing the Maze, Egregor and Sekhmet decryption keys, as well as the source code for the M0yv malware used by the operators. However, because of being malicious, the link removed from post. It may be possible to contact to get them again.

Meanwhile, some experts corrected the decryption keys’ performance.

BotenaGo Malware Source Code Published

AT&T Alien Labs last week announced that the source code of BotenaGo malware has been published in GitHub. BotenaGo was discovered and named in November 2021 by Alien Labs again, and according to the post of Alien Labs, the source code of this malware has been published on 16th of October 2021.

It is noticed that too few AV vendors can detect (3/60) this malware already and now it is more dangerous because with the published source code, it is possible to change code simply and create new variants to bypass the detection.

It is also possible to find a source code analysis and IoCs of the malware in the post with recommended actions suggestions.

CTI does not mean Fraud Detection

Organizations invests more and more to security tools, breach statistics keep increasing. About ten years ago and more, attackers were mostly alone, and were using basic tools, so it was easier to block them. But with the advanced techniques and tools, and the groups that came together to attack, made these attacks more difficult to block. There was no such thing as intelligence on our agenda. Some basic blacklists and virus databases were enough against most of the attackers.

CTI (Cyber Threat Intelligence) has become indispensable nowadays. We need more and more information about attackers day by day to gain advantage in this fight. At the same time, we see that a lot of people confuse threat intelligence with fraud. People seem really confused about what to expect from threat intelligence. In this post, I try to mention the needs and usage for CTI.

IoCs: Of course, IoCs are one of the most important things that we are waiting from a CTI product. We are feeding our tools with IoCs and this is the simplest thing for our security intelligence. It is possible to find open source IoCs on many historical threats on the internet. Our expectation from a CTI product should be that it gives us the latest IOCs on threats. While evaluating a CTI tool, it should be observed how much IOC it gives compared to its competitors. Some CTI vendors are mostly using Open IoCs, so it is important to check this value before paying money. Meanwhile, the accuracy of the IOCs is also an issue that should not be overlooked. There will be no point in pushing so many wrong IoCs into our systems every day, even those false positive IoC will cause us to waste time. And time is the most important value in a battle.

TTPs: According to Pyramid of Pain – we discussed in the related post deeply – TTPs are the most valued information for defenders. Sun Tzu says that “if you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.” Of course this is very meaningful. If you do not know what tools, techniques and tactics your enemies are using, it d be very difficult to win a battle. For a defender, the most valuable information are these TTPs and tools that the enemy is using. From a CTI vendor, this must be one of your most important expectations.

Threat Groups: As mentioned before, attackers now works together, they come together and join forces. And while a group is successful on technique with specific tools and malwares, they rarely change these TTPS and tools. So, it is very important to know who is targeting your geography, country and sector. With these information, organizations get really useful IOCs for themselves, and can design their defense according to these attackers’ TTPs. According to this, maybe tracking the threat groups are also the most important thing for the first two bullets (IoCs and TTPs). You can take random IOCs and install them on your systems, but this is never the same as working with the information of attackers you know who they are.

Vulnerabilities: are critical because attackers use these vulnerabilities to infiltrate. It is vital to be aware of vulnerabilities as quickly as possible after they appear. Meanwhile, the information whether these vulnerabilities are exploitable or not, and their criticality and knowledge of affected systems should also be among the things you expect from CTI. Of course, you need a proactive patch management to use these information in success.

Dark Web Tracking: Every day, a lot of information about companies is offered for sale on the dark web or different attackers and groups come together by communicating here. It is not possible to track all forums and portals in dark web continuously for a security team. One of the expectations from the CTI should be the constant monitoring of the dark web and access to information about threats to the organization.

CTI is not Fraud Detection: Fraud is an important subject to save customers our and users. There are many fraud techniques that fraud teams need to be aware of but CTI is not fraud. As mentioned at the beginning, people seem really confused about what CTI and fraud are. Some CTI vendors provide fraud data to their customer. It is undisputed very valuable. But a CTI product should not be evaluated solely on the fraud information obtained. For a good CTI investment, the above issues should be evaluated.

Cyber Attack to Belgian Defense Ministry

Belgium’s ministry of defense confirmed on Monday it had been hit by a cyber attack.

Log4j vulnerability discovered earlier in December and very popular in recent days. According to the Belgian Defense Ministry officials, hackers exploited Log4j vulnerability in one of their systems. The ministry uncovered the attack last Thursday.

A lot has been written about Log4j in recent days, we will not touch on the details of the vulnerability here but it is important to say that this vulnerability hit a long list of software.

We already know that some hacker groups including state sponsored groups started using this vulnerability. It is a really critical vulnerability and need to patched as soon as possible (today) if not done yet.

Apple Delays CSAM Detection Plans

Before, we posted about Apple’s CSAM detection plans and worries about this process of customers that it could be weaponized against users’ privacy. Apple now temporarily pausing the process because of these worries of the customers.

Apple announced this delay on its Child Safety website as; “Update as of September 3, 2021: Previously we announced plans for features intended to help protect children from predators who use communication tools to recruit and exploit them and to help limit the spread of Child Sexual Abuse Material. Based on feedback from customers, advocacy groups, researchers, and others, we have decided to take additional time over the coming months to collect input and make improvements before releasing these critically important child safety features.

CSAM detection was one of new features that Apple announced in August. Normally, the changes were planned to go live with iOS 15 and macOS Monterey later this year in US. Despite the delay, it seems like the company has not given up on its plan. The date of going live of CSAM detection is not yet known.