The IT Nerd

CISA Insights has posted a new bulletin urging US organizations to defend against potential critical threats, similar to the malicious attacks Ukraine is currently battling. CISA is warning and encouraging organizations to strengthen cybersecurity defenses against data-wiping attacks recently seen targeting Ukrainian government agencies and businesses. 

Saryu Nayyar, CEO and Founder, Gurucul had this comment:

“The CISA’s guidance has several detailed measures that should be followed by every organization. One area of particular note is ‘identifying and quickly assessing any unexpected or unusual network behavior’. This is especially relevant when it comes to unusual communications, but also privileged access violations. In fact, another piece of guidance states: ‘take extra care to monitor, inspect, and isolate traffic from those organizations; closely review access controls for that traffic’. It is critical to monitor for and determine if access violations are taking place, but with stolen credentials commonly being used by attackers appearing valid to most detection solutions, this is really where behavioral analytics can determine if the access is indeed legitimate, suspicious or malicious and help security teams investigate further or rapidly respond.”

Clearly there’s a threat out there that the CISA is worried about, and given the which means that US organizations should take this seriously.

UPDATE: Antonio Martinelli, Director of Cyber Training at GRIMM had this additional commentary.

Attack surface reduction is a critical aspect of any Information Security program, yet something companies have consistently been struggling with since The Internet became ubiquitous. We’re seeing it’s easier now more than ever for employees to spin up new cloud resources and enroll in SaaS services without proper channels being involved, leading to companies being hit by attacks in these ever-expanding blind spots. A cyclical process of active asset inventory identification and subsequent attack surface assessment & reduction is mandatory in this day and age of Shadow IT complacency.

New research from email security firm INKY shows a phishing attack impersonating the US Department of Labor targeting Office 365 users. The phishing attack, which has been ongoing and active for at least a couple of months, uses over ten different phishing sites impersonating the government agency. Furthermore, those who do submit bids for the project will then be taken to a fake ‘error’ website, in order to trick the victim into entering their credentials again. If the victim falls for both traps, they are re-directed to the actual DoL site, showing little evidence of the attack that has taken place.

I have two comments on this new threat. The first is from Saryu Nayyar, CEO and Founder of Gurucul:

“Spoofed domains are the foundation of phishing attacks and spoofing government agencies is extremely difficult for users to identify unless they consistently research the addresses on their own before clicking on any links. That is why these types of attacks are so successful in stealing credentials or establishing a foothold within an organization. This one is particularly clever in thwarting email security through hijacked legitimate servers and even eventually directing users to a legitimate DoL site after they’ve acquired what they wanted. The latter is a subtle, yet effective twist. However, advanced behavioral analysis and out-of-the-box machine learning (ML) models would have detected the abnormal communications to the servers and/or malicious, but unknown, domains. It is critical for organizations to invest beyond the current SIEM and XDR tools and look at more Next gen SIEMs and advanced SOC platforms with a multitude of analytics and true ML models that can not only identify the malicious activity quickly, but also elevate the risk as determines it is part of an attack campaign. The analytics also provided needed context for a targeted automated response, potentially stopping the attack earlier in the kill chain before credentials can be stolen.” 

The second is from Chris Olson, CEO of The Media Trust:

“Today’s malicious actors are vigilant in generating new domain names to skirt around blockers. By the time a list is updated to reflect the latest source of a phishing or malware attack, the operation shifts to a brand new site. This is why organizations can’t depend solely on CMPs, ad blockers or other traditional tools to protect their online visitors: there is no replacement for live scanning to detect malicious code.”

I’ve heard of cases where a spoofing attack has cost an organization hundreds of thousands of dollars. Thus making sure you have the means to stop these attacks before the start is key to making sure that you’re not bleeding cash because of a spoofing attack.