Cyber Security

Global Political Events and Accessibility of new Tech will Breed Innovative Threat Actors

Published

1 month ago

January 2, 2023

Written by Manoj Reddy, Rhonda Leopold & Max Kersten, researchers at Trellix Advanced Research Center

When protecting digital estate, companies search high and low for the right talent. In recent years, as cybersecurity has increased in importance in the Gulf region, we have often discussed the scarcity of that talent. Now we fear that our digital adversaries may be recruiting it for the same reason that regional SOCs have: to enhance a skills base and become more innovative.

More and more teen cybercriminals are getting involved with what can now only be described as professional criminal enterprises. As a result, cyber gangs are now firms with reputations and products. They are part of a wider ecosystem that is innovating much as legitimate enterprises do. Frontline operators use soft skills, backed by predesigned malware kits that are often offered in aaS-style subscriptions. Remember that Lapsu$, a group that made trouble for some big names, appeared to do so without ever dropping any malware. Attackers are changing and we must allow for this. Here are some major developments that CISOs should note.

Hacktivism moves to the center stage
For many years the headlines have been dominated by state-sponsored and financially motivated cyber threats. Hacktivism — politically or socially motivated hacking by activists — has remained in the background in recent years. Given current global tensions, we are already seeing the re-emergence of Hacktivism and expect this to play a larger part in 2023. As groups of loosely organized individuals, fueled by propaganda align for a common cause, they may continue to ramp up their use of cyber tools to voice their anger and cause disruption.

Patriotic hacktivism has increased in 2022 as war and other conflicts continue, and it breaks down into broad streams of actions like DDoS attacks, defacements, doxxing, intrusions, and leaking of personally identifiable information (PII). Hacktivists are targeting a wide range of industries and sectors that don’t align with their ideological and political views, including the telecommunication, energy, aviation, technology, media, and government sectors.

As tensions in 2023 are expected to rise, we expect hacktivism to continue to scale as it suits the political agenda of opposing parties and offers perfect plausible deniability for actions since they are initiated and undertaken by activists.

Increasing activity by teen cybercriminals at every scale
We are seeing technically talented young people being recruited by bad actors and organizations. Beginning in late 2021 a 16-year-old allegedly led successful hacks of international organizations like Microsoft, NVIDIA, Okta, and Samsung under the guise of the Lapsus$ gang. These cybercriminal organizations are today the talent competition of Fortune 500 companies and security companies who all work to protect society online.

In 2023, we expect to see increased activity from teens and young adults — everything from large-scale attacks on leading organizations to low-level crime targeting family, friends, peers, and strangers to make a quick buck, cause embarrassment, test new skills, and gain social capital. This problem may grow, budget increases will follow, and costs will continue to be handed back down to us as consumers. Teaching children what a crime is on the keyboard is essential.

There are some global initiatives to help prevent our youngsters from sliding off into a world of cybercrime. To educate the young on the dangers of cybercrime, there are some new initiatives like Hackshield that teach kids about the dangers of gaming. But the generational gap needs to be addressed and parents need to be educated to ensure they are leading their children away from petty cybercrime or even more nefarious crimes.

Declining accuracy of code-based attribution
With regard to cybersecurity, attribution is often heavily based upon dissected malware samples. It has been proven time and again that coding styles can be linked to actors, much like someone’s handwriting.

Attribution purely based on code alone can, however, pose a problem. Whereas advanced espionage groups are often known to create their own tooling for their campaigns to preserve their secrecy, some other malware types do not require such secrecy per se. Prime examples of such malware are wipers.

Once a wiper is used, it isn’t novel anymore, and the detection and prevention of malware are bound to be implemented. The creation of malware is often thought to be done by coders, who then sell the malware-as-a-service, or work with affiliates. Creation can also be outsourced to legitimate contractors, thus obscuring the code base attribution immensely, as the contracted authors have different coding styles.

The decrease in accuracy of code-based attribution, albeit seemingly insignificant on its own, is likely to become more problematic in the future, especially when taking the re-use of (leaked) malware source code and the collaboration between actors in the segmented underground into account. We, therefore, urge analysts to include their confidence level when making claims that aren’t (fully) supported by facts. This provides a clear indication to the reader with regards to the way the report should be perceived, allowing the appropriate actions to be taken from the get-go.

Skill up or get out-skilled
The cybercrime industry is fishing for talent just as the cybersecurity industry is. Facing competition, one must compete. We must look to the employee experience when attracting security talent, being mindful of the allure of shadowy worlds. We must make the SOC more attractive than the digital back alleys that beckon our young talent. We must equip them with tools that allow them to innovate and add value.

Meanwhile, we must look inward. For those employees that show interest and skill in cybersecurity, we must find the budget and invest in them. This is a war. We will not win it by conscription. We must equal the bad actors for their capacity to incentivise innovation. If we do not, they will outmatch us at every turn.

Cyber Security

OneNote Documents Increasingly Used to Deliver Malware

Published

2 days ago

February 6, 2023

Edward Frank

Proofpoint researchers recently identified an increase in threat actor use of OneNote documents to deliver malware via email to unsuspecting end-users in December 2022 and January 2023. OneNote is a digital notebook created by Microsoft and available via the Microsoft 365 product suite. Proofpoint has observed threat actors deliver malware via OneNote documents, which are .one extensions, via email attachments and URLs.

While there is an increase in the number of campaigns utilizing OneNote to deliver malware, its use is unusual. Based on Proofpoint’s observed characteristics of past threat campaigns, it is believed that threat actors have increasingly adopted OneNote as of result of their experimentation with different attachment types to bypass threat detection. Since Microsoft began blocking macros by default in 2022, threat actors have experimented with many new tactics, techniques, and procedures (TTPs), including the use of previously infrequently observed filetypes such as virtual hard disk (VHD), compiled HTML (CHM), and now OneNote (.one).

Observed email campaigns that use OneNote for malware delivery share similar characteristics. While the message subjects and senders vary, nearly all campaigns use unique messages to deliver malware, and do not typically utilize thread hijacking. Messages typically contain OneNote file attachments with themes such as invoice, remittance, shipping, and seasonal themes such as Christmas bonus, among other subjects. In mid-January 2023, Proofpoint researchers observed actors using URLs to deliver OneNote attachments that use the same TTPs for malware execution.

The OneNote documents contain embedded files, often hidden behind a graphic that looks like a button. When the user double-clicks the embedded file, they will be prompted with a warning. If the user clicks continue, the file will execute. The technique may be effective for now. At the time of analysis, multiple OneNote malware samples observed by Proofpoint were not detected by numerous anti-virus vendors on VirusTotal.

It is important to note, an attack is only successful if the recipient engages with the attachment, specifically by clicking on the embedded file and ignoring the warning message displayed by OneNote. Organizations should educate end users about this technique and encourage users to report suspicious emails and attachments.

Channel Talk

NetWitness Signs Distribution Partnership with CyberKnight

Published

2 days ago

February 6, 2023

Chris Fernando

NetWitness today announced it is partnering with CyberKnight, to bring its extended detection and response (XDR) solutions to enterprises in the Middle East. “Together, NetWitness and CyberKnight will enable enterprise and government customers in the Middle East with fast detection and automatic response capabilities to combat today’s advanced cybersecurity threats,” the companies said.

The NetWitness Platform is an open XDR solution that enables security teams to detect, understand the full scope of a compromise, and automatically respond to security threats across modern IT infrastructures, accelerating threat detection and response. NetWitness delivers enhanced visibility across all capture points, including logs, network packets, net flow, endpoints, and computing platforms on-premise, in the cloud, or as a hybrid of the two. The NetWitness Platform applies threat intelligence as well as user and entity behavior analytics to detect, prioritize, investigate threats, and automate responses, improving the effectiveness and efficiency of security strategies.

“We are excited about this new partnership with NetWitness, as their modern approach to security will give customers in the Middle East an advantage in the battle against cyberattacks, ensuring unsurpassed visibility, smarter threat detection, and faster analytics — all on-premises. Hundreds of organizations in the Middle East are already using this robust platform, which easily integrates with the world’s most critical and widely deployed tools, as well as many specialized and industry-specific solutions,” commented Avinash Advani, CEO and Founder at CyberKnight.

“Keeping end users safe from ever-evolving cyberattacks requires forward-thinking and holistic approaches that enable security operations teams to stay ahead of such breaches. We are proud to continue our expansion in the region and offer enterprises our unparalleled XDR platform. We are thrilled about our partnership with CyberKnight, which allows us to leverage their regional coverage, channel breadth, deep-rooted customer relationships, and cybersecurity expertise to accelerate our growth,” added Motaz Al Mohamady, head of Channel Sales — Middle East, Turkey, and Africa, at NetWitness.

Cyber Security

79% of MEA Organizations have a “Protection Gap”: Veeam Research

Published

3 weeks ago

January 18, 2023

Chris Fernando

Veeam Software has released findings of the company’s fourth annual Data Protection Trends Report to better understand how data protection is evolving in a digital world.

Notable insights from the report include:

Reliability and consistency (of protecting IaaS and SaaS alongside data center servers) are the key drivers for improving data protection in 2023. For organizations that are struggling to protect cloud-hosted data with legacy backup solutions, it is likely they will supplement their data center backup solution with IaaS/PaaS and/or SaaS capabilities.
Ransomware is both the most common and most impactful cause of outages, alongside natural disasters (fire, flood, etc.) and user errors (overwrites, deletion, etc.). Organizations should implement backup and recovery solutions that support a holistic approach to data protection, and that can integrate with other cyber detection and remediation technologies to ensure comprehensive cyber resilience.
Cloud-based services seem nearly inevitable for organizations of all sizes. But similar to how there isn’t just one type of production cloud, there isn’t just one protection cloud scenario. Organizations should consider cloud tiers for retention, Backup as a Service (BaaS), and ultimately, Disaster Recovery as a Service (DRaaS).

“IT leaders are facing a dual challenge. They are building and supporting increasingly complex hybrid environments, while the volume and sophistication of cyberattacks are increasing,” said Danny Allan, CTO and Senior Vice President of Product Strategy at Veeam. “This is a major concern as leaders think through how they mitigate and recover business operations from any type of disruption. Legacy backup approaches won’t address modern workloads – from IaaS and SaaS to containers – and result in an unreliable and slow recovery for the business when it’s needed most. This is what’s focusing the minds of IT leaders as they consider their cyber resiliency plan. They need Modern Data Protection.”

The report shows that data protection budgets are increasing. Globally, organizations expect to increase their data protection budget in 2023 by 6.5%, which is notably higher than overall spending plans in other areas of IT. Of the 85% of organizations planning on increasing their data protection budgets, their average planned increase is 8.3% and often in concert with increased investments in cybersecurity tools.

The Middle East and Africa market throw up some interesting findings:

Protection and Availability Gap in the MEA region

78% have an “Availability Gap” between how quickly they need systems to be recoverable and how quickly IT can bring them back
79% have a “Protection Gap” between how much data they can lose and how frequently IT protects their data

Ransomware in the MEA region

Ransomware attacks continue to be more frequent

Only 14% experienced no ransomware attacks in 2022
18% experienced only one attack
48% experienced two or three attacks
And 21% experienced four or more attacks in 2022
45% of organizations stated that ransomware (including both prevention and remediation) was their biggest hindrance to Digital Transformation or IT modernization initiatives, due to its burden on budgets and manpower
When organizations were asked about their most significant attacks suffered in 2022:
- 39% of their entire production data set was successfully encrypted or destroyed
- Only 55% of the encrypted/destroyed data was recoverable

“Ransomware is indiscriminatory – every business is a target. Rather than be gripped with fear at the prospect of being attacked, organizations must focus on what they can control – their defence. The fundamental principles of how to prepare defences against even the most sophisticated and powerful ransomware stay relatively the same. The first is the practice of impeccable digital hygiene. All employees must be trained to identify suspicious content and be warned of the impact that malpractice using work devices can lead to. Secondly, all businesses must prepare for their defences to fail. Concepts such as zero trust and deploying techniques such as two-factor authentication can be useful for restricting the access an attacker has to data. The best way to protect data is to ensure that it has been securely backed up and is fully recoverable before an incident takes place with the 3-2-1-1-0 backup rule – there should always be at least three copies of data, on at least two different types of media, at least one off-site and one immutable or offline, with zero unverified backups or errors,” concludes Rizk.

Business Continuity and Disaster Recovery (BC/DR) initiatives in the MEA region

Every facet of IT continues to be a candidate for cloudification, with data protection being a common scenario.
- 84% of Middle East & Africa organizations anticipate using Backup as a Service (BaaS) or Disaster Recovery as a Service (DRaaS) to protect at least some of their servers over the next two years.
That said, cloud-based storage is not misunderstood as the “tape killer” that early pundits tried to sell it as. When discussing the media used within their backup systems, the Middle East & Africa organizations reported that in addition to disk-based protection:
- 64% of production data is stored in a cloud at some point in its lifecycle
- 52% of production data is stored on a tape at some point in its lifecycle
86% organizations consider their cyber and (traditional) BC/DR initiatives to be either mostly or completely integrated. To achieve that among organizations in the Middle East & Africa:
- 41% want to orchestrate recovery workflows, instead of relying on manual processes
- 25% will leverage on-premises infrastructures for their BC/DR
- 41% will leverage cloud infrastructures for their BC/DR, using IaaS or DRaaS

“It is no surprise that BaaS and DRaaS are becoming so popular among regional organizations. They provide viable alternatives to managing everything. It can be more cost effective to outsource backup and disaster recovery needs instead of hiring and training in-house resources. A BaaS provider can ensure backups are not only successful but regularly tested and restorable. A DRaaS provider can support with as little as an off-site replication or fully manage your complete disaster recovery plan from testing and execution to failing over and failing back, should an unplanned event occur,” comments Rizk.

“Veeam understands these changing market dynamics and data protection needs of enterprises today. From critical workloads running on-premises to the sprawl of data in the cloud and at home offices, Veeam-powered BaaS and DRaaS service provider partners offer the off‑site backup, monitoring and management, and disaster recovery services organizations need to stay resilient in the face of any threat.”