Tag Archives: Ransomware

News

Black Basta ransomware: Attacks deploy custom EDR evasion tools tied to FIN7 threat actor

Black Basta ransomware emerged in April 2022 and went on a spree, breaching over 90 organisations by September 2022. The rapidity and volume of attacks prove that the actors behind Black Basta are well-organised and well-resourced, and yet there have been no indications of Black Basta attempting to recruit affiliates or advertising as a RaaS on the usual darknet forums or crimeware marketplaces. This has led to much speculation about the origin, identity and operation of the Black Basta ransomware group.

SentinelLabs’ research indicates that the individuals behind Black Basta ransomware develop and maintain their own toolkit and either exclude affiliates or only collaborate with a limited and trusted set of affiliates, in similar ways to other ‘private’ ransomware groups such as Conti, TA505, and Evilcorp.

Executive Summary

  • SentinelLabs assesses it is highly likely the Black Basta ransomware operation has ties with FIN7
  • SentinelLabs assess it is likely the developer of these EDR evasion tools is, or was, a developer for FIN7
  • Black Basta maintains and deploys custom tools, including EDR evasion tools
  • Black Basta attacks use a uniquely obfuscated version of ADFind and exploit PrintNightmare, ZeroLogon and NoPac for privilege escalation
  • Black Basta operators have a number of Remote Admin Tools (RAT) tools in their arsenal. The threat actor has been observed dropping a self-extracting archive containing all the files needed to run the Netsupport Manager application, staged in the ‘C:\temp’ folder with the name ‘Svvhost.exe’
  • The Black Basta actor has been seen using different methods for lateral movement, deploying different batch scripts through psexec towards different machines in order to automate process and services termination and to impair defences. Ransomware has also been deployed through a multitude of machines via psexec.
  • In order to impair the host’s defences prior to dropping the locker payload, Black Basta targets installed security solutions with specific batch scripts downloaded into the Windows directory.

To read the full report, click this link.

News

SentinelOne integrates with Proofpoint for enhanced ransomware protection

SentinelOne, an autonomous cybersecurity platform company, has announced a new integration with Proofpoint to orchestrate unified ransomware protection. With SentinelOne Singularity XDR and Proofpoint Targeted Attack Protection (TAP), enterprises enjoy the benefits of threat intelligence and multi-layered detection and response from email to endpoint, cloud, and identity management.

In 2021, 83 percent of organisations experienced at least one successful email-based phishing attack, according to recent Proofpoint research. Furthermore, the threat landscape is dominated by ransomware, an increasingly prevalent risk for organisations of all sizes. Human-powered EDR and legacy antivirus struggle to quickly halt the spread of an attack and are proving to be less effective than they historically were.

“Threats come from everywhere today,” said Chuck Fontana, SVP of Business Development, SentinelOne. “Attackers continue to use phishing techniques, exploiting the weakest link in enterprise cybersecurity – humans. Proofpoint and SentinelOne are in the right alignment to solve this problem, helping cybersecurity teams save valuable time while reducing risk.”

“Regardless of the level of sophistication, modern cyberattacks, including ransomware, tend to share one common trait – they target the inbox,” said D.J. Long, Vice President, Strategic Alliances & Business Development, Proofpoint. “Proofpoint’s integration with SentinelOne will help organisations as they look to unify their cybersecurity defence, securing the inbox and preventing threats associated with their users.”

Proofpoint TAP detects, analyses, and blocks advanced threats before they reach employee inboxes, including ransomware and other email threats delivered through malicious attachments and URLs.

SentinelOne unifies prevention, detection, and response in a single platform driven by patented machine learning and intelligent automation. With SentinelOne, organisations can detect malicious behaviour across all vectors and rapidly eliminate threats with autonomous response capabilities across enterprise attack surfaces.

With this integration, Proofpoint TAP offers unique visibility into email-based threats and streams data to the SentinelOne Singularity XDR platform for defence-in-depth protection. Joint capabilities include:

  • Device, inbox, and data visibility
  • Autonomous remediation capabilities including kill, quarantine, and even reversing malicious activity
  • Realtime intelligence sharing for proactive defence across the enterprise
  • Proactive device, user, and inbox isolation
  • Multitenant enterprise management

For more information on SentinelOne visit: www.sentinelone.com

For more information on Proofpoint’s people-centric solutions, visit: www.proofpoint.com.

Data, News

Catalogic Software Introduces Newest Version of DPX with Proactive Ransomware Protection

DPX 4.8.1 includes GuardMode for greater cyber-resiliency and DPX vPlus providing data protection for Microsoft 365 and open virtualization platforms.

Woodcliff Lake, NJ — July 12, 2022 — Catalogic Software, a leading provider of smart data protection solutions, today announced the release and general availability of the newest version of Catalogic DPX, the company’s enterprise data protection software. DPX 4.8.1 introduces GuardMode, a feature providing early detection of ransomware and DPX vPlus, cloud data protection for Microsoft 365 and other open virtualization platforms.

“Cybercriminals are constantly innovating, costing US victims $49.2 million in losses to ransomware attacks last year alone – and that is just based on incidents reported to the FBI,” said Krista Macomber, Senior Analyst, Evaluator Group. “Catalogic DPX’s new GuardMode feature can help organizations to minimize business disruption, including financial losses, when they are hit by ransomware. For example, proactive monitoring against over a list of over 4,000 known ransomware patterns that is automatically updated helps to mitigate the spread of ransomware, and the ability to roll back only affected data allows good data that might be interspersed with infected files to be preserved.”

DPX GuardMode is complementary to endpoint and edge protection, monitoring file shares and file system behavior, even over the network, instead of relying on a specific binary fingerprint. GuardMode maintains, and regularly updates over 4000 known ransomware threat patterns, and assesses affected files. Backing up this extensive forensic layer of protection are honeypots as a deception layer to catch ever-evolving types of ransomware strains. GuardMode increases confidence in ransomware detection while identifying and enabling recovery of only the affected data

“DPX GuardMode changes a backup teams’ cyber reliance posture from reactive to proactive with early detection,” said Sathya Sankaran, COO, Catalogic Software. “DPX GuardMode notifies backup and storage teams of suspicious activity and pinpoints the extent of damage caused by cyber incidents. Combined with the comprehensive workload coverage of DPX and instant recoveries, Catalogic DPX customers will be among the best prepared to recover from a cyberattack.”

With DPX vPlus, Catalogic provides data protection for Microsoft 365, and other open virtualization platforms such as RHV/oVirt, Acropolis, XenServer, Oracle VM and KVM.

“We are excited to extend our relationship with Storware and announce DPX vPlus, that adds Microsoft 365 cloud data protection and expands our coverage of hypervisor workloads, said Ken Barth, CEO, Catalogic Software. “DPX vPlus is fully integrated into the DPX vStor backup repository, and it delivers greater workload coverage for an organization’s edge and cloud data.”

Catalogic will host a live webinar “Adding Cyber Resilience to your Data Protection Strategy with Early Detection” on Wednesday, July 13th at 10 AM Eastern Time. Evaluator Group’s Krista Macomber will discuss data protection trends and challenges, including how cyber-attacks are changing best practices for data protection and recovery. Catalogic’s Sathya Sankaran will discuss what storage and backup teams can do strengthen their cyber security posture.

For further information on Catalogic DPX 4.8.1 and earlier releases, please see:

What’s New in DPX 4.8.1 and the DPX Product Page.

Cybersecurity, News

Ransomware volume already doubled 2021 total by end of Q1 2022 says WatchGuard Threat Lab Report

New research shows Log4Shell detections tripled, PowerShell scripts heavily influenced a surge in endpoint attacks, the Emotet botnet came back in a big way and malicious cryptomining activity increased

28 June 2022 – Ransomware detections in the first quarter of this year doubled the total volume reported for 2021, according to the latest quarterly Internet Security Report from the WatchGuard Threat Lab. Researchers also found that the Emotet botnet came back in a big way, the infamous Log4Shell vulnerability tripled its attack efforts and malicious cryptomining activity increased.

Although findings from the Threat Lab’s Q4 2021 report showed ransomware attacks trending down year over year, that all changed in Q1 2022 with a massive explosion in ransomware detections. While Q4 2021 saw the downfall of the infamous REvil cybergang, WatchGuard analysis suggests that this opened the door for the LAPSUS$ extortion group to emerge, which along with many new ransomware variants such as BlackCat – the first known ransomware written in the Rust programming language – could be contributing factors to an ever-increasing ransomware and cyber-extortion threat landscape.

The report also shows that EMEA continues to be a hotspot for malware threats. Overall regional detections of basic and evasive malware show WatchGuard Fireboxes in EMEA were hit harder than those in North, Central and South America (AMER) at 57% and 22%, respectively, followed by Asia-Pacific (APAC) at 21%.

“Based on the early spike in ransomware this year and data from previous quarters, we predict 2022 will break our record for annual ransomware detections,” said Corey Nachreiner, chief security officer at WatchGuard. “We continue to urge companies to not only commit to implementing simple but critically important measures but also to adopt a true unified security approach that can adapt quickly and efficiently to growing and evolving threats.”

Other key findings from this Internet Security Report include:

  • Log4Shell makes its debut on the top 10 network attacks list – Publicly disclosed in early December 2021, the Apache Log4j2 vulnerability, also known as Log4Shell, debuted on the top 10 network attack list fashionably late this quarter. Compared to aggregate IPS detections in Q4 2021, the Log4Shell signature nearly tripled in the first quarter of this year. Highlighted as the top security incident in WatchGuard’s previous Internet Security Report, Log4Shell garnered attention for scoring a perfect 10.0 on CVSS, the maximum possible criticality for a vulnerability, and because of its widespread use in Java programs and the level of ease in arbitrary code execution.

 

  • Emotet’s comeback tour continues – Despite law enforcement disruption efforts in early 2021, Emotet accounts for three of the top 10 detections and the top widespread malware this quarter following its resurgence in Q4 2021. Detections of Trojan.Vita, which heavily targeted Japan and appeared in the top five encrypted malware list, and Trojan.Valyria both use exploits in Microsoft Office to download the botnet Emotet. The third malware sample related to Emotet, MSIL.Mensa.4, can spread over connected storage devices and mostly targeted networks in the US. Threat Lab data indicates Emotet acts as the dropper, downloading and installing the file from a malware delivery server.

 

  • PowerShell scripts lead the charge in surging endpoint attacks – Overall endpoint detections for Q1 were up about 38% from the previous quarter. Scripts, specifically PowerShell scripts, were the dominating attack vector. Accounting for 88% of all detections, scripts single-handedly pushed the number of overall endpoint detections clear past the figure reported for the previous quarter. PowerShell scripts were responsible for 99.6% of script detections in Q1, showing how attackers are moving to fileless and living-off-the-land attacks using legitimate tools. Although these scripts are the clear choice for attackers, WatchGuard’s data shows that other malware origin sources shouldn’t be overlooked.

 

  • Legitimate cryptomining operations associated with malicious activity – All three new additions to the top malware domains list in Q1 were related to Nanopool. This popular platform aggregates cryptocurrency mining activity to enable steady returns. These domains are technically legitimate domains associated with a legitimate organization. However, connections to these mining pools almost always originate in a business or education network from malware infections versus legitimate mining operations.

 

  • Businesses still facing a wide range of unique network attacks – While the top 10 IPS signatures accounted for 87% of all network attacks; unique detections reached their highest count since Q1 2019. This increase indicates that automated attacks are focusing on a smaller subset of potential exploits rather than trying everything but the kitchen sink. However, businesses are still experiencing a wide range of detections.

WatchGuard’s quarterly research reports are based on anonymised Firebox Feed data from active WatchGuard Fireboxes whose owners have opted to share data in direct support of the Threat Lab’s research efforts. In Q1, WatchGuard blocked a total of more than 21.5 million malware variants (274 per device) and nearly 4.7 million network threats (60 per device). The full report includes details on additional malware and network trends from Q1 2022, recommended security strategies and critical defence tips for businesses of all sizes and in any sector, and more.

For a detailed view of WatchGuard’s research, read the complete Q1 2022 Internet Security Report here, or visit: https://www.watchguard.com/wgrd-resource-center/security-report-q1-2022