Blog

Einblicke in das SOC-Team

3CX Supply Chain Compromise: How Darktrace Uncovered A “Smooth Operator”

Jun 2023

This blog discusses how Darktrace detected examples of the 3CX supply chain compromise, the first known cascading supply chain compromise. Leveraging integrations with security vendors like CrowdStrike and SentinelOne, Darktrace was able to successfully identify and prevent multiple cases of the 3CX supply chain compromise across its customer base.

Ever since the discovery of the SolarWinds hack that affected tens of thousands of organizations around the world in 2020, supply chain compromises have remained at the forefront of the minds of security teams and continue to pose a significant threat to their business operations.

Supply chain compromises can have far-reaching implications, from disrupting an organization’s daily operations, incurring huge financial and reputational damage, to affecting the critical infrastructure of entire countries. As such, it is essential for organizations to have effective security measures in place able to identify and halt these attacks at the earliest possible stage.

In March 2023 the 3CX Desktop application became the latest victim of a supply chain compromise dubbed as the “SmoothOperator” by SentinelOne. This application is used by over 600,000 companies worldwide and the customer list contains high-profile customers across a variety of industries [2]. The 3CX Desktop application is a Voice over Internet Protocol (VoIP) communication software for enterprises that allows for chats, video calls, and voice calls. [3] The 3CX installers for both Windows and macOS systems were affected by information stealing malware. Researchers were able to discern that threat actors also known as UNC 4736 related to financially motivated North Korean operators also known as AppleJeus were responsible for the supply chain compromise. Researchers have also linked it to another supply chain compromise that occurred prior on the Trading Technologies X_TRADER platform, making this the first known cascading software supply chain compromise used to distribute malware on a wide scale and still be able to align operator interests. [3] Customer reports following the compromise began to surface about the 3CX software being picked up as malicious by several cybersecurity vendors such as CrowdStrike, SentinelOne, and Palo Alto Networks. [6]

By leveraging integrations with other security vendors like CrowdStrike and SentinelOne, Darktrace DETECT™ was able to identify activity from the “SmoothOperator” across the customer base at multiple stages of the kill chain in March 2023. Darktrace RESPOND™ was then able to autonomously intervene against these emerging threats, preventing significant disruption to customer networks.

Background on the first known cascading supply chain attack

Initial Access

In April 2023, security researchers identified the initial target in this story was not the 3CX desktop application, rather, it was another software application called X_TRADER by Trading Technologies. [3] Trading Technologies is a provider that offers high-performance financial trading packages, allowing financial professionals to analyze and trade assets within the stock market more efficiently. Unfortunately, a compromise already existed in the supply chain for this organization. The X_TRADER installer, which had been retired in 2020, still had its code signing certificate set to expire in October 2022. This code signing certificate was exploited by attackers to digitally sign the malicious software. [3] It also inopportunely led to 3CX when an employee unknowingly downloaded a trojanized installer for the X_TRADER software from Trading Technologies prior to the certificate’s expiration. [4]. This compromise of 3CX via X_TRADER was the first case of a cascading supply chain attack reported on within the wider threat landscape.

Persistence and Privilege Escalation

Following these findings, researchers were able to identify the likely kill chain that occurred on Windows systems, beginning with the download of the 3CX DesktopApp installer that executed an executable (.exe) file before dropping two trojanized Data Link Libraries (DLLs) alongside a benign executable that was used to sideload malicious DLLs. These DLLs contained and used SIGFLIP and DAVESHELL; both publicly available projects. [3] In this case, the DLLs were used to decrypt using an RC4 key and load a payload into the memory of a compromised system. [3] SIGFLIP and DAVESHELL also extract and decrypt the modular backdoor named VEILEDSIGNAL, which also contains a command and control (C2) configuration. This malware allowed the North Korean threat operators to gain administrative control to the 3CX employee’s device. [3] This was followed by access to the employee’s corporate credentials, ultimately leading to access to 3CX systems. [4]

Lateral Movement and C2 activity

Security researchers were also able to identify other malware families that were mainly utilized in the supply chain attack to move laterally within the 3CX environment, and allow for C2 communication [3], these malware families are detailed below:

TaxHaul: when executed it decrypts shellcode payload, observed by Mandiant to persist via DLL search-order hijacking.
Coldcat: complex downloader, which also beacons to a C2 infrastructure.
PoolRat: collects system information and executes commands. This is the malware that was found to affect macOS systems.
IconicStealer: served as a third stage payload on 3CX systems to steal data or information.

Furthermore, it was also reported early on by Kaspersky that a backdoor named Gopuram, routinely used by the North Korean threat actors Lazarus and typically used against cryptocurrency companies, was also used as a second stage payload on a limited number of 3CX’s customers compromised systems. [5]

3CX detections observed by Darktrace

CrowdStrike and SentinelOne, two of the major detection platforms with which Darktrace partners through security integrations, initially revealed that their platforms had identified the campaign appeared to be targeting 3CXDesktopApp customers in March 2023.

At this time, Darktrace was also observing this activity and alerting customers to unusual behavior on their networks. [1][7] Darktrace DETECT identified activity related to the supply chain compromise primarily through host-level alerts associated with CrowdStrike and SentinelOne integrations, as well as model breaches related to lateral movement and C2 activity.

Some of the activity related to the 3CX supply chain compromise that Darktrace detected was observed solely via integration models picking up executable and Microsoft Software Installer (msi) file downloads for the 3CXDesktopApp, suggesting the compromise likely was stopped at the endpoint device.

Figure 1: CrowdStrike integration model breach identifying 3CXDesktopApp[.]exe as possible malware on March 30, 2023.

Figure 2: The above figure, showcases the Model Breach Event Log for the CrowdStrike integration model breach shown in Figure 1.

In another case highlighted in Figure 3 and 4, security platforms were associating 3CX as malicious. The device in these figures was observed downloading a 3CXDesktopApp executable followed by an msi file about an hour later. This pattern of activity correlates with the compromise process that had been on reported, where the “SmoothOperator” malware that affected 3CX systems was able to persist through DLL side-loading of malicious DLL files delivered with benign executable files, making it difficult for traditional security tools to detect. [2][3][7]

The activity in this case was detected by the DETECT integration model, ‘High Severity Integration Malware Detection’ and was later blocked by the Darktrace RESPOND/Network model, ‘Antigena Significant Anomaly from Client Block’ which applied the “Enforce Pattern of Life” action to intercept the malicious download that was taking place. Darktrace RESPOND uses AI to learn every devices normal pattern of life and act autonomously to enforce its normal activity. In this event, RESPOND would not only intercept the malicious download that was taking place on the device, but also not allow the device to significantly deviate from its normal pattern of activity.

Figure 3: The Model Breach Event log for the device displays the moment in which the SentinelOne integration model breached for the 3CXDesktopApp.exe file followed subsequently by the RESPOND model, ‘Antigena Significant Anomaly from Client Block’, on March 29, 2023.

Figure 4: Another ‘High Severity Integration Malware Detection’ breached for the same device in Figure 3 approximately one hour later because of the msi file, 3CXDesktopApp-18.12.416.msi, which also led to the Darktrace RESPOND model, ‘Antigena Significant Anomaly from Client Block’, on March 29, 2023.

In a separate case, Darktrace also detected a device performing unusual SMB drive writes for the file ‘3CXDesktopApp-18.10.461.msi’. This breached the DETECT model ‘SMB Drive Write’. This model detects when a device starts writing files to another internal device it does not usually communicate with via the SMB protocol using the admin$ or drive shares.

Figure 5: This Model Breach Event log highlights the moment Darktrace captured the msi application file for the 3CXDesktopApp being transferred internally on this customer’s network, this was picked up as new activity for the device on March 28, 2023.

In a couple of other cases observed by Darktrace, connections detected were made from affected devices to 3CX compromise related endpoints. In Figure 6, the device in question was detected connecting to the endpoint, journalide[.]org. This breached the model, ‘Suspicious Self-Signed SSL’, which looks for connections being made to an endpoint with a self-signed SSL certificate which is designed to look legitimate, as self-signed certificates are often used in malware communication.

Figure 6: Model Breach Event log for connections to the 3CX C2 related endpoint, journalide[.]org, these connections breached the model Suspicious Self-Signed SSL on April 24, 2023.

On another Darktrace customer environment, a 3CX C2 endpoint, pbxphonenetwork[.]com, had already been added to the Watched Domains list around the time reports of the 3CX application software being malicious had been reported. The Watched Domains list allows Darktrace to detect if any device on the network makes connections to these domains with more scrutiny and breach a model for further visibility of threats on the network. Activity in this case was detected and subsequently blocked by a Darktrace RESPOND action, “Block connections to 89.45.67[.]160 port 443 and pbxphonenetwork[.]com on port 443”, blocking the device from connecting to this 3CX C2 endpoints on the spot (see Figure 7). This activity subsequently breached the RESPOND model, ‘Antigena Watched Domain Block’.

Figure 7: History log of the Darktrace RESPOND action applied to the device breaching the Darktrace RESPOND model, Antigena Watched Domain Block and applying the action, “Block connections to 89.45.67[.]160 port 443 and pbxphonenetwork[.]com on port 443” on March 31, 2023.

Darktrace Coverage

Utilizing integrations with Darktrace such as those with CrowdStrike and SentinelOne, Darktrace was able to detect and respond to activity identified as malicious 3CX activity by CrowdStrike and SentinelOne as seen in Figures 1, 2, 3, and 4. This activity breached the following Darktrace DETECT models:

Integration / CrowdStrike Alert
Security Integration / High Severity Integration Malware Detection

Darktrace was also able to identify lateral movement activity such as in the case illustrated in Figure 5.

Compliance / SMB Drive Write

Lastly, C2 beaconing activity from malicious endpoints associated with the 3CX compromise was also detected as seen in Figure 6, this activity breached the following Darktrace DETECT model:

Anomalous Connection / Suspicious Self-Signed SSL

For customers with Darktrace RESPOND configured in autonomous response mode, Darktrace RESPOND models also breached to activity related to the 3CX supply chain compromise as seen in Figures 3, 4, and 7. Below are the models that breached and the following autonomous actions that were applied:

Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block, “Enforce pattern of life”
Antigena / Network / External Threat / Antigena Watched Domain Block, “Block connections to 89.45.67[.]160 port 443 and pbxphonenetwork[.]com on port 443”

Schlussfolgerung

The first known cascading supply chain compromise occurred inopportunely for 3CX but conveniently for UNC 4736 North Korean threat actors. This “SmoothOperator” compromise was detected by endpoint security platforms such as CrowdStrike who was at the cusp of this discovery when it became one of the first platforms to report on malicious activity related to the 3CX DesktopApp supply chain compromise.

Although still novel at the time and largely without reported indicators of compromise, Darktrace was able to capture and identify activity related to the 3CX compromise across its customer base, as well as respond autonomously to contain it. Darktrace was able to amplify security integrations with CrowdStrike and SentinelOne, and via anomaly-based model breaches, contribute unique insights by highlighting activity in varied parts of the 3CX supply chain compromise kill chain. The “SmoothOperator” supply chain attack proves that the Darktrace suite of products, including DETECT and RESPOND, can not only act autonomously to identify and respond to novel threats, but also work with security integrations to further amplify intervention and prevent cyber disruption on customer networks.

Credit to Nahisha Nobregas, SOC Analyst and Trent Kessler, SOC Analyst.

Appendices

MITRE ATT&CK Framework

Resource Development

T1588 Obtain Capabilities
T1588.004 Digital Certificates
T1608 Stage Capabilities
T1608.003 Install Digital Certificate

Initial Access

T1190 Exploit Public-Facing Application
T1195 Supply Chain Compromise
T1195.002 Compromise Software Supply Chain

Persistence

T1574 Hijack Execution Flow
T1574.002 DLL Side-Loading

Privilege Escalation

T1055 Process Injection
T1574 Hijack Execution Flow
T1574.002 DLL Side-Loading

Command and Control

T1071 Application Layer Protocol
T1071.001 Web Protocols
T1071.004 DNS
T1105 Ingress Tool Transfer
T1573 Encrypted Channel

List of IOCs

C2 Hostnames

journalide[.]org
pbxphonenetwork[.]com

Likely C2 IP address

89.45.67[.]160

References

EINBLICKE IN DAS SOC-Team

Darktrace Cyber-Analysten sind erstklassige Experten für Threat Intelligence, Threat Hunting und Incident Response. Sie bieten Tausenden von Darktrace Kunden auf der ganzen Welt rund um die Uhr SOC-Support. Einblicke in das SOC-Team wird ausschließlich von diesen Experten verfasst und bietet Analysen von Cyber-Vorfällen und Bedrohungstrends, die auf praktischen Erfahrungen in diesem Bereich basieren.

AUTOR

ÜBER DEN AUTOR

Nahisha Nobregas

SOC Analyst

Watch the NIS2 Webinar

share this article

KATEGORIEN

McLaren

PREVENT

RESPOND

Cloud

Ransomware

Einblicke in das SOC-Team

Vordenkerrolle

Krypto

E-Mail

Funde von Bedrohungen

ANWENDUNGSFÄLLE

PRODUKT-SPOTLIGHT

COre-Abdeckung

Aktuelle Blogs

Moving Beyond XDR to Achieve True Cyber Resilience with Darktrace ActiveAI Security Platform

Apr 9, 2024

Managing Risk Beyond CVE Scores With the Latest Innovations to Darktrace/OT

Apr 9, 2024

Looking Beyond Secure Email Gateways with the Latest Innovations to Darktrace/Email

Apr 7, 2024

The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners

Apr 9, 2024

Beyond DMARC: Navigating the Gaps in Email Security

Feb 29, 2024

More in this series

Keine Artikel gefunden.

Blog

Einblicke in das SOC-Team

A Thorn in Attackers’ Sides: How Darktrace Uncovered a CACTUS Ransomware Infection

Apr 2024

What is CACTUS Ransomware?

In May 2023, Kroll Cyber Threat Intelligence Analysts identified CACTUS as a new ransomware strain that had been actively targeting large commercial organizations since March 2023 [1]. CACTUS ransomware gets its name from the filename of the ransom note, “cAcTuS.readme.txt”. Encrypted files are appended with the extension “.cts”, followed by a number which varies between attacks, e.g. “.cts1” and “.cts2”.

As the cyber threat landscape adapts to ever-present fast-paced technological change, ransomware affiliates are employing progressively sophisticated techniques to enter networks, evade detection and achieve their nefarious goals.

How does CACTUS Ransomware work?

In the case of CACTUS, threat actors have been seen gaining initial network access by exploiting Virtual Private Network (VPN) services. Once inside the network, they may conduct internal scanning using tools like SoftPerfect Network Scanner, and PowerShell commands to enumerate endpoints, identify user accounts, and ping remote endpoints. Persistence is maintained by the deployment of various remote access methods, including legitimate remote access tools like Splashtop, AnyDesk, and SuperOps RMM in order to evade detection, along with malicious tools like Cobalt Strike and Chisel. Such tools, as well as custom scripts like TotalExec, have been used to disable security software to distribute the ransomware binary. CACTUS ransomware is unique in that it adopts a double-extortion tactic, stealing data from target networks and then encrypting it on compromised systems [2].

At the end of November 2023, cybersecurity firm Arctic Wolf reported instances of CACTUS attacks exploiting vulnerabilities on the Windows version of the business analytics platform Qlik, specifically CVE-2023-41266, CVE-2023-41265, and CVE-2023-48365, to gain initial access to target networks [3]. The vulnerability tracked as CVE-2023-41266 can be exploited to generate anonymous sessions and perform HTTP requests to unauthorized endpoints, whilst CVE-2023-41265 does not require authentication and can be leveraged to elevate privileges and execute HTTP requests on the backend server that hosts the application [2].

Darktrace’s Coverage of CACTUS Ransomware

In November 2023, Darktrace observed malicious actors leveraging the aforementioned method of exploiting Qlik to gain access to the network of a customer in the US, more than a week before the vulnerability was reported by external researchers.

Here, Qlik vulnerabilities were successfully exploited, and a malicious executable (.exe) was detonated on the network, which was followed by network scanning and failed Kerberos login attempts. The attack culminated in the encryption of numerous files with extensions such as “.cts1”, and SMB writes of the ransom note “cAcTuS.readme.txt” to multiple internal devices, all of which was promptly identified by Darktrace DETECT™.

While traditional rules and signature-based detection tools may struggle to identify the malicious use of a legitimate business platform like Qlik, Darktrace’s Self-Learning AI was able to confidently identify anomalous use of the tool in a CACTUS ransomware attack by examining the rarity of the offending device’s surrounding activity and comparing it to the learned behavior of the device and its peers.

Unfortunately for the customer in this case, Darktrace RESPOND™ was not enabled in autonomous response mode during their encounter with CACTUS ransomware meaning that attackers were able to successfully escalate their attack to the point of ransomware detonation and file encryption. Had RESPOND been configured to autonomously act on any unusual activity, Darktrace could have prevented the attack from progressing, stopping the download of any harmful files, or the encryption of legitimate ones.

Cactus Ransomware Attack Overview

Holiday periods have increasingly become one of the favoured times for malicious actors to launch their attacks, as they can take advantage of the festive downtime of organizations and their security teams, and the typically more relaxed mindset of employees during this period [4].

Following this trend, in late November 2023, Darktrace began detecting anomalous connections on the network of a customer in the US, which presented multiple indicators of compromise (IoCs) and tactics, techniques and procedures (TTPs) associated with CACTUS ransomware. The threat actors in this case set their attack in motion by exploiting the Qlik vulnerabilities on one of the customer’s critical servers.

Darktrace observed the server device making beaconing connections to the endpoint “zohoservice[.]net” (IP address: 45.61.147.176) over the course of three days. This endpoint is known to host a malicious payload, namely a .zip file containing the command line connection tool PuttyLink [5].

Darktrace’s Cyber AI Analyst was able to autonomously identify over 1,000 beaconing connections taking place on the customer’s network and group them together, in this case joining the dots in an ongoing ransomware attack. AI Analyst recognized that these repeated connections to highly suspicious locations were indicative of malicious command-and-control (C2) activity.

Figure 1: Cyber AI Analyst Incident Log showing the offending device making over 1,000 connections to the suspicious hostname “zohoservice[.]net” over port 8383, within a specific period.

The infected device was then observed downloading the file “putty.zip” over a HTTP connection using a PowerShell user agent. Despite being labelled as a .zip file, Darktrace’s detection capabilities were able to identify this as a masqueraded PuttyLink executable file. This activity resulted in multiple Darktrace DETECT models being triggered. These models are designed to look for suspicious file downloads from endpoints not usually visited by devices on the network, and files whose types are masqueraded, as well as the anomalous use of PowerShell. This behavior resembled previously observed activity with regards to the exploitation of Qlik Sense as an intrusion technique prior to the deployment of CACTUS ransomware [5].

Figure 2: The downloaded file’s URI highlighting that the file type (.exe) does not match the file's extension (.zip). Information about the observed PowerShell user agent is also featured.

Following the download of the masqueraded file, Darktrace observed the initial infected device engaging in unusual network scanning activity over the SMB, RDP and LDAP protocols. During this activity, the credential, “service_qlik” was observed, further indicating that Qlik was exploited by threat actors attempting to evade detection. Connections to other internal devices were made as part of this scanning activity as the attackers attempted to move laterally across the network.

Figure 3: Numerous failed connections from the affected server to multiple other internal devices over port 445, indicating SMB scanning activity.

The compromised server was then seen initiating multiple sessions over the RDP protocol to another device on the customer’s network, namely an internal DNS server. External researchers had previously observed this technique in CACTUS ransomware attacks where an RDP tunnel was established via Plink [5].

A few days later, on November 24, Darktrace identified over 20,000 failed Kerberos authentication attempts for the username “service_qlik” being made to the internal DNS server, clearly representing a brute-force login attack. There is currently a lack of open-source intelligence (OSINT) material definitively listing Kerberos login failures as part of a CACTUS ransomware attack that exploits the Qlik vulnerabilities. This highlights Darktrace’s ability to identify ongoing threats amongst unusual network activity without relying on existing threat intelligence, emphasizing its advantage over traditional security detection tools.

Figure 4: Kerberos login failures being carried out by the initial infected device. The destination device detected was an internal DNS server.

In the month following these failed Kerberos login attempts, between November 26 and December 22, Darktrace observed multiple internal devices encrypting files within the customer’s environment with the extensions “.cts1” and “.cts7”. Devices were also seen writing ransom notes with the file name “cAcTuS.readme.txt” to two additional internal devices, as well as files likely associated with Qlik, such as “QlikSense.pdf”. This activity detected by Darktrace confirmed the presence of a CACTUS ransomware infection that was spreading across the customer’s network.

Figure 5: The model, 'Ransom or Offensive Words Written to SMB', triggered in response to SMB file writes of the ransom note, ‘cAcTuS.readme.txt’, that was observed on the customer’s network.

Figure 6: CACTUS ransomware extensions, “.cts1” and “.cts7”, being appended to files on the customer’s network.

Following this initial encryption activity, two affected devices were observed attempting to remove evidence of this activity by deleting the encrypted files.

Figure 7: Attackers attempting to remove evidence of their activity by deleting files with appendage “.cts1”.

Schlussfolgerung

In the face of this CACTUS ransomware attack, Darktrace’s anomaly-based approach to threat detection enabled it to quickly identify multiple stages of the cyber kill chain occurring in the customer’s environment. These stages ranged from ‘initial access’ by exploiting Qlik vulnerabilities, which Darktrace was able to detect before the method had been reported by external researchers, to ‘actions on objectives’ by encrypting files. Darktrace’s Self-Learning AI was also able to detect a previously unreported stage of the attack: multiple Kerberos brute force login attempts.

If Darktrace’s autonomous response capability, RESPOND, had been active and enabled in autonomous response mode at the time of this attack, it would have been able to take swift mitigative action to shut down such suspicious activity as soon as it was identified by DETECT, effectively containing the ransomware attack at the earliest possible stage.

Learning a network’s ‘normal’ to identify deviations from established patterns of behaviour enables Darktrace’s identify a potential compromise, even one that uses common and often legitimately used administrative tools. This allows Darktrace to stay one step ahead of the increasingly sophisticated TTPs used by ransomware actors.

Credit to Tiana Kelly, Cyber Analyst & Analyst Team Lead, Anna Gilbertson, Cyber Analyst

Appendices

References

[1] https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection

[2] https://www.bleepingcomputer.com/news/security/cactus-ransomware-exploiting-qlik-sense-flaws-to-breach-networks/

[3] https://explore.avertium.com/resource/new-ransomware-strains-cactus-and-3am

[4] https://www.soitron.com/cyber-attackers-abuse-holidays/

[5] https://arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/

Darktrace DETECT Models

Compromise / Agent Beacon (Long Period)

Anomalous Connection / PowerShell to Rare External

Device / New PowerShell User Agent

Device / Suspicious SMB Scanning Activity

Anomalous File / EXE from Rare External Location

Anomalous Connection / Unusual Internal Remote Desktop

User / Kerberos Password Brute Force

Compromise / Ransomware / Ransom or Offensive Words Written to SMB

Unusual Activity / Anomalous SMB Delete Volume

Anomalous Connection / Multiple Connections to New External TCP Port

Compromise / Slow Beaconing Activity To External Rare

Compromise / SSL Beaconing to Rare Destination

Anomalous Server Activity / Rare External from Server

Compliance / Remote Management Tool On Server

Compromise / Agent Beacon (Long Period)

Compromise / Suspicious File and C2

Device / Internet Facing Device with High Priority Alert

Device / Large Number of Model Breaches

Anomalous File / Masqueraded File Transfer

Anomalous File / Internet facing System File Download

Anomalous Server Activity / Outgoing from Server

Device / Initial Breach Chain Compromise

Compromise / Agent Beacon (Medium Period)

Compromise / Agent Beacon (Long Period)

List of IoCs

IoC - Type - Description‍

zohoservice[.]net: 45.61.147[.]176 - Domain name: IP Address - Hosting payload over HTTP

Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17763.2183 - User agent -PowerShell user agent

.cts1 - File extension - Malicious appendage

.cts7- File extension - Malicious appendage

cAcTuS.readme.txt - Filename -Ransom note

putty.zip – Filename - Initial payload: ZIP containing PuTTY Link

MITRE ATT&CK Mapping

Tactic - Technique - SubTechnique

Web Protocols: COMMAND AND CONTROL - T1071 -T1071.001

Powershell: EXECUTION - T1059 - T1059.001

Exploitation of Remote Services: LATERAL MOVEMENT - T1210 – N/A

Vulnerability Scanning: RECONAISSANCE - T1595 - T1595.002

Network Service Scanning: DISCOVERY - T1046 - N/A

Malware: RESOURCE DEVELOPMENT - T1588 - T1588.001

Drive-by Compromise: INITIAL ACCESS - T1189 - N/A

Remote Desktop Protocol: LATERAL MOVEMENT – 1021 -T1021.001

Brute Force: CREDENTIAL ACCESS T – 1110 - N/A

Data Encrypted for Impact: IMPACT - T1486 - N/A

Data Destruction: IMPACT - T1485 - N/A

File Deletion: DEFENSE EVASION - T1070 - T1070.004

About the author

Tiana Kelly

Deputy Team Lead, London & Cyber Analyst

Blog

Keine Artikel gefunden.

The State of AI in Cybersecurity: How AI will impact the cyber threat landscape in 2024

Apr 2024

About the AI Cybersecurity Report

We surveyed 1,800 CISOs, security leaders, administrators, and practitioners from industries around the globe. Our research was conducted to understand how the adoption of new AI-powered offensive and defensive cybersecurity technologies are being managed by organizations.

This blog is continuing the conversation from our last blog post “The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners” which was an overview of the entire report. This blog will focus on one aspect of the overarching report, the impact of AI on the cyber threat landscape.

To access the full report click here.

Are organizations feeling the impact of AI-powered cyber threats?

Nearly three-quarters (74%) state AI-powered threats are now a significant issue. Almost nine in ten (89%) agree that AI-powered threats will remain a major challenge into the foreseeable future, not just for the next one to two years.

However, only a slight majority (56%) thought AI-powered threats were a separate issue from traditional/non AI-powered threats. This could be the case because there are few, if any, reliable methods to determine whether an attack is AI-powered.

Identifying exactly when and where AI is being applied may not ever be possible. However, it is possible for AI to affect every stage of the attack lifecycle. As such, defenders will likely need to focus on preparing for a world where threats are unique and are coming faster than ever before.

a hypothetical cyber attack augmented by AI at every stage

Are security stakeholders concerned about AI’s impact on cyber threats and risks?

The results from our survey showed that security practitioners are concerned that AI will impact organizations in a variety of ways. There was equal concern associated across the board – from volume and sophistication of malware to internal risks like leakage of proprietary information from employees using generative AI tools.

What this tells us is that defenders need to prepare for a greater volume of sophisticated attacks and balance this with a focus on cyber hygiene to manage internal risks.

One example of a growing internal risks is shadow AI. It takes little effort for employees to adopt publicly-available text-based generative AI systems to increase their productivity. This opens the door to “shadow AI”, which is the use of popular AI tools without organizational approval or oversight. Resulting security risks such as inadvertent exposure of sensitive information or intellectual property are an ever-growing concern.

Are organizations taking strides to reduce risks associated with adoption of AI in their application and computing environment?

71.2% of survey participants say their organization has taken steps specifically to reduce the risk of using AI within its application and computing environment.

16.3% of survey participants claim their organization has not taken these steps.

These findings are good news. Even as enterprises compete to get as much value from AI as they can, as quickly as possible, they’re tempering their eager embrace of new tools with sensible caution.

Still, responses varied across roles. Security analysts, operators, administrators, and incident responders are less likely to have said their organizations had taken AI risk mitigation steps than respondents in other roles. In fact, 79% of executives said steps had been taken, and only 54% of respondents in hands-on roles agreed. It seems that leaders believe their organizations are taking the needed steps, but practitioners are seeing a gap.

Do security professionals feel confident in their preparedness for the next generation of threats?

A majority of respondents (six out of every ten) believe their organizations are inadequately prepared to face the next generation of AI-powered threats.

The survey findings reveal contrasting perceptions of organizational preparedness for cybersecurity threats across different regions and job roles. Security administrators, due to their hands-on experience, express the highest level of skepticism, with 72% feeling their organizations are inadequately prepared. Notably, respondents in mid-sized organizations feel the least prepared, while those in the largest companies feel the most prepared.

Regionally, participants in Asia-Pacific are most likely to believe their organizations are unprepared, while those in Latin America feel the most prepared. This aligns with the observation that Asia-Pacific has been the most impacted region by cybersecurity threats in recent years, according to the IBM X-Force Threat Intelligence Index.

The optimism among Latin American respondents could be attributed to lower threat volumes experienced in the region, but it's cautioned that this could change suddenly (1).

What are biggest barriers to defending against AI-powered threats?

The top-ranked inhibitors center on knowledge and personnel. However, issues are alluded to almost equally across the board including concerns around budget, tool integration, lack of attention to AI-powered threats, and poor cyber hygiene.

The cybersecurity industry is facing a significant shortage of skilled professionals, with a global deficit of approximately 4 million experts (2). As organizations struggle to manage their security tools and alerts, the challenge intensifies with the increasing adoption of AI by attackers. This shift has altered the demands on security teams, requiring practitioners to possess broad and deep knowledge across rapidly evolving solution stacks.

Educating end users about AI-driven defenses becomes paramount as organizations grapple with the shortage of professionals proficient in managing AI-powered security tools. Operationalizing machine learning models for effectiveness and accuracy emerges as a crucial skill set in high demand. However, our survey highlights a concerning lack of understanding among cybersecurity professionals regarding AI-driven threats and the use of AI-driven countermeasures indicating a gap in keeping pace with evolving attacker tactics.

The integration of security solutions remains a notable problem, hindering effective defense strategies. While budget constraints are not a primary inhibitor, organizations must prioritize addressing these challenges to bolster their cybersecurity posture. It's imperative for stakeholders to recognize the importance of investing in skilled professionals and integrated security solutions to mitigate emerging threats effectively.

To access the full report click here.

References

1. IBM, X-Force Threat Intelligence Index 2024, Available at: https://www.ibm.com/downloads/cas/L0GKXDWJ

2. ISC2, Cybersecurity Workforce Study 2023, Available at: https://media.isc2.org/-/media/Project/ISC2/Main/Media/ documents/research/ISC2_Cybersecurity_Workforce_Study_2023.pdf?rev=28b46de71ce24e6ab7705f6e3da8637e

About the author

Our ai. Your data.

Elevate your cyber defenses with Darktrace AI

Starten Sie Ihren kostenlosen Test

Darktrace AI protecting a business from cyber threats.

Check out this article by Darktrace: 3CX Supply Chain Compromise: How Darktrace Uncovered A “Smooth Operator”

Blog

Einblicke in das SOC-Team

3CX Supply Chain Compromise: How Darktrace Uncovered A “Smooth Operator”

Background on the first known cascading supply chain attack

Initial Access

Persistence and Privilege Escalation

Lateral Movement and C2 activity

3CX detections observed by Darktrace

Darktrace Coverage

Schlussfolgerung

Appendices

MITRE ATT&CK Framework

List of IOCs

References

Sie mögen das und wollen mehr?

Sie mögen das und wollen mehr?

More in this series

Blog

Einblicke in das SOC-Team

A Thorn in Attackers’ Sides: How Darktrace Uncovered a CACTUS Ransomware Infection

What is CACTUS Ransomware?

How does CACTUS Ransomware work?

Darktrace’s Coverage of CACTUS Ransomware

Cactus Ransomware Attack Overview

Schlussfolgerung

Appendices

References

Darktrace DETECT Models

List of IoCs

MITRE ATT&CK Mapping

Blog

The State of AI in Cybersecurity: How AI will impact the cyber threat landscape in 2024

About the AI Cybersecurity Report

Are organizations feeling the impact of AI-powered cyber threats?

Are security stakeholders concerned about AI’s impact on cyber threats and risks?

Are organizations taking strides to reduce risks associated with adoption of AI in their application and computing environment?

Do security professionals feel confident in their preparedness for the next generation of threats?

What are biggest barriers to defending against AI-powered threats?

To access the full report click here.

References

Elevate your cyber defenses with Darktrace AI