Cyber Security

New Connections Between Hive, Royal, and Black Basta Ransomware Uncovered by Sophos

Published

9 months ago

August 14, 2023

Sophos released new findings into the connections between the most prominent ransomware groups this past year, including Royal, in its report, “Clustering Attacker Behavior Reveals Hidden Patterns.” Over the course of three months beginning in January 2023, Sophos X-Ops investigated four different ransomware attacks, one involving Hive, two by Royal, and one by Black Basta, and noticed distinct similarities between the attacks. Despite Royal being a notoriously closed-off group that doesn’t openly solicit affiliates from underground forums, granular similarities in the forensics of the attacks suggest all three groups are sharing either affiliates or highly specific technical details of their activities. Sophos is tracking and monitoring the attacks as a “cluster of threat activity” that defenders can use to speed up detection and response times.

“Because the ransomware-as-a-service model requires outside affiliates to carry out attacks, it’s not uncommon for there to be crossover in the tactics, techniques, and procedures (TTPs) between these different ransomware groups. However, in these cases, the similarities we’re talking about are at a very granular level. These highly specific, unique behaviours suggest that the Royal ransomware group is much more reliant on affiliates than previously thought. The new insights we’ve gained about Royal’s work with affiliates and possible ties to other groups speak to the value of Sophos’ in-depth, forensic investigations,” said Andrew Brandt, principal researcher, Sophos.

The unique similarities include using the same specific usernames and passwords when the attackers took over systems on the targets, delivering the final payload in .7z archive named after the victim organization, and executing commands on the infected systems with the same batch scripts and files. Sophos X-Ops succeeded in uncovering these connections following a three-month-long investigation into four ransomware attacks. The first attack involved Hive ransomware in January 2023. This was followed by Royals’ attacks in February and March 2023 and, later, in March, Black Basta’s. Near the end of January this year, a large portion of Hive’s operation was disbanded following a sting operation by the FBI. This operation could have led Hive affiliates to seek new employment—perhaps with Royal and Black Basta—which would explain the similarities in the ensuing ransomware attacks.

Because of the similarities between these attacks, Sophos X-Ops began tracking all four ransomware incidents as a cluster of threat activity. “While threat activity clusters can be a stepping stone to attribution when researchers focus too much on the ‘who’ of an attack, then they can miss critical opportunities for strengthening defences. Knowing highly specific attacker behaviour helps managed detection and response teams react faster to active attacks. It also helps security providers create stronger protections for customers. When protections are based on behaviours, it doesn’t matter who is attacking—Royal, Black Basta, or otherwise—potential victims will have the necessary security measures in place to block subsequent attacks that display some of the same distinct characteristics,” said Brandt.

Up Next

Dynatrace Intros Security Analytics for Proactive Defense Against Threats to Cloud Apps

Don't Miss

AmiViz and Darktrace Announce Cybersecurity Partnership

Cyber Security

Data Stealers Are Hunting for User Credentials, Says Kaspersky

Published

1 week ago

April 18, 2024

Edward Frank

As the malware development market continues to flourish with new stealers such as Lumma, for the last three years Redline still remains the dominant data-stealing malware used by cybercriminals. More than half of every device (55%) targeted by password-stealer attacks in 2023 has been infected with the Redline malware, Kaspersky Digital Footprint Intelligence finds.

Infostealers infiltrate devices to illicitly obtain sensitive credentials such as logins and passwords, which are then peddled on the shadow market, posing significant cybersecurity threats to personal and corporate systems. According to information gleaned from log files traded or distributed freely on the dark web, Redline was used in 51% of infostealer infections from 2020 to 2023. Other notable malware families included Vidar (17%) and Raccoon (nearly 12%). In total, around 100 distinct infostealer types were identified by Kaspersky Digital Footprint Intelligence between 2020 and 2023 using metadata from log files.

The underground market for data-stealing malware development is expanding, evident from the rising popularity of new stealers. Between 2021 and 2023, the portion of infections caused by new stealers grew from 4% to 28%. Specifically, in 2023, the new “Lumma” stealer alone was responsible for more than 6% of all infections.

“Lumma emerged in 2022 and gained popularity in 2023, through a Malware-as-a-Service (MaaS) distribution model. This means any criminal, even those without advanced technical skills, can purchase a subscription for a pre-made malicious solution and use this stealer to carry out cyberattacks. Lumma is primarily designed for stealing credentials and other information from cryptocurrency wallets, commonly spread through email, YouTube, and Discord spam campaigns,” said Sergey Shcherbel, an expert at Kaspersky Digital Footprint Intelligence.

To guard against data-stealing malware, individuals are advised to use a comprehensive security solution for any device. This will help prevent infections and alert them to dangers, such as suspicious sites or phishing emails that can be an initial vector for infection. Companies can help their users, employees and partners protect themselves from the threat by proactively monitoring leaks and prompting users to change leaked passwords immediately.

Channel Talk

AmiViz Joins Signs Up with Abstract Security

Published

1 week ago

April 18, 2024

Chris Fernando

AmiViz has forged a partnership with Abstract Security, a cyber threat operations platform offering a revolutionary approach to security analytics that allows organisations to improve efficiency, reduce SIEM-related storage costs, and enhance detection and response capabilities across multi-cloud and on-premise environments. The Abstract platform disrupts traditional cybersecurity analytics with its innovative approach, challenging the limitations of conventional Security Analytics systems. Abstract Security offers a transformative cyber threat operations platform in an era marked by compliance-induced data swamps and redundant data storage.

“Engineered to streamline security analytics, it enhances detection and response capabilities across diverse IT environments, including multi-cloud and on-premise setups. By integrating tactical artificial intelligence (AI), Abstract empowers security analysts to decode complex cloud security data, improving detection strategies and filling visibility gaps. Pioneering initiatives like the decentralized edge computing platform and a one-click data lake further solidify Abstract Security’s position as a visionary player in cybersecurity,” the company said.

“The strategic expansion into Middle Eastern markets aligns with the region’s growing demand for advanced cybersecurity measures. With rapid digital transformation and increased cyber threats, the Middle East presents a significant opportunity for Abstract Security. Government investments in cybersecurity infrastructure and the adoption of IoT technologies amplify the demand for efficient, AI-driven security solutions,” the company added.

Ilyas Mohammed, COO at AmiViz, said, “Our partnership with Abstract Security heralds a new era in cybersecurity analytics. By leveraging their innovative solutions, we empower our clients with proactive threat management capabilities that surpass traditional systems. Together, we redefine industry standards, ensuring robust protection against evolving cyber threats and bolstering our position as leaders in the cybersecurity landscape.”

Richard Betts, Vice President of International Business at Abstract Security, commented on the strategic alliance, stating, ‘Our collaboration with AmiViz in the Middle East is more than a partnership; it’s a synergy of strengths. This venture not only amplifies our presence in a region but also marks a significant step in our journey to broaden Abstract Security’s international reach.

The companies claimed that the solutions are tailored for large enterprises in critical sectors like finance, oil and gas, telecommunications, MSSP and government, to address unique cyber threats. Abstract Security said it aims to integrate its solutions in local markets deeply through a channel-focused distribution strategy, empowering channel partners and addressing evolving security needs. The company added that it has partnered with AmiViz to provide comprehensive support, including technical training, marketing assistance, and dedicated account management, further strengthening Abstract Security’s position in the GCC markets.

Abstract Security’s partnership with AmiViz allows Middle Eastern channel partners to revolutionize security analytics, transcending traditional SIEM systems and compliance burdens. Together, they set a new standard for cybersecurity analytics, paving the way for proactive and predictive security measures. This partnership aims to position the Middle East as a cybersecurity stronghold, contributing to its global leadership in cybersecurity.

Cyber Security

Check Point Software Technologies to Participate at GISEC 2024

Published

2 weeks ago

April 17, 2024

Chris Fernando

Check Point Software Technologies has announced its participation at the Gulf Information Security Expo & Conference (GISEC) 2024, scheduled from April 23rd to April 25th, 2024, at the Dubai World Trade Centre. As cyber threats continue to evolve rapidly, the need for advanced cybersecurity solutions has never been more pressing. With the United Arab Emirates experiencing an average of 1,207 cyberattacks per organization each week over the last six months—surpassing the global average—Check Point Software is set to showcase its flagship Check Point Infinity Platform at GISEC 2024.

This platform, which is at the forefront of AI-powered, cloud-delivered cybersecurity, has been specifically designed to meet the modern challenges of an evolving threat landscape, providing comprehensive protection, consolidated operations, and collaborative communication capabilities. Visitors can explore these solutions at booth #C39 in Hall 7, where the following highlights will be featured:

Check Point Infinity Playblocks: Automatically triggers preventive actions upon detecting an attack, swiftly containing threats through a consolidated, cloud-based security platform.
Check Point Infinity AI Copilot: Enhances the efficiency of security teams by leveraging AI to automate complex tasks and deliver proactive security solutions.
Check Point UAE Infinity Portal: Tailored to meet the needs of organizations of all sizes while fully adhering to the UAE’s data privacy regulations.

Ram Narayanan, Country Manager at Check Point Software Technologies Middle East, commented, “Our participation at GISEC 2024 underscores our commitment to bolstering cybersecurity defences in the region. The Check Point Infinity Platform, with its AI-powered threat prevention and cloud-delivered threat intelligence, is critical for organizations needing robust solutions to protect their assets. We look forward to engaging with customers and partners to discuss how these innovations can enhance cybersecurity resilience.”

Additionally, at GISEC 2024, Check Point Software will focus on strengthening relationships with customers and partners. This commitment highlights the company’s ongoing effort to provide advanced cybersecurity solutions in the region. Check Point Software is eager to meet with attendees, discuss their security challenges, and explore how it can help organizations enhance their defences, prevent cyber-attacks, and protect their critical assets.