Cyber Threat Intelligence

From the defender’s perspective ransomware is the biggest threat in the modern cybersecurity landscape. From a criminal perspective it’s a highly lucrative form of cybercrime, and perpetrators face only negligible chances of being prosecuted with less than 20 arrests reported in 2020 [1]. The highest amount of ransom ever paid by a single company for a single incident is $40 million US dollars [2][3], however, the cost of a ransomware attack is not limited to ransom payments. Companies can incur millions more in remediation costs, service downtime, legal settlements, higher insurance premiums, and potentially suffer long-term deleterious effects to their brand reputation [4]. One report estimates that 74% of ransomware payments go to Russian backed groups; more than $400 million USD in 2021 [5]. Another report from blockchain research group Chainalysis suggests that nearly $700 million USD in ransomware ransom was paid in 2020 [6] [7]. Not all ransomware strains…

Read more

The OpenSSF project is a new program sponsored by Google and other prominent tech corporations that aims to addresses  the challenge of identifying malicious packages in popular open source repositories. In just one month of analysis, the project identified more than 200 malicious packages uploaded to PyPI and npm.

Read more

In an MSNBC interview posted to YouTube on February 24th, 2022, approximately 24 hours after the initial invasion of Ukraine by Russian military forces, Leon Panetta former US Secratary of Defence and former head of the CIA was asked whether now is a good time for the US to use offensive cyber-war against Russia.  Rather that address the question directly, Panetta addressed the greater context of the invasion for Ukrainian national security.  The question is worth addressing though. So, is now a good time for counter forces to launch a cyber offensive? Is now the time for offensive cyber-attack? It Depends. That is the short and true answer. Here comes the why. Probably the most effective use of cyber weapons in warfare is when they are purposed for for gathering information, aka spying. The most advanced forms of cyber weapons (known as advanced persistent threats or APT for short) are…

Read more

We Have All Heard This Story Before It’s no doubt that ransomware is is the biggest threat in the modern cybersecurity landscape. The highest amount of ransom ever paid by a single company for a single incident is $40 million US dollars. Companies can incur millions more in remediation costs, service downtime, legal settlements, higher insurance premiums, and potentially suffer long-term deleterious effects to their brand reputation. Blockchain research group Chainalysis suggests that nearly $700 million USD in ransomware ransom was paid in 2020. Defenders have all been hearing this story for years, and know how to secure against ransomware right? The most common initial access vector is phishing so staff training sessions educating our staff on how to spot a deceptive url is required to keep the bad guys out. Installing endpoint security products and keeping them updated, and of course keep bulletproof backups right? Well, yes and no….

Read more

What Is “Fake Ransomware”? The term “fake ransomware” might conjure up some feelings of relief. After all, if the ransomware is fake, then it must not have encrypted files, right? However, the term has been used to refer to a few different variants of a true ransomware attack. Firstly, it has been used to describe ransomware that does not encrypt files, but instead attempts to trick the victim into thinking their files are encrypted while demanding a payment to recover them. Secondly, the term has also been used to refer to ransomware that does in fact encrypt your files, but does not offer a decryption key if ransom is paid. This is much more nefarious and destructive than the first type; a real sucker punch. And most recently, the term has been used to refer to a case where ransomware was deployed by a company against itself to cover up…

Read more

In part 1 of PHP Malware series, we learned what a web-shell is and learned some basic ways that an attacker can build web-shell in PHP. In part two we took a look at how web-shells can be hidden using base 64 encoding and AES encryption techniques. In part three we’re gonna look at other crafty ways that an attacker could obfuscate PHP web shell or other malware such as a stealer which would exfiltrate sensitive data as it’s processed by a website. Cyber criminals want to avoid malware being found, and when it is found, they want it to be difficult for a researcher to discover what the malware is doing. An an attack technique is novel, attackers don’t want defensive security researchers to be able to use the technique information to build defensive strategy or make the information public. In order to demonstrate the skill’s of reverse engineering…

Read more

In October 2021, while writing an article about EDR/XDR solutions,  I read an article from The Journal of CyberSecurity and Privacy entitled:  “An Empirical Assessment of Endpoint Detection and Response Systems against Advanced Persistent Threats Attack Vectors”.  I think now is a good time to revisit that research paper. The study tested state of the art EPP and EDR platforms against simulated APT attacks.  They key contribution of this paper is that it reveals what type of TTPs are still able to circumvent top of the line EDR solutions.  The products tested in the study are a who’s who of leading endpoint security vendors? Seeing a blog post from Recorded Future discussing the same paper  reminded me about it, and wanted to contribute my take on it. The full FINAL paper is available and the published version is available by searching Google for the article title “An Empirical Assessment of…

Read more

The Details The Log4J vulnerability in the Java logging package maintained by Apache made headlines late last week. It was disclosed as a Zero Day bug which is easily exploitable, received a CVSS score of 10/10, and includes remote code execution (RCE) on the target host. Associated CVE-2021-44228 is available on the NIST NVD website which provides more information and references including the CISA advisory. The number of Log4J installations has been described as “hundreds of millions” and “countless”. Virtually all Log4J versions (<= 20.14.1 which was released in early March 2021) are vulnerable. The most recent version of Log4J is now version 20.16.0 since subsequent patched updates were released in quick succession on December 6th and December 13th of 2021. If you want to know whether a 3rd party application is vulnerable to re-assess your risk, review the Software Bill of Materials (SBOM), if one has been provided, it…

Read more

The Recorded Future web-conference today was a great insight into the deep Cyber-Intelligence technology the company has developed and what it offers organizations. On display were both a definitive set of broad trend data combined with deep and granular information on every aspect of the MITRE ATT&CK framework and beyond. Recorded Future’s LinkedIn profile reports the company as having had Series E funding of $25 million dollars, however Crunchbase reports an even higher total investment of over $50 million dollars.  A press report on PRNewswire in October 2021 outlines Recorded Future’s recent investment in CVE intelligence company Cyber Threat Cognitive Intelligence (CTCI)  and describes the Intelligence Fund; Recorded Future’s investment platform. For anyone as passionate about Cyber-Security, predictive forecasting, and Intelligence as I am, there is a ton to be excited about with Recorded Future’s platform and capabilities.  Here’s what I learned from the conference today. Recorded Future aggregates data…

Read more