By: William Malik – Trendmicro August 14, 2023 Read time: 4 min (1014 words)
Rethinking learning metrics and fostering critical thinking in the era of generative AI and LLMs
I recently participated in a conversation about artificial intelligence, specifically ChatGPT and its kin, with a group of educators in South Africa. They were concerned that the software would help students cheat.
We discussed two possible alternatives to ChatGPT: First, teachers could require that students submit handwritten homework. This would force students to at least read the material once before submitting it; Second, teachers could grade the paper submissions no higher than 89 percent (or a “B”), but that to get an “A,” the student would have to stand in front of the class and verbally discuss the material, their research, their conclusion, and answer any questions the teacher or other classmates might ask. (With that verbal defense of the ideas, the teacher might even waive the requirement for paper submission at all!)
The fundamental problem is that the grading system depends on homework. If education aims to teach an individual both a) a body of knowledge and b) the techniques of reasoning with that knowledge, then the metrics proving that achievement is misaligned.
One of the most quoted management scientists is Fredrick W. Taylor. He is most known for saying, “If you can’t measure it, you can’t manage it.” Interestingly, he never said that – which is fortunate because it is entirely wrong. People always manage things without metrics – from driving a car to raising children. He said: “If you measure it, you’ll manage it” – and he intended that as a warning. Whenever you adopt a metric, you will adjust your assessment of the underlying process in terms of your chosen metric. His warning is to be very careful about which metrics you choose.
Sometime in the past forty years, we decided that the purpose of education is to do well on tests. Unfortunately, that is also wrong. The purpose of education is to teach people to gather evidence and to think clearly about it. Students should learn how to judge various forms of evidence. They should understand rhetorical techniques (in the classical sense – how to render ideas clearly). They should be aware of common errors in thinking – the cognitive pitfalls we all fall into when rushed or distracted and logical fallacies which rob our arguments of their validity.
Large Language Models (LLMs) aggregate vast troves of text. Those data sources are not curated, so LLMs reflect the biases, logical limitations, and cognitive distortions in so much of what’s online. We are all familiar with early chatbots that were easily corrupted – the Microsoft chatbot Tay was perverted into being a racist resonator. (See “Twitter taught Microsoft’s AI Chatbot to be a Racist A**hole in Less than a Day” from The Verge, March 24, 2016, at https://www.theverge.com/2016/3/24/11297050/tay-microsoft-chatbot-racist accessed Aug 2023.)
LLMs do not think. They scan as much material as possible, then build a set of probabilities about which word is most likely to follow another word. If the word “pterodactyl” occurs in a text, then the next most likely word might be “soaring,” and “flying” might be in second place. If ChatGPT gets the word “pterodactyl” as input, it will put “soaring” next to it. This may look plausible to a person reading the output, but it cannot be correct. Correctness implies some kind of comprehension and judgment. ChatGPT does neither. It merely arranges words based on their statistical likelihood in the LLM’s database. We are now learning that LLMs that ingest computer-generated content become even more skewed – augmenting the likelihood of one word following another by rescanning the previous output. Over time, LLMs fed AI-generated content will drift farther and farther from actual human writing. The oft-mentioned hallucinations that LLMs generate will become more common as the distillation and amplification of the more likely subset of words leads to a contracted pool of possible machine-generated responses. Eventually – if we are not able to prevent LLMs from ingesting already-processed content – the output of ChatGPT will become more and more constrained, which, taken to the extreme, will yield one plot, one answer, one painting, and one outcome regardless of the specific input. Long before then, people will have abandoned LLM-based efforts for any activity that requires creativity.
Where can LLMs help? By sorting through bounded sets of information. That means an LLM trained on protein sequences could rapidly develop a most likely model for a protein that could attack a particular disease or interrupt an allergic reaction. In that case, the issue isn’t seeking creativity but rapidly scanning a set of nearly identical data overreactions to find the few that stand out enough to make a difference. A human doing this kind of work would quickly grow bored and likely make errors. LLMs can help science move quickly through vast quantities of data in closed domains. But when looking at an unbounded domain (art, poetry, fiction, movies, music, and the like), LLMs can only build average content, filling in the space between works. Artists seek to reach beyond the space their prior work defined.
The core problem with LLMs may be unsolvable. At this point, various organizations are exploring ways to tag AI-generated content (written and graphic) so humans can spend a moment assessing the accuracy and validity of the material. Of course, message digests can be corrupted and watermarks forged. A bad actor might maliciously tag authentic content as AI-generated. Recent developments include malicious ChatGPT variants designed to create BEC and phishing email content,
Students will always look for a shortcut, and that habit is difficult to overcome. In business, it will also be tempting for bureaucrats to use tools to simplify their tasks. How will your firm incorporate LLMs safely into your business processes? Organizations should consider how they will audit their internal procedures to ensure that LLM outputs are incorporated appropriately into communications. Imagine the potential for harm if some publicly traded company was found to have used an LLM to develop its annual financial report!
What do you think? Let me know in the comments below, or contact me @wjmalik@noc.social
By: Trend Micro August 15, 2023 Read time: 4 min (1157 words)
The unveiling of the first-ever Open Worldwide Application Security Project (OWASP) risk list for large language model AI chatbots was yet another sign of generative AI’s rush into the mainstream—and a crucial step toward protecting enterprises from AI-related threats.
For more than 20 years, the Open Worldwide Application Security Project (OWASP) top 10 risk list has been a go-to reference in the fight to make software more secure. So it’s no surprise developers and cybersecurity professionals paid close attention earlier this spring when OWASP published an all-new list focused on large language model AI vulnerabilities.
OWASP’s move is yet more proof of how quickly AI chatbots have swept into the mainstream. Nearly half (48%) of corporate respondents to one survey said that by February 2023 they had already replaced workers with ChatGPT—just three months after its public launch. With many observers expressing concern that AI adoption has rushed ahead without understanding of the risks involved, the OWASP top 10 AI risk list is both timely and essential.
Large language model vulnerabilities at a glance
OWASP has released two draft versions of its AI vulnerability list so far: one in May 2023 and a July 1 update with refined classifications and definitions, examples, scenarios, and links to additional references. The most recent is labeled ‘version 0.5’, and a formal version 1 is reported to be in the works.
We did some analysis and found the vulnerabilities identified by OWASP fall broadly into three categories:
Access risks associated with exploited privileges and unauthorized actions.
Data risks such as data manipulation or loss of services.
Reputational and business risks resulting from bad AI outputs or actions.
In this blog, we take a closer look at the specific risks in each case and offer some suggestions about how to handle them.
1. Access risks
Of the 10 vulnerabilities listed by OWASP, four are specific to access and misuse of privileges: insecure plugins, insecure output handling, permissions issues, and excessive agency.
According to OWASP, any large language model that uses insecure plugins to receive “free-form text” inputs could be exposed to malicious requests, resulting in unwanted behaviors or the execution of unauthorized remote code. On the flipside, plugins or applications that handle large language model outputs insecurely—without evaluating them—could be susceptible to cross-site and server-side request forgeries, unauthorized privilege escalations, hijack attacks, and more.
Similarly, when authorizations aren’t tracked between plugins, permissions issues can arise that open the way for indirect prompt injections or malicious plugin usage.
Finally, because AI chatbots are ‘actors’ able to make and implement decisions, it matters how much free reign (i.e., agency) they’re given. As OWASP explains, “When LLMs interface with other systems, unrestricted agency may lead to undesirable operations and actions.” Examples include personal mail reader assistants being exploited to propagate spam or customer service AI chatbots manipulated into issuing undeserved refunds.
In all of these cases, the large language model becomes a conduit for bad actors to infiltrate systems.
2. Data risks
Poisoned training data, supply chain vulnerabilities, prompt injection vulnerabilities and denials of serviceare all data-specific AI risks.
Data can be poisoned deliberately by bad actors who want to harm an organization. It can also be distorted inadvertently when an AI system learns from unreliable or unvetted sources. Both types of poisoning can occur within an active AI chatbot application or emerge from the large language model supply chain, where reliance on pre-trained models, crowdsourced data, and insecure plugin extensions may produce biased data outputs, security breaches, or system failures.
With prompt injections, ill-meaning inputs may cause a large language model AI chatbot to expose data that should be kept private or perform other actions that lead to data compromises.
AI denial of service attacks are similar to classic DOS attacks. They may aim to overwhelm a large language model and deprive users of access to data and apps, or—because many AI chatbots rely on pay-as-you-go IT infrastructure—force the system to consume excessive resources and rack up massive costs.
3. Reputational and business risks
The final OWASP vulnerability (according to our buckets) is already reaping consequences around the world today:overreliance on AI. There’s no shortage of stories about large language models generating false or inappropriate outputs from fabricated citations and legal precedents to racist and sexist language.
OWASP points out that depending on AI chatbots without proper oversight can make organizations vulnerable to publishing misinformation or offensive content that results in reputational damage or even legal action. Given all these various risks, the question becomes, “What can we do about it?” Fortunately, there are some protective steps organizations can take.
What enterprises can do about large language model vulnerabilities
From our perspective at Trend Micro, defending against AI access risks requires a zero-trust security stance with disciplined separation of systems (sandboxing). Even though generative AI has the ability to challenge zero-trust defenses in ways that other IT systems don’t—because it can mimic trusted entities—a zero-trust posture still adds checks and balances that make it easier to identify and contain unwanted activity. OWASP also advises that large language models “should not self-police” and calls for controls to be embedded in application programming interfaces (APIs).
Sandboxing is also key to protecting data privacy and integrity: keeping confidential information fully separated from shareable data and making it inaccessible to AI chatbots and other public-facing systems. (See our recent blog on AI cybersecurity policies for more.)
Good separation of data prevents large language models from including private or personally identifiable information in public outputs, and from being publicly prompted to interact with secure applications such as payment systems in inappropriate ways.
On the reputational front, the simplest remedies are to not rely solely on AI-generated content or code, and to never publish or use AI outputs without first verifying they are true, accurate, and reliable.
Many of these defensive measures can—and should—be embedded in corporate policies. Once an appropriate policy foundation is in place, security technologies such as endpoint detection and response (EDR), extended detection and response (XDR), and security information and event management (SIEM) can be used for enforcement and to monitor for potentially harmful activity.
Large language model AI chatbots are here to stay
OWASP’s initial work cataloguing AI risks proves that concerns about the rush to embrace AI are well justified. At the same time, AI clearly isn’t going anywhere, so understanding the risks and taking responsible steps to mitigate them is critically important.
Setting up the right policies to manage AI use and implementing those policies with the help of cybersecurity solutions is a good first step. So is staying informed. The way we see it at Trend Micro, OWASP’s top 10 AI risk list is bound to become as much of an annual must-read as its original application security list has been since 2003.
Next steps
For more Trend Micro thought leadership on AI chatbot security, check out these resources:
By: Trend Micro Research August 09, 2023 Read time: 7 min (1966 words)
Updated on August 9, 2023, 9:30 a.m. EDT: We updated the entry to include an analysis of current Rhysida ransomware samples’ encryption routine. Updated on August 14, 2023, 6:00 a.m. EDT: We updated the entry to include Trend XDR workbench alerts for Rhysida and its components.
Introduction
On August 4, 2023, the HHS’ Health Sector Cybersecurity Coordination Center (HC3) released a security alert about a relatively new ransomware called Rhysida (detected as Ransom.PS1.RHYSIDA.SM), which has been active since May 2023. In this blog entry, we will provide details on Rhysida, including its targets and what we know about its infection chain.
Who is behind the Rhysida ransomware?
Not much is currently known about the threat actors behind Rhysida in terms of origin or affiliations. According to the HC3 alert, Rhysida poses itself as a “cybersecurity team” that offers to assist victims in finding security weaknesses within their networks and system. In fact, the group’s first appearance involved the use of a victim chat support portal.
Who are Rhysida’s targets?
As mentioned earlier, Rhysida, which was previously known for targeting the education, government, manufacturing, and tech industries, among others — has begun conducting attacks on healthcare and public health organizations. The healthcare industry has seen an increasing number of ransomware attacks over the past five years. This includes a recent incident involving Prospect Medical Holdings, a California-based healthcare system, that occurred in early August (although the group behind the attack has yet to be named as of writing).
Data from Trend Micro™ Smart Protection Network™ (SPN) shows a similar trend, where detections from May to August 2023 show that its operators are targeting multiple industries rather than focusing on just a single sector.
The threat actor also targets organizations around the world, with SPN data showing several countries where Rhysida binaries were detected, including Indonesia, Germany, and the United States.
Figure 1. The industry and country detection count for Rhysida ransomware based on Trend SPN data from May to August 2023
How does a Rhysida attack proceed?
Figure 2. The Rhysida ransomware infection chain
Rhysida ransomware usually arrives on a victim’s machine via phishing lures, after which Cobalt Strike is used for lateral movement within the system.
Additionally, our telemetry shows that the threat actors execute PsExec to deploy PowerShell scripts and the Rhysida ransomware payload itself. The PowerShell script (g.ps1), detected as Trojan.PS1.SILENTKILL.A, is used by the threat actors to terminate antivirus-related processes and services, delete shadow copies, modify remote desktop protocol (RDP) configurations, and change the active directory (AD) password.
Interestingly, it appears that the script (g.ps1) was updated by the threat actors during execution, eventually leading us to a PowerShell version of the Rhysida ransomware.
Rhysida ransomware employs a 4096-bit RSA key and AES-CTR for file encryption, which we discuss in detail in a succeeding section. After successful encryption, it appends the .rhysida extension and drops the ransom note CriticalBreachDetected.pdf.
This ransom note is fairly unusual — instead of an outright ransom demand as seen in most ransom notes from other ransomware families, the Rhysida ransom note is presented as an alert from the Rhysida “cybersecurity team” notifying victims that their system has been compromised and their files encrypted. The ransom demand comes in the form of a “unique key” designed to restore encrypted files, which must be paid for by the victim.
Summary of malware and tools used by Rhysida
Malware: RHYSIDA, SILENTKILL, Cobalt Strike
Tools: PsExec
Initial Access
Phishing
Based on external reports, Rhysida uses phishing lures for initial access
Lateral Movement
PsExec
Microsoft tool used for remote execution
Cobalt Strike
3rd party tool abused for lateral movement
Defense Evasion
SILENTKILL
Malware deployed to terminate security-related processes and services, delete shadow copies, modify RDP configurations, and change the AD password
Impact
Rhysida ransomware
Ransomware encryption
Table 1. A summary of the malware, tools, and exploits used by Rhysida
A closer look at Rhysida’s encryption routine After analyzing current Rhysida samples, we observed that the ransomware uses LibTomCrypt, an open-source cryptographic library, to implement its encryption routine. Figure 3 shows the procedures Rhysida follows when initializing its encryption parameters.
Figure 3. Rhysida’s parameters for encryption
Rhysida uses LibTomCrypt’s pseudorandom number generator (PRNG) functionalities for key and initialization vector (IV) generation. The init_prng function is used to initialize PRNG functionalities as shown in Figure 4. The same screenshot also shows how the ransomware uses the library’s ChaCha20 PRNG functionality.
Figure 4. Rhysida’s use of the “init_prng” function
After the PRNG is initialized, Rhysida then proceeds to import the embedded RSA key and declares the encryption algorithm it will use for file encryption:
It will use the register_cipher function to “register” the algorithm (in this case, aes), to its table of usable ciphers.
It will use the find_cipher function to store the algorithm to be used (still aes), in the variable CIPHER.
Afterward, it will proceed to also register and declare aes for its Cipher Hash Construction (CHC) functionalities.
Based on our analysis, Rhysida’s encryption routine follows these steps:
After it reads file contents for encryption, it will use the initialized PRNG’s function, chacha20_prng_read, to generate both a key and an IV that are unique for each file.
It will use the ctr_start function to initialize the cipher that will be used, which is aes (from the variable CIPHER), in counter or CTR mode.
The generated key and IV are then encrypted with the rsa_encrypt_key_ex function.
Once the key and IV are encrypted, Rhysida will proceed to encrypt the file using LibTomCrypt’s ctr_encrypt function.
Figure 5. Rhysida’s encryption routine
Unfortunately, since each encrypted file has a unique key and IV — and only the attackers have a copy of the associated private key — decryption is currently not feasible.
How can organizations protect themselves from Rhysida and other ransomware families?
Although we are still in the process of fully analyzing Rhysida ransomware and its tools, tactics, and procedures (TTPs), the best practices for defending against ransomware attacks still holds true for Rhysida and other ransomware families.
Here are several recommended measures that organizations implement to safeguard their systems from ransomware attacks:
Create an inventory of assets and data
Review event and incident logs
Manage hardware and software configurations.
Grant administrative privileges and access only when relevant to an employee’s role and responsibilities.
Enforce security configurations on network infrastructure devices like firewalls and routers.
Establish a software whitelist permitting only legitimate applications
Perform routine vulnerability assessments
Apply patches or virtual patches for operating systems and applications
Keep software and applications up to date using their latest versions
Integrate data protection, backup, and recovery protocols
Utilize sandbox analysis to intercept malicious emails
Regularly educate and evaluate employees’ security aptitude
Deploy security tools (such as XDR) which are capable of detecting abuse of legitimate applications
Indicators of compromise
Hashes
The indicators of compromise for this entry can be found here.
MITRE ATT&CK Matrix
Initial Access
T1566 Phishing
Based on external reports, Rhysida uses phishing lures for initial access.
Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell
It uses cmd.exe to execute commands for execution.
T1059.001 Command and Scripting Interpreter: PowerShell
It uses PowerShell to create scheduled task named Rhsd pointing to the ransomware.
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
When executed with the argument -S, it will create a scheduled task named Rhsd that will execute the ransomware
Defense Evasion
T1070.004 Indicator Removal: File Deletion
Rhysida ransomware deletes itself after execution. The scheduled task (Rhsd) created would also be deleted after execution.
T1070.001 Indicator Removal: Clear Windows Event Logs
It uses wevtutil.exe to clear Windows event logs.
Discovery
T1083 File and Directory Discovery
It enumerates and looks for files to encrypt in all local drives.
T1082 System Information Discovery
Obtains the following information:Number of processorsSystem information
Impact
T1490 Inhibit System Recovery
It executes uses vssadmin to remove volume shadow copies
T1486 Data Encrypted for Impact
It uses a 4096-bit RSA key and Cha-cha20 for file encryption.It avoids encrypting files with the following strings in their file name:.bat.bin.cab.cmd.com.cur.diagcab.diagcfg.diagpkg.drv.dll.exe.hlp.hta.ico.msi.ocx.ps1.psm1.scr.sys.ini.Thumbs.db.url.isoIt avoids encrypting files found in the following folders:$Recycle.BinBootDocuments and SettingsPerfLogsProgramDataRecoverySystem Volume InformationWindows$RECYCLE.BINApzDataIt appends the following extension to the file name of the encrypted files:.rhysidaIt encrypts all system drives from A to Z.It drops the following ransom note:{Encrypted Directory}\CriticalBreachDetected.pdf
T1491.001 Defacement: Internal Defacement
It changes the desktop wallpaper after encryption and prevents the user from changing it back by modifying the NoChangingWallpaper registry value.
As ransomware attacks continue to grow in number and sophistication, threat actors can quickly impact business operations if organizations are not well prepared. In a recent investigation by Microsoft Incident Response (previously known as Microsoft Detection and Response Team – DART) of an intrusion, we found that the threat actor progressed through the full attack chain, from initial access to impact, in less than five days, causing significant business disruption for the victim organization.
Our investigation found that within those five days, the threat actor employed a range of tools and techniques, culminating in the deployment of BlackByte 2.0 ransomware, to achieve their objectives. These techniques included:
Exploitation of unpatched internet-exposed Microsoft Exchange Servers
Web shell deployment facilitating remote access
Use of living-off-the-land tools for persistence and reconnaissance
Deployment of Cobalt Strike beacons for command and control (C2)
Process hollowing and the use of vulnerable drivers for defense evasion
Deployment of custom-developed backdoors to facilitate persistence
Deployment of a custom-developed data collection and exfiltration tool
Figure 1. BlackByte 2.0 ransomware attack chain
In this blog, we share details of our investigation into the end-to-end attack chain, exposing security weaknesses that the threat actor exploited to advance their attack. As we learned from Microsoft’s tracking of ransomware attacks and the cybercriminal economy that enables them, disrupting common attack patterns could stop many of the attacker activities that precede ransomware deployment. This case highlights that common security hygiene practices go a long way in preventing, identifying, and responding to malicious activity as early as possible to mitigate the impact of ransomware attacks. We encourage organizations to follow the outlined mitigation steps, including ensuring that internet-facing assets are up to date and configured securely. We also share indicators of compromise, detection details, and hunting guidance to help organizations identify and respond to these attacks in their environments.
Forensic analysis
Initial access and privilege escalation
To obtain initial access into the victim’s environment, the threat actor was observed exploiting the ProxyShell vulnerabilities CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 on unpatched Microsoft Exchange Servers. The exploitation of these vulnerabilities allowed the threat actor to:
Attain system-level privileges on the compromised Exchange host
Enumerate LegacyDN of users by sending Autodiscover requests, including SIDs of users
Construct a valid authentication token and use it against the Exchange PowerShell backend
Impersonate domain admin users and create a web shell by using the New-MailboxExportRequest cmdlet
Create web shells to obtain remote control on affected servers
The threat actor was observed operating from the following IP to exploit ProxyShell and access the web shell:
185.225.73[.]244
Persistence
Backdoor
After gaining access to a device, the threat actor created the following registry run keys to run a payload each time a user signs in:
The file api-msvc.dll (SHA-256: 4a066569113a569a6feb8f44257ac8764ee8f2011765009fdfd82fe3f4b92d3e) was determined to be a backdoor capable of collecting system information, such as the installed antivirus products, device name, and IP address. This information is then sent via HTTP POST request to the following C2 channel:
hxxps://myvisit[.]alteksecurity[.]org/t
The organization was not using Microsoft Defender Antivirus, which detects this malware as Trojan:Win32/Kovter!MSR, as the primary antivirus solution, and the backdoor was allowed to run.
An additional file, api-system.png, was identified to have similarities to api-msvc.dll. This file behaved like a DLL, had the same default export function, and also leveraged run keys for persistence.
Cobalt Strike Beacon
The threat actor leveraged Cobalt Strike to achieve persistence. The file sys.exe (SHA-256: 5f37b85687780c089607670040dbb3da2749b91b8adc0aa411fd6280b5fa7103), detected by Microsoft Defender Antivirus as Trojan:Win64/CobaltStrike!MSR, was determined to be a Cobalt Strike Beacon and was downloaded directly from the file sharing service temp[.]sh:
hxxps://temp[.]sh/szAyn/sys.exe
This beacon was configured to communicate with the following C2 channel:
109.206.243[.]59:443
AnyDesk
Threat actors leverage legitimate remote access tools during intrusions to blend into a victim network. In this case, the threat actor utilized the remote administration tool AnyDesk, to maintain persistence and move laterally within the network. AnyDesk was installed as a service and was run from the following paths:
C:\systemtest\anydesk\AnyDesk.exe
C:\Program Files (x86)\AnyDesk\AnyDesk.exe
C:\Scripts\AnyDesk.exe
Successful connections were observed in the AnyDesk log file ad_svc.trace involving anonymizer service IP addresses linked to TOR and MULLVAD VPN, a common technique that threat actors employ to obscure their source IP ranges.
Reconnaissance
We found the presence and execution of the network discovery tool NetScan being used by the threat actor to perform network enumeration using the following file names:
Additionally, execution of AdFind (SHA-256: f157090fd3ccd4220298c06ce8734361b724d80459592b10ac632acc624f455e), an Active Directory reconnaissance tool, was observed in the environment.
Credential access
Evidence of likely usage of the credential theft tool Mimikatzwas also uncovered through the presence of a related log file mimikatz.log. Microsoft IR assesses that Mimikatz was likely used to attain credentials for privileged accounts.
Lateral movement
Using compromised domain admin credentials, the threat actor used Remote Desktop Protocol (RDP) and PowerShell remoting to obtain access to other servers in the environment, including domain controllers.
Data staging and exfiltration
In one server where Microsoft Defender Antivirus was installed, a suspicious file named explorer.exe was identified, detected as Trojan:Win64/WinGoObfusc.LK!MT, and quarantined. However, because tamper protection wasn’t enabled on this server, the threat actor was able to disable the Microsoft Defender Antivirus service, enabling the threat actor to run the file using the following command:
explorer.exe P@$$w0rd
After reverse engineering explorer.exe, we determined it to be ExByte, a GoLang-based tool developed and commonly used in BlackByte ransomware attacks for collection and exfiltration of files from victim networks. This tool is capable of enumerating files of interest across the network and, upon execution, creates a log file containing a list of files and associated metadata. Multiple log files were uncovered during the investigation in the path:
C:\Exchange\MSExchLog.log
Analysis of the binary revealed a list of file extensions that are targeted for enumeration.
Figure 2. Binary analysis showing file extensions enumerated by explorer.exe
Forensic analysis identified a file named data.txt that was created and later deleted after ExByte execution. This file contained obfuscated credentials that ExByte leveraged to authenticate to the popular file sharing platform Mega NZ using the platform’s API at:
hxxps://g.api.mega.co[.]nz
Figure 3. Binary analysis showing explorer.exe functionality for connecting to file sharing service MEGA NZ
We also determined that this version of Exbyte was crafted specifically for the victim, as it contained a hardcoded device name belonging to the victim and an internal IP address.
ExByte execution flow
Upon execution, ExByte decodes several strings and checks if the process is running with privileged access by reading \\.\PHYSICALDRIVE0:
If this check fails, ShellExecuteW is invoked with the IpOperation parameter RunAs, which runs explorer.exe with elevated privileges.
After this access check, explorer.exe attempts to read the data.txt file in the current location:
If the text file doesn’t exist, it invokes a command for self-deletion and exits from memory:
If data.txt exists, explorer.exe reads the file, passes the buffer to Base64 decode function, and then decrypts the data using the key provided in the command line. The decrypted data is then parsed as JSON below and fed for login function:
{“a”:”us0”,“user”:”<CONTENT FROM data.txt>”}
Finally, it forms a URL for sign-in to the API of the service MEGA NZ:
hxxps://g.api.mega.co[.]nz/cs?id=1674017543
Data encryption and destruction
On devices where files were successfully encrypted, we identified suspicious executables, detected by Microsoft Defender Antivirus as Trojan:Win64/BlackByte!MSR, with the following names:
wEFT.exe
schillerized.exe
The files were analyzed and determined to be BlackByte 2.0 binaries responsible for encryption across the environment. The binaries require an 8-digit key number to encrypt files.
Two modes of execution were identified:
When the -s parameter is provided, the ransomware self-deletes and encrypts the machine it was executed on.
When the -a parameter is provided, the ransomware conducts enumeration and uses an Ultimate Packer Executable (UPX) packed version of PsExec to deploy across the network. Several domain admin credentials were hardcoded in the binary, facilitating the deployment of the binary across the network.
Depending on the switch (-s or -a), execution may create the following files:
C:\SystemData\M8yl89s7.exe (UPX-packed PsExec with a random name; SHA-256: ba3ec3f445683d0d0407157fda0c26fd669c0b8cc03f21770285a20b3133098f)
C:\SystemData\rENEgOtiAtES (A vulnerable (CVE-2019-16098) driver RtCore64.sys used to evade detection by installed antivirus software; SHA-256: 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd)
C:\SystemData\iHu6c4.ico (Random name – BlackBytes icon)
Some capabilities identified for the BlackByte 2.0 ransomware were:
Antivirus bypass
The file rENEgOtiAtES created matches RTCore64.sys, a vulnerable driver (CVE-2049-16098) that allows any authenticated user to read or write to arbitrary memory
The BlackByte binary then creates and starts a service named RABAsSaa calling rENEgOtiAtES, and exploits this service to evade detection by installed antivirus software
Process hollowing
Invokes svchost.exe, injects to it to complete device encryption, and self-deletes by executing the following command:
Ability to terminate running services and processes
Ability to enumerate and mount volumes and network shares for encryption
Perform anti-forensics technique timestomping (sets the file time of encrypted and ReadMe file to 2000-01-01 00:00:00)
Ability to perform anti-debugging techniques
Recommendations
To guard against BlackByte ransomware attacks, Microsoft recommends the following:
Ensure that you have a patch management process in place and that patching for internet-exposed devices is prioritized; Understand and assess your cyber exposure with advanced vulnerability and configuration assessment tools like Microsoft Defender Vulnerability Management
Implement an endpoint detection and response (EDR) solution like Microsoft Defender for Endpoint to gain visibility into malicious activity in real time across your network
Ensure antivirus protections are updated regularly by turning on cloud-based protection and that your antivirus solution is configured to block threats
Enable tamper protection to prevent components of Microsoft Defender Antivirus from being disabled
Block inbound traffic from IPs specified in the indicators of compromise section of this report
Block inbound traffic from TOR exit nodes
Block inbound access from unauthorized public VPN services
Restrict administrative privileges to prevent authorized system changes
Conclusion
BlackByte ransomware attacks target organizations that have infrastructure with unpatched vulnerabilities. As outlined in the Microsoft Digital Defense Report, common security hygiene practices, including keeping systems up to date, could protect against 98% of attacks.
As new tools are being developed by threat actors, a modern threat protection solution like Microsoft 365 Defender is necessary to prevent and detect the multiple techniques used in the attack chain, especially where the threat actor attempts to evade or disable specific defense mechanisms. Hunting for malicious behavior should be performed regularly in order to detect potential attacks that could evade detections, as a complementary activity for continuous monitoring from security tools alerts and incidents.
To understand how Microsoft can help you secure your network and respond to network compromise, visit https://aka.ms/MicrosoftIR.
Microsoft 365 Defender detections
Microsoft Defender Antivirus
Microsoft Defender Antivirus detects this threat as the following malware:
Trojan:Win32/Kovter!MSR
Trojan:Win64/WinGoObfusc.LK!MT
Trojan:Win64/BlackByte!MSR
HackTool:Win32/AdFind!MSR
Trojan:Win64/CobaltStrike!MSR
Microsoft Defender for Endpoint
The following alerts might indicate threat activity related to this threat. Note, however, that these alerts can be also triggered by unrelated threat activity.
‘CVE-2021-31207’ exploit malware was detected
An active ‘NetShDisableFireWall’ malware in a command line was prevented from executing.
Suspicious registry modification.
‘Rtcore64’ hacktool was detected
Possible ongoing hands-on-keyboard activity (Cobalt Strike)
A file or network connection related to a ransomware-linked emerging threat activity group detected
Suspicious sequence of exploration activities
A process was injected with potentially malicious code
Suspicious behavior by cmd.exe was observed
‘Blackbyte’ ransomware was detected
Microsoft Defender Vulnerability Management
Microsoft Defender Vulnerability Management surfaces devices that may be affected by the following vulnerabilities used in this threat:
CVE-2021-34473
CVE-2021-34523
CVE-2021-31207
CVE-2019-16098
Hunting queries
Microsoft 365 Defender
Microsoft 365 Defender customers can run the following query to find related activity in their networks:
ProxyShell web shell creation events
DeviceProcessEvents| where ProcessCommandLine has_any ("ExcludeDumpster","New-ExchangeCertificate") and ProcessCommandLine has_any ("-RequestFile","-FilePath")
Suspicious vssadmin events
DeviceProcessEvents| where ProcessCommandLine has_any ("vssadmin","vssadmin.exe") and ProcessCommandLine has "Resize ShadowStorage" and ProcessCommandLine has_any ("MaxSize=401MB"," MaxSize=UNBOUNDED")
Detection for persistence creation using Registry Run keys
DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where (RegistryKey has @"Microsoft\Windows\CurrentVersion\RunOnce" and RegistryValueName == "MsEdgeMsE") or (RegistryKey has @"Microsoft\Windows\CurrentVersion\RunOnceEx" and RegistryValueName == "MsEdgeMsE")or (RegistryKey has @"Microsoft\Windows\CurrentVersion\Run" and RegistryValueName == "MsEdgeMsE")| where RegistryValueData startswith @"rundll32"| where RegistryValueData endswith @".dll,Default"| project Timestamp,DeviceId,DeviceName,ActionType,RegistryKey,RegistryValueName,RegistryValueData
Microsoft Sentinel
Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace. More details on the Content Hub can be found here: https://learn.microsoft.com/azure/sentinel/sentinel-solutions-deploy
Microsoft Sentinel also has a range of detection and threat hunting content that customers can use to detect the post exploitation activity detailed in this blog in addition to Microsoft 365 Defender detections list above.
The table below shows IOCs observed during our investigation. We encourage our customers to investigate these indicators in their environments and implement detections and protections to identify past related activity and prevent future attacks against their systems.
AdFind.exe (Active Directory information gathering tool)
hxxps://myvisit[.]alteksecurity[.]org/t
URL
C2 for backdoor api-msvc.dll
hxxps://temp[.]sh/szAyn/sys.exe
URL
Download URL for sys.exe
109.206.243[.]59
IP Address
C2 for Cobalt Strike Beacon sys.exe
185.225.73[.]244
IP Address
Originating IP address for ProxyShell exploitation and web shell interaction
NOTE: These indicators should not be considered exhaustive for this observed activity.
Appendix
File extensions targeted by BlackByte binary for encryption:
.4dd
.4dl
.accdb
.accdc
.accde
.accdr
.accdt
.accft
.adb
.ade
.adf
.adp
.arc
.ora
.alf
.ask
.btr
.bdf
.cat
.cdb
.ckp
.cma
.cpd
.dacpac
.dad
.dadiagrams
.daschema
.db
.db-shm
.db-wal
.db3
.dbc
.dbf
.dbs
.dbt
.dbv
. dbx
. dcb
. dct
. dcx
. ddl
. dlis
. dp1
. dqy
. dsk
. dsn
. dtsx
. dxl
. eco
. ecx
. edb
. epim
. exb
. fcd
. fdb
. fic
. fmp
. fmp12
. fmpsl
. fol
.fp3
. fp4
. fp5
. fp7
. fpt
. frm
. gdb
. grdb
. gwi
. hdb
. his
. ib
. idb
. ihx
. itdb
. itw
. jet
. jtx
. kdb
. kexi
. kexic
. kexis
. lgc
. lwx
. maf
. maq
. mar
. masmav
. mdb
. mpd
. mrg
. mud
. mwb
. myd
. ndf
. nnt
. nrmlib
. ns2
. ns3
. ns4
. nsf
. nv
. nv2
. nwdb
. nyf
. odb
. ogy
. orx
. owc
. p96
. p97
. pan
. pdb
. pdm
. pnz
. qry
. qvd
. rbf
. rctd
. rod
. rodx
. rpd
. rsd
. sas7bdat
. sbf
. scx
. sdb
. sdc
. sdf
. sis
. spg
. sql
. sqlite
. sqlite3
. sqlitedb
. te
. temx
. tmd
. tps
. trc
. trm
. udb
. udl
. usr
. v12
. vis
. vpd
. vvv
. wdb
. wmdb
. wrk
. xdb
. xld
. xmlff
. abcddb
. abs
. abx
. accdw
. and
. db2
. fm5
. hjt
. icg
. icr
. kdb
. lut
. maw
. mdn
. mdt
Shared folders targeted for encryption (Example: \\[IP address]\Downloads):
Users
Backup
Veeam
homes
home
media
common
Storage Server
Public
Web
Images
Downloads
BackupData
ActiveBackupForBusiness
Backups
NAS-DC
DCBACKUP
DirectorFiles
share
File extensions ignored:
.ini
.url
.msilog
.log
.ldf
.lock
.theme
.msi
.sys
.wpx
.cpl
.adv
.msc
.scr
.key
.ico
.dll
.hta
.deskthemepack
.nomedia
.msu
.rtp
.msp
.idx
.ani
.386
.diagcfg
.bin
.mod
.ics
.com
.hlp
.spl
.nls
.cab
.exe
.diagpkg
.icl
.ocx
.rom
.prf
.thempack
.msstyles
.icns
.mpa
.drv
.cur
.diagcab
.cmd
.shs
Folders ignored:
windows
boot
program files (x86)
windows.old
programdata
intel
bitdefender
trend micro
windowsapps
appdata
application data
system volume information
perflogs
msocache
Files ignored:
bootnxt
ntldr
bootmgr
thumbs.db
ntuser.dat
bootsect.bak
autoexec.bat
iconcache.db
bootfont.bin
Processes terminated:
teracopy
teamviewer
nsservice
nsctrl
uranium
processhacker
procmon
pestudio
procmon64
x32dbg
x64dbg
cff explorer
procexp
pslist
tcpview
tcpvcon
dbgview
rammap
rammap64
vmmap
ollydbg
autoruns
autorunssc
filemon
regmon
idaq
idaq64
immunitydebugger
wireshark
dumpcap
hookexplorer
importrec
petools
lordpe
sysinspector
proc_analyzer
sysanalyzer
sniff_hit
windbg
joeboxcontrol
joeboxserver
resourcehacker
fiddler
httpdebugger
dumpit
rammap
rammap64
vmmap
agntsvc
cntaosmgr
dbeng50
dbsnmp
encsvc
infopath
isqlplussvc
mbamtray
msaccess
msftesql
mspub
mydesktopqos
mydesktopservice
mysqld
mysqld-nt
mysqld-opt
Ntrtscan
ocautoupds
ocomm
ocssd
onenote
oracle
outlook
PccNTMon
powerpnt
sqbcoreservice
sql
sqlagent
sqlbrowser
sqlservr
sqlwriter
steam
synctime
tbirdconfig
thebat
thebat64
thunderbird
tmlisten
visio
winword
wordpad
xfssvccon
zoolz
Services terminated:
CybereasonRansomFree
vnetd
bpcd
SamSs
TeraCopyService
msftesql
nsService
klvssbridge64
vapiendpoint
ShMonitor
Smcinst
SmcService
SntpService
svcGenericHost
Swi_
TmCCSF
tmlisten
TrueKey
TrueKeyScheduler
TrueKeyServiceHelper
WRSVC
McTaskManager
OracleClientCache80
mfefire
wbengine
mfemms
RESvc
mfevtp
sacsvr
SAVAdminService
SepMasterService
PDVFSService
ESHASRV
SDRSVC
FA_Scheduler
KAVFS
KAVFS_KAVFSGT
kavfsslp
klnagent
macmnsvc
masvc
MBAMService
MBEndpointAgent
McShield
audioendpointbuilder
Antivirus
AVP
DCAgent
bedbg
EhttpSrv
MMS
ekrn
EPSecurityService
EPUpdateService
ntrtscan
EsgShKernel
msexchangeadtopology
AcrSch2Svc
MSOLAP$TPSAMA
Intel(R) PROSet Monitoring
msexchangeimap4
ARSM
unistoresvc_1af40a
ReportServer$TPS
MSOLAP$SYSTEM_BGC
W3Svc
MSExchangeSRS
ReportServer$TPSAMA
Zoolz 2 Service
MSOLAP$TPS
aphidmonitorservice
SstpSvc
MSExchangeMTA
ReportServer$SYSTEM_BGC
Symantec System Recovery
UI0Detect
MSExchangeSA
MSExchangeIS
ReportServer
MsDtsServer110
POP3Svc
MSExchangeMGMT
SMTPSvc
MsDtsServer
IisAdmin
MSExchangeES
EraserSvc11710
Enterprise Client Service
MsDtsServer100
NetMsmqActivator
stc_raw_agent
VSNAPVSS
PDVFSService
AcrSch2Svc
Acronis
CASAD2DWebSvc
CAARCUpdateSvc
McAfee
avpsus
DLPAgentService
mfewc
BMR Boot Service
DefWatch
ccEvtMgr
ccSetMgr
SavRoam
RTVsc screenconnect
ransom
sqltelemetry
msexch
vnc
teamviewer
msolap
veeam
backup
sql
memtas
vss
sophos
svc$
mepocs
wuauserv
Drivers that Blackbyte can bypass:
360avflt.sys
360box.sys
360fsflt.sys
360qpesv.sys
5nine.cbt.sys
a2acc.sys
a2acc64.sys
a2ertpx64.sys
a2ertpx86.sys
a2gffi64.sys
a2gffx64.sys
a2gffx86.sys
aaf.sys
aalprotect.sys
abrpmon.sys
accessvalidator.sys
acdriver.sys
acdrv.sys
adaptivaclientcache32.sys
adaptivaclientcache64.sys
adcvcsnt.sys
adspiderdoc.sys
aefilter.sys
agentrtm64.sys
agfsmon.sys
agseclock.sys
agsyslock.sys
ahkamflt.sys
ahksvpro.sys
ahkusbfw.sys
ahnrghlh.sys
aictracedrv_am.sys
airship-filter.sys
ajfsprot.sys
alcapture.sys
alfaff.sys
altcbt.sys
amfd.sys
amfsm.sys
amm6460.sys
amm8660.sys
amsfilter.sys
amznmon.sys
antileakfilter.sys
antispyfilter.sys
anvfsm.sys
apexsqlfilterdriver.sys
appcheckd.sys
appguard.sys
appvmon.sys
arfmonnt.sys
arta.sys
arwflt.sys
asgard.sys
ashavscan.sys
asiofms.sys
aswfsblk.sys
aswmonflt.sys
aswsnx.sys
aswsp.sys
aszfltnt.sys
atamptnt.sys
atc.sys
atdragent.sys
atdragent64.sys
aternityregistryhook.sys
atflt.sys
atrsdfw.sys
auditflt.sys
aupdrv.sys
avapsfd.sys
avc3.sys
avckf.sys
avfsmn.sys
avgmfi64.sys
avgmfrs.sys
avgmfx64.sys
avgmfx86.sys
avgntflt.sys
avgtpx64.sys
avgtpx86.sys
avipbb.sys
avkmgr.sys
avmf.sys
awarecore.sys
axfltdrv.sys
axfsysmon.sys
ayfilter.sys
b9kernel.sys
backupreader.sys
bamfltr.sys
bapfecpt.sys
bbfilter.sys
bd0003.sys
bddevflt.sys
bdfiledefend.sys
bdfilespy.sys
bdfm.sys
bdfsfltr.sys
bdprivmon.sys
bdrdfolder.sys
bdsdkit.sys
bdsfilter.sys
bdsflt.sys
bdsvm.sys
bdsysmon.sys
bedaisy.sys
bemk.sys
bfaccess.sys
bfilter.sys
bfmon.sys
bhdrvx64.sys
bhdrvx86.sys
bhkavka.sys
bhkavki.sys
bkavautoflt.sys
bkavsdflt.sys
blackbirdfsa.sys
blackcat.sys
bmfsdrv.sys
bmregdrv.sys
boscmflt.sys
bosfsfltr.sys
bouncer.sys
boxifier.sys
brcow_x_x_x_x.sys
brfilter.sys
brnfilelock.sys
brnseclock.sys
browsermon.sys
bsrfsflt.sys
bssaudit.sys
bsyaed.sys
bsyar.sys
bsydf.sys
bsyirmf.sys
bsyrtm.sys
bsysp.sys
bsywl.sys
bwfsdrv.sys
bzsenspdrv.sys
bzsenth.sys
bzsenyaradrv.sys
caadflt.sys
caavfltr.sys
cancelsafe.sys
carbonblackk.sys
catflt.sys
catmf.sys
cbelam.sys
cbfilter20.sys
cbfltfs4.sys
cbfsfilter2017.sys
cbfsfilter2020.sys
cbsampledrv.sys
cdo.sys
cdrrsflt.sys
cdsgfsfilter.sys
centrifyfsf.sys
cfrmd.sys
cfsfdrv
cgwmf.sys
change.sys
changelog.sys
chemometecfilter.sys
ciscoampcefwdriver.sys
ciscoampheurdriver.sys
ciscosam.sys
clumiochangeblockmf.sys
cmdccav.sys
cmdcwagt.sys
cmdguard.sys
cmdmnefs.sys
cmflt.sys
code42filter.sys
codex.sys
conduantfsfltr.sys
containermonitor.sys
cpavfilter.sys
cpavkernel.sys
cpepmon.sys
crexecprev.sys
crncache32.sys
crncache64.sys
crnsysm.sys
cruncopy.sys
csaam.sys
csaav.sys
csacentr.sys
csaenh.sys
csagent.sys
csareg.sys
csascr.sys
csbfilter.sys
csdevicecontrol.sys
csfirmwareanalysis.sys
csflt.sys
csmon.sys
cssdlp.sys
ctamflt.sys
ctifile.sys
ctinet.sys
ctrpamon.sys
ctx.sys
cvcbt.sys
cvofflineflt32.sys
cvofflineflt64.sys
cvsflt.sys
cwdriver.sys
cwmem2k64.sys
cybkerneltracker.sys
cylancedrv64.sys
cyoptics.sys
cyprotectdrv32.sys
cyprotectdrv64.sys
cytmon.sys
cyverak.sys
cyvrfsfd.sys
cyvrlpc.sys
cyvrmtgn.sys
datanow_driver.sys
dattofsf.sys
da_ctl.sys
dcfafilter.sys
dcfsgrd.sys
dcsnaprestore.sys
deepinsfs.sys
delete_flt.sys
devmonminifilter.sys
dfmfilter.sys
dgedriver.sys
dgfilter.sys
dgsafe.sys
dhwatchdog.sys
diflt.sys
diskactmon.sys
dkdrv.sys
dkrtwrt.sys
dktlfsmf.sys
dnafsmonitor.sys
docvmonk.sys
docvmonk64.sys
dpmfilter.sys
drbdlock.sys
drivesentryfilterdriver2lite.sys
drsfile.sys
drvhookcsmf.sys
drvhookcsmf_amd64.sys
drwebfwflt.sys
drwebfwft.sys
dsark.sys
dsdriver.sys
dsfemon.sys
dsflt.sys
dsfltfs.sys
dskmn.sys
dtdsel.sys
dtpl.sys
dwprot.sys
dwshield.sys
dwshield64.sys
eamonm.sys
easeflt.sys
easyanticheat.sys
eaw.sys
ecatdriver.sys
edevmon.sys
ednemfsfilter.sys
edrdrv.sys
edrsensor.sys
edsigk.sys
eectrl.sys
eetd32.sys
eetd64.sys
eeyehv.sys
eeyehv64.sys
egambit.sys
egfilterk.sys
egminflt.sys
egnfsflt.sys
ehdrv.sys
elock2fsctldriver.sys
emxdrv2.sys
enigmafilemondriver.sys
enmon.sys
epdrv.sys
epfw.sys
epfwwfp.sys
epicfilter.sys
epklib.sys
epp64.sys
epregflt.sys
eps.sys
epsmn.sys
equ8_helper.sys
eraser.sys
esensor.sys
esprobe.sys
estprmon.sys
estprp.sys
estregmon.sys
estregp.sys
estrkmon.sys
estrkr.sys
eventmon.sys
evmf.sys
evscase.sys
excfs.sys
exprevdriver.sys
failattach.sys
failmount.sys
fam.sys
fangcloud_autolock_driver.sys
fapmonitor.sys
farflt.sys
farwflt.sys
fasdriver
fcnotify.sys
fcontrol.sys
fdrtrace.sys
fekern.sys
fencry.sys
ffcfilt.sys
ffdriver.sys
fildds.sys
filefilter.sys
fileflt.sys
fileguard.sys
filehubagent.sys
filemon.sys
filemonitor.sys
filenamevalidator.sys
filescan.sys
filesharemon.sys
filesightmf.sys
filesystemcbt.sys
filetrace.sys
file_monitor.sys
file_protector.sys
file_tracker.sys
filrdriver.sys
fim.sys
fiometer.sys
fiopolicyfilter.sys
fjgsdis2.sys
fjseparettifilterredirect.sys
flashaccelfs.sys
flightrecorder.sys
fltrs329.sys
flyfs.sys
fmdrive.sys
fmkkc.sys
fmm.sys
fortiaptfilter.sys
fortimon2.sys
fortirmon.sys
fortishield.sys
fpav_rtp.sys
fpepflt.sys
fsafilter.sys
fsatp.sys
fsfilter.sys
fsgk.sys
fshs.sys
fsmon.sys
fsmonitor.sys
fsnk.sys
fsrfilter.sys
fstrace.sys
fsulgk.sys
fsw31rj1.sys
gagsecurity.sys
gbpkm.sys
gcffilter.sys
gddcv.sys
gefcmp.sys
gemma.sys
geprotection.sys
ggc.sys
gibepcore.sys
gkff.sys
gkff64.sys
gkpfcb.sys
gkpfcb64.sys
gofsmf.sys
gpminifilter.sys
groundling32.sys
groundling64.sys
gtkdrv.sys
gumhfilter.sys
gzflt.sys
hafsnk.sys
hbflt.sys
hbfsfltr.sys
hcp_kernel_acq.sys
hdcorrelatefdrv.sys
hdfilemon.sys
hdransomoffdrv.sys
hdrfs.sys
heimdall.sys
hexisfsmonitor.sys
hfileflt.sys
hiofs.sys
hmpalert.sys
hookcentre.sys
hooksys.sys
hpreg.sys
hsmltmon.sys
hsmltwhl.sys
hssfwhl.sys
hvlminifilter.sys
ibr2fsk.sys
iccfileioad.sys
iccfilteraudit.sys
iccfiltersc.sys
icfclientflt.sys
icrlmonitor.sys
iderafilterdriver.sys
ielcp.sys
ieslp.sys
ifs64.sys
ignis.sys
iguard.sys
iiscache.sys
ikfilesec.sys
im.sys
imffilter.sys
imfilter.sys
imgguard.sys
immflex.sys
immunetprotect.sys
immunetselfprotect.sys
inisbdrv64.sys
ino_fltr.sys
intelcas.sys
intmfs.sys
inuse.sys
invprotectdrv.sys
invprotectdrv64.sys
ionmonwdrv.sys
iothorfs.sys
ipcomfltr.sys
ipfilter.sys
iprotect.sys
iridiumswitch.sys
irongatefd.sys
isafekrnl.sys
isafekrnlmon.sys
isafermon
isecureflt.sys
isedrv.sys
isfpdrv.sys
isirmfmon.sys
isregflt.sys
isregflt64.sys
issfltr.sys
issregistry.sys
it2drv.sys
it2reg.sys
ivappmon.sys
iwdmfs.sys
iwhlp.sys
iwhlp2.sys
iwhlpxp.sys
jdppsf.sys
jdppwf.sys
jkppob.sys
jkppok.sys
jkpppf.sys
jkppxk.sys
k7sentry.sys
kavnsi.sys
kawachfsminifilter.sys
kc3.sys
kconv.sys
kernelagent32.sys
kewf.sys
kfac.sys
kfileflt.sys
kisknl.sys
klam.sys
klbg.sys
klboot.sys
kldback.sys
kldlinf.sys
kldtool.sys
klfdefsf.sys
klflt.sys
klgse.sys
klhk.sys
klif.sys
klifaa.sys
klifks.sys
klifsm.sys
klrsps.sys
klsnsr.sys
klupd_klif_arkmon.sys
kmkuflt.sys
kmnwch.sys
kmxagent.sys
kmxfile.sys
kmxsbx.sys
ksfsflt.sys
ktfsfilter.sys
ktsyncfsflt.sys
kubwksp.sys
lafs.sys
lbd.sys
lbprotect.sys
lcgadmon.sys
lcgfile.sys
lcgfilemon.sys
lcmadmon.sys
lcmfile.sys
lcmfilemon.sys
lcmprintmon.sys
ldsecdrv.sys
libwamf.sys
livedrivefilter.sys
llfilter.sys
lmdriver.sys
lnvscenter.sys
locksmith.sys
lragentmf.sys
lrtp.sys
magicbackupmonitor.sys
magicprotect.sys
majoradvapi.sys
marspy.sys
maxcryptmon.sys
maxproc64.sys
maxprotector.sys
mbae64.sys
mbam.sys
mbamchameleon.sys
mbamshuriken.sys
mbamswissarmy.sys
mbamwatchdog.sys
mblmon.sys
mcfilemon32.sys
mcfilemon64.sys
mcstrg.sys
mearwfltdriver.sys
message.sys
mfdriver.sys
mfeaack.sys
mfeaskm.sys
mfeavfk.sys
mfeclnrk.sys
mfeelamk.sys
mfefirek.sys
mfehidk.sys
mfencbdc.sys
mfencfilter.sys
mfencoas.sys
mfencrk.sys
mfeplk.sys
mfewfpk.sys
miniicpt.sys
minispy.sys
minitrc.sys
mlsaff.sys
mmpsy32.sys
mmpsy64.sys
monsterk.sys
mozycorpfilter.sys
mozyenterprisefilter.sys
mozyentfilter.sys
mozyhomefilter.sys
mozynextfilter.sys
mozyoemfilter.sys
mozyprofilter.sys
mpfilter.sys
mpkernel.sys
mpksldrv.sys
mpxmon.sys
mracdrv.sys
mrxgoogle.sys
mscan-rt.sys
msiodrv4.sys
msixpackagingtoolmonitor.sys
msnfsflt.sys
mspy.sys
mssecflt.sys
mtsvcdf.sys
mumdi.sys
mwac.sys
mwatcher.sys
mwfsmfltr.sys
mydlpmf.sys
namechanger.sys
nanoavmf.sys
naswsp.sys
ndgdmk.sys
neokerbyfilter
netaccctrl.sys
netaccctrl64.sys
netguard.sys
netpeeker.sys
ngscan.sys
nlcbhelpi64.sys
nlcbhelpx64.sys
nlcbhelpx86.sys
nlxff.sys
nmlhssrv01.sys
nmpfilter.sys
nntinfo.sys
novashield.sys
nowonmf.sys
npetw.sys
nprosec.sys
npxgd.sys
npxgd64.sys
nravwka.sys
nrcomgrdka.sys
nrcomgrdki.sys
nregsec.sys
nrpmonka.sys
nrpmonki.sys
nsminflt.sys
nsminflt64.sys
ntest.sys
ntfsf.sys
ntguard.sys
ntps_fa.sys
nullfilter.sys
nvcmflt.sys
nvmon.sys
nwedriver.sys
nxfsmon.sys
nxrmflt.sys
oadevice.sys
oavfm.sys
oczminifilter.sys
odfsfilter.sys
odfsfimfilter.sys
odfstokenfilter.sys
offsm.sys
omfltlh.sys
osiris.sys
ospfile_mini.sys
ospmon.sys
parity.sys
passthrough.sys
path8flt.sys
pavdrv.sys
pcpifd.sys
pctcore.sys
pctcore64.sys
pdgenfam.sys
pecfilter.sys
perfectworldanticheatsys.sys
pervac.sys
pfkrnl.sys
pfracdrv.sys
pgpfs.sys
pgpwdefs.sys
phantomd.sys
phdcbtdrv.sys
pkgfilter.sys
pkticpt.sys
plgfltr.sys
plpoffdrv.sys
pointguardvista64f.sys
pointguardvistaf.sys
pointguardvistar32.sys
pointguardvistar64.sys
procmon11.sys
proggerdriver.sys
psacfileaccessfilter.sys
pscff.sys
psgdflt.sys
psgfoctrl.sys
psinfile.sys
psinproc.sys
psisolator.sys
pwipf6.sys
pwprotect.sys
pzdrvxp.sys
qdocumentref.sys
qfapflt.sys
qfilter.sys
qfimdvr.sys
qfmon.sys
qminspec.sys
qmon.sys
qqprotect.sys
qqprotectx64.sys
qqsysmon.sys
qqsysmonx64.sys
qutmdrv.sys
ranpodfs.sys
ransomdefensexxx.sys
ransomdetect.sys
reaqtor.sys
redlight.sys
regguard.sys
reghook.sys
regmonex.sys
repdrv.sys
repmon.sys
revefltmgr.sys
reveprocprotection.sys
revonetdriver.sys
rflog.sys
rgnt.sys
rmdiskmon.sys
rmphvmonitor.sys
rpwatcher.sys
rrmon32.sys
rrmon64.sys
rsfdrv.sys
rsflt.sys
rspcrtw.sys
rsrtw.sys
rswctrl.sys
rswmon.sys
rtologon.sys
rtw.sys
ruaff.sys
rubrikfileaudit.sys
ruidiskfs.sys
ruieye.sys
ruifileaccess.sys
ruimachine.sys
ruiminispy.sys
rvsavd.sys
rvsmon.sys
rw7fsflt.sys
rwchangedrv.sys
ryfilter.sys
ryguard.sys
safe-agent.sys
safsfilter.sys
sagntflt.sys
sahara.sys
sakfile.sys
sakmfile.sys
samflt.sys
samsungrapidfsfltr.sys
sanddriver.sys
santa.sys
sascan.sys
savant.sys
savonaccess.sys
scaegis.sys
scauthfsflt.sys
scauthiodrv.sys
scensemon.sys
scfltr.sys
scifsflt.sys
sciptflt.sys
sconnect.sys
scred.sys
sdactmon.sys
sddrvldr.sys
sdvfilter.sys
se46filter.sys
secdodriver.sys
secone_filemon10.sys
secone_proc10.sys
secone_reg10.sys
secone_usb.sys
secrmm.sys
secufile.sys
secure_os.sys
secure_os_mf.sys
securofsd_x64.sys
sefo.sys
segf.sys
segiraflt.sys
segmd.sys
segmp.sys
sentinelmonitor.sys
serdr.sys
serfs.sys
sfac.sys
sfavflt.sys
sfdfilter.sys
sfpmonitor.sys
sgresflt.sys
shdlpmedia.sys
shdlpsf.sys
sheedantivirusfilterdriver.sys
sheedselfprotection.sys
shldflt.sys
si32_file.sys
si64_file.sys
sieflt.sys
simrep.sys
sisipsfilefilter
sk.sys
skyamdrv.sys
skyrgdrv.sys
skywpdrv.sys
slb_guard.sys
sld.sys
smbresilfilter.sys
smdrvnt.sys
sndacs.sys
snexequota.sys
snilog.sys
snimg.sys
snscore.sys
snsrflt.sys
sodatpfl.sys
softfilterxxx.sys
soidriver.sys
solitkm.sys
sonar.sys
sophosdt2.sys
sophosed.sys
sophosntplwf.sys
sophossupport.sys
spbbcdrv.sys
spellmon.sys
spider3g.sys
spiderg3.sys
spiminifilter.sys
spotlight.sys
sprtdrv.sys
sqlsafefilterdriver.sys
srminifilterdrv.sys
srtsp.sys
srtsp64.sys
srtspit.sys
ssfmonm.sys
ssrfsf.sys
ssvhook.sys
stcvsm.sys
stegoprotect.sys
stest.sys
stflt.sys
stkrnl64.sys
storagedrv.sys
strapvista.sys
strapvista64.sys
svcbt.sys
swcommfltr.sys
swfsfltr.sys
swfsfltrv2.sys
swin.sys
symafr.sys
symefa.sys
symefa64.sys
symefasi.sys
symevent.sys
symevent64x86.sys
symevnt.sys
symevnt32.sys
symhsm.sys
symrg.sys
sysdiag.sys
sysmon.sys
sysmondrv.sys
sysplant.sys
szardrv.sys
szdfmdrv.sys
szdfmdrv_usb.sys
szedrdrv.sys
szpcmdrv.sys
taniumrecorderdrv.sys
taobserveflt.sys
tbfsfilt.sys
tbmninifilter.sys
tbrdrv.sys
tdevflt.sys
tedrdrv.sys
tenrsafe2.sys
tesmon.sys
tesxnginx.sys
tesxporter.sys
tffregnt.sys
tfsflt.sys
tgfsmf.sys
thetta.sys
thfilter.sys
threatstackfim.sys
tkdac2k.sys
tkdacxp.sys
tkdacxp64.sys
tkfsavxp.sys
tkfsavxp64.sys
tkfsft.sys
tkfsft64.sys
tkpcftcb.sys
tkpcftcb64.sys
tkpl2k.sys
tkpl2k64.sys
tksp2k.sys
tkspxp.sys
tkspxp64.sys
tmactmon.sys
tmcomm.sys
tmesflt.sys
tmevtmgr.sys
tmeyes.sys
tmfsdrv2.sys
tmkmsnsr.sys
tmnciesc.sys
tmpreflt.sys
tmumh.sys
tmums.sys
tmusa.sys
tmxpflt.sys
topdogfsfilt.sys
trace.sys
trfsfilter.sys
tritiumfltr.sys
trpmnflt.sys
trufos.sys
trustededgeffd.sys
tsifilemon.sys
tss.sys
tstfilter.sys
tstfsredir.sys
tstregredir.sys
tsyscare.sys
tvdriver.sys
tvfiltr.sys
tvmfltr.sys
tvptfile.sys
tvspfltr.sys
twbdcfilter.sys
txfilefilter.sys
txregmon.sys
uamflt.sys
ucafltdriver.sys
ufdfilter.sys
uncheater.sys
upguardrealtime.sys
usbl_ifsfltr.sys
usbpdh.sys
usbtest.sys
uvmcifsf.sys
uwfreg.sys
uwfs.sys
v3flt2k.sys
v3flu2k.sys
v3ift2k.sys
v3iftmnt.sys
v3mifint.sys
varpffmon.sys
vast.sys
vcdriv.sys
vchle.sys
vcmfilter.sys
vcreg.sys
veeamfct.sys
vfdrv.sys
vfilefilter.sys
vfpd.sys
vfsenc.sys
vhddelta.sys
vhdtrack.sys
vidderfs.sys
vintmfs.sys
virtfile.sys
virtualagent.sys
vk_fsf.sys
vlflt.sys
vmwvvpfsd.sys
vollock.sys
vpdrvnt.sys
vradfil2.sys
vraptdef.sys
vraptflt.sys
vrarnflt.sys
vrbbdflt.sys
vrexpdrv.sys
vrfsftm.sys
vrfsftmx.sys
vrnsfilter.sys
vrsdam.sys
vrsdcore.sys
vrsdetri.sys
vrsdetrix.sys
vrsdfmx.sys
vrvbrfsfilter.sys
vsepflt.sys
vsscanner.sys
vtsysflt.sys
vxfsrep.sys
wats_se.sys
wbfilter.sys
wcsdriver.sys
wdcfilter.sys
wdfilter.sys
wdocsafe.sys
wfp_mrt.sys
wgfile.sys
whiteshield.sys
windbdrv.sys
windd.sys
winfladrv.sys
winflahdrv.sys
winfldrv.sys
winfpdrv.sys
winload.sys
winteonminifilter.sys
wiper.sys
wlminisecmod.sys
wntgpdrv.sys
wraekernel.sys
wrcore.sys
wrcore.x64.sys
wrdwizfileprot.sys
wrdwizregprot.sys
wrdwizscanner.sys
wrdwizsecure64.sys
wrkrn.sys
wrpfv.sys
wsafefilter.sys
wscm.sys
xcpl.sys
xendowflt.sys
xfsgk.sys
xhunter1.sys
xhunter64.sys
xiaobaifs.sys
xiaobaifsr.sys
xkfsfd.sys
xoiv8x64.sys
xomfcbt8x64.sys
yahoostorage.sys
yfsd.sys
yfsd2.sys
yfsdr.sys
yfsrd.sys
zampit_ml.sys
zesfsmf.sys
zqfilter.sys
zsfprt.sys
zwasatom.sys
zwpxesvr.sys
zxfsfilt.sys
zyfm.sys
zzpensys.sys
Further reading
For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: https://aka.ms/threatintelblog.
To get notified about new publications and to join discussions on social media, follow us on Twitter at https://twitter.com/MsftSecIntel.
On July 11, 2023, Microsoft published two blogs detailing a malicious campaign by a threat actor tracked as Storm-0558 that targeted customer email that we’ve detected and mitigated: Microsoft Security Response Center and Microsoft on the Issues. As we continue our investigation into this incident and deploy defense in depth measures to harden all systems involved, we’re providing this deeper analysis of the observed actor techniques for obtaining unauthorized access to email data, tools, and unique infrastructure characteristics.
As described in more detail in our July 11 blogs, Storm-0558 is a China-based threat actor with espionage objectives. Beginning May 15, 2023, Storm-0558 used forged authentication tokens to access user email from approximately 25 organizations, including government agencies and related consumer accounts in the public cloud. No other environment was impacted. Microsoft has successfully blocked this campaign from Storm-0558. As with any observed nation-state actor activity, Microsoft has directly notified targeted or compromised customers, providing them with important information needed to secure their environments.
Since identification of this malicious campaign on June 16, 2023, Microsoft has identified the root cause, established durable tracking of the campaign, disrupted malicious activities, hardened the environment, notified every impacted customer, and coordinated with multiple government entities. We continue to investigate and monitor the situation and will take additional steps to protect customers.
Actor overview
Microsoft Threat Intelligence assesses with moderate confidence that Storm-0558 is a China-based threat actor with activities and methods consistent with espionage objectives. While we have discovered some minimal overlaps with other Chinese groups such as Violet Typhoon (ZIRCONIUM, APT31), we maintain high confidence that Storm-0558 operates as its own distinct group.
Figure 1 shows Storm-0558 working patterns from April to July 2023; the actor’s core working hours are consistent with working hours in China, Monday through Friday from 12:00 AM UTC (8:00 AM China Standard time) through 09:00 AM UTC (5:00 PM China Standard Time).
Figure 1. Heatmap of observed Stom-0558 activity by day of week and hour (UTC).
In past activity observed by Microsoft, Storm-0558 has primarily targeted US and European diplomatic, economic, and legislative governing bodies, and individuals connected to Taiwan and Uyghur geopolitical interests.
Historically, this threat actor has displayed an interest in targeting media companies, think tanks, and telecommunications equipment and service providers. The objective of most Storm-0558 campaigns is to obtain unauthorized access to email accounts belonging to employees of targeted organizations. Storm-0558 pursues this objective through credential harvesting, phishing campaigns, and OAuth token attacks. This threat actor has displayed an interest in OAuth applications, token theft, and token replay against Microsoft accounts since at least August 2021. Storm-0558 operates with a high degree of technical tradecraft and operational security. The actors are keenly aware of the target’s environment, logging policies, authentication requirements, policies, and procedures. Storm-0558’s tooling and reconnaissance activity suggests the actor is technically adept, well resourced, and has an in-depth understanding of many authentication techniques and applications.
In the past, Microsoft has observed Storm-0558 obtain credentials for initial access through phishing campaigns. The actor has also exploited vulnerabilities in public-facing applications to gain initial access to victim networks. These exploits typically result in web shells, including China Chopper, being deployed on compromised servers. One of the most prevalent malware families used by Storm-0558 is a shared tool tracked by Microsoft as Cigril. This family exists in several variants and is launched using dynamic-link library (DLL) search order hijacking.
After gaining access to a compromised system, Storm-0558 accesses credentials from a variety of sources, including the LSASS process memory and Security Account Manager (SAM) registry hive. Microsoft assesses that once Storm-0558 has access to the desired user credentials, the actor signs into the compromised user’s cloud email account with the valid account credentials. The actor then collects information from the email account over the web service.
Initial discovery and analysis of current activity
On June 16, 2023, Microsoft was notified by a customer of anomalous Exchange Online data access. Microsoft analysis attributed the activity to Storm-0558 based on established prior TTPs. We determined that Storm-0558 was accessing the customer’s Exchange Online data using Outlook Web Access (OWA). Microsoft’s investigative workflow initially assumed the actor was stealing correctly issued Azure Active Directory (Azure AD) tokens, most probably using malware on infected customer devices. Microsoft analysts later determined that the actor’s access was utilizing Exchange Online authentication artifacts, which are typically derived from Azure AD authentication tokens (Azure AD tokens). Further in-depth analysis over the next several days led Microsoft analysts to assess that the internal Exchange Online authentication artifacts did not correspond to Azure AD tokens in Microsoft logs.
Microsoft analysts began investigating the possibility that the actor was forging authentication tokens using an acquired Azure AD enterprise signing key. In-depth analysis of the Exchange Online activity discovered that in fact the actor was forging Azure AD tokens using an acquired Microsoft account (MSA) consumer signing key. This was made possible by a validation error in Microsoft code. The use of an incorrect key to sign the requests allowed our investigation teams to see all actor access requests which followed this pattern across both our enterprise and consumer systems. Use of the incorrect key to sign this scope of assertions was an obvious indicator of the actor activity as no Microsoft system signs tokens in this way. Use of acquired signing material to forge authentication tokens to access customer Exchange Online data differs from previously observed Storm-0558 activity. Microsoft’s investigations have not detected any other use of this pattern by other actors and Microsoft has taken steps to block related abuse.
Actor techniques
Token forgery
Authentication tokens are used to validate the identity of entities requesting access to resources – in this case, email. These tokens are issued to the requesting entity (such as a user’s browser) by identity providers like Azure AD. To prove authenticity, the identity provider signs the token using a private signing key. The relying party validates the token presented by the requesting entity by using a public validation key. Any request whose signature is correctly validated by the published public validation key will be trusted by the relying party. An actor that can acquire a private signing key can then create falsified tokens with valid signatures that will be accepted by relying parties. This is called token forgery.
Storm-0558 acquired an inactive MSA consumer signing key and used it to forge authentication tokens for Azure AD enterprise and MSA consumer to access OWA and Outlook.com. All MSA keys active prior to the incident – including the actor-acquired MSA signing key – have been invalidated. Azure AD keys were not impacted. The method by which the actor acquired the key is a matter of ongoing investigation. Though the key was intended only for MSA accounts, a validation issue allowed this key to be trusted for signing Azure AD tokens. This issue has been corrected.
As part of defense in depth, we continuously update our systems. We have substantially hardened key issuance systems since the acquired MSA key was initially issued. This includes increased isolation of the systems, refined monitoring of system activity, and moving to the hardened key store used for our enterprise systems. We have revoked all previously active keys and issued new keys using these updated systems. Our active investigation indicates these hardening and isolation improvements disrupt the mechanisms we believe the actor could have used to acquire MSA signing keys. No key-related actor activity has been observed since Microsoft invalidated the actor-acquired MSA signing key. Further, we have seen Storm-0558 transition to other techniques, which indicates that the actor is not able to utilize or access any signing keys. We continue to explore other ways the key may have been acquired and add additional defense in depth measures.
Identity techniques for access
Once authenticated through a legitimate client flow leveraging the forged token, the threat actor accessed the OWA API to retrieve a token for Exchange Online from the GetAccessTokenForResource API used by OWA. The actor was able to obtain new access tokens by presenting one previously issued from this API due to a design flaw. This flaw in the GetAccessTokenForResourceAPI has since been fixed to only accept tokens issued from Azure AD or MSA respectively. The actor used these tokens to retrieve mail messages from the OWA API.
Actor tooling
Microsoft Threat Intelligence routinely identifies threat actor capabilities and leverages file intelligence to facilitate our protection of Microsoft customers. During this investigation, we identified several distinct Storm-0558 capabilities that facilitate the threat actor’s intrusion techniques. The capabilities described in this section are not expected to be present in the victim environment.
Storm-0558 uses a collection of PowerShell and Python scripts to perform REST API calls against the OWA Exchange Store service. For example, Storm-0558 has the capability to use minted access tokens to extract email data such as:
Download emails
Download attachments
Locate and download conversations
Get email folder information
The generated web requests can be routed through a Tor proxy or several hardcoded SOCKS5 proxy servers. The threat actor was observed using several User-Agents when issuing web requests, for example:
Client=REST;Client=RESTSystem;;
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36 Edg/106.0.1370.52
The scripts contain highly sensitive hardcoded information such as bearer access tokens and email data, which the threat actor uses to perform the OWA API calls. The threat actor has the capability to refresh the access token for use in subsequent OWA commands.
Figure 2. Python code snippet of the token refresh functionality used by the threat actor.Figure 3. PowerShell code snippet of OWA REST API call to GetConversationItems.
Actor infrastructure
During significant portions of Storm-0558’s malicious activities, the threat actor leveraged dedicated infrastructure running the SoftEther proxy software. Proxy infrastructure complicates detection and attribution of Storm-0558 activities. During our response, Microsoft Threat Intelligence identified a unique method of profiling this proxy infrastructure and correlated with behavioral characteristics of the actor intrusion techniques. Our profile was based on the following facets:
Hosts operating as part of this network present a JARM fingerprint consistent with SoftEther VPN: 06d06d07d06d06d06c42d42d000000cdb95e27fd8f9fee4a2bec829b889b8b.
Presented x509 certificate has expiration date of December 31, 2037.
Subject information within the x509 certificate does not contain “softether”.
Over the course of the campaign, the IPs listed in the table below were used during the corresponding timeframes.
IP address
First seen
Last seen
Description
51.89.156[.]153
3/9/2023
7/10/2023
SoftEther proxy
176.31.90[.]129
3/28/2023
6/29/2023
SoftEther proxy
137.74.181[.]100
3/31/2023
7/11/2023
SoftEther proxy
193.36.119[.]45
4/19/2023
7/7/2023
SoftEther proxy
185.158.248[.]159
4/24/2023
7/6/2023
SoftEther proxy
131.153.78[.]188
5/6/2023
6/29/2023
SoftEther proxy
37.143.130[.]146
5/12/2023
5/19/2023
SoftEther proxy
146.70.157[.]45
5/12/2023
6/8/2023
SoftEther proxy
185.195.200[.]39
5/15/2023
6/29/2023
SoftEther proxy
185.38.142[.]229
5/15/2023
7/12/2023
SoftEther proxy
146.70.121[.]44
5/17/2023
6/29/2023
SoftEther proxy
31.42.177[.]181
5/22/2023
5/23/2023
SoftEther proxy
185.51.134[.]52
6/7/2023
7/11/2023
SoftEther proxy
173.44.226[.]70
6/9/2023
7/11/2023
SoftEther proxy
45.14.227[.]233
6/12/2023
6/26/2023
SoftEther proxy
185.236.231[.]109
6/12/2023
7/3/2023
SoftEther proxy
178.73.220[.]149
6/16/2023
7/12/2023
SoftEther proxy
45.14.227[.]212
6/19/2023
6/29/2023
SoftEther proxy
91.222.173[.]225
6/20/2023
7/1/2023
SoftEther proxy
146.70.35[.]168
6/22/2023
6/29/2023
SoftEther proxy
146.70.157[.]213
6/26/2023
6/30/2023
SoftEther proxy
31.42.177[.]201
6/27/2023
6/29/2023
SoftEther proxy
5.252.176[.]8
7/1/2023
7/1/2023
SoftEther proxy
80.85.158[.]215
7/1/2023
7/9/2023
SoftEther proxy
193.149.129[.]88
7/2/2023
7/12/2023
SoftEther proxy
5.252.178[.]68
7/3/2023
7/11/2023
SoftEther proxy
116.202.251[.]8
7/4/2023
7/7/2023
SoftEther proxy
185.158.248[.]93
6/25/2023
06/26/2023
SoftEther proxy
20.108.240[.]252
6/25/2023
7/5/2023
SoftEther proxy
146.70.135[.]182
5/18/2023
6/22/2023
SoftEther proxy
As early as May 15, 2023, Storm-0558 shifted to using a separate series of dedicated infrastructure servers specifically for token replay and interaction with Microsoft services. It is likely that the dedicated infrastructure and supporting services configured on this infrastructure offered a more efficient manner of facilitating the actor’s activities. The dedicated infrastructure would host an actor-developed web panel that presented an authentication page at URI /#/login. The observed sign-in pages had one of two SHA-1 hashes: 80d315c21fc13365bba5b4d56357136e84ecb2d4 and 931e27b6f1a99edb96860f840eb7ef201f6c68ec.
Figure 4. Token web panel sign-in page with SHA-1 hashes.
As part of the intelligence-driven response to this campaign, and in support of tracking, analyzing, and disrupting actor activity, analytics were developed to proactively track the dedicated infrastructure. Through this tracking, we identified the following dedicated infrastructure.
IP address
First seen
Last seen
Description
195.26.87[.]219
5/15/2023
6/25/2023
Token web panel
185.236.228[.]183
5/24/2023
6/11/2023
Token web panel
85.239.63[.]160
6/7/2023
6/11/2023
Token web panel
193.105.134[.]58
6/24/2023
6/25/2023
Token web panel
146.0.74[.]16
6/28/2023
7/4/2023
Token web panel
91.231.186[.]226
6/29/2023
7/4/2023
Token web panel
91.222.174[.]41
6/29/2023
7/3/2023
Token web panel
185.38.142[.]249
6/29/2023
7/2/2023
Token web panel
The last observed dedicated token replay infrastructure associated with this activity was stood down on July 4, 2023, roughly one day following the coordinated mitigation conducted by Microsoft.
Post-compromise activity
Our telemetry and investigations indicate that post-compromise activity was limited to email access and exfiltration for targeted users.
Mitigation and hardening
No customer action is required to mitigate the token forgery technique or validation error in OWA or Outlook.com. Microsoft has mitigated this issue on customers’ behalf as follows:
On June 26, OWA stopped accepting tokens issued from GetAccessTokensForResource for renewal, which mitigated the token renewal being abused.
On June 27, Microsoft blocked the usage of tokens signed with the acquired MSA key in OWA preventing further threat actor enterprise mail activity.
On June 29, Microsoft completed replacement of the key to prevent the threat actor from using it to forge tokens. Microsoft revoked all MSA signing which were valid at the time of the incident, including the actor-acquired MSA key. The new MSA signing keys are issued in substantially updated systems which benefit from hardening not present at issuance of the actor-acquired MSA key:
Microsoft has increased the isolation of these systems from corporate environments, applications, and users.Microsoft has refined monitoring of all systems related to key activity, and increased automated alerting related to this monitoring.
Microsoft has moved the MSA signing keys to the key store used for our enterprise systems.
On July 3, Microsoft blocked usage of the key for all impacted consumer customers to prevent use of previously-issued tokens.
Ongoing monitoring indicates that all actor activity related to this incident has been blocked. Microsoft will continue to monitor Storm-0558 activity and implement protections for our customers.
Recommendations
Microsoft has mitigated this activity on our customers’ behalf for Microsoft services. No customer action is required to prevent threat actors from using the techniques described above to access Exchange Online and Outlook.com.
Indicators of compromise
Indicator
Type
First seen
Last seen
Description
d4b4cccda9228624656bff33d8110955779632aa
Thumbprint
Thumbprint of acquired signing key
195.26.87[.]219
IPv4
5/15/2023
6/25/2023
Token web panel
185.236.228[.]183
IPv4
5/24/2023
6/11/2023
Token web panel
85.239.63[.]160
IPv4
6/7/2023
6/11/2023
Token web panel
193.105.134[.]58
IPv4
6/24/2023
6/25/2023
Token web panel
146.0.74[.]16
IPv4
6/28/2023
7/4/2023
Token web panel
91.231.186[.]226
IPv4
6/29/2023
7/4/2023
Token web panel
91.222.174[.]41
IPv4
6/29/2023
7/3/2023
Token web panel
185.38.142[.]249
IPv4
6/29/2023
7/2/2023
Token web panel
51.89.156[.]153
IPv4
3/9/2023
7/10/2023
SoftEther proxy
176.31.90[.]129
IPv4
3/28/2023
6/29/2023
SoftEther proxy
137.74.181[.]100
IPv4
3/31/2023
7/11/2023
SoftEther proxy
193.36.119[.]45
IPv4
4/19/2023
7/7/2023
SoftEther proxy
185.158.248[.]159
IPv4
4/24/2023
7/6/2023
SoftEther proxy
131.153.78[.]188
IPv4
5/6/2023
6/29/2023
SoftEther proxy
37.143.130[.]146
IPv4
5/12/2023
5/19/2023
SoftEther proxy
146.70.157[.]45
IPv4
5/12/2023
6/8/2023
SoftEther proxy
185.195.200[.]39
IPv4
5/15/2023
6/29/2023
SoftEther proxy
185.38.142[.]229
IPv4
5/15/2023
7/12/2023
SoftEther proxy
146.70.121[.]44
IPv4
5/17/2023
6/29/2023
SoftEther proxy
31.42.177[.]181
IPv4
5/22/2023
5/23/2023
SoftEther proxy
185.51.134[.]52
IPv4
6/7/2023
7/11/2023
SoftEther proxy
173.44.226[.]70
IPv4
6/9/2023
7/11/2023
SoftEther proxy
45.14.227[.]233
IPv4
6/12/2023
6/26/2023
SoftEther proxy
185.236.231[.]109
IPv4
6/12/2023
7/3/2023
SoftEther proxy
178.73.220[.]149
IPv4
6/16/2023
7/12/2023
SoftEther proxy
45.14.227[.]212
IPv4
6/19/2023
6/29/2023
SoftEther proxy
91.222.173[.]225
IPv4
6/20/2023
7/1/2023
SoftEther proxy
146.70.35[.]168
IPv4
6/22/2023
6/29/2023
SoftEther proxy
146.70.157[.]213
IPv4
6/26/2023
6/30/2023
SoftEther proxy
31.42.177[.]201
IPv4
6/27/2023
6/29/2023
SoftEther proxy
5.252.176[.]8
IPv4
7/1/2023
7/1/2023
SoftEther proxy
80.85.158[.]215
IPv4
7/1/2023
7/9/2023
SoftEther proxy
193.149.129[.]88
IPv4
7/2/2023
7/12/2023
SoftEther proxy
5.252.178[.]68
IPv4
7/3/2023
7/11/2023
SoftEther proxy
116.202.251[.]8
IPv4
7/4/2023
7/7/2023
SoftEther proxy
Further reading
For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: https://aka.ms/threatintelblog.
To get notified about new publications and to join discussions on social media, follow us on Twitter at https://twitter.com/MsftSecIntel.
Small businesses are often targeted by cybercriminals due to their lack of resources and security measures. Protecting your business from cyber threats is crucial to avoid data breaches and financial losses.
Why is cyber security so important for small businesses?
Small businesses are particularly in danger of cyberattacks, which can result in financial loss, data breaches, and damage to IT equipment. To protect your business, it’s important to implement strong cybersecurity measures.
Here are some tips to help you get started:
One important aspect of data protection and cybersecurity for small businesses is controlling access to customer lists. It’s important to limit access to this sensitive information to only those employees who need it to perform their job duties. Additionally, implementing strong password policies and regularly updating software and security measures can help prevent unauthorized access and protect against cyber attacks. Regular employee training on cybersecurity best practices can also help ensure that everyone in the organization is aware of potential threats and knows how to respond in the event of a breach.
When it comes to protecting customer credit card information in small businesses, there are a few key tips to keep in mind. First and foremost, it’s important to use secure payment processing systems that encrypt sensitive data. Additionally, it’s crucial to regularly update software and security measures to stay ahead of potential threats. Employee training and education on cybersecurity best practices can also go a long way in preventing data breaches. Finally, having a plan in place for responding to a breach can help minimize the damage and protect both your business and your customers.
Small businesses are often exposed to cyber attacks, making data protection and cybersecurity crucial. One area of particular concern is your company’s banking details. To protect this sensitive information, consider implementing strong passwords, two-factor authentication, and regular monitoring of your accounts. Additionally, educate your employees on safe online practices and limit access to financial information to only those who need it. Regularly backing up your data and investing in cybersecurity software can also help prevent data breaches.
Small businesses are often at high risk of cyber attacks due to their limited resources and lack of expertise in cybersecurity. To protect sensitive data, it is important to implement strong passwords, regularly update software and antivirus programs, and limit access to confidential information.
It is also important to have a plan in place in case of a security breach, including steps to contain the breach and notify affected parties. By taking these steps, small businesses can better protect themselves from cyber threats and ensure the safety of their data.
Tips for protecting your small business from cyber threats and data breaches are crucial in today’s digital age. One of the most important steps is to educate your employees on cybersecurity best practices, such as using strong passwords and avoiding suspicious emails or links.
It’s also important to regularly update your software and systems to ensure they are secure and protected against the latest threats. Additionally, implementing multi-factor authentication and encrypting sensitive data can add an extra layer of protection. Finally, having a plan in place for responding to a cyber-attack or data breach can help minimize the damage and get your business back on track as quickly as possible.
Small businesses are attackable to cyber-attacks and data breaches, which can have devastating consequences. To protect your business, it’s important to implement strong cybersecurity measures. This includes using strong passwords, regularly updating software and systems, and training employees on how to identify and avoid phishing scams.
It’s also important to have a data backup plan in place and to regularly test your security measures to ensure they are effective. By taking these steps, you can help protect your business from cyber threats and safeguard your valuable data.
To protect against cyber threats, it’s important to implement strong data protection and cybersecurity measures. This can include regularly updating software and passwords, using firewalls and antivirus software, and providing employee training on safe online practices. Additionally, it’s important to have a plan in place for responding to a cyber attack, including backing up data and having a designated point person for handling the situation.
In today’s digital age, small businesses must prioritize data protection and cybersecurity to safeguard their operations and reputation. With the rise of remote work and cloud-based technology, businesses are more vulnerable to cyber attacks than ever before. To mitigate these risks, it’s crucial to implement strong security measures for online meetings, advertising, transactions, and communication with customers and suppliers. By prioritizing cybersecurity, small businesses can protect their data and prevent unauthorized access or breaches.
Here are 8 essential tips for data protection and cybersecurity in small businesses.
1. Train Your Employees on Cybersecurity Best Practices
Your employees are the first line of defense against cyber threats. It’s important to train them on cybersecurity best practices to ensure they understand the risks and how to prevent them. This includes creating strong passwords, avoiding suspicious emails and links, and regularly updating software and security systems. Consider providing regular training sessions and resources to keep your employees informed and prepared.
2. Use Strong Passwords and Two-Factor Authentication
One of the most basic yet effective ways to protect your business from cyber threats is to use strong passwords and two-factor authentication. Encourage your employees to use complex passwords that include a mix of letters, numbers, and symbols, and to avoid using the same password for multiple accounts. Two-factor authentication adds an extra layer of security by requiring a second form of verification, such as a code sent to a mobile device, before granting access to an account. This can help prevent unauthorized access even if a password is compromised.
3. Keep Your Software and Systems Up to Date
One of the easiest ways for cybercriminals to gain access to your business’s data is through outdated software and systems. Hackers are constantly looking for vulnerabilities in software and operating systems, and if they find one, they can exploit it to gain access to your data. To prevent this, make sure all software and systems are kept up-to-date with the latest security patches and updates. This includes not only your computers and servers but also any mobile devices and other connected devices used in your business. Set up automatic updates whenever possible to ensure that you don’t miss any critical security updates.
4. Use Antivirus and Anti-Malware Software
Antivirus and anti-malware software are essential tools for protecting your small business from cyber threats. These programs can detect and remove malicious software, such as viruses, spyware, and ransomware before they can cause damage to your systems or steal your data. Make sure to install reputable antivirus and anti-malware software on all devices used in your business, including computers, servers, and mobile devices. Keep the software up-to-date and run regular scans to ensure that your systems are free from malware.
5. Backup Your Data Regularly
One of the most important steps you can take to protect your small business from data loss is to back up your data regularly. This means creating copies of your important files and storing them in a secure location, such as an external hard drive or cloud storage service. In the event of a cyber-attack or other disaster, having a backup of your data can help you quickly recover and minimize the impact on your business. Make sure to test your backups regularly to ensure that they are working properly and that you can restore your data if needed.
6. Carry out a risk assessment
Small businesses are especially in peril of cyber attacks, making it crucial to prioritize data protection and cybersecurity. One important step is to assess potential risks that could compromise your company’s networks, systems, and information. By identifying and analyzing possible threats, you can develop a plan to address security gaps and protect your business from harm.
For Small businesses making data protection and cybersecurity is a crucial part. To start, conduct a thorough risk assessment to identify where and how your data is stored, who has access to it, and potential threats. If you use cloud storage, consult with your provider to assess risks. Determine the potential impact of breaches and establish risk levels for different events. By taking these steps, you can better protect your business from cyber threats
7. Limit access to sensitive data
One effective strategy is to limit access to critical data to only those who need it. This reduces the risk of a data breach and makes it harder for malicious insiders to gain unauthorized access. To ensure accountability and clarity, create a plan that outlines who has access to what information and what their roles and responsibilities are. By taking these steps, you can help safeguard your business against cyber threats.
8. Use a firewall
For Small businesses, it’s important to protect the system from cyber attacks by making data protection and reducing cybersecurity risk. One effective measure is implementing a firewall, which not only protects hardware but also software. By blocking or deterring viruses from entering the network, a firewall provides an added layer of security. It’s important to note that a firewall differs from an antivirus, which targets software affected by a virus that has already infiltrated the system.
Small businesses can take steps to protect their data and ensure cybersecurity. One important step is to install a firewall and keep it updated with the latest software or firmware. Regularly checking for updates can help prevent potential security breaches.
Conclusion
Small businesses are particularly vulnerable to cyber attacks, so it’s important to take steps to protect your data. One key tip is to be cautious when granting access to your systems, especially to partners or suppliers. Before granting access, make sure they have similar cybersecurity practices in place. Don’t hesitate to ask for proof or to conduct a security audit to ensure your data is safe.
Transferring your domains to a new registrar isn’t something you do every day, and getting any step of the process wrong could mean downtime and disruption. That’s why this Speed Week we’ve prepared a domain transfer checklist. We want to empower anyone to quickly transfer their domains to Cloudflare Registrar, without worrying about missing any steps along the way or being left with any unanswered questions.
Domain Transfer Checklist
Confirm eligibility
Confirm you want to use Cloudflare’s nameservers: We built our registrar specifically for customers who want to use other Cloudflare products. This means domains registered with Cloudflare can only use our nameservers. If your domain requires non-Cloudflare nameservers then we’re not the right registrar for you.
Confirm your domain is not a premium domain or internationalized domain name (IDNs): Cloudflare currently does not support premium domains or internationalized domain names (Unicode).
Confirm your domain hasn’t been registered or transferred in the past 60 days: ICANN rules prohibit a domain from being transferred if it has been registered or previously transferred within the last 60 days.
Confirm your WHOIS Registrant contact information hasn’t been updated in the past 60 days: ICANN rules also prohibit a domain from being transferred if the WHOIS Registrant contact information was modified in the past 60 days.
Before you transfer
Gather your credentials for your current registrar: Make sure you have your credentials for your current registrar. It’s possible you haven’t logged in for many years and you may have to reset your password.
Make note of your current DNS settings: Make note of your current DNS settings: When transferring your domain, Cloudflare will automatically scan your DNS records, but you’ll want to capture your current settings in case there are any issues. If your current provider supports it, you could use the standard BIND Zone File format to export your records.
Remove WHOIS privacy (if necessary): In most cases, domains may be transferred even if WHOIS privacy services have been enabled. However, some registrars may prohibit the transfer if the WHOIS privacy service has been enabled.
Renew your domain if up for renewal in the next 15 days: If your domain is up for renewal, you’ll need to renew it with your current registrar before initiating a transfer to Cloudflare.
Unlock the domain: Registrars include a lightweight safeguard to prevent unauthorized users from starting domain transfers – often called a registrar or domain lock. This lock prevents any other registrar from attempting to initiate a transfer. Only the registrant can enable or disable this lock, typically through the administration interface of the registrar.
Sign up for Cloudflare: If you don’t already have a Cloudflare account, you can sign up here.
Add your domain to Cloudflare: You can add a new domain to your Cloudflare account by following these instructions.
Add a valid credit card to your Cloudflare account: If you haven’t already added a payment method into your Cloudflare dashboard billing profile, you’ll be prompted to add one when you add your domain.
Wait for your DNS changes to propagate: Registrars can take up to 24 hours to process nameserver updates. You will receive an email when Cloudflare has confirmed that these changes are in place. You can’t proceed with transferring your domain until this process is complete.
Initiating and confirming transfer process
Request an authorization code: Cloudflare needs to confirm with your old registrar that the transfer flow is authorized. To do that, your old registrar will provide an authorization code to you. This code is often referred to as an authorization code, auth code, authinfo code, or transfer code. You will need to input that code to complete your transfer to Cloudflare. We will use it to confirm the transfer is authentic.
Initiate your transfer to Cloudflare: Visit the Transfer Domains section of your Cloudflare dashboard. Here you’ll be presented with any domains available for transfer. If your domain isn’t showing, ensure you completed all the proceeding steps. If you have, review the list on this page to see if any apply to your domain.
Review the transfer price: When you transfer a domain, you are required by ICANN to pay to extend its registration by one year from the expiration date. You will not be billed at this step. Cloudflare will only bill your card when you input the auth code and confirm the contact information at the conclusion of your transfer request.
Input your authorization code: In the next page, input the authorization code for each domain you are transferring.
Confirm or input your contact information: In the final stage of the transfer process, input the contact information for your registration. Cloudflare Registrar redacts this information by default but is required to collect the authentic contact information for this registration.
Approve the transfer with Cloudflare: Once you have requested your transfer, Cloudflare will begin processing it, and send a Form of Authorization (FOA) email to the registrant, if the information is available in the public WHOIS database. The FOA is what authorizes the domain transfer.
Approve the transfer with your previous registrar: After this step, your previous registrar will also email you to confirm your request to transfer. Most registrars will include a link to confirm the transfer request. If you follow that link, you can accelerate the transfer operation. If you do not act on the email, the registrar can wait up to five days to process the transfer to Cloudflare. You may also be able to approve the transfer from within your current registrar dashboard.
Follow your transfer status in your Cloudflare dashboard: Your domain transfer status will be viewable under Account Home > Overview > Domain Registration for your domain.
After you transfer
Test your site and email: After the transfer is complete, you’ll want to test your site to ensure everything is working properly. If you encounter any issues or have any questions you can always talk with us on our community forums or Discord server.
Visit 1.1.1.1 from any device to get started with our free app that makes your Internet faster and safer.
To learn more about our mission to help build a better Internet, start here. If you’re looking for a new career direction, check out our open positions.
Last updated: June 20, 2023 Robert Waters Security Unified Endpoint Management DEX
Increases in attack surface size lead to increased cybersecurity risk. Thus, logically, decreases in attack surface size lead to decreased cybersecurity risk.
While some attack surface management solutions offer remediation capabilities that aid in this effort, remediation is reactive. As with all things related to security and risk management, being proactive is preferred.
The good news is that ASM solutions aren’t the only weapons security teams have in the attack surface fight. There are many steps an organization can take to lessen the exposure of its IT environment and preempt cyberattacks.
How do I reduce my organization’s attack surface?
Unfortunately for everyone but malicious actors, there’s no eliminating your entire attack surface, but the following best practice security controls detailed in this post will help you significantly shrink it:
As noted in our attack surface glossary entry, different attack vectors can technically fall under multiple types of attack surfaces — digital, physical and/or human. Similarly, many of the best practices in this post can help you reduce multiple types of attack surfaces.
For that reason, we have included a checklist along with each best practice that signifies which type(s) of attack surface a particular best practice primarily addresses.
#1: Reduce complexity
.
Digital attack surface
Physical attack surface
Human attack surface
X
X
.
Reduce your cybersecurity attack surface by reducing complexity. Seems obvious, right? And it is. However, many companies have long failed at this seemingly simple step. Not because it’s not obvious, but because it hasn’t always been easy to do.
Research from Randori and ESG reveals seven in 10 organizations were compromised by an unknown, unmanaged or poorly managed internet-facing asset over the past year. Cyber asset attack surface management (CAASM) solutions enable such organizations to identify all their assets — including those that are unauthorized and unmanaged — so they can be secured, managed or even removed from the enterprise network.
Any unused or unnecessary assets, from endpoint devices to network infrastructure, should also be removed from the network and properly discarded.
The code that makes up your software applications is another area where complexity contributes to the size of your attack surface. Work with your development team to identify where opportunities exist to minimize the amount of executed code exposed to malicious actors, which will thereby also reduce your attack surface.
#2: Adopt a zero trust strategy for logical and physical access control
.
Digital attack surface
Physical attack surface
Human attack surface
X
X
.
The National Institute of Standards and Technology (NIST) defines zero trust as follows:
“A collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised.”
Taking a zero trust approach to logical access control reduces your organization’s attack surface — and likelihood of data breaches — by continuously verifying posture and compliance and providing least-privileged access.
And while zero trust isn’t a product but a strategy, there are products that can help you implement a zero trust strategy. Chief among those products are those included in the secure access service edge (SASE) framework:
And though it’s not typically viewed in this manner, a zero trust strategy can extend beyond logical access control to physical access control. When it comes to allowing anyone into secure areas of your facilities, remember to never trust, always verify. Mechanisms like access cards and biometrics can be used for this purpose.
#3: Evolve to risk-based vulnerability management
.
Digital attack surface
Physical attack surface
Human attack surface
X
.
First, the bad news: the US National Vulnerability Database (US NVD) contains over 160,000 scored vulnerabilities and dozens more are added every day. Now, the good news: a vast majority of vulnerabilities have never been exploited, which means they can’t be used to perpetrate a cyberattack, which means they aren’t part of your attack surface.
In fact, a ransomware research report from Securin, Cyber Security Works (CSW), Ivanti and Cyware showed only 180 of those 160,000+ vulnerabilities were trending active exploits.
Comparison of total NVD vulnerabilities vs. those that endanger an organization
Only approximately 0.1% of all vulnerabilities in the US NVD are trending active exploits that pose an immediate risk to an organization
A true risk-based approach is needed. Risk-based vulnerability management (RBVM) — as its name suggests — is a cybersecurity strategy that prioritizes vulnerabilities for remediation based on the risk they pose to the organization.
With the intelligence from their RBVM tool in hand, organizations can then go about reducing their attack surface by remediating the vulnerabilities that pose them the most risk. Most commonly, that involves patching exploited vulnerabilities on the infrastructure side and fixing vulnerable code in the application stack.
#4: Implement network segmentation and microsegmentation
.
Digital attack surface
Physical attack surface
Human attack surface
X
.
Once again, borrowing from the NIST glossary, network segmentation is defined as follows:
Splitting a network into sub-networks, for example, by creating separate areas on the network which are protected by firewalls configured to reject unnecessary traffic. Network segmentation minimizes the harm of malware and other threats by isolating it to a limited part of the network.
From this definition, you can see how segmenting can reduce your attack surface by blocking attackers from certain parts of your network. While traditional network segmentation stops those attackers from moving north-south at the network level, microsegmentation stops them from moving east-west at the workload level.
More specifically, microsegmentation goes beyond network segmentation and enforces policies on a more granular basis — for example, by application or device instead of by network.
For example, it can be used to implement restrictions so an IoT device can only communicate with its application server and no other IoT devices, or to prevent someone in one department from accessing any other department’s systems.
#5: Strengthen software and asset configurations
.
Digital attack surface
Physical attack surface
Human attack surface
X
.
Operating systems, applications and enterprise assets — such as servers and end user, network and IoT devices — typically come unconfigured or with default configurations that favor ease of deployment and use over security. According to CIS Critical Security Controls (CIS Controls) v8, the following can all be exploitable if left in their default state:
Basic controls
Open services and ports
Default accounts or passwords
Pre-configured Domain Name System (DNS) settings
Older (vulnerable) protocols
Pre-installation of unnecessary software
Clearly, such configurations increase the size of an attack surface. To remedy the situation, Control 4: Secure Configuration of Enterprise Assets and Software of CIS Controls v8 recommends developing and applying strong initial configurations, then continually managing and maintaining those configurations to avoid degrading security of software and assets.
Here are some free resources and tools your team can leverage to help with this effort:
CIS Benchmarks List – Configuration recommendations for over 25 vendor product families
CIS-CAT Lite — Assessment tool that helps users implement secure configurations for a range of technologies
#6: Enforce policy compliance
.
Digital attack surface
Physical attack surface
Human attack surface
X
X
.
It’s no secret that endpoints are a major contributor to the size of most attack surfaces — especially in the age of Everywhere Work when more employees are working in hybrid and remote roles than ever before. Seven in 10 government employees now work virtually at least part of the time.
It’s hard enough getting employees to follow IT and security policies when they’re inside the office, let alone when 70% of them are spread all over the globe.
Unified endpoint management (UEM) tools ensure universal policy compliance by automatically enforcing policies. This fact should come as no surprise to IT and security professionals, many of whom consider UEM a commodity at this point. In fact, Gartner predicts that 90% of its clients will manage most of their estate with cloud-based UEM tools by just 2025.
Nonetheless, UEM is the best option for enforcing IT and security policy compliance, so I’d be remiss to omit it from this list.
Additionally, beyond compliance, modern UEM tools offer several other capabilities that can help you identify, manage and reduce your attack surface:
Have complete visibility into IT assets by discovering all devices on your network — a key ASM capability for organizations without a CAASM solution.
Provision devices with the appropriate software and access permissions, then automatically update that software as needed — no user interactions required.
Manage all types of devices across the entire lifecycle, from onboarding to retirement, to ensure they’reproperly discarded once no longer in use.
Support zero trust access and contextual authentication, vulnerability, policy, configuration and data management by integrating with identity, security and remote-access tools. For example, UEM and mobile threat defense (MTD) tools can integrate to enable you to enact risk-based policies to protect mobile devices from compromising the corporate network and its assets.
#7: Train all employees on cybersecurity policies and best practices
Thus, it should come as no surprise when you review the data from Ivanti’s 2023 Government Cybersecurity Status Report and see the percentages of employees around the world that don’t believe their actions have any impact on their organization’s ability to avert cyberattacks:
Do employees think their own actions matter?
Many employees don’t believe their actions impact their organization’s ability to stay safe from cyberattacks.
In the immortal words of Alexander Pope: “To err is human…” In cybersecurity terms: until AI officially takes over, humans will remain a significant part of your attack surface. And until then, human attack surfaces must be managed and reduced wherever possible.
Thus far, the best way to do that’s proven to be cybersecurity training, both on general best practices and company-specific policies — and definitely don’t forget to include a social engineering module.
To once again borrow from CIS Controls v8, Control 14: Security Awareness and Skills Training encourages organizations to do the following: “Establish and maintain a security awareness program to influence behavior among the workforce to be security conscious and properly skilled to reduce cybersecurity risks to the enterprise.”
CIS — the Center for Internet Security — also recommends leveraging the following resources to help build a security awareness program:
Security and IT staff — not just those in non-technical roles — should also be receiving cybersecurity training relevant to their roles. In fact, according to the IT and security decision-makers surveyed by Randori and ESG for their 2022 report on The State of Attack Surface Management, providing security and IT staff with more ASM training would be the third most-effective way to improve ASM.
Ensuring partners, vendors and other third-party contractors take security training as well can also help contain your human attack surface.
#8: Improve digital employee experience (DEX)
.
Digital attack surface
Physical attack surface
Human attack surface
X
X
.
No matter how much cybersecurity training you provide employees, the more complex and convoluted security measures become, the more likely they are to bypass them. Sixty-nine percent of end users report struggling to navigate overly convoluted and complex security measures. Such dissatisfied users are prone to distribute data over unsecured channels, prevent the installation of security updates and deploy shadow IT.
So what do you do? Ivanti’s 2022 Digital Employee Experience Report indicates IT leaders — with support from the C-suite — need to put their efforts toward providing a secure-by-design digital employee experience. While that once may have seemed like an impossible task, it’s now easier than ever thanks to an emerging market for DEX tools that help you measure and continuously improve employees’ technology experience.
One area in which organizations can easily improve both security and employee experience is authentication. Annoying and inefficient to remember, enter and reset, passwords have long been the bane of end users.
On top of that, they’re extremely unsecure. Roughly half of the 4,291 data breaches not involving internal malicious activity analyzed for the 2023 Verizon DBIR were enabled through credentials — about four times the amount enabled by phishing — making them by far the most popular path into an organization’s IT estate.
Passwordless authentication software solves this problem. If you’d like to improve end user experience and reduce your attack surface in one fell swoop, deploy a passwordless authentication solution that uses FIDO2 authentication protocols. Both you and your users will rejoice when you can say goodbye to passwords written on Post-it Notes forever.
Ivanti’s suggested best practices for reducing your attack surface combine learnings from our firsthand experience plus secondhand knowledge gleaned from authoritative resources.
And while these best practices will indeed greatly diminish the size of your attack surface, there’s no shortage of other steps an organization could take to combat the ever-expanding size and complexity of modern attack surfaces.
Check out the following free resources — some of which were referenced above — for additional guidance on shrinking your attack surface:
So, you’ve implemented all the best practices above and you’re wondering what’s next. As with all things cybersecurity, there’s no time for standing still. Attack surfaces require constant monitoring.
You never know when the next unmanaged BYOD device will connect to your network, the next vulnerability in your CRM software will be exploited or the next employee will forget their iPhone at the bar after a team happy hour.
On top of tracking existing attack vectors, you also need to stay informed about emerging ones. For example, the recent explosion of AI models is driving substantial attack surface growth, and it’s safe to say more technologies that open the door to your IT environment are on the horizon. Stay vigilant.
About Robert Waters
Robert Waters is the Lead Product Marketing Manager for endpoint security at Ivanti. His 15 years of marketing experience in the technology industry include an early stint at a Fortune 1000 telecommunications company and a decade at a network monitoring and managed services firm.
Robert joined Ivanti in November of 2022 and now oversees all things risk-based vulnerability management and patch management.
By: Peter Girnus, Aliakbar Zahravi June 15, 2023 Read time: 7 min (2020 words)
We looked into the documented behavior of SeroXen malware and noted the inclusion of the latest iteration of the batch obfuscation engine BatCloak to generate a fully undetectable (FUD) .bat loader. This is the second part of a three-part series documenting the abuse of BatCloak’s evasion capabilities and interoperability with other malware.
The recent rise of highly sophisticated malware’s ability to evade detection through fully undetectable (FUD) capabilities, low-cost financial accessibility, and minimal skill barriers have created a pervasive threat targeting online communities and organizations. One particular malware known as SeroXen has deployed an advanced, fully undetectable (FUD) technique via highly obfuscated batch files to infect victims with hVNC-(Hidden Virtual Network Computing) capable malware.
This entry is the second installment of a three-part series featuring BatCloak engine, its iterations, and inclusion in SeroXen malware as the main loading mechanism. The first entry, titled “The Dark Evolution: Advanced Malicious Actors Unveil Malware Modification Progression,” looked into the beginnings and evolution of the BatCloak obfuscation engine. The third part of this series, “SeroXen Mechanisms: Exploring Distribution, Risks, and Impact,” analyzes the distribution mechanism of SeroXen and BatCloak, including the security impact and insights of FUD batch obfuscation. As of this writing, a quick online search for SeroXen will show top results for an official website and social media and sharing pages with videos on how to use the remote access trojan (RAT) as if it were a legitimate tool. We will go over these dissemination strategies in the subsequent entry.
SeroXen’s FUD batch patterns
To attain FUD status, the obfuscation patterns employed in SeroXen have shown multilayered tiers in its evolution, evolving from notable predecessors such as Jlaive, BatCloak, CryBat, Exe2Bat, and ScrubCrypt. Notably, the author of these FUD tools is acknowledged as a contributor in various instances, including attributions present on the main SeroXen website and forum posts authored by the individual behind SeroXen.
Examining the SeroXen infection chain
Figure 1. SeroXen infection chain
To successfully initiate the infection process, the targeted user is lured into executing a batch file. These lures are often presented as software-specific to enthusiast groups such as gaming communities. The infection process’ efficiency is enhanced because of the batch file’s FUD capability.
We found a compilation of compromised archives associated with cheats pertaining to prominent game titles. Each of these archives harbors a highly obfuscated batch file that serves as the infection vector initiating a SeroXen infection. Alarmingly, none of the archives exhibited any form of security solution detection. In most instances, these malicious archives are hosted on the Discord CDN (content delivery network) catering to specific interested communities, but they could also be hosted on any number of cloud storage options as well as special interest forums.
Taking a visual representation of a SeroXen sample submitted to a public repository under the false pretense of being a popular online video game cheat, the sample showcases the comprehensive concealment capabilities inherent. Through investigative analysis, we found a consistent pattern in the dimensions of SeroXen’s obfuscated batch files, which commonly exhibit sizes ranging from approximately 10MB to 15MB.
Figure 2. Gaming lures with no detections
Analyzing the obfuscation patterns deployed by SeroXen
To develop a comprehensive understanding of the obfuscation algorithm utilized within SeroXen, we conducted an in-depth examination on a multitude of heavily obfuscated batch files. The figure sample exhibits an obfuscated SeroXen batch payload camouflaged under the guise of a Fortnite hack.
Figure 3. SeroXen obfuscated batch payload
The batch obfuscation patterns implemented by the SeroXen FUD algorithm can be summarized as follows:
Suppression of console output through the inclusion of the directive “@echo off”
Utilization of sophisticated string manipulation techniques to obfuscate the initial “set” command
Assignment of the “set” command to a user-defined variable
Assignment of equal operations (“=”) to a user-defined variable
Utilization of steps 3 and 4 to assign values to the additional user-defined variables
Concatenation of variables at the conclusion of the obfuscation process to construct a command, which is subsequently executed
Furthermore, our investigation showed that the implementation of layered obfuscation techniques alongside the incorporation of superfluous code fragments or “junk code” were employed to impede the analysis of the batch file hindering detections.
Summary of commands executed during the SeroXen infection process
We break down the core commands concatenated and executed in order to infect the victim as follows:
Ensure all batch commands run are suppressed with “@echo off”
Copy the PowerShell executable from System32 to the current directory
Set the current directory
Name this copied PowerShell after the batch filename with an appended .exe, such as <mal_bat>.exe
Use the PowerShell command to decrypt and execute the encrypted payload
Build the final PowerShell command used to decrypt the final payload
Use the static operator to decrypt the final payload
Analyzing the deobfuscated SeroXen batch files
During our technical analysis of FUD-enabled SeroXen batch payloads, we were able to deobfuscate the commands associated with its execution and patch key points in its operation to dump the deobfuscated version.
Figure 4. Deobfuscated SeroXen batch payload
If we compare the deobfuscated sample presented with the highly obfuscated sample (Figure 3), we can demonstrate the core function of the batch script: to generate a series of set commands in an obfuscated manner to evade detection. We see the result of the numerous obfuscated set commands in its deobfuscated equivalent. Throughout the obfuscated batch file, numerous variables are concatenated together to be executed.
The PowerShell command to be executed in the FUD obfuscated batch file is a series of hidden PowerShell commands used to decrypt and deliver the .Net loader.
Figure 6 . Final PowerShell command executed in the SeroXen batch file
The deobfuscated sequence of PowerShell commands decrypt the payload and employ an assembly reflection mechanism to reflectively load it. The essential characteristics of the final sequence of PowerShell commands include:
Decode payload using Base64
Decrypt payload using AES OR XOR algorithm. In the case of AES:
Instantiate an AES decryption object with the cipher block chaining (CBC) mode
Use a Base64 blob for the key and IV
Unzip the payload
Reflectively load the payload
From the next figure, we demonstrate how the C# loader is decrypted from the deobfuscated batch files, after which we unzip the decrypted archive to drop the .Net binary.
We decoded the payload using Base64, which is then AES-decrypted using the deobfuscated Key and IV and finally gunzipped to reveal the .Net loader. This payload is then loaded into memory using reflection.
Figure 7. Using Python to decrypt the .Net loader
Deep dive into SeroXen builder
Figure 8. Obfuscated builder
The SeroXen builder binary file is protected by the Agile .NET. After unpacking the functions and builder resources, this section shows that SeroXen is a modified version of Quasar RAT with a rootkit and other modifications, such as adopting the loader builder Jlaive and BatCloak obfuscation engine to generate a FUD .bat loader. The evolution and technical analysis of Jlaive and BatCloak was discussed in part 1 of this series.
Figure 9 . Unpacked builder resources (left) and builder function names (right) a modified version of Quasar RAT in its arsenalFigure 10. SeroXen builder adopting Jlaive and BatCloak source codes
As of this writing, SeroXen offers monthly and lifetime key options for purchase online, as well as instructions for using the RAT. We go over this in detail in the third installment of this series as part of the cybercriminals’ distribution strategies.
Figure 11. SeroXen builder usage instruction
SeroXen payload generation process
Upon pressing the “build” button, the builder writes the user-given configuration to the pre-compiled file called “client.bin,” and this produces the Quasar RAT payload and passes it to a function called “Crypt.”
Figure 12. SeroXen vs Quasar RAT payload generation
The Crypt function employs the Jlaive crypter multi-stage loader generator and BatCloack obfuscator source code to produce undetectable loaders. This function first reads the Quasar RAT payload content and verifies if it is a valid .NET assembly. Crypt then patches some string and opcode within the binary and encrypts it using the AES algorithm with CBC cipher mode, and saves it as “payload.exe.”
Figure 13. Payload encryption and obfuscation process
Much like a Jlaive crypter, the builder takes in user configuration and produces the first loader. This is achieved using a C# template file, “Quasar.Server.Stub.cs,” found embedded within its resources. The author has integrated an extra functionality in this adapted version of the Jlaive CreateCS function such as API unhooking.
Figure 14. Create C# loader
Apiunhooker.dll is an open-source project called “SharpUnhooker,” which is a C#-based universal API unhooker that automatically Unhooks API Hives (i.e., ntdll.dll, kernel32.dll, advapi32.dll, and kernelbase.dll). This technique is used to attempt evading user-land monitoring done by antivirus technologies and/or endpoint detection and response (EDR) solutions by cleansing or refreshing API DLLs that loaded during the process.
The builder subsequently compiles the C# loader stub, adding necessary files and dependencies such as encrypted Quasart RAT (payload.exe) and SharpUnhooker (Apiunhooker.dll) to its resources.
Figure 15. C# loader compilation
Next, the builder compresses the C# loader, encrypts it using AES/XOR (depending on the configuration), and encodes it in Base64. Finally, it creates a batch file and includes the encoded C# loader binary into it. It also manages the compression, decoding, and decryption processes using an obfuscated PowerShell script, which is also appended to the batch file.
The batch file’s role is to deobfuscate the PowerShell script and execute it. This PowerShell script scans the content of the batch file for the value following “::“, extracts this value, decodes it, decompresses it, decrypts it, and finally executes it in memory.
Figure 16. Creating and writing encrypted data to a batch file, and deleting temporary filesFigure 17. Generating an obfuscated batch loader (top) and PowerShell loader (bottom)
Two PowerShell templates, “Qusar.Server.AESStub.ps1” and “Quasar.Server.XORStub.ps1,” exist in the resource section of the builder. Depending on the configuration, one of these will be loaded and utilized.
Figure 18. PowerShell stub
Conclusion
In this entry, we include a Yara rule that organizations and security teams can use to detect SeroXen obfuscated batch files. Additionally, here’s a PowerShell script that can reveal the final deobfuscated batch file and commands to be run.It is critically important that this PowerShell script be run in an isolated malware sandbox.This script can be used to deobfuscate the SeroXen batch file where security teams can inspect its output file for the PowerShell command to be executed in the deobfuscation routine. By inspecting this deobfuscated payload, the analyst can grab the Key and IV from the PowerShell command to decrypt the final payload.
Overall, SeroXen is a full-feature remote administration tool (RAT) coded in C# and built using a combination of various open-source projects that work together to generate a FUD payload. Reportshaveemerged of SeroXen being abused for several infections and attacks. We foresee the evolved BatCloak engine at the core of SeroXen’s FUD capabilities as the BatCloak obfuscation engine continues to evolve and be used as a FUD tool for future malware attacks.
Individuals are strongly advised to adopt a skeptical stance when encountering links and software packages associated with terms such as “cheats,” “hacks,” “cracks,” and other pieces of software related to gaining a competitive edge. Users, developers, gamers, and enthusiasts are also advised to exercise caution when executing batch files obtained from the internet. Additionally, organizations are encouraged to stay vigilant against phishing attacks that might attempt to entice users to download and run batch installers (e.g., scripting and automation of repetitive tasks).
Organizations should consider employing a cutting edge multilayered defensive strategy and comprehensive security solutions, such as Trend Micro™ XDR, that can detect, scan, and block malicious content such as SeroXen and BatCloak across the modern threat landscape. An extended detection and response capability across endpoint, servers, workloads, email, network, cloud, and identity observed from a single platform like Trend Vision One™️ can mitigate these risks by considering adversarial tactics, techniques, and procedures (TTPs) to profile the entirety of a routine. Learn more about how the Zero Day Initiative (ZDI) bug bounty program rewards researchers for responsible vulnerability disclosure as well as protects organizations globally and stay up to date on the latest news regarding mission critical security patches.
By: Peter Girnus, Aliakbar Zahravi June 09, 2023 Read time: 3 min (681 words)
We look into BatCloak engine, its modular integration into modern malware, proliferation mechanisms, and interoperability implications as malicious actors take advantage of its fully undetectable (FUD) capabilities.
UPDATE as of 6/15/2023 7:30PM (PHT): We’ve updated this entry to include indicators of compromise (IOCs) for BatCloak.
In our recent investigation, we discovered the use of heavily obfuscated batch files utilizing the advanced BatCloak engine to deploy various malware families at different instances. Running analysis and sample collection from September 2022 to June 2023, we found that these batch files are designed to be fully undetectable (FUD) and have demonstrated a remarkable ability to persistently evade security solutions. As a result, threat actors can load various malware families and exploits by leveraging highly obfuscated batch files seamlessly. Our initial research titled “The Dark Evolution: Advanced Malicious Actors Unveil Malware Modification Progression” delves into the continuing evolution of BatCloak, uncovering the modifications that have propelled modern malware to new levels of security evasion.
This is the first entry in a three-part technical research series taking an in-depth look at the continuing evolution of the highly evasive batch obfuscation engine BatCloak. The second part of this series, “SeroXen Incorporates Latest BatCloak Engine Iteration,” will look into the remote access trojan (RAT) SeroXen, a piece of malware gaining popularity for its stealth and, in its latest iterations, targets gamers, enthusiast communities, and organizations. Aside from the RAT’s own tools, we will look into the updated BatCloak engine included as SeroXen’s loading mechanism. The third and last part of this series, “SeroXen Mechanisms: Exploring Distribution, Risks, and Impact,” will detail the distribution mechanisms of SeroXen and BatCloak. We also include our security insights on the community and demographic impact of this level of sophistication when it comes to batch FUD obfuscation.
Defying detection: A preview of BatCloak engine’s efficacy
We analyzed hundreds of batch samples sourced from a public repository. The results showed a staggering 80% of the retrieved samples exhibiting zero detections from security solutions. This finding underscores the ability of BatCloak to evade traditional detection mechanisms employed by security providers. Moreover, when considering the overall sample set of 784, the average detection rate was less than one, emphasizing the challenging nature of identifying and mitigating threats associated with BatCloak-protected pieces of malware.
Figure 1. BatCloak detection counts from a public repository; samples and detection results collected from September 2022 to June 2023
Understanding the evolving landscape of advanced malware techniques such as FUD obfuscator BatCloak enables us to develop more effective strategies for combating the ever-evolving threats posed by these sophisticated adversaries. These findings highlight the pressing need for enhanced approaches to malware detection and prevention, such as a cutting-edge multilayered defensive strategy and comprehensive security solutions.
Security teams and organizations are advised to exercise a zero-trust approach. Teams should implement solutions capable of combining multiple rules, filters, and analysis techniques, including data stacking and machine learning to address the need for precise detection, as these tools can analyze individual and dynamic file signatures and observe patterns via heuristics and behavioral analysis. When uncertain of intrusions, behaviors, and routines, assume compromise or breach immediately to isolate affected artifacts or tool chains. With a broader perspective and rapid response, an organization can address these and keep the rest of its systems protected. Multilayered technologies and solutions, such as Trend Micro XDR™️, efficiently monitor, detect, and block tiered threats and attacks, as well as their clones and modified versions.
Instead of marking the end of an infection or an attack prior to the target because of siloed solutions, an extended detection and response capability across endpoint, servers, workloads, email, network, cloud, and identity observed from a single platform like Trend Vision One™️ can mitigate these risks by considering adversarial tactics, techniques, and procedures (TTPs) to profile the entirety of a routine. Trend Vision One also correlates with a connected threat intelligence system and rapidly prioritizes and responds with the necessary security and defensive actions as far left of the routine as possible.
Download the first part of our analysis on BatCloak engine here, and the indicators of compromise (IOCs) here and below :
