Wie KI kritische Infrastrukturen vor Ransomware schützt

Standard-BlogbildStandard-BlogbildStandard-BlogbildStandard-BlogbildStandard-BlogbildStandard-Blogbild
12
May 2021
12
May 2021
In the wake of the Colonial Pipeline cyber-attack, this blog discusses the many threats facing critical infrastructure, and how Cyber AI disrupted a similar ‘double extortion’ ransomware attack against an electrical utilities supplier.

Modern Threats to OT Environments

At the 2021 RSA cyber security conference, US Secretary of Homeland Security Alejandro Mayorkas made an era-defining statement regarding the cyber security landscape: “Let me be clear: ransomware now poses a national security threat.”

Last weekend, Mayorkas’ words rang true. A ransomware attack on the Colonial Pipeline – responsible for nearly half of the US East Coast’s diesel, gasoline, and jet fuel – resulted in the shutdown of a critical fuel network supplying a number of Eastern states.

The fallout from the attack demonstrated how widespread and damaging the consequences of ransomware can be. Against critical infrastructure and utilities, cyber-attacks have the potential to disrupt supplies, harm the environment, and even threaten human lives.

Though full details remain to be confirmed, the attack is reported to have been conducted by an affiliate of the cyber-criminal group called DarkSide, and likely leveraged common remote desktop tools. Remote access has been enabled as an exploitable vulnerability within critical infrastructure by the shift to remote work that many organizations made last year, including those with Industrial Control Systems (ICS) and Operational Technology (OT).

The rise of industrial ransomware

Ransomware against industrial environments is on the rise, with a reported 500% increase since 2018. Oftentimes, these threats leverage the convergence of IT and OT systems, first targeting IT before pivoting to OT. This was seen with the EKANS ransomware that included ICS processes in its ‘kill list’, as well as the Cring ransomware that compromised ICS after first exploiting a vulnerability in a virtual private network (VPN).

It remains to be seen whether the initial attack vector in the Colonial Pipeline compromise exploited a technical vulnerability, compromised credentials, or a targeted spear phishing campaign. It has been reported that the attack first impacted IT systems, and that Colonial then shut down OT operations as a safety precaution. Colonial confirms that the ransomware “temporarily halted all pipeline operations and affected some of our IT systems,” showing that, ultimately, both OT and IT were affected. This is a great example of how many OT systems depend on IT, such that an IT cyber-attack has the ability to take down OT and ICS processes.

In addition to locking down systems, the threat actors also stole 100GB of sensitive data from Colonial. This kind of double extortion attack — in which data is exfiltrated before files are encrypted — has unfortunately become the norm rather than the exception, with over 70% of ransomware attacks involving exfiltration. Some ransomware gangs have even announced that they are dropping encryption altogether in favor of data theft and extortion methods.

Earlier this year, Darktrace defended against a double extortion ransomware attack waged against a critical infrastructure organization, which also leveraged common remote access tools. This blog will outline the threat find in depth, showing how Darktrace’s self-learning AI responded autonomously to an attack strikingly similar to the Colonial Pipeline incident.

Darktrace threat find

Ransomware against electric utilities equipment supplier

In an attack against a North American equipment supplier for electrical utilities earlier this year, Darktrace/OT demonstrated its ability to protect critical infrastructure against double extortion ransomware that targeted organizations with ICS and OT.

The ransomware attack initially targeted IT systems, and, thanks to self-learning Cyber AI, was stopped before it could spill over into OT and disrupt operations.

The attacker first compromised an internal server in order to exfiltrate data and deploy ransomware over the course of 12 hours. The short amount of time between initial compromise and deployment is unusual, as ransomware threat actors often wait several days to spread stealthily as far across the cyber ecosystem as possible before striking.

Abbildung 1: Die Timeline des Angriffs

How did the attack bypass the rest of the security stack?

The attacker leveraged ‘Living off the Land’ techniques to blend into the business’ normal ‘patterns of life’, using a compromised admin credential and a remote management tool approved by the organization, in its attempts to remain undetected.

Darktrace commonly sees the abuse of legitimate remote management software in attackers’ arsenal of techniques, tactics, and procedures (TTPs). Remote access is also becoming an increasingly common vector of attack in ICS attacks in particular. For example, in the cyber-incident at the Florida water treatment facility last February, attackers exploited a remote management tool in attempts to manipulate the treatment process.

The specific strain of ransomware deployed by this attacker also successfully evaded detection by anti-virus by using a unique file extension when encrypting files. These forms of ‘signatureless’ ransomware easily slip past legacy approaches to security that rely on rules, signatures, threat feeds, and lists of documented Common Vulnerabilities and Exposures (CVEs), as these are methods that can only detect previously documented threats.

The only way to detect never-before-seen threats like signatureless ransomware is for a technology to find anomalous behavior, rather than rely on lists of ‘known bads’. This can be achieved with self-learning technology, which spots even the most subtle deviations from the normal ‘patterns of life’ for all devices, users, and all the connections between them.

Darktrace insights

Initial compromise and establishing foothold

Despite the abuse of a legitimate tool and the absence of known signatures, Darktrace/OT was able to use a holistic understanding of normal activity to detect the malicious activity at multiple points in the attack lifecycle.

The first clear sign of an emerging threat that was alerted by Darktrace was the unusual use of a privileged credential. The device also served an unusual remote desktop protocol (RDP) connection from a Veeam server shortly before the incident, indicating that the attacker may have moved laterally from elsewhere in the network.

Three minutes later, the device initiated a remote management session which lasted 21 hours. This allowed the attacker to move throughout the broader cyber ecosystem while remaining undetected by traditional defences. Darktrace, however, was able to detect unusual remote management usage as another early warning indicative of an attack.

Double threat part one: Data exfiltration

One hour after the initial compromise, Darktrace detected unusual volumes of data being sent to a 100% rare cloud storage solution, pCloud. The outbound data was encrypted using SSL, but Darktrace created multiple alerts relating to large internal downloads and external uploads that were a significant deviation from the device’s normal ‘pattern of life’.

The device continued to exfiltrate data for nine hours. Analysis of the files downloaded by the device, which were transferred using the unencrypted SMB protocol, suggests that they were sensitive in nature. Fortunately, Darktrace was able to pinpoint the specific files that were exfiltrated so that the customer could immediately evaluate the potential implications of the compromise.

Double threat part two: File encryption

A short time later, at 01:49 local time, the compromised device began encrypting files in a SharePoint back-up share drive. Over the next three and a half hours, the device encrypted over 13,000 files on at least 20 SMB shares. In total, Darktrace produced 23 alerts for the device in question, which amounted to 48% of all the alerts produced in the corresponding 24-hour period.

Darktrace’s Cyber AI Analyst then automatically launched an investigation, identifying the internal data transfers and the file encryption over SMB. From this, it was able to present incident reports that connected the dots among these disparate anomalies, piecing them together into a coherent security narrative. This put the security team in a position to immediately take remediating action.

If the customer had been using Darktrace’s autonomous response technology, there is no doubt the activity would have been halted before significant volumes of data could have been exfiltrated or files encrypted. Fortunately, after seeing both the alerts and Cyber AI Analyst reports, the customer was able to use Darktrace’s ‘Ask the Expert’ (ATE) service for incident response to mitigate the impact of the attack and assist with disaster recovery.

Figure 2: AI Analyst Incident reporting an unusual reprogram command using the MODBUS protocol. The incident includes a plain English summary, relevant technical information, and the investigation process used by the AI.  

Detecting the threat before it could disrupt critical infrastructure

The targeted supplier was overseeing OT and had close ties to critical infrastructure. By facilitating the early-stage response, Darktrace prevented the ransomware from spreading further onto the factory floor. Crucially, Darktrace also minimized operational disruption, helping to avoid the domino effect which the attack could have had, affecting not only the supplier itself, but also the electric utilities that this supplier supports.

As both the recent Colonial Pipeline incident and the above threat find reveal, ransomware is a pressing concern for organizations overseeing industrial operations across all forms of critical infrastructure, from pipelines to the power grid and its suppliers. With self-learning AI, these attack vectors can be dealt with before the damage is done through real-time threat detection, autonomous investigations, and — if activated — targeted machine-speed response.

Looking forward: Using Self-Learning AI to protect critical infrastructure across the board

In late April, the Biden administration announced an ambitious effort to “safeguard US critical infrastructure from persistent and sophisticated threats.” The Department of Energy’s (DOE) 100-day plan specifically seeks technologies “that will provide cyber visibility, detection, and response capabilities for industrial control systems of electric utilities.”

The Biden administration’s cyber sprint clearly calls for a technology that protects critical energy infrastructure, rather than merely best practice measures and regulations. As seen in the above threat find, Darktrace AI is a powerful technology that leverages unsupervised machine learning to autonomously safeguard critical infrastructure and its suppliers with machine speed and precision.

Darktrace enhances detection, mitigation, and forensic capabilities to detect  sophisticated and novel attacks, along with insider threats and pre-existing infections, using Self-Learning Cyber AI, without rules, signatures, or lists of CVEs. Incident investigations provided in real time by Cyber AI Analyst jumpstart remediation with actionable insights, containing emerging attacks at their early stages, before they escalate into crisis.

Enable near real-time situational awareness and response capabilities

Darktrace immediately understands, identifies, and investigates all anomalous activity in ICS/OT networks, whether human or machine driven. Additionally, Darktrace actions targeted response where appropriate to neutralize threats, either actively or in human confirmation mode. Because Self-learning AI adapts alongside evolutions in the ecosystem, organizations benefit from real-time awareness with no tuning or human input necessary

Deploy technologies to increase visibility of threats in ICS and OT systems

Darktrace contextualizes security events, adapts to novel techniques, and translates findings into a security narrative that can be actioned by humans in minutes. Delivering a unified view across IT and OT systems.

Darktrace detects, investigates, and responds to threats at higher Purdue levels and in IT systems before they ‘spill over’ into OT. ‘Plug and play’ deployment seamlessly integrates with technological architecture, presenting 3D network topology with granular visibility into all users, devices, and subnets.

Darktrace's asset identification continuously catalogues all ICS/OT devices and identifies and investigates all threatening activity indicative of emerging attacks – be it ICS ransomware, APTs, zero-day exploits, insider threats, pre-existing infections, DDoS, crypto-mining, misconfigurations, or never-before-seen attacks.

Thanks to Darktrace analyst Oakley Cox for his insights on the above threat find.

Darktrace Modell-Erkennungen:

  • Initial compromise:
  • User / New Admin Credential on Client
  • Data exfiltration:
  • Anomalous Connection / Uncommon 1 GiB Outbound
  • Anomalous Connection / Low and Slow Exfiltration
  • Device / Anomalous SMB Followed by Multiple Model Breaches
  • Anomalous Connection / Download and Upload
  • File encryption:
  • Compromise / Ransomware / Suspicious SMB Activity
  • Anomalous Connection / SMB Enumeration
  • Device / Anomalous RDP Followed by Multiple Model Breaches
  • Anomalous File / Internal / Additional Extension Appended to SMB File
  • Anomalous Connection / Sustained MIME Type Conversion
  • Anomalous Connection / Suspicious Read Write Ratio
  • Device / Multiple Lateral Movement Model Breaches

EINBLICKE IN DAS SOC-Team
Darktrace Cyber-Analysten sind erstklassige Experten für Threat Intelligence, Threat Hunting und Incident Response. Sie bieten Tausenden von Darktrace Kunden auf der ganzen Welt rund um die Uhr SOC-Support. Einblicke in das SOC-Team wird ausschließlich von diesen Experten verfasst und bietet Analysen von Cyber-Vorfällen und Bedrohungstrends, die auf praktischen Erfahrungen in diesem Bereich basieren.
AUTOR
ÜBER DEN AUTOR
David Masson
Direktor für Unternehmenssicherheit

David Masson is Darktrace’s Director of Enterprise Security, and has over two decades of experience working in fast moving security and intelligence environments in the UK, Canada and worldwide. With skills developed in the civilian, military and diplomatic worlds, he has been influential in the efficient and effective resolution of various unique national security issues. David is an operational solutions expert and has a solid reputation across the UK and Canada for delivery tailored to customer needs. At Darktrace, David advises strategic customers across North America and is also a regular contributor to major international and national media outlets in Canada where he is based. He holds a master’s degree from Edinburgh University.

Book a 1-1 meeting with one of our experts
share this article
COre-Abdeckung

More in this series

Keine Artikel gefunden.

Blog

Keine Artikel gefunden.

Customer Blog: Community Housing Limited Enhancing Incident Response

Standard-BlogbildStandard-Blogbild
04
Mar 2024

About Community Housing Limited

Community Housing Limited is a non-profit organization based in Australia that focuses on providing affordable, long-term housing and creating employment opportunities where possible. We give people the security of having a home so that they can focus on other essential pathways. As such, we are responsible for sensitive information on our clients.

As part of our commitment to strengthening our cyber security, we sought to simplify and unify our incident response plans and equip our engineers and desktop support teams with all the information we need at our fingertips.

Why Community Housing Limited chose Darktrace

Our team hoped to achieve a response procedure that allowed us to have oversight over any potential security risks, even cases that don’t overtly seem like a security risk. For example, an incident could start as a payroll issue and end up in the hands of HR, instead of surfacing as a security problem. In this case, our security team has no way of knowing the real number of events or how the threat had actually started and played out, making incident response and mitigation even more challenging.

We were already a customer of Darktrace’s autonomous threat detection, attack intervention, and attack surface management capabilities, and decided to add Darktrace for AI-assisted incident response and AI cyber-attack simulation.

AI-generated playbooks save time during incident response

I wanted to reduce the time and resources it took our security team to appropriately respond to a threat. Darktrace automates several steps of the recovery process to accelerate the rate of incident response by using AI that learns the granular details of the specific organization, building a dynamic understanding of the devices, connections, and user behaviors that make up the normal “pattern of life.”  

The AI then uses this understanding to create bespoke, AI-generated incident response playbooks that leverage an evolving understanding of our organization to determine recovery steps that are tailored not only to the specific incident but also to our unique environment.

For my security team, this means having access to all the information we need to respond to a threat. When running through an incident, rather than going to different places to synthesize relevant information, which takes up valuable resources and time, we can speed up its remediation with Darktrace.  

The playbooks created by Darktrace help lower the technical skills required to respond to incidents by elevating the workload of the staff, tripling our capacity for incident response.

Realistic attack simulations upskill teams while saving resources

We have differing levels of experience on the team which means some members know exactly what to do during incident response while others are slower and need more guidance. Thus, we have to either outsource skilled security professionals or add a security solution that could lower the technical skills bar.

You don’t want to be second guessing and searching for the right move – it’s urgent – there should be certainty. Our goal with running attack simulations is to test and train our team's response capabilities in a “realistic” scenario. But this takes considerable time to plan and execute or can be expensive if outsourced, which can be a challenge for organizations short on resources. 

Darktrace provides AI-assisted incident response and cyber-attack simulation using AI that understands the organization to run simulations that effectively map onto the real digital environment and the assets within it, providing training for actual incidents.

It is one thing to sit together in a meeting and discuss various outcomes of a cyber-attack, talking through the best response strategies. It is a huge benefit being able to run attack simulations that emulate real-world scenarios.

Our team can now see how an incident would play out over several days to resemble a real-world scenario or it can play through the simulation quickly to ascertain outcomes immediately. It then uses these insights to strengthen its technology, processes, and training.

AI-Powered Incident Response

Darktrace helps my security team save resources and upskill staff using AI to generate bespoke playbooks and run realistic simulations. Its real-time understanding of our business ensures incident preparedness and incident response are tailored to not only the specific threat in question, but also to the contextual infrastructure of the organization.  

Continue reading
About the author
Jamie Woodland
Head of Technology at Community Housing Limited

Blog

E-Mail

Beyond DMARC: Navigating the Gaps in Email Security

Standard-BlogbildStandard-Blogbild
29
Feb 2024

Email threat landscape  

Email has consistently ranked among the most targeted attack vectors, given its ubiquity and criticality to business operations. From September to December 2023, 10.4 million phishing emails were detected across Darktrace’s customer fleet demonstrating the frequency of attempted email-based attacks.

Businesses are searching for ways to harden their email security posture alongside email providers who are aiming to reduce malicious emails traversing their infrastructure, affecting their clients. Domain-based Message Authentication (DMARC) is a useful industry-wide protocol organizations can leverage to move towards these goals.  

What is DMARC?

DMARC is an email authentication protocol designed to enhance the security of email communication.

Major email service providers Google and Yahoo recently made the protocol mandatory for bulk senders in an effort to make inboxes safer worldwide. The new requirements demonstrate an increasing need for a standardized solution as misconfigured or nonexistent authentication systems continue to allow threat actors to evade detection and leverage the legitimate reputation of third parties.  

DMARC is a powerful tool that allows email administrators to confidently identify and stop certain spoofed emails; however, more organizations must implement the standard for it to reach its full potential. The success and effectiveness of DMARC is dependent on broad adoption of the standard – by organizations of all sizes.  

How does DMARC work?

DMARC builds on two key authentication technologies, Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) and helps to significantly improve their ability to prevent domain spoofing. SPF verifies that a sender’s IP address is authorized to send emails on behalf of a particular domain and DKIM ensures integrity of email content by providing a verifiable digital signature.  

DMARC adds to this by allowing domain owners to publish policies that set expectations for how SPF and DKIM verification checks relate to email addresses presented to users and whose authenticity the receiving mail server is looking to establish.  

These policies work in tandem to help authenticate email senders by verifying the emails are from the domain they say they are, working to prevent domain spoofing attacks. Key benefits of DMARC include:

  1. Phishing protection DMARC protects against direct domain spoofing in which a threat actor impersonates a legitimate domain, a common phishing technique threat actors use to trick employees to obtain sensitive information such as privileged credentials, bank information, etc.  
  2. Improving brand reputation: As DMARC helps to prevent impersonation of domains, it stands to maintain and increase an organization’s brand reputation. Additionally, as organizational reputation improves, so will the deliverability of emails.
  3. Increased visibility: DMARC provides enhanced visibility into email communication channels, including reports of all emails sent on behalf of your domain. This allows security teams to identify shadow-IT and any unauthorized parties using their domain.

Understanding DMARC’s Limitations

DMARC is often positioned as a way for organizations to ‘solve’ their email security problems, however, 65% of the phishing emails observed by Darktrace successfully passed DMARC verification, indicating that a significant number of threat actors are capable of manipulating email security and authentication systems in their exploits. While DMARC is a valuable tool in the fight against email-based attacks, the evolving threat landscape demands a closer look at its limitations.  

As threat actors continue to innovate, improving their stealth and evasion tactics, the number of attacks with valid DMARC authentication will only continue to increase in volume and sophistication. These can include:

  1. Phishing attacks that leverage non-spoofed domains: DMARC allows an organization to protect the domains that they own, preventing threat actors from being able to send phishing emails from their domains. However, threat actors will often create and use ‘look-a-like’ domains that closely resemble an organization’s domain to dupe users. 3% of the phishing emails identified by Darktrace utilized newly created domains, demonstrating shifting tactics.  
  2. Email Account Takeovers: If a threat actor gains access to a user’s email account through other social engineering means such as credential stuffing, they can then send phishing emails from the legitimate domain to pursue further attacks. Even though these emails are malicious, DMARC would not identify them as such because they are coming from an authorized domain or sender.  

Organizations must also ensure their inbound analysis of emails is not skewed by successful DMARC authentication. Security teams cannot inherently trust emails that pass DMARC, because the source cannot always be legitimized, like in the event of an account takeover. If a threat actor gains access to an authenticated email account, emails sent by the threat actor from that account will pass DMARC – however the contents of that email may be malicious. Sender behavior must be continuously evaluated and vetted in real time as past communication history and validated DMARC cannot be solely relied upon amid an ever-changing threat landscape.  

Security teams should lean on other security measures, such as anomaly detection tools that can identify suspicious emails without relying on historical attack rules and static data. While DMARC is not a silver bullet for email security, it is nevertheless foundational in helping organizations protect their brand identity and must be viewed as an essential layer in an organization's overall cyber security strategy.  

Implementing DMARC

Despite the criticality of DMARC for preserving brand reputation and trust, adoption of the standard has been inconsistent. DMARC can be complex to implement with many organizations lacking the time required to understand and successfully implement the standard. Because of this, DMARC set-up is often outsourced, giving security and infrastructure teams little to no visibility into or control of the process.  

Implementation of DMARC is only the start of this process, as DMARC reports must be consistently monitored to ensure organizations have visibility into who is sending mail from their domain, the volume of mail being sent and whether the mail is passing authentication protocols. This process can be time consuming for security teams who are already faced with mounting responsibilities, tight budgets, and personnel shortages. These complexities unfortunately delay organizations from using DMARC – especially as many today still view it as a ‘nice to have’ rather than an essential.  

With the potential complexities of the DMARC implementation process, there are many ways security and infrastructure teams can still successfully roll out the standard. Initial implementation should start with monitoring, policy adjustment and then enforcement. As business changes over time, DMARC should be reviewed regularly to ensure ongoing protection and maintain domain reputation.

The Future of Email Security

As email-based attacks continue to rise, the industry must recognize the importance of driving adoption of foundational email authentication protocols. To do this, a new and innovative approach to DMARC is needed. DMARC products must evolve to better support organizations throughout the ongoing DMARC monitoring process, rather than just initial implementation. These products must also be able to share intelligence across an organization’s security stack, extending beyond email security tools. Integration across these products and tools will help organizations optimize their posture, ensuring deep understanding of their domain and increased visibility across the entire enterprise.

DMARC is critical in protecting brand identity and mitigating exact-domain based attacks. However, organizations must understand DMARC’s unique benefits and limitations to ensure their inboxes are fully protected. In today’s evolving threat landscape, organizations require a robust, multi-layered approach to stop email threats – in inbound mail and beyond. Email threats have evolved – its time security does too.

Join Darktrace on 9 April for a virtual event to explore the latest innovations needed to get ahead of the rapidly evolving threat landscape. Register today to hear more about our latest innovations coming to Darktrace’s offerings. For additional insights check out Darktrace’s 2023 End of Year Threat Report.

Credit to Carlos Gray and Stephen Pickman for their contribution to this blog

Continue reading
About the author
Carlos Gray
Product Manager

Gute Nachrichten für Ihr Unternehmen.
Schlechte Nachrichten für die Bösewichte.

Starten Sie Ihren kostenlosen Test

Starten Sie Ihren kostenlosen Test

Flexible Lieferung
Cloud-based deployment.
Schnelle Installation
Nur 1 Stunde für die Einrichtung - und noch weniger für eine Testversion der E-Mail-Sicherheit.
Wählen Sie Ihre Reise
Testen Sie selbstlernende KI dort, wo Sie sie am meisten brauchen - in der Cloud, im Netzwerk oder für E-Mail.
Keine Verpflichtung
Voller Zugriff auf den Darktrace Threat Visualizer und drei maßgeschneiderte Bedrohungsberichte, ohne Kaufverpflichtung.
For more information, please see our Privacy Notice.
Thanks, your request has been received
A member of our team will be in touch with you shortly.
YOU MAY FIND INTERESTING
Huch! Beim Absenden des Formulars ist etwas schief gelaufen.

Demo anfordern

Flexible Lieferung
Sie können es entweder virtuell oder mit Hardware installieren.
Schnelle Installation
Nur 1 Stunde für die Einrichtung - und noch weniger für eine Testversion der E-Mail-Sicherheit.
Wählen Sie Ihre Reise
Testen Sie selbstlernende KI dort, wo Sie sie am meisten brauchen - in der Cloud, im Netzwerk oder für E-Mail.
Keine Verpflichtung
Voller Zugriff auf den Darktrace Threat Visualizer und drei maßgeschneiderte Bedrohungsberichte, ohne Kaufverpflichtung.
Vielen Dank! Ihre Anfrage ist eingegangen!
Huch! Beim Absenden des Formulars ist etwas schief gelaufen.