Author: hello@alienvault.com

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

Numerous risks are inherent in the technologies that all organizations use. These risks have especially become apparent with recent ransomware attacks, which have crippled major infrastructure such as the Colonial Pipeline in the Eastern United States¹. This discussion will focus on how GRC, or governance, risk, and compliance can help organizations face and manage the risks that they face.

As GRC is broken down into three components, a discussion of each will illuminate why each is critical for risk management. The first part of GRC is governance. Governance involves ensuring that the IT organization is managed in a way that is consistent with the overall business goals.². The overall business goals are the strategy that an organization puts in place to ensure that they enjoy a competitive advantage. It is necessary to ensure that proper controls are in place that manages risks, and that starts at the governance level, with high-level business strategies³.

From an IT perspective, risk involves IT management ensuring that any organizational activities that they conduct are consistent with the organizational business goals as just stated. This means that the IT departments’ risk management process should be a part of the corporate risk management functionality. When IT departments limit their activities to economic and technical aspects, they fail to be engaged in the organization’s strategy, which fails to fully leverage the strength and potential of the company⁴.

The IT department’s risk strategies, when aligned with the corporate risk management policies, work in concert to make certain that the risks identified by upper management are reflected in risk management and prevention that occurs within the IT department. One way that organizations using GRC ensure that IT remains aligned with the corporate leadership’s risk management policies and objectives is by setting specific measurable objectives that demonstrate the effectiveness of how GRC is applied in the IT context.

The final area of GRC is compliance. While often considered adherence to laws and regulations, compliance can have a true impact on risk as well. As the complexity of compliance with myriads of regulatory requirements increases, the IT department is often involved with aiding the company to meet compliance demands. The complexity of compliance demands (that come with significant penalties for failures) can often only be accomplished with the support of IT, as the IT department establishes systems and processes which can help the organization to remain in compliance. If surveillance systems are not set up and used properly and the organization is found to be out of compliance, this could cause an enormous risk of financial penalties which could be crippling for the organization⁵.

As this brief discussion has outlined, using GRC to manage IT departments is essential for multiple reasons. Firstly, it ensures that the IT department is aligned with the rest of the organization and its’ strategies. Second, IT organizations run using GRC ensure that their risk management activities are aligned with the corporate risk management activities so that risks identified by the leadership are addressed in IT. Finally, using GRC ensures that the IT department does its part to ensure the organization stays in compliance with regulatory demands. This will protect against the risk of costly penalties for compliance failures.

References

1. Ransomware attack forces shutdown of largest fuel pipeline in the U.S. (https://www.cnbc.com/2021/05/08/colonial-pipeline-shuts-pipeline-operations-after-cyberattack.html)
2. What is GRC and why do you need it? (https://www.cio.com/article/230326/what-is-grc-and-why-do-you-need-it.html)
3. Corporate Governance and Risk Management: Lessons (Not) Learnt from the Financial Crisis (https://www.mdpi.com/1911-8074/14/9/419)
4. The impact of enterprise risk management on competitive advantage by moderating role of information technology (https://www.sciencedirect.com/science/article/abs/pii/S0920548918301454)
5. Dialectic Tensions in the Financial Markets: A Longitudinal Study of pre- and Post-Crisis Regulatory Technology (https://journals.sagepub.com/doi/10.1057/s41265-017-0047-5)

The post Managing technology risk appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

While cryptocurrencies have been celebrated for their potential to revolutionize finance, their anonymous nature has also been exploited for illicit activities. From drug dealing and arms trafficking to funding terrorism, black market activities have thrived under the cloak of cryptocurrency’s pseudonymity. According to a report by Chainalysis in 2023, around $21 billion in crypto transactions were linked to illegal activities.

Money laundering, too, has found a home in the crypto space. Overall, between 2017 and 2021, crooks laundered over $33 billion worth of cryptocurrency.

Moreover, tax evasion has surged with crypto’s rise. Crypto traders evading their tax obligations could be costing the Internal Revenue Service upwards of $50 billion annually.

Law enforcement’s response to technological challenges

While the majority of cryptocurrency transactions remain legitimate, these dark sides of cryptocurrency cannot be ignored. Regulatory and law enforcement agencies worldwide have an urgent task ahead: to develop robust mechanisms to combat these illicit uses while supporting the technology’s legitimate growth. We should craft and use Blockchains that are safe and advantageous to everyone except lawbreakers.

There is a long-standing tradition of law enforcement agencies modifying their approaches to chase criminals who exploit the newest technologies for illicit purposes. This adaptability was evident when technologies like fax machines and pagers were invented. Throughout history, the legal system has consistently demonstrated its ability to adapt and grow in order to confront emerging technological challenges.

Even though Blockchain represents a revolutionary development in the finance and tech spheres, it is merely the latest example of how law enforcement must continually innovate and adapt to new technologies. Given this perspective, it is hard to argue that Bitcoin and other coins pose an insurmountable problem for law enforcement.

As Blockchain technology is still young, we have a unique opportunity to enhance law enforcement’s understanding of it and improve its security. Individuals interested in Blockchain should assist law enforcement in understanding and harnessing the potential of this technology.

A practical approach to achieving this is implementing a public-private information-sharing process like the one employed to exchange cybersecurity threat details. These dialogues can establish a mechanism through which the Bitcoin community can contribute their knowledge to help law enforcement overcome challenges encountered during cybercrime investigations.

Challenges for law enforcement in investigating cryptocurrency crimes

Still, certain features of Bitcoin and other popular cryptocurrencies present substantial challenges for law enforcement. Collaborating with distant international counterparts, each with its distinct policies often complicates investigative efforts. Identifying an individual from a Bitcoin address is also not easy. Cryptocurrency exchanges operating in different jurisdictions, the use of mixers and tumblers to obfuscate transactions, and the rapid evolution of technology pose significant hurdles for investigators.

The greatest obstacle in any cybercrime investigation is attributing a specific person to a virtual offense. Prosecutors often attempt to link a particular MAC or IP address, or an email address, to a specific individual. This becomes significantly more challenging when someone utilizes Tor, proxies, or employs privacy coins like Monero.

Another complication arises from the fact that many email providers, as well as cell phone companies, either cannot or do not find it necessary to validate the information their users provide them.

One potential solution to overcome these challenges is to employ data analysis from multiple sources, aiming to isolate and identify the single offender in the crowd.

Advantages of Blockchain for law enforcement

Despite the various challenges it presents, the Blockchain actually offers several advantages to law enforcement. One of the notable benefits is the ability to trace all transactions associated with a particular Bitcoin address, including records dating back to its initial transaction.

Cases like Silk Road, Mt. Gox, and others have showcased the proficiency of law enforcement agencies in tracing transactions on the Blockchain. Carl Force, a DEA agent, faced accusations of pilfering Bitcoins during the Silk Road investigation. During the trial, a chart was presented as evidence, demonstrating how law enforcement successfully tracked the funds across the Blockchain, despite Carl Force’s attempts to divide the transactions among multiple addresses.

Contrary to popular belief, Bitcoin is not as anonymous as many people think. Each Bitcoin address may serve as an account number for an individual. If a person can be linked to a specific address, it becomes possible to access information about all the transactions associated with that person.

If an individual utilizes a crypto wallet to interact with the Blockchain, the wallet organization will associate the address with the individual, similar to how a bank keeps records of its customers and their accounts.

New software tools can identify patterns in Blockchain transactions, such as repeated transactions between specific addresses or sudden large transactions, indicating potential illegal activity and leading to particular people.

The Blockchain operates as a peer-to-peer system, where no single entity has exclusive authority to remove records. It functions as a publicly accessible ledger of data blocks, and it cannot be revised or tampered with. This ability allows law enforcement to track the flow of funds in a manner that was previously impossible.

Law enforcement agencies often face a significant challenge when dealing with phone and Internet companies due to varying regulations regarding the retention of customer data. The process of locating the specific provider that possesses the information needed to trace a high-level cyber-criminal can be time-consuming, spanning multiple providers and even different countries.

Furthermore, there is always a risk that the trail may have gone cold by the time the relevant provider is identified. In contrast, the Blockchain serves as a permanent repository for all data. It retains information indefinitely, ensuring that it is always accessible. This eliminates the need for extensive investigations across multiple providers and offers a streamlined way to obtain the required data.

The Third Party Doctrine states that individuals should not expect confidentiality for data shared with third parties such as ISPs, banks, etc., creating complications for law enforcement. It enables law enforcement to obtain records from ISPs, banks, and cellphone carriers through a subpoena rather than a search warrant. However, Blockchain operates differently in this regard. There are no such complications when it comes to Blockchain. It is straightforward to utilize Blockchain and trace transactions without needing a subpoena. The Blockchain is intentionally designed to be open and accessible to all, eliminating the need for legal procedures to access its data.

When evidence emerges in a foreign country, U.S. law enforcement is required to adhere to the Mutual Legal Assistance Treaty (MLAT) procedure in order to seek assistance from foreign agencies. One significant example highlights the Department of Justice engaging in a legal battle against Microsoft. This case revolved around the question of whether the DOJ possesses the authority to access data stored in a Microsoft data center located in Ireland. Microsoft argued that the DOJ could not employ a search warrant to obtain overseas data and must follow the MLAT procedure instead. However, with Blockchain, such issues do not arise as it allows access from anywhere in the world without the need for MLAT.

Final thoughts

It is an undeniable reality that illegal money transfers will persist. It is impossible to completely eliminate criminals from utilizing Blockchain or the internet as a whole. However, what we can strive for is to develop solutions that make it increasingly challenging for illicit parties to thrive. Law enforcement should concentrate their efforts on the specific areas of the Blockchain where criminal activities frequently emerge. Individuals must collaborate and devise innovative strategies that law enforcement can adopt to combat these challenges effectively.

The post Law enforcement’s battle against Cryptocurrency crime appeared first on Cybersecurity Insiders.

Executive Summary

Killnet is a hacktivist group based in Russia that has been active since at least 2015. The group is known for launching DDoS attacks on a diverse range of industries, including state and local governments, telecommunications, and defense.

Killnet has been linked to several high profile attacks, including distributed denial-of-service (DDoS) attacks against U.S. airports and Elon Musk’s Starlink satellite broadband service.

The motivations behind these attacks vary, but recently, they have primarily targeted those who are the most vocal supporters of Ukraine and its political agenda.

The aim of this threat hunt is to create a virtual attack environment that simulates Killnet’s tactics, techniques, and procedures (TTPs). Subsequently, detections and threat hunt queries will be written to proactively identify the emulated TTPs while compensating for the limitations of traditional IOC historical searches.

The results of the threat hunt will include high-level dashboards, code, and network artifacts generated from the attack range, which will be used to explain how a hypothesis was formed. The outcomes will also contain the pseudo and translated query logic in a format that can be utilized by tools such as Suricata, Snort, Splunk, and Zeek. The query output will then be employed to confirm the initial hypothesis generated.

Network Artifacts

To emulate the attack, cc.py was utilized to generate continuous HEAD requests against an Apache server, refer to Appendix A for further details. Once the attack was launched, the captured log traffic was examined, as shown in Figure 1 and Figure 2. Upon reviewing the HEAD HTTP traffic, it was discovered that the digits between the ranges of 11-12 appeared after “HEAD /?” consistently. This pattern will serve as the basis for our first hypothesis, as outlined in the next section.

Figure 3 also contains the Apache logs that were generated on the server as the attack script kept trying to access different files in the ‘/var/www/html/’ directory. The script reiterates in a brute force type style, until CPU resources are rendered exhausted by sheer traffic volume.

Figure 1 –Wireshark – Dynamically Generated 11-12 Digits

Figure 2 –Wireshark – Forged Referrer & Anonymized IPs

Figure 3 – Splunk – Apache Server Error Logs – Failed File Access Attempts

Detection Guidance

Perl compatible regular expressions can be used to leverage the context derived from the packet capture during threat analysis, as shown in Figure 1. This allows us to write Suricata/Snort rules that will match observed patterns in headers. Detections tend to scale more than hunt queries and can be applied strategically on a per sensor basis. Specifically, the following rule will match any instance when an HTTP HEAD request containing 11-12 digits has been captured by a network sensor on a forward looking basis. This serves as our first hypothesis to identify the usage of DDoS HEAD floods:

alert tcp any any -> any any (msg:”Killnet cc.py DDoS HTTP HEAD Flood”; content:”HEAD”; depth:4; content:” /?”; distance:0; content:” HTTP/1.1|0d0a|Host: “; distance:0; fast_pattern; content:”.”; distance:1; within:3; content:”.”; distance:1; within:3; content:”.”; distance:1; within:3; content:”|0d0a|Referer: https://”; distance:0; content:”|0d0a|Accept-Language: “; distance:0; content:”|0d0a|Accept-Charset: “; distance:0; content:”|0d0a|Connection: Keep-Alive|0d0a0d0a|”; distance:0; pcre:”/^HEADx20/?[0-9]{11,12}x20HTTP/”; sid:10000001;)

Hypothesis #1

Hunting Process

The following is a Splunk hunt query that utilizes the Zeek/Bro dataset to identify “High connections from common source over a short amount of time”. The query breaks the time column (shown in Figure 2) into 1-second chunks. Once an appropriate threshold has been established, the “where count > 10” statement can be adjusted accordingly to search retroactively within the last 7 days from when the activity was first observed. This query serves as our second hypothesis to identify the usage of DDoS HEAD floods:

index=zeek sourcetype=zeek_conn | eval datetime=strftime(ts,”%Y-%m-%d %H:%M:%S”) | bucket span=1s datetime | stats count by datetime, id.orig_h | where count > 10 | rename datetime as “Date & Time” id.orig_h as “Attacker IP”

Hypothesis #2

Appendix A – Adversary Emulation

Cc.py is a Python tool publicly available on the internet that can be used for Layer 7 DDoS attacks. The tool, created by a student in 2020, uses various dynamic characteristics to launch DDoS attacks against web assets. The script automates the process of using open proxy servers to relay attacks while maintaining anonymity, which can render traditional IP-based blocking techniques ineffective.

Figure 4 depicts a Python function called “head” that performs an HTTP HEAD request to a target server. The function takes two arguments: “event” and “proxy type”. These arguments control the flow of the request and specify the type of open proxy to leverage. Additionally, the code concatenates the variables where the forged/randomized headers will be used.

Figure 4 – cc python script

To generate a dynamic list of compromised open proxies that will be used to relay attacks on behalf of the attacker, the following command is utilized:

python3 cc.py –down –f proxy.txt –v 5

Once the list is generated, the following command is used to launch an attack against a server running Apache web server within the attack range. The command specifies the use of the “head” module and sets the duration of the attack to 30 seconds. The “head” module floods the target server with continuous HTTP HEAD requests until it is knocked offline.

python3 cc.py –url http:// -f proxy.txt –m head –v 4 –s 30

Appendix B – IOCs

At OTX pulse was created listing over the 12K+ indicators from this research.

https://otx.alienvault.com/pulse/642dd6df987a88229012d214

References

https://github.com/Leeon123/CC-attack

https://securityresearch.samadkhawaja.com/

The post Threat Hunt: KillNet’s DDoS HEAD Flood Attacks – cc.py appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

In an era where digital technology increasingly underpins food production and distribution, the urgency of cybersecurity in agriculture has heightened. A surge of cyberattacks in recent years, disrupting operations, causing economic losses, and threatening food industry security- all underscore this escalating concern.

In April 2023, hackers targeted irrigation systems and wastewater treatment plants in Israel. The attack was part of an annual “hacktivist” campaign, and it temporarily disabled automated irrigation systems on about a dozen farms in the Jordan Valley. The attack also disrupted wastewater treatment processes at the Galil Sewage Corporation.

In addition, in June 2022, six grain cooperatives in the US were hit by a ransomware attack during the fall harvest, disrupting their seed and fertilizer supplies. Adding to this growing list, a leading US agriculture firm also fell victim to a cyberattack the same year, which affected operations at several of its production facilities.

These incidents highlight the pressing need for improved cybersecurity in the agricultural sector and underscore the challenges and risks this sector faces compared to others.

As outlined in a study, “Various technologies are integrated into one product to perform specific agricultural tasks.” An example provided is that of an irrigation system which “has smart sensors/actuators, communication protocols, software, traditional networking devices, and human interaction.”

The study further elaborates that these complex systems are often outsourced from diverse vendors for many kinds of environments and applications. This complexity “increases the attack surface, and cyber-criminals can exploit vulnerabilities to compromise one or other parts of the agricultural application.”

However, the situation is far from hopeless. By taking decisive action, we can significantly strengthen cybersecurity in the agricultural sector. Here are three strategies that pave the way toward a more secure future for the farming industry:

1. Strengthening password practices

Weak or default passwords are an easily avoidable security risk that can expose vital assets in the agricultural sector to cyber threats. Arguably, even now, people have poor habits when it comes to password security.

As per the findings of a survey conducted by GoodFirms:

• A significant percentage of people – 62.9%, to be exact – update their passwords only when prompted.
• 45.7% of people admitted to using the same password across multiple platforms or applications.
• More than half of the people had shared their passwords with others, such as colleagues, friends, or family members, raising the risk of unauthorized access.
• A surprising 35.7% of respondents reported keeping a physical record of their passwords on paper, sticky notes, or in planners.

These lax password practices have had tangible negative impacts, with 30% of users experiencing security breaches attributable to weak passwords.

Hackers can use various methods, such as brute force attacks or phishing attacks, to guess or obtain weak passwords and access sensitive information or control critical systems.

Therefore, agricultural organizations need to make passwords stronger. Here are some of the critical steps these organizations need to take:

• Encourage using strong, unique passwords (8+ characters, mixed letters, numbers, symbols).
• Implement regular password changes (every three months or upon a suspected breach).
• Enforce multi-factor authentication on all systems.
• Update network passwords regularly to invalidate stolen credentials.
• Use a password keeper/generator app for secure password storage.
• Discourage password sharing or reuse across platforms.
• Avoid using dictionary words, common phrases, or personal info in passwords.
• Deploy a password management tool for efficient password handling.

2. Maintaining updated systems

In the digitally transformed landscape of agriculture, known vulnerabilities linked to outdated software and hardware present significant cybersecurity risks. Cybercriminals often exploit these weaknesses in such systems, compounding the cybersecurity challenges faced by the industry.

The Ponemon Institute, in a comprehensive study, found that 60% of organizations that experienced a breach said it occurred due to a known vulnerability that was left unpatched, even though a patch was available. Further complicating matters, the study reported that 88% of IT teams had to coordinate with other departments when patching vulnerabilities. This coordination added an extra 12 days before a patch could be applied, leaving systems vulnerable for a more extended period.

As we’ve seen from the damaging agricultural infrastructure attacks, neglecting cybersecurity in the context of known vulnerabilities can lead to significant problems. Regular updates and patches are not just good practice—they’re a crucial first line of defense against cyberattacks. In the digitally transforming world of agriculture, this is not merely an option—it’s a necessity.

3. Securing operational technology traffic

Given the scale of the risks associated with known vulnerabilities, it’s clear that agribusinesses face a significant cybersecurity challenge. However, the threats are not confined to these known issues alone. The unknown vulnerabilities, particularly those associated with Operational Technology (OT) systems, present another layer of risk that has recently come into focus.

The growing prevalence of Internet of Things (IoT) devices in contemporary agriculture amplifies these concerns. If not adequately secured, these devices can expand the attack surface, offering potential attackers an open door to critical systems.

Highlighting the severity of such issues, Itay Glick, VP of Products at OPSWAT, brings up the cyberattack on irrigation systems in Israel. He pointed out that weak passwords and outdated OT devices were a significant part of the problem. He noted that “there was a critical vulnerability in a specific device dated back to 2015 (CVE-2015-7905), which could have been exploited by any average hacker.”

The vulnerability Glick referred to underscores the importance of regularly updating OT devices. “If this was the case, this underscores the importance of scanning and validating that OT devices are updated,” he emphasized.

This dual approach – segregating OT traffic and monitoring it – provides a solid defense strategy. Segregation makes it more challenging for attackers to access critical systems, while monitoring allows for early detection of any potential threats. Agribusinesses must heed this advice, as the digital landscape continues to evolve, and the stakes continue to rise.

Conclusion

Cyber threats pose grave risks, with the potential to disrupt operations and cause hefty financial losses. Plus, the enduring harm to brand image and customer trust post-attack can be tough to bounce back from. A thorough assessment of current cybersecurity protocols, identification of potential vulnerabilities, and application of the discussed solutions should be on top of the list. These steps encompass the use of robust and unique passwords, segregation and monitoring of OT traffic, and consistent updating of software and hardware.

In the final analysis, agribusinesses that can integrate these cybersecurity measures into their operations are better positioned to secure their future in the rapidly evolving agricultural landscape.

The post Three ways agribusinesses can protect vital assets from cyberattacks appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

When most people think about social media and cybersecurity, they typically think about hackers taking over Instagram accounts or Facebook Messenger scammers taking private information. It’s for good reason that this is top-of-mind. The Identity Theft Resource Center’s 2022 Consumer Impact Report revealed that social media account takeovers have grown by 1,000% in one year. 

Putting yourself out there on social media platforms opens up your personal information to cyber threats. However, social media can be used for good, rather than evil, when it comes to cybersecurity. Learn how to educate your social media following on everyday cybersecurity risks.

Create Cybersecurity content relevant to your audience

Not every company or content creator posting on social media is in the cybersecurity niche, not to mention any offshoots or umbrella niches like technology. Of course, if you do fall into a tech niche and have an audience that’s interested specifically in cybersecurity, you can certainly post on social media about the topic.

However, virtually any industry could benefit from creating cybersecurity content. When planning quality content for your social pages, identify your content niche and determine what aspects of cybersecurity would be most beneficial and interesting to your audience. You can also capitalize on current trends on social media or in the news when designing an informational content campaign around cybersecurity.

Let’s look at how cybersecurity topics can be approached from a variety of industry angles.

B2B

If you are a shared workspace company, for example, your followers are likely interested in ways to establish network security in a hybrid workplace. Followers of a hiring software company likely want to see how to hire more securely online. If your business caters to other businesses, you can create educational cybersecurity content to help them stay safe while using your services or otherwise doing things related to your product or services.

Healthcare

While creating content aimed at public services is different than B2B audiences, cybersecurity information is especially relevant. In a time when interest in virtual healthcare services is booming, patients and providers alike need to be aware of HIPAA laws. For instance, a social media post about the security risks and ethical concerns of doctors emailing and texting patients is an important and highly relevant topic.

Education

Like many healthcare practices have incorporated virtual visits, many schools have started providing virtual classes. If your business is in the education sphere at all, your followers would likely benefit from engaging content about keeping student information private in online classrooms.

Lifestyle

If your brand is in a lifestyle category, you may not think this has much to do with cybersecurity. However, think about the ways in which your followers engage with your brand. If you sell products on a website, make a social post about how to create a secure login for your site when purchasing to reduce the risk of data theft. Further, you can inform your consumers how you’re taking steps to securely process payments and handle customer information. This will instill trust in your brand.

If you don’t sell tangible products or services in this way, you can still find something to do with cybersecurity that will benefit your audience. People use online services all the time, and not everyone is up to date with the latest ways to catch phishing scams or create safe passwords. If your followers are interested in a certain fashion brand and you are aware of an email scam under that brand’s name, you can post about it on social media to help spread awareness.

Pick the right platform and format

Regardless of your industry, it’s clear that all audiences can benefit from some level of cybersecurity education. Similar to how your content will differ, each creator will also benefit from posting on varying social platforms. Some of the most popular social media sites for sharing informative posts include:

• Twitter: platform for text posts, accompanying images, and links;
• Reddit: site for more nuanced, forum-style discussions;
• Quora: site with question-and-answer-style discussions;
• Instagram: app with primarily image-based with short-form video and live streaming options;
• Facebook: platform affiliated with and similar to Instagram but with longer text posts and groups;
• LinkedIn: professional networking platform with longer text posts and videos;
• YouTube: leader in the long-form video space with the option for Shorts and live streaming;
• Twitch: live streaming platform primarily for gamers;
• Pinterest: image-based sharing platform;
• TikTok: short-form video content platform with live streaming options.

TikTok, in particular, is interested in promoting cybersecurity education, so you may have enhanced luck on the platform. Short-form TikTok videos are brief enough to keep viewers’ attention, but you also have enough options to successfully pack in cybersecurity knowledge. For example, you could make a video using a trending sound about how to spot insider threats, pointing to each tip. The platform shows users the content they will be most interested in, so you are more likely to reach the right audience and spread cybersecurity awareness.

If you already have a social media presence, you likely know which platforms garner you the most engagement currently. Start by testing the performance of cybersecurity education posts on your chosen platforms. Then, analyze the data and adjust accordingly.

Using social media for Cybersecurity awareness

Whatever industry you’re in, your social media following will be able to benefit from cybersecurity education. Data privacy is top-of-mind for most social media users, so cater to their unique needs with your content.

The post Using social media as a tool to share knowledge on day-to-day Cybersecurity risks appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

Cybersecurity is practice of protecting information technology (IT) infrastructure assets such as computers, networks, mobile devices, servers, hardware, software, and data (personal & financial) against attacks, breaches and unauthorised access. Due to bloom of technology, most of all businesses rely on IT services, making cybersecurity a critical part of IT infrastructure in any business.

The role of cybersecurity in financial institutions is very vital as the number and severity of cyber threats continues to rise by each day. With the widespread use of technology and the increasing amount of data being stored and shared electronically, financial institutions must ensure that they have robust cybersecurity measures in place to protect against evolving threats.

Financial institutions face a range of cybersecurity threats, including phishing attacks, malware, ransomware, and denial of service (DDoS) attacks. These threats can result in the theft of sensitive customer data (PII), financial fraud, and reputational damage. Sometimes theft of PII can lead to identity theft too.

Cybersecurity measures are designed to protect the confidentiality, integrity, and availability of data and systems. Confidentiality refers to protection of sensitive information from unauthorised disclosure using measures like encryption, access control etc., to protect sensitive data. Integrity refers to accuracy and completeness of data to ensure data is not manipulated or corrupted using cybersecurity measures like data backups, system monitoring. Availability refers to the ability of authorised users to access the systems and data when needed under any circumstances using measures like disaster recovery plans.

Before we go further and discuss about various threats faced by financial institutions, let’s look at the regulatory requirements and industry standards in financial institutions.

There are mainly two standards which financial institutions must comply with:

PCI-DSS: Payment Card Industry Data Security Standard is a set of security and compliance requirements designed to protect the cardholder data which defines how the financial data (card data) will be processed, stored and transmitted in a safe manner. This standard requires use of encryption, masking, hashing and other secure mechanisms to safeguard the customer data. PCI-DSS is widely accepted globally.

GLBA: Gramm-Leach-Bliley Act, also known as Financial Modernisation Act of 1999 is a federal law in the United states which requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data.

Apart from PCI-DSS, GLBA some countries have their own privacy laws which also requires compliance from financial institutions to operate. Non-adherence to regulatory compliance can sometimes attract penalties to financial institutions.

Top Cybersecurity threats faced by banks are:

• Malware- Malware, or malicious software, is any program or file that is intentionally harmful to a computer, network or server. It is very important to secure customer devices such as computers and mobile devices that are used for digital transactions. Malware on these devices can pose a significant risk to a bank’s cybersecurity when they connect to the network. Confidential data passes through the network and if the user’s device has malware without proper security, it can create a serious danger to the bank’s network.

• Phishing- Phishing means to get confidential, classified data such as credit, debit card details etc. for malicious actions by hiding as a reliable person in electronic interaction. Online banking phishing scams have advanced constantly. They seem real and genuine, but they trick you into providing away your access data.

• Spoofing- Spoofing can be used to gain access to a target’s PII (Personally Identifiable Information), spread malware through infected links or attachments, bypass network access controls, or redistribute traffic to conduct a denial-of-service attack. Spoofing is often the way a bad actor gains access in order to execute a larger cyber-attack such as an advanced persistent threat or a man-in-the-middle attack.

• Unencrypted data- unencrypted data is a significant threat to financial institutions, as hackers can use it immediately if they seize it. Therefore, all data should be encrypted, even if stolen by potential thieves, they would face the challenge of decrypting it.

• Cloud-based cybersecurity theft- There is an increased risk of cloud-based attacks as more software systems and data are stored in the cloud. Attackers have taken advantage of this, leading to a rise in cloud-based attacks.

• Insider theft- An insider threat refers to when someone with authorized access to an organization’s information or systems misuses that access to harm the organization. This can be intentional or unintentional and can come from employees, third-party vendors, contractors, or partners. Insider threats can include data theft, corporate espionage, or data destruction. People are the root cause of insider threats, and it’s important to recognize that anyone with access to proprietary data can pose a threat. 25% of security incidents involve insiders. Many security tools only analyse computer, network, or system data, but it’s crucial to consider the human element in preventing insider threats.

Financial institutions can take several steps to improve their cybersecurity posture and protect against evolving threats. Some best practices for cybersecurity in financial institutions include:

• Regular risk assessments: Financial institutions should conduct regular risk assessments to identify potential vulnerabilities in their systems and networks. Risk assessments should include both technical and non-technical factors such as employee training and physical security.
• Implementing strong access controls: Financial institutions should implement strong access controls to protect against unauthorized access to systems and data. Access controls should include strong passwords, multi-factor authentication, and role-based access controls.
• Awareness programs: Financial institutions should educate employees on cybersecurity best practices and provide regular training to help them recognize and respond to potential threats. Employees should be trained on topics such as phishing, malware, and password security. They can also simulate phishing campaigns to make employees aware.
• Encrypting sensitive data: Financial institutions should encrypt sensitive data such as customer information and financial transactions to protect against unauthorized disclosure.

Financial institutions must manage third-party risks by conducting due diligence on third-party vendors and ensuring that they have robust cybersecurity measures in place. This includes regular monitoring and auditing of third-party vendors to ensure that they are complying with cybersecurity standards and regulations.

Cybersecurity is a critical issue for financial institutions, given the sensitive information and valuable assets they handle. Financial institutions must prioritize cybersecurity measures to protect themselves and their customers from cyber-attacks. The evolving cyber threat landscape and the challenges financial institutions face in implementing effective cybersecurity measures make it crucial for them to stay up-to-date with evolving threats, invest more resources in cybersecurity, prioritize employee training and education, and manage third-party risks.

The post The role of cybersecurity in financial institutions -protecting against evolving threats appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

Small businesses are more vulnerable to cyber-attacks since hackers view them as easy victims to target. While this may seem unlikely, statistics reveal that more than half of these businesses experienced some form of cyber-attack in 2022. It’s also reported that state-sponsored threat actors are diversifying their tactics and shifting their focus toward smaller enterprises.

Cyber-attacks against small-sized businesses do not always make headlines, but they have potentially catastrophic impacts. These attacks can result in significant financial and data loss, sometimes shutting down the business. Therefore, it’s crucial that small businesses make cybersecurity a top priority.

What drives more cybersecurity attacks on small businesses?

Small businesses are on the target list of hackers mainly because they focus less on security. On average, SMBs and small businesses allocate 5%-20% of their total budget to security. Additionally, human mistakes are the root cause of 82% of cyber breaches in organizations. Cybercriminals take advantage of their weak security infrastructure and exploit the behavior of careless employees to launch insider threats and other cyber-attacks successfully.

A report reveals various cyber-attacks that often target small businesses, such as malware, phishing, data breaches, and ransomware attacks. Also, small businesses are vulnerable to malware, brute-force attacks, ransomware, and social attacks and may not survive one incident.

The influx of remote working culture has added new challenges and cybersecurity risks for small businesses. This culture has given rise to a large number of personal devices like mobile phones, laptops, and tablets that can easily access sensitive information. Many employees don’t undergo regular scans of their phones and laptops for potential vulnerabilities.

In addition, few companies can provide access to password management software or VPNs to protect their internet connection and credentials and maintain security on rogue Wi-Fi networks. Statistics also reveal that only 17% of small businesses encrypt their data, which is alarming.

Moreover, small businesses are at a higher risk of being attacked because they have limited resources to respond to cyber-attacks. Unlike large organizations, they don’t have a dedicated IT team with exceptional skills and experience to deal with complex cyber-attacks. They also have a limited budget to spend on effective cyber security measures. Hence they don’t invest in advanced cybersecurity solutions or hire professionals to manage their cybersecurity.

Impacts of a Cybersecurity attack on small businesses

Cyber-attacks on small businesses can result in severe consequences – like financial loss, reputational damage, legal ramifications, and disruptions in operations. Below is a better insight into the effects of a potential cyber-attack on small businesses:

Loss of money

A cyber-attack may cause small businesses to lose billions of dollars. A report predicted that the attacks on small businesses will cost the global economy $10.5 trillion by 2025. Also, the average data breach cost to small businesses increased to $2.98 million in 2021, and these figures will likely increase with time. Sometimes small businesses will need to pay to compensate customers, investigate the attack, or implement additional security measures – all of which add up to more financial costs.

Reputational damage

A possible cyber-attack can also damage the business’s reputation and erodes customers’ trust. Suppose a customer’s, partner’s, or supplier’s sensitive data gets exposed to attackers. In that case, it negatively affects the company’s reputation. This might cause them to lose valuable clients, which can also lead to the unexpected closure of the business. According to the National Cybersecurity Alliance, 60% of small and mid-size companies get shut down within six months of falling victim to a cyber-attack. It might take a lot of time and effort to restore the client trust and restore the organization’s reputation.

Disruptions in operations

Small businesses often face operational disruption after a cyber-attack. They may experience downtime or lose access to critical business data – which leads to lost opportunities and delays in operations. This negatively impacts your business as you fail to meet customer demands.

Legal ramifications

Small organizations are also subject to various industry legal and regulatory regulations like GDPR, HIPAA, and CCPA to maintain data privacy. A cyber-attack resulting in valuable data loss ultimately triggers regulatory penalties. As a result, small businesses may face lawsuits and hefty fines for non-compliance, further adding financial strains. A Small Business Association Office of Advocacy report finds that the cost of lawsuits for small firms ranges from $3,000 to $150,000. Therefore, protecting the clients’ data is better than facing compliance issues.

Actionable Cybersecurity tips for small businesses

With  51% of small businesses having limited cybersecurity measures, adopting preventive measures to protect networks and employees from malicious threat actors is crucial. Some of the best practices that you, as an owner of a small business, can exercise to reduce the attack vector includes:

• Educate employees by providing regular training sessions and conducting awareness programs about cyber-attacks like phishing, malware, or social engineering techniques. Ensure that the employees at all levels understand the risks and learn how to detect and respond to these attacks.
• Create a comprehensive cybersecurity policy outlining the employees’ guidelines, best practices, and responsibilities regarding data protection, password management, incident reporting, and acceptable use of technology.
• With the rise of remote and hybrid working culture, it’s crucial to ensure that all remote workers use online security tools like a virtual private network (VPN). It maintains data safety and privacy and enables the workers to access the company’s resources safely.
• Deploy a regular data backup strategy to prevent data loss due to phishing or ransomware attacks. Store the backups offline or within secure cloud storage to ensure they are not easily accessible by attackers.
• Regularly monitor and assess systems using inexpensive security tools to detect and respond to threats in real-time. Conduct regular security assessments, vulnerability scans, or penetration testing to identify potential vulnerabilities within the system and address them promptly.
• Creating an incident response plan (IRP) helps small businesses prevent cyber-attacks by providing a structured approach to detect, respond, and mitigate security incidents. It outlines roles, procedures, and protocols – enabling effective action to minimize damage, protect data, and restore operations, ultimately strengthening the business’s cybersecurity defenses.

These are some of the effective steps that small businesses and start-ups can take to reduce the likelihood of a data breach or decrease the negative impact when an attack occurs.

Final thoughts

Small businesses face many cybersecurity threats and challenges that can affect their reputation and making it difficult to run their business successfully. The best way to ensure a healthy cybersecurity culture is to deploy a successful security awareness and training program. This assures employees are well aware of the threats and how to respond at the right time. To sum up, by prioritizing cybersecurity and adopting proactive measures, small businesses can safeguard their digital assets and mitigate potential threats in today’s increasingly interconnected world.

The post How can small businesses ensure Cybersecurity? appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

OpenAI’s flagship product, ChatGPT, has dominated the news cycle since its unveiling in November 2022. In only a few months, ChatGPT became the fastest-growing consumer app in internet history, reaching 100 million users as 2023 began.

The generative AI application has revolutionized not only the world of artificial intelligence but is impacting almost every industry. In the world of cybersecurity, new tools and technologies are typically adopted quickly; unfortunately, in many cases, bad actors are the earliest to adopt and adapt.

This can be bad news for your business, as it escalates the degree of difficulty in managing threats. 

Using ChatGPT’s large language model, anyone can easily generate malicious code or craft convincing phishing emails, all without any technical expertise or coding knowledge. While cybersecurity teams can leverage ChatGPT defensively, the lower barrier to entry for launching a cyberattack has both complicated and escalated the threat landscape.

Understanding the role of ChatGPT in modern ransomware attacks

We’ve written about ransomware many times, but it’s crucial to reiterate that the cost to individuals, businesses, and institutions can be massive, both financially and in terms of data loss or reputational damage.

With AI, cybercriminals have a potent tool at their disposal, enabling more precise, adaptable, and stealthy attacks. They’re using machine learning algorithms to simulate trusted entities, create convincing phishing emails, and even evade detection.

The problem isn’t just the sophistication of the attacks, but their sheer volume. With AI, hackers can launch attacks on an unprecedented scale, exponentially expanding the breadth of potential victims. Today, hackers use AI to power their ransomware attacks, making them more precise, adaptable, and destructive.

Cybercriminals can leverage AI for ransomware in many ways, but perhaps the easiest is more in line with how many ChatGPT users are using it: writing and creating content. For hackers, especially foreign ransomware gangs, AI can be used to craft sophisticated phishing emails that are much more difficult to detect than the poorly-worded message that was once so common with bad actors (and their equally bad grammar). Even more concerning, ChatGPT-fueled ransomware can mimic the style and tone of a trusted individual or company, tricking the recipient into clicking a malicious link or downloading an infected attachment.

This is where the danger lies. Imagine your organization has the best cybersecurity awareness program, and all your employees have gained expertise in deciphering which emails are legitimate and which can be dangerous. Today, if the email can mimic tone and appear 100% genuine, how are the employees going to know? It’s almost down to a coin flip in terms of odds.

Furthermore, AI-driven ransomware can study the behavior of the security software on a system, identify patterns, and then either modify itself or choose the right moment to strike to avoid detection.

Trends and patterns in ChatGPT-themed cybercrimes

While the vast majority of people use ChatGPT for benign or beneficial purposes, the notable uptick in ChatGPT-themed suspicious activities is cause for concern. These threats include the creation of malicious code, phishing schemes, and of course ransomware — often exploiting the advanced capabilities of ChatGPT to enhance their effectiveness.

The majority of patterns and trends in these activities are not ransomware-related; however, they provide invaluable insights for security experts to proactively respond to these challenges.

Creation of malware using ChatGPT

A self-proclaimed novice reportedly created a powerful data-mining malware using just ChatGPT prompts within a few hours.

ChatGPT imposters

Malware operators and spammers read the news, too, and are following trends and high-engagement topics, leading to an increase in malicious ChatGPT imposters.

Malware campaigns using ChatGPT

ChatGPT is everywhere. Meta took steps to take down more than 1,000 malicious URLs that were found to leverage ChatGPT.

Cybercriminals using ChatGPT

ChatGPT cybercrime is popular with hackers. A thread named “ChatGPT – Benefits of Malware” appeared on a popular underground hacking forum, indicating that cybercriminals are starting to use ChatGPT.

ChatGPT-themed lures

Watch out: hackers are using ChatGPT-themed malware to take over online accounts.

ChatGPT phishing attacks

Finally, these phishing attacks are the most concerning for organizations defending against ransomware. The ChatGPT “Banker” phishing attack involves fake webpages and a trojan virus.

Copycat Chatbots and their threat to Cybersecurity

The success and visibility of OpenAI’s ChatGPT inevitably leads to another cybersecurity concern — the rise of copycat chatbots. These are AI models developed by other groups or individuals seeking to mimic the functionalities and capabilities of ChatGPT, often with less stringent ethical guidelines and fewer protective measures.

There are two key issues that arise from these imitation chatbots. First, they often lack the advanced protective guardrails that have been incorporated into ChatGPT, leaving them more open to misuse. These bots could easily become tools for generating malicious code, crafting phishing emails, or designing ransomware attacks.

Next, these copycat chatbots are frequently hosted on less secure platforms, which may be susceptible to cyber-attacks. Hackers could potentially compromise these platforms to gain control of the chatbots and manipulate their capabilities for nefarious purposes.

Copycat chatbots present the risk of amplifying misinformation and fostering cybercrime. As they lack the same level of scrutiny and oversight as ChatGPT, they could be used to disseminate deceptive content on a large scale.

Proactive measures you can take to combat AI-enhanced ransomware threats

Despite the escalating threat, the outlook is not hopeless.

As always, good security hygiene can go a long way in bolstering your defenses. The advice hasn’t changed, but it bears repeating.

Regular updates and patches: Ensure that all your software, including your operating system and applications, are up to date.

Avoid suspicious emails/links: Be wary of emails from unknown sources and don’t click on suspicious links. Remember, AI can be used to mimic trusted contacts.

Back up your data: Regularly backing up data is a simple yet effective way of mitigating the potential damage of a ransomware attack. The more data you have backed up, the easier it is to recover from a potential disaster.

Promote a culture of security awareness: Learn about the latest threats and techniques used by hackers. The better your company and all employees understand these tactics, the easier it will be to recognize and avoid potential threats.

If you do fall victim to a ransomware attack, don’t panic. Disconnect from the internet, report the incident to local authorities, and consider seeking professional help to mitigate the damage. In most cases, paying the ransomware is not recommended.

While AI can pose a threat when in the hands of hackers, it can also be a potent ally in your defense. AI-driven cybersecurity solutions are becoming more prevalent and can help you combat these advanced threats. These solutions use machine learning to recognize patterns, anticipate threats, and respond in real-time. By adopting AI-based security tools, you’re not just reacting to cyber threats, but proactively defending against them.

How AT&T Cybersecurity can help defend against ransomware

If your company lacks cybersecurity expertise, you may consider hiring trusted and experienced consultants to help you out. Take control by proactively making your company a place that cybercriminals do not want to visit.

With AT&T Cybersecurity incident response service, you’ll be well-positioned to:

• Prevent data breaches
• Quickly respond to attacks and mitigate impact
• Minimize impacts of a potential breach
• Quickly analyze and recover from the breach
• Mitigate security risk
• Improve incident response
• Leverage an “all hands on deck” approach, which includes in-depth digital forensic analysis, breach, support and compromise detection

The post Rise of AI in Cybercrime: How ChatGPT is revolutionizing ransomware attacks and what your business can do appeared first on Cybersecurity Insiders.

In today’s fast-paced digital landscape, businesses proactively seek innovative ways to optimize their networks, enhance operational efficiency, and reduce costs. Network Functions Virtualization (NFV) emerges as a transformative technology that leads the charge.

NFV revolutionizes traditional, hardware-based network functions by converting them into flexible, software-based solutions. Virtual Network Functions (VNFs) can be deployed on commodity servers, cloud infrastructure, or even in data centers, freeing businesses from the constraints of specialized, proprietary hardware.

NFV simplifies network operations and significantly reduces hardware costs by allowing network functions, such as firewalls, load balancers, and routers, to run on general-purpose servers. This leads to substantial savings in both capital expenditure (CAPEX) and operational expenditure (OPEX).

Furthermore, NFV equips businesses with the agility and flexibility necessary to adapt quickly to changing network demands. Unlike traditional hardware-based network functions, which are static and require manual configuration, VNFs can be rapidly deployed, scaled, or modified to accommodate fluctuating network requirements. This provides a level of scalability and agility that was previously unattainable.

NFV also streamlines network management and automation. With NFV Management and Orchestration (MANO) systems, businesses can centrally manage and orchestrate VNFs, reducing the complexity and manual effort associated with network administration. This simplifies the deployment and management of network services, improves efficiency, and minimizes the risk of errors.

Moreover, NFV contributes to more sustainable and environmentally friendly operations by reducing energy consumption. By consolidating multiple network functions onto shared infrastructure, NFV lowers energy usage and cooling requirements.

The NFV architecture, standardized by the European Telecommunications Standards Institute (ETSI), provides a blueprint for implementing and deploying NFV solutions. It comprises three main components:

• Virtual Network Functions (VNFs): Software implementations of network functions deployable on Network Function Virtualization Infrastructure (NFVI). Each VNF runs on generic server hardware and interconnects with other VNFs to create extensive networking communication services.
• NFV Infrastructure (NFVI): The environment hosting the VNFs. It includes the hardware resources and the software layers that abstract, pool, and manage the physical resources.
• NFV Management and Orchestration (MANO): The framework orchestrating and managing physical and/or virtual resources that support the VNFs. The MANO layer consists of the NFV Orchestrator, VNF Manager, and Virtualized Infrastructure Manager (VIM).

This architecture decouples network functions from proprietary hardware appliance which is how NFV enhances network flexibility, scalability, and service deployment speed, while cutting costs and energy consumption.

NFV not only brings cost savings and efficiency but also fosters innovation. The ability to quickly and easily deploy new network functions enables businesses to experiment with new services and features, accelerating innovation and enhancing competitiveness.

NFV represents a paradigm shift in networking. By transforming rigid, hardware-based network functions into flexible, software-based solutions, NFV equips businesses with the agility, cost-efficiency, and innovation potential necessary to thrive in the digital age. Embracing NFV is a strategic move for businesses looking to future-proof their networks and maintain a competitive edge in the digital era. Don’t let your current network setup hold you back; explore the possibilities NFV offers with AT&T Cybersecurity and transform your network infrastructure today.

The post What is NFV appeared first on Cybersecurity Insiders.

This blog was jointly written with Alejandro Prada and Ofer Caspi.

Executive summary

SeroXen is a new Remote Access Trojan (RAT) that showed up in late 2022 and is becoming more popular in 2023. Advertised as a legitimate tool that gives access to your computers undetected, it is being sold for only $30 for a monthly license or $60 for a lifetime bundle, making it accessible.

Key takeaways:

• SeroXen is a fileless RAT, performing well at evading detections on static and dynamic analysis.
• The malware combines several open-source projects to improve its capabilities. It is a combination of Quasar RAT, r77-rootkit and the command line NirCmd.
• Hundreds of samples have shown up since its creation, being most popular in the gaming community. It is only a matter of time before it is used to target companies instead of individual users.

Analysis

Quasar RAT is a legitimate open-source remote administration tool. It is offered on github page to provide user support or employee monitoring. It has been historically associated with malicious activity performed by threat actors, APT groups (like in this Mandiant report from 2017), or government attacks (in this report by Unit42 in 2017).

It was first released in July 2014 as “xRAT” and renamed to “Quasar” in August 2015. Since then, there have been released updates to the code until v1.4.1 in March 2023, which is the most current version. As an open-source RAT tool with updates 9 years after its creation, it is no surprise that it continues to be a common tool used by itself or combined with other payloads by threat actors up to this day.

In a review of the most recent samples, a new Quasar variant was observed by Alien Labs in the wild: SeroXen. This new RAT is a modified branch of the open-source version, adding some modifications features to the original RAT. They’re selling it for monthly or lifetime fee. Figure 1 contains some of the features advertised on their website.

Figure 1. SeroXen features announced on its website.

This new RAT first showed up on a Twitter account, established in September 2022. The person advertising the RAT appeared to be an English-speaking teenager. The same Twitter handle published a review of the RAT on YouTube. The video approached the review from an attacking/Red Team point of view, encouraging people to buy the tool because it is worth the money. They were claiming to be a reseller of the tool.

In December 2022, a specific domain was registered to market/sell the tool, seroxen[.]com. The RAT was distributed via a monthly license for $30 USD or a lifetime license of $60 USD. It was around that time that the malware was first observed in the wild, appearing with 0 detections on VirusTotal.

After a few months, on the 1st of February, the YouTuber CyberSec Zaado published a video alerting the community about the capabilities of the RAT from a defensive perspective. In late February, the RAT was advertised on social media platforms such as TikTok, Twitter, YouTube, and several cracking forums, including hackforums. There were some conversations on gaming forums complaining about being infected by malware after downloading some video games. The artifacts described by the users matched with SeroXen RAT.

The threat actor updated the domain name to seroxen[.]net by the end of March. This domain name was registered on March 27th, 2023, after seroxen[.]com was decommissioned. The threat actor used GoDaddy for registration and Cloudflare for hosting the website. These domains are only used for selling and marketing purposes, and not for Command and Control (C&C) communications.

Figure 2: SeroXen website

Based on the packed versions uploaded to VT, it appears that the RAT is being used for targeting video game users. Several lure injector cheat files have been observed with names invoking popular videogames such as Fortnite, Valorant, Roblox or Warzone2. The threat actor used Discord for the distribution of some of the samples.

Figure 3. SeroXen timeline.

One of the most relevant announced features is that it is a fully undetectable version. This is currently true from a static analysis point of view, since the RAT is packaged into an obfuscated PowerShell batch file. The file’s size typically ranges between 12-14 megabytes, as we can see in sample 8ace121fae472cc7ce896c91a3f1743d5ccc8a389bc3152578c4782171c69e87 uploaded to VT on May 21. Due to its relatively large size, certain antivirus may choose not to analyze it, potentially bypassing detection. This sample currently has 0 detections on VT, but some of the crowdsourced Sigma Rules do detect the activity as suspicious.

As the malware is fileless and executed only in memory after going through several decryptions and decompression routines, it is more difficult to detect by antiviruses. In addition, its rootkit loads a fresh copy of ntdll.dll, which makes it harder to detect by Endpoint Detection & Response (EDR) solutions that hook into it to detect process injections.

Regarding the dynamic analysis, it is worth noting that some sandbox environments might fail to detect the RAT due to its utilization of several techniques to evade virtualization and sandbox detection mechanisms and string encryption subsequent payloads.

The RAT employs anti-debugging techniques by leveraging Windows Management Instrumentation (WMI) to identify the system’s manufacturer. This enables it to identify virtualization environments such as VMware and abort the execution to delay and make the analysis harder. The RAT also checks for the presence of debuggers and uses pings make the threads sleep.

Currently, most child processes and files dropped during the execution of the RAT have a low detection rate.

Execution analysis

When the malicious payload is delivered to the victim, commonly through a phishing mail or a Discord channel – the victim often receives a ZIP file containing a benign file in plain sight, and the heavily obfuscated batch file is hidden and automatically executed when launched. The bat file format is always very similar and looks like the contents of Figure 4, followed by base64 encoded text later in the file.

Figure 4. Obfuscated bat script.

During the bat execution, the script extracts two separate binaries from the base64 encoded text, AES decrypts, and GZIP decompresses it to produce two separate byte arrays. These byte arrays are then used with .NET reflection to perform an in-memory load of the assembly from its bytes, locate the binary’s entry point, and perform an Invoke on both.

Throughout the decryption process, the attackers had the need to create a legitimate looking folder to drop an illicit version of the System Configuration Utility msconfig.exe that is required later. For this purpose, the script creates the folder “C:Windows System32”, with a space after Windows and deletes it as soon as the utility is running. If it wasn’t for this file temporarily dropped into disk, the RAT would be fully fileless.

The execution of one of the above-mentioned binaries leads to another obfuscated binary carrying an embedded resource. This resource is hidden behind anti-sandboxing and debugger techniques, only to lead to more obfuscation and encryption techniques that lead to the final payload. This payload has been built using the Github project Costura, which allows SeroXen to pack the code’s dependencies into the .NET assembly so it can run self-contained.

Figure 5. Payload embedded resources.

The extraction of the resources leads to the final payloads. This is in the form of two .NET assemblies: CSStub2.InstallStager.exe, and CSStub2.UninstallStager.exe. And a Win32 binary called CSStub2.$sxr-nircmd.exe, which corresponds to the unmodified command-line utility NirCmd.

The payload InstallStager.exe is a compilation of the open-source rootkit named r77-rootkit – a fileless ring 3 rootkit written in .NET. This rootkit supports both x32 and x64 Windows processes and has the following features:

• Fileless persistence: The rootkit is stored as obfuscated data in the registry and is spawned with PowerShell via Task Scheduler to be injected into the winlogon.exe process.
• Child process hooking.
• Option to embed additional malware to be executed with the rootkit – in this case NirCmd and/or Quasar. The added malware will be decompressed and decrypted before it is injected into other processes.
• In memory process injection: the rootkit injects itself and additional malware(s) into all processes. Injection is done from memory: no files are needed to be stored on disk.
• Hooking: Hooks several functions from ntdll.dll to hide its presence.
• Communicating via NamedPipe: The rootkit can receive a command from any running process.
• Antivirus / EDR evasion: The rootkit uses several evasion techniques:
  • AMSI bypass: PowerShell inline script patches “amsi.dll!AmsiScanBuffer” to always return “AMSI_RESULT_CLEAN”.
  • DLL unhooking: Removes EDR hooks by loading a fresh copy of “ntdll.dll” from disk to avoid process hollowing detection
• Hiding entities: Hiding all entities starts with a configurable prefix, which in SeroXen’s case its “$sxr”. This prefix hardens the visualization of the attack on the system, but eases attribution of the malware family during the analysis. The prefix is used to hide files, directories, NamedPipes, scheduled tasks, processes, registry keys/values, and services.

R77 technical documentation provides a guideline of where can the prefix be found:

Config parameter	Details	Example
HIDE_PREFIX	The prefix for name-based hiding (e.g. processes, files, etc…).	L”$sxr”
R77_SERVICE_NAME32	Name for the scheduled task that starts the r77 service for 32-bit processes.	HIDE_PREFIX L”svc32″
R77_SERVICE_NAME64	Name for the scheduled task that starts the r77 service for 64-bit processes.	HIDE_PREFIX L”svc64″
CHILD_PROCESS_PIPE_NAME32	Name for the named pipe that notifies the 32-bit r77 service about new child processes.	L”.pipe” HIDE_PREFIX L”childproc32″
CHILD_PROCESS_PIPE_NAME64	Name for the named pipe that notifies the 64-bit r77 service about new child processes.	L”.pipe” HIDE_PREFIX L”childproc64″
CONTROL_PIPE_NAME	Name for the named pipe that receives commands from external processes.	L”.pipe” HIDE_PREFIX L”control”

 

The two main components in this project are the InstallStager service and the Rootkit. The InstallStager service is responsible for:

• Creating a registry key to store the malware code and writes it as encrypted data.
• Creating a scheduled task to execute the malware using PowerShell. PowerShell will decompress and decrypt the final payload (Service) that will be injected into the winlogon.exe process and executed via dllhost.exe using process hollowing techniques.

Figure 6. Starting payload after decryption using process hollowing.

Now the second and main stage of the Rootkit is ready to start. The service kicks off the load of the rootkit’s DLL that is embedded as a resource and saves its configuration as a registry key. (In SeroXen case it’s [HKEY_LOCAL_MACHINESOFTWARE$sxrconfig]).

The service creates 3 listener threads:

• NewProcessListener: Enumerates all running processes and injects the rootkit when new processes are created.
• ChildProcessListener: Injects the rootkit to a newly created process by another process and updates the callee via NamedPipe.

Figure 7. Child process injection.

• ControlPipeListener: Creates a NamedPipe to receive commands from any process. Supported commands are listed below:

Command	Details
CONTROL_R77_UNINSTALL	The control code that uninstalls r77.
CONTROL_R77_PAUSE_INJECTION	The control code that temporarily pauses injection of new processes.
CONTROL_R77_RESUME_INJECTION	The control code that resumes injection of new processes.
CONTROL_PROCESSES_INJECT	The control code that injects r77 into a specific process, if it is not yet injected.
CONTROL_PROCESSES_INJECT_ALL	The control code that injects r77 into all processes that are not yet injected.
CONTROL_PROCESSES_DETACH	The control code detaches r77 from a specific process.
CONTROL_PROCESSES_DETACH_ALL	The control code detaches r77 from all processes.
CONTROL_USER_SHELLEXEC	The control code that executes a file using ShellExecute.
CONTROL_USER_RUNPE	The control code that executes an executable using process hollowing.
CONTROL_SYSTEM_BSOD	The control code that triggers a BSOD.
CONTROL_R77_TERMINATE_SERVICE	The control code that terminates the r77 service.

 

The DLL rootkit carries out process injections, executes commands received by other processes, and keeps out of sight any sign of SeroXen being executed within the system.

Figure 8. System function hooking.

As a summary of the execution process:

Figure 9. SeroXen decryption flow.

Since Seroxen is based on QuasarRAT, the C&C server utilizes the same Common Name in their TLS certificate. The functionalities offered by the threat actor for the C&C server closely mirror those found in the Quasar Github repository, including support for TCP network streams (both IPv4 and IPv6), efficient network serialization, compression using QuickLZ, and secure communication through TLS encryption.

Figure 10. Quasar Server Certificate.

 

Conclusion

The SeroXen developer has found a formidable combination of free resources to develop a hard to detect in static and dynamic analysis RAT. The use of an elaborated open-source RAT like Quasar, with almost a decade since its first appearance, makes an advantageous foundation for the RAT. While the combination of NirCMD and r77-rootkit are logical additions to the mix, since they make the tool more elusive and harder to detect.

The Alien Labs team will continue to monitor the threat landscape for SeroXen samples and infrastructure.

Detection methods

The following associated detection methods are in use by Alien Labs. They can be used by readers to tune or deploy detections in their own environments or for aiding additional research.

SURICATA IDS SIGNATURES

2035595: ET TROJAN Generic AsyncRAT Style SSL Cert

2027619: ET TROJAN Observed Malicious SSL Cert (Quasar CnC)

 

Associated indicators (IOCs)

The following technical indicators are associated with the reported intelligence. A list of indicators is also available in the OTX Pulse. Please note, the pulse may include other activities related but out of the scope of the report.

 

TYPE	INDICATOR	DESCRIPTION
SHA256	8ace121fae472cc7ce896c91a3f1743d5ccc8a389bc3152578c4782171c69e87	Example malware hash

Mapped to MITRE ATT&CK

The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques:

• TA0002 : Execution 
• T1053: Scheduled Task/Job 
• T1053.005: Scheduled Task 
• T1059: Command and Scripting Interpreter 
• T1059.003: Windows Command Shell 
• TA0003: Persistence 
• T1547: Boot or Logon Autostart Execution 
• T1547.001 Registry Run Keys / Startup Folder 
• TA0004: Privilege Escalation 
• T1548: Abuse Elevation Control Mechanism 
• T1548.002: Bypass User Account Control 
• TA0005: Defense Evasion 
• T1112: Modify Registry 
• T1553: Subvert Trust Controls 
• T1553.002: Code Signing 
• T1564: Hide Artifacts 
• T1564.001: Hidden Files and Directories 
• T1564.003: Hidden Window 
• TA0006: Credential Access 
• T1552: Unsecured Credentials 
• T1552.001: Credentials In Files 
• T1555: Credentials from Password Stores 
• T1555.003: Credentials from Web Browsers 
• TA0007: Discovery 
• T1016: System Network Configuration Discovery 
• T1033: System Owner/User Discovery 
• T1082: System Information Discovery 
• T1614: System Location Discovery 
• TA0008: Lateral Movement 
• T1021: Remote Services 
• T1021.001: Remote Desktop Protocol 
• TA009: Collection 
• T1005: Data from Local System 
• T1056: Input Capture 
• T1056.001: Keylogging 
• T1125: Video Capture 
• TA0011: Command and Control 
• T1090: Proxy 
• T1095: Non-Application Layer Protocol  
• T1105: Ingress Tool Transfer 
• T1571: Non-Standard Port 
• T1573: Encrypted Channel: 
• T1573.001: Symmetric Cryptography 

References:

• Seroxen webpage
• Seroxen features
• Quasar RAT
• NirCmd – Windows command line tool (nirsoft.net)
• R77-rootkit

The post SeroXen RAT for sale appeared first on Cybersecurity Insiders.