The IT Nerd

The U.S. State Department’s Rewards for Justice program has decided to go after Clop who are the people behind ransomware attacks via the MOVEit vulnerability. The news was posted on Twitter:

This is bad news for these threat actors because Rewards of Justice is a U.S. Department of State program that offers monetary rewards for information on threat actors and attacks impacting the national security of the USA. So that means that the US Government really wants to get these guys because they’ve been launching attacks over the last two weeks or so, and they’re getting a lot of press because of it. Which means that law enforcement will be spending a lot of time and a lot of effort trying to catch these threat actors. Let’s see how much of an incentive this is to rat these guys out.

Yesterday, CrowdStrike posted that bad actor Spyboy is promoting a $3000, all-in-one tool called “Terminator” that can allegedly bypass 24 antivirus, XDR, and EDR platform, including Windows Defender, on devices running Windows 7 and later, but in reality it’s just a fancy Bring Your Own Vulnerable Driver (BYOVD) attack.  

To use Terminator, one must have administrative privileges on the targeted systems and have tricked the user into accepting a User Account Controls pop-up that will be displayed when running the tool. 

However, researchers discovered that Terminator just drops the legitimate, signed Zemana anti-malware kernel driver into the C:\Windows\System32\ folder, and then loads it to use its kernel-level privileges to kill off the user-mode processes of AV and EDR software running on the device. 

​Currently, according to a VirusTotal scan this driver is only being detected by a single anti-malware scanning engine as a vulnerable driver. 

Roy Akerman, Co-Founder & CEO, Rezonate has this comment:

   “This claim made by Spyboy created anticipation and anxiety among cyber defense teams for the past week, as tampering with security controls may leave organizations vulnerable and unaware assuming protection is in place and active. Organizations who use an EDR solution that only has usermode agent need to take further actions to avoid any exploitation and elimination of that agent. If kernel mode agent is available, a check to make sure configuration is properly listed is a priority.”

If this claim is true, this is going to make a lot of lives miserable. Hopefully the fact that CrowdStrike got this info out there quickly will help to mitigate this threat.

While there’s always a new malware of the moment, Snake Malware, which is associated with Russian hackers affiliated to FSB is one that you might want to be concerned about. The CISA are so concerned about it that they have put out an advisory on this malware. And when you read the technical description on this malware, it should make you re-evaluate your defences.

Kevin Bocek, VP,Ecosystem and Community at Venafi had this comment on Snake:

“According to more information released about the Snake Ransomware uncovered by the U.S. Department of Justice earlier this month, cybercriminals appear to have fallen into a trap. Namely, they have neglected the basics of machine identity management. The CISA Advisory published a report suggesting that the OpenSSL library the group used for the Diffie-Hellman key exchange had a significant vulnerability. Snake’s key set generated during the exchange used a wholly inadequate prime length of only 128 bits. This made this process completely insecure for asymmetric key systems and vulnerable to today’s machine-to-machine operations, whether for malware or transactions. In addition, when Snake was hastily deployed, users failed to remove certain components, inadvertently exposing function names, plaintext strings, and developer comments.”

“This again shows how difficult it is to properly manage machine identities manually – both for developers and security teams. Even experienced attackers obviously make mistakes. In this case, the malware’s developers did not properly configure one. This allowed the machine identities to be exposed, making the communications no longer private or even open to another attacker and revealing who the operators of Snake were. At best, this could have rendered the entire campaign useless; at worst, the Snake developers could have been attacked by other cybercriminals themselves.”

“The lesson is that machine identity management requires developers, operations and security teams to work closely together. In a world where machines transact, protect and attack, machine identity management is increasingly important.”

Well it seems that even the bad guys have issues creating malware that doesn’t give away clues about what it’s all about. Defenders should take that as a hint that they should do better when it comes to ensuring that they are as secure as possible.

The Ransomware Report 2023 from Cybersecurity Insiders and BullWall offers findings from a survey of 435 cybersecurity professionals across several sectors, showing that ransomware remains a top concern, and the effectiveness of remediation steps are often misunderstood. Although 76% were confident in the organization’s ability to prevent an attack, only 35% were confident in the organization’s current ability to remediate ransomware after it locks or encrypts data within their systems. Moreover, 79% expect their organization to be a ransomware target within the next year.

I have two views on this. The first is from Mark Bermingham, VP, Cyware:

   “This research highlights the general apathy around a serious situation with EDR. If these numbers were about threats to individuals’ retirement income you would hear a lot more alarm bells. Better solutions exist and many are already deployed, but we need better tools for dealing with all the threat noise, connecting these dots with existing tools, and taking proactive action.“

Roy Akerman, Co-Founder & CEO, Rezonate follows up with this:

   “We often see that despite controls put in place to prevent ransomware, they are often misconfigured and therefore not able to prevent and at best detect active encryption attempts. Proactively simulating ransomware-type attacks can help an organization assure existing security investments are fully utilized and properly configured. Increasing readiness in case of an actual attack against their infrastructure. The Ransomware readiness architecture highlights actions to be taken pre- and post-attacks across prevention, detection, investigation, and recovery and only once we proactively take these actions across the complete cycle, we are able to truly reduce risk.”

What this says to me is that organizations need to wrap their head around getting better defences in place to mitigate ransomware attacks. If they don’t they are guaranteed to be the next headline that I write about.

For the second time this month, The White House has made an announcement in regards to the responsible use of AI. Unlike an earlier announcement, this one centres around R&D and deployment:

AI is one of the most powerful technologies of our time, with broad applications. President Biden has been clear that in order to seize the opportunities AI presents, we must first manage its risks. To that end, the Administration has taken significant action to promote responsible AI innovation that places people, communities, and the public good at the center, and manages risks to individuals and our society, security, and economy. This includes the landmark Blueprint for an AI Bill of Rights and related executive actions, the AI Risk Management Framework, a roadmap for standing up a National AI Research Resource, active work to address the national security concerns raised by AI, as well as investments and actions announced earlier this month. Last week, the Administration also convened representatives from leading AI companies for a briefing from experts across the national security community on cyber threats to AI systems and best practices to secure high-value networks and information.

Ani Chaudhuri, CEO, Dasera was kind enough to provide their view of this announcement:

The Biden-Harris Administration’s recent steps to advance responsible artificial intelligence (AI) research, development, and deployment are crucial in our rapidly evolving digital age. Undoubtedly, AI technologies will transform how we live and work, so we must approach this field with a responsible yet innovative mindset.

One fundamental aspect of this responsible approach is to ensure data security. Every AI system relies on vast amounts of data, whether it’s automating tasks, making predictions, or creating new services. Ensuring the security of this data, its privacy, and its ethical use is not just a good practice; it’s a necessity. An AI system is only as good as the data it’s trained on, and if that data is biased, misused, or breached, the consequences can be severe.

However, while the government’s role in fostering responsible AI innovation is critical, we should be mindful of the potential pitfalls of heavy-handed regulation. We must strike a careful balance: on one side, safeguarding the rights and safety of individuals, and on the other side, not stifling innovation and competition. This is a delicate act. It’s essential to refrain from giving too much power to the government over the tech sector and limit regulatory barriers that could hamper the global competitiveness of our AI industry.

 Sam Altman, CEO of OpenAI, was recently in front of Congress and proposed a new agency to oversee AI. The idea of issuing licenses to train and use AI models is thought-provoking. Still, it could create regulatory capture where established players protect their position by creating barriers for others.

Instead, we should consider a more collaborative and decentralized approach that fosters trust, transparency, and accountability. Regulations should be built with an understanding of the technology and, more importantly, its implications on society and individuals. Instead of a single body that issues licenses, why not have a network of organizations, including academic institutions, non-profits, and private enterprises, that review, audit, and certify AI systems and their uses?

The risks associated with AI are complex and multifaceted, akin to cybersecurity risks. Cybersecurity has always been a cat-and-mouse game between those who seek to exploit vulnerabilities and those who work tirelessly to patch them. The same will likely be true with AI.

We should learn from our experiences in handling cybersecurity and data privacy issues. Clear guidelines, self-regulation, transparency, and domestic and international cooperation are vital in managing these risks without curbing innovation. While it’s true that we might not be able to regulate every AI model, we can build regulations for how these models are used, just like we have regulations for how personal data is used.

It’s crucial to focus on the main goal: making AI serve humanity, protect individuals, and foster innovation. We should not just regulate AI but guide it towards that goal. Our approach should be both proactive and adaptive, ready to embrace the opportunities AI presents and address the risks it poses. After all, AI is a tool we created, and it’s up to us to ensure it’s used responsibly.

It is a positive step that The White House is interested in putting up guardrails around AI. Because in my mind, AI could either be a positive force for all of us, or it could go off the rails in a really bad way. The actions that we take now will decide which way that goes.

UPDATE: Craig Burland, CISO, Inversion6 adds this comment:

On the surface, this is a well-considered, positive, and actionable step forward. The government appears to be looking at AI as a tool with both potential and risks, seeking first to understand. This is a smart approach for any new technology, particularly for something disruptive like AI.

The nine strategies outlined within the updated roadmap are sound, again balancing both the potential and risk of AI.  For example, the first strategy focuses on investment in AI research.  The third strategy focuses on ethical, legal, and societal implications of AI.  Maybe more importantly, what the administration lays out is actionable. They’ve outlined strategies that the US government can drive. They’ve avoiding calling for moratoriums, global bans, or other unattainable steps that would accomplish little.

UPDATE #2: Kevin Bocek, VP Ecosystem and Community, Venafi adds this commentary:

“We are still in the early stages of understanding the impact of AI on both businesses and the public, and it’s a constantly moving target, with new use cases and products being announced on a daily basis. So, it is very encouraging to see The White House take the first steps in developing a responsible AI framework. As part of this process, it is vital that the government recognizes that smart organizations will not slow down the innovation that we’re seeing with Generative AI, and that the results will be overwhelmingly positive. However, there are known and unknown risks that need to be skillfully mitigated. 

“As such, the priority for regulations must be to contain risks while encouraging exploration, curiosity and trial and error. But any steps to achieve this can’t be approached with a “set and forget” mentality. Regulators need to establish policies and guidelines that are reviewed and refreshed frequently as we explore the power of AI in more depth. This means the government will need to constantly collaborate and communicate with experts in the field to avoid neglect and exploitation.”

Searchlight Cyber has released new research today describing how threat actors auction off access to oil and gas industry networks on the Dark Web. Someone should tell the oil and gas industry about this, as researchers found that more than 27% of energy industry CISOs said that they believe activity on the dark web has no impact on their company.

“The report we have released today –Dark Web Threats Against the Energy Industry – demonstrates conclusively that that is not the case by showing that energy companies are routinely discussed on dark web forums.” Searchlight report)

Cybercriminals have shifted their attention beyond banks and insurance companies and are now directing their efforts towards enterprises operating in various industries like healthcare, oil and gas (think Colonial Pipeline), and manufacturing.

“The global oil & gas industry experienced a 145% rise in company filings mentions of cybersecurity in Q1 2023 compared with the previous quarter … according to GlobalData’s analysis of over 338 oil & gas company filings.” URL: https://www.offshore-technology.com/dashboards/filings/cybersecurity-mentions-oil-gas-industry/

Stephen Gates, Principal Security SME, Horizon3.ai had this comment:

1. I think it’s clear that threat actors have moved beyond the financial and insurance sectors, but this is still all about “the money”. Previously, attackers would look to compromise organizations in these sectors for the sole purpose of stealing PII and selling it to the highest bidder. But today, it’s easier to compromise an organization and hold them for ransom since the payouts are much larger. And as we have seen, cities, universities, non-commercial entities, and pretty much everyone other type of organization has experienced some form of ransom-based attacks.
2. In nearly every attack that has resulted in a breach of security posture, threat actors first gain a foothold in the organization or find an attack vector where one can easily be obtained. In this case, they next auction that information off since they do not want to perform a potential ransom-based attack on their own. This is like someone who builds a list of consumers, then sells that list to someone else who wants to take it to the next level.
3. I feel the energy industry is aware of the threats and understands the risks, but are they prepared for an attack? Likely not. The reason is that energy companies have much different infrastructures as compared to banks or insurance companies. Energy companies have networks so office employees can do their jobs. While at the same time, have other networks used for delivery and distribution of their energy products. Both are widely different in the context of what can be attacked and how an attack would progress.

You would think that the oil and gas industry would improve their security after the Colonial Pipeline incident. I for one hope they have as they’re clearly a target. And that means we’ll find out very quickly if they haven’t done everything possible to make themselves attack resistant.

Cybersecurity intelligence firm KELA has compiled a report presenting the rise of variants and MaaS operations that have grown substantially in the first quarter of 2023, raising the associated risk for organizations and individuals.

KELA’s report highlights the evolving MaaS marketplace referred to as “Clouds of Logs,” focusing on threat actors’ subscription-based access to what is described as private, cloud-hosted log collections from their info-stealing malware operations.

2023 Emerging Info Stealers:

• Titan: appeared on Russian-speaking hacker forums in November 2022. A Go-based info-stealer targeting 20 web browsers
• LummaC2: Targets over 70 browsers, cryptocurrency wallets, and two-factor authentication extensions
• Stealc: Analyzed by SEKOIA in February 2023. A lightweight stealer. Targets over 22 web browsers, 75 plugins, and 25 desktop wallets
• WhiteSnake: Attacks Windows & Linux. First seen on hacker forums in February 2023 as an email, Telegram, Steam, and cryptocurrency wallet stealer

Clouds of Logs is presumably a safer alternative to automated log markets, created to give data sellers a simpler way to monetize their activity without the involvement of middlemen.

KELA believes that the MaaS market will preserve its popularity this year, so the use of info-stealers will continue to be substantial.

Dave Ratner, CEO, HYAS had this to say:

   “With the increase in info-stealing malware, visibility into the communication patterns coming out of an enterprise is increasingly important, across both corporate and production environments, to ensure that anomalous outbound communications are identified, inspected, and shut down quickly and efficiently.  Other than preventing the malware from breaching the environment in the first place, this can be the best protection for an organization and drive a true business resiliency strategy.”

This is another one of those cases where the bad guys are quickly evolving to make your life miserable. Thus you need to take action to make sure that you’re not a victim by doing everything that you can to make sure that your IT environment is safe from these threat actors.

Ransomware isn’t just a “thing” as the kiddies would say. It’s an insanely prevalent and dangerous threat. If you’ve been reading my blog for a while, I’ve illustrated the costs and effects of ransomware. Thus anything that highlights the need to be better protected against ransomware is a win in my books. Which is why I applaud the fact that Anti-Ransomware Day exists as it really brings this threat to light and reminds all of us to do whatever we can to make sure that this day is no longer required.

I got the thoughts of Nic Finn, Senior Threat Intelligence Consultant, Guidepoint Research and Intelligence Team (GRIT) at GuidePoint Security on Anti-Ransomware Day.

“As we step into the fourth Anti-Ransomware Day, it’s clear that ransomware is still a dominant threat for organizations across the globe. Looking at GRIT’s ransomware dataset, we’ve observed a steady increase in victims published by ransomware groups. In 2021, from January 1st – May 12th, GRIT observed just over 700 reported victims. In 2022, that number increased to just over 1,000. So far, in 2023, we’ve observed more than 1,300 reported victims. This increase of roughly 300 reports per year also correlates to a shift in active groups, with Lockbit bounding to the most active group in 2022 and increasing their lead in 2023.”

“What’s more important than the number of reported victims and targeting by ransomware groups is how organizations are prepared to defend against and respond to ransomware. The availability of CISA’s Stop Ransomware resources is a massive value add for proactive organizations looking to protect against these threat groups. Additionally, defenders need to understand how they should respond when faced with a successful ransomware attack. Many organizations today still jump to check the ransomware group’s chat and can often have a negative impact on successful negotiation or delayment strategies. These teams should set up playbooks to ensure a coordinated and calculated response to ransomware attacks, which includes a thorough evaluation of the environment, solid backup practices, and knowledge of critical information and systems utilized across the environment.”

Just to highlight the sorts of things that Nic is seeing, I have the latest GRIT Ransomware Report for you to review. Along with that, I’m going to give you some resources to use. Starting with The Ransomware Playbook that the Canadian Center For Cybersecurity put out. The CISA has done something similar with their Ransomware Guide. Both are great resources and I highly recommend reading both.