Blog

Ransomware

Der Vorhang über die Grief-Ransomware wird gelüftet

Mai 2022

Die Ransomware Grief tauchte im vergangenen Jahr plötzlich auf und verursachte Störungen in einer Reihe von Branchen und bei Gemeinden - aber das Playbook der Angreifer, die dahinter stecken, kam vielen bekannt vor. Erfahren Sie, warum DoppelPaymer zu PayOrGrief wurde und wie die KI von Darktrace dazu beitrug, ein Unternehmen vor einem der raffinierten Ransomware-Angriffe zu schützen.

Der Ransomware-Stamm Grief, auch unter dem Namen PayOrGrief bekannt, sorgte Mitte bis Ende 2021 für Ausfälle und brachte es so zu einiger Bekanntheit. Die Bande hinter der Malware nutzte „Quadruple Extortion“-Ransomware, die Erpressung auf vier Stufen ermöglicht, und griff diverse Ziele wie Stadtverwaltungen und Schulbezirke an.

Im Juli 2021, nur wenige Wochen, nachdem der Stamm den Cybersicherheitsteams erstmals gemeldet wurde, startete Grief einen erfolgreichen Angriff auf Thessaloniki, die zweitgrößte Stadt Griechenlands. Es wurde ein Lösegeld von 20 Mio. US-Dollar gefordert und das Sicherheitsteam musste alle Websites und Bürgerservices abschalten, um den Vorfall zu untersuchen.

Doppelpack: Grief und DoppelPaymer

Seitdem Grief im Mai 2021 erstmals in Erscheinung getreten war, nutzte die Bande neuartige Malware, die auf historischen Angriffsdaten basierende Sicherheitstools ungehindert passieren konnte. Im Juli vermuteten viele aufgrund der Komplexität und Effizienz der Angriffe der Bande, dass ihre Erfahrung weit über die zwei Monate ihrer derzeitigen Aktivität hinausgehen musste.

Man geht mittlerweile davon aus, dass es sich bei Grief um den neuen Name der Ransomware-Bande DoppelPaymer handelt. Diese stellte im Mai 2021 ihren Betrieb ein und soll mit der russischen Ransomware-Gruppe Evil Corp in Verbindung gestanden haben. Unter dem neuen Namen setzte Grief regelmäßig traditionelle Sicherheitstools außer Kraft und kassierte in nur vier Monaten weit über 10 Mio. US-Dollar an Lösegeld.

Anpassungen und Umbenennungen sind gängige Methoden von Verbrecherbanden, die auf Ransomware as a Service' als Geschäftsmodell setzen. Der Erfolg des Rebrandings von Grief macht deutlich, wie schnell eine Ransomware-Gruppe ihre Angriffe aktualisieren und für signaturbasierte Tools unkenntlich machen kann.

Cyber AI Analyst durchschaut Grief

Im Juli 2021 griff PayOrGrief ein europäisches Fertigungsunternehmen an, das in seinem Netzwerk Darktrace implementiert hatte. Darktrace erkannte den Angriff frühzeitig und der Cyber AI Analyst lieferte Echtzeiteinblicke in dessen Lebenszyklus, sodass jede Phase der Attacke lückenlos offengelegt wurde.

*Abbildung 1: Zeitlicher Ablauf des PayOrGrief-Angriffs*

Zunächst wurden vier Geräte kompromittiert. Darktrace erkannte diese Kompromittierung, weil die Geräte sich mit ungewöhnlichen externen IPs verbanden und codierte Textdateien herunterluden. Vermutlich wurden diese Geräte infolge einer gezielten Phishing-Kampagne kompromittiert, die bei Grief-Attacken häufig durchgeführt wird, um Malware wie Dridex einzuschleusen. Wäre in dem angegriffenen Unternehmen Antigena Email installiert gewesen, wäre die Phishing-Kampagne erkannt und gestoppt worden, bevor sie die Posteingänge der Mitarbeiter erreicht hätte. Da dies aber nicht der Fall war, ging der Angriff weiter.

Nach der anfänglichen Kompromittierung wurden Command & Control (C2)-Verbindungen über einen verschlüsselten Kanal mit ungültigen SSL-Zertifikaten hergestellt. Es wurden 50 MB an Daten von einem der infizierten Geräte auf den Firmenserver des Unternehmens übertragen, sodass die Angreifer Zugang zu dessen „Kronjuwelen“ erhielten: seinen sensibelsten Daten. Von dieser günstigen Ausgangsposition samt aktiver Keepalive-Beacons konnte sich der Angriff voll entfalten.

Einige Geräte versuchten, Daten mit einem Volumen von mehr als 100 GB über verschlüsseltes HTTPS an Port 443 zu der externen Speicherplattform Mega zu übertragen. Die Angreifer erhielten jedoch nicht das gesamte Datenpaket, mit dem sie gerechnet hatten. Das Unternehmen hatte die Darktrace Autonomous Response implementiert, um seine kritischen Unternehmenswerte und sensibelsten Daten zu schützen. Die KI erkannte in dem Verhalten eine erhebliche Abweichung von den normalen Verhaltensmustern, den „Patterns of Life“ des Unternehmens. Dementsprechend blockierte sie eigenständig Uploads von geschützten Geräten und vereitelte hier jegliche Ausschleusungsversuche.

*Abbildung 2: Datenausschleusung von einem einzelnen Gerät, untersucht vom Cyber AI Analyst*

Die Angreifer breiteten sich in der digitalen Umgebung weiter aus. Mithilfe von „Living off the Land“'-Methoden wie RDP und SMB nahmen sie eine interne Auskundschaftung vor, weiteten ihre Rechte aus und bewegten sich lateral zu weiteren digitalen Unternehmenswerten. Nur zehn Stunden nach der ersten C2-Kommunikation hatten die Angreifer Zugriff auf neue Admin-Zugangsdaten und nutzten dies, um mit der Ransomware-Verschlüsselung zu beginnen.

Es ist daher sehr gut möglich, dass Grief bereits früher einmal Kunden von Darktrace angegriffen hatte und neutralisiert worden war, bevor der Angriff identifiziert und zugeordnet werden konnte. In diesem Fall hatte das Unternehmen die Autonomous Response nur in bestimmten Bereichen des Netzwerks implementiert. Daher wird für uns sichtbar, wie der Angriff auf ungeschützten Geräten verlief.

Ungewöhnlicher Verdacht

Die Kompromittierungsindikatoren (IoC) für Grief-Ransomware wurden mittlerweile von vielen traditionellen Sicherheitstools übernommen. Das ist allerdings nur eine kurzfristige Lösung, weil weitere Veränderungen sowohl bei den Taktiken der Bedrohungsakteure als auch in den anvisierten digitalen Umgebungen nicht berücksichtigt werden können. Sobald mit Grief kein Geld mehr zu machen ist, wird eine andere Ransomware an seine Stelle treten.

Der KI-Ansatz für Cybersicherheit erkennt Bedrohungen, egal wo und wann sie auftauchen und unter welchem Namen sie agieren. Die Darktrace Autonomous Response entwickelt ein umfassendes Verständnis des gesamten digitalen Ökosystems und ergreift bei spezifischen Anomalien –auch wenn sie Teil völlig neuartiger Angriffe sind' – gezielte und verhältnismäßige Maßnahmen. Und wenn die Autonomous Response gleich nach der Erkennung freie Hand hat und mit eigenständigen Maßnahmen gegen diese Bedrohungen vorgehen kann, sind die Unternehmen jederzeit geschützt, selbst wenn die menschlichen Teams gerade nicht im Einsatz sind.

Wir danken der Analystin Beverly McCann von Darktrace für ihre Einblicke in die oben genannte Bedrohungslage.

Technische Einzelheiten

Abweichungen von Darktrace Modellen

Device / Suspicious SMB Scanning Activity
Device / New User Agents
Anomalous Server Activity / Rare External from Server
Compliance / External Windows Communications
Anomalous Connection / Application Protocol on Uncommon Port
Anomalous Connection / Anomalous SSL without SNI to New External
Anomalous Connection / Rare External SSL Self-Signed
Anomalous Connection / Multiple Connections to New External TCP Port
Anomalous Connection / New User Agent to IP Without Hostname
Compliance / Remote Management Tool on Server
Anomalous Server Activity / Outgoing from Server
Anomalous Connection / Multiple HTTP POSTs to Rare Hostname
Anomalous Connection / Data Sent to Rare Domain
Anomalous Connection / Lots of New Connections
Unusual Activity / Unusual File Storage Data Transfer
Unusual Activity / Enhanced Unusual External Data Transfer [Enhanced Monitoring]
Anomalous Connection / Uncommon 1GiB Outbound
Unusual Activity / Unusual External Data to New Ips
Anomalous Connection / SMB Enumeration
Multiple Device Correlations / Behavioral Change Across Multiple Devices
Device / New or Uncommon WMI Activity
Unusual Activity / Unusual External Connections
Device / ICMP Address Scan
Anomalous Connection / Unusual Admin RDP Session
Compliance / SMB Version 1 Usage
Anomalous Connection / Unusual SMB Version 1
Anomalous File / Internal / Additional Extension Appended to SMB File
Unusual Activity / Anomalous SMB Move and Write
Compromise / Ransomware / Suspicious SMB Activity [Enhanced Monitoring]
Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB
Anomalous Connection / New or Uncommon Service Control
Device / New or Unusual Remote Command Execution
User / New Admin Credentials On Client
Device / New or Uncommon SMB Named Pipe
Device / Multiple Lateral Movement Model Breaches [Enhanced Monitoring]
Anomalous Connection / Suspicious Read Write Ratio
Device / SMA Lateral Movement
Anomalous File / Internal / Unusual Internal EXE File Transfer
Anomalous Server Activity / Unusual Unresponsive Server
Device / Internet Facing Device with High Priority Alert
Multiple Device Correlations / Spreading Unusual SMB Activity
Multiple Device Correlations / Multiple Devices Breaching the Same Model

Abweichungen von Darktrace Modellen

Antigena / Network / Insider Threat / Antigena Network Scan Block
Antigena / Network / Insider Threat / Antigena Breaches Over Time Block
Antigena / Network / Significant Anomaly / Antigena Significant Anomaly Block
Antigena / Network / Significant Anomaly / Antigena Breaches over Time Block
Antigena / Network / Insider Threat / Antigena Large Data Volume Outbound Block
Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Client Block
Antigena / Network / Insider Threat / Antigena SMB Enumeration Block
Antigena / Network / Significant Anomaly / Antigena Controlled and Model Breach
Antigena / Network / Insider Threat / Antigena Internal Anomalous File Activity
Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block
Antigena / Network / External Threat / Antigena Ransomware Block
Antigena / Network / External Threat / SMB Ratio Antigena Block

MITRE ATT&CK-Techniken beobachtet

Reconnaissance
T1595 — Active Scanning

Resource Development
T1608 — Stage Capabilities

Initial Access
T1190 — Exploit Public-Facing Application

Persistence
T1133 — External Remote Services

Defense Evasion
T1079 — Valid Accounts

Discovery
T1046 — Network Service Scanning
T1083 — File and Directory Discovery
T1018 — Remote System Discovery

Lateral Movement
T1210 — Exploitation of Remote Services
T1080 — Taint Shared Content
T1570 — Lateral Tool Transfer
T1021 — Remote Services

Command and Control
T1071 — Application Layer Protocol
T1095 — Non-Application Layer Protocol
T1571 — Non-Standard Port

Exfiltration
T1041 — Exfiltration over C2 Channel
T1567 — Exfiltration Over Web Service
T1029 — Scheduled Transfer

Impact
T1486 — Data Encrypted for Impact
T1489 — Service Stop
T1529 — System Shutdown/Reboot

EINBLICKE IN DAS SOC-Team

Darktrace Cyber-Analysten sind erstklassige Experten für Threat Intelligence, Threat Hunting und Incident Response. Sie bieten Tausenden von Darktrace Kunden auf der ganzen Welt rund um die Uhr SOC-Support. Einblicke in das SOC-Team wird ausschließlich von diesen Experten verfasst und bietet Analysen von Cyber-Vorfällen und Bedrohungstrends, die auf praktischen Erfahrungen in diesem Bereich basieren.

AUTOR

ÜBER DEN AUTOR

Oakley Cox

Analyst Technical Director, APAC

Oakley is a technical expert with 5 years’ experience as a Cyber Analyst. After leading a team of Cyber Analysts at the Cambridge headquarters, he relocated to New Zealand and now oversees the defense of critical infrastructure and industrial control systems across the APAC region. His research into cyber-physical security has been published by Cyber Security journals and CISA. Oakley is GIAC certified in Response and Industrial Defense (GRID), and has a Doctorate (PhD) from the University of Oxford.

Watch the NIS2 Webinar

share this article

KATEGORIEN

McLaren

PREVENT

RESPOND

Cloud

Ransomware

Einblicke in das SOC-Team

Vordenkerrolle

Krypto

E-Mail

Funde von Bedrohungen

ANWENDUNGSFÄLLE

PRODUKT-SPOTLIGHT

Keine Artikel gefunden.

COre-Abdeckung

Keine Artikel gefunden.

Aktuelle Blogs

Moving Beyond XDR to Achieve True Cyber Resilience with Darktrace ActiveAI Security Platform

Apr 9, 2024

Managing Risk Beyond CVE Scores With the Latest Innovations to Darktrace/OT

Apr 9, 2024

Looking Beyond Secure Email Gateways with the Latest Innovations to Darktrace/Email

Apr 7, 2024

The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners

Apr 9, 2024

Beyond DMARC: Navigating the Gaps in Email Security

Feb 29, 2024

More in this series

Keine Artikel gefunden.

Blog

Einblicke in das SOC-Team

A Thorn in Attackers’ Sides: How Darktrace Uncovered a CACTUS Ransomware Infection

Apr 2024

What is CACTUS Ransomware?

In May 2023, Kroll Cyber Threat Intelligence Analysts identified CACTUS as a new ransomware strain that had been actively targeting large commercial organizations since March 2023 [1]. CACTUS ransomware gets its name from the filename of the ransom note, “cAcTuS.readme.txt”. Encrypted files are appended with the extension “.cts”, followed by a number which varies between attacks, e.g. “.cts1” and “.cts2”.

As the cyber threat landscape adapts to ever-present fast-paced technological change, ransomware affiliates are employing progressively sophisticated techniques to enter networks, evade detection and achieve their nefarious goals.

How does CACTUS Ransomware work?

In the case of CACTUS, threat actors have been seen gaining initial network access by exploiting Virtual Private Network (VPN) services. Once inside the network, they may conduct internal scanning using tools like SoftPerfect Network Scanner, and PowerShell commands to enumerate endpoints, identify user accounts, and ping remote endpoints. Persistence is maintained by the deployment of various remote access methods, including legitimate remote access tools like Splashtop, AnyDesk, and SuperOps RMM in order to evade detection, along with malicious tools like Cobalt Strike and Chisel. Such tools, as well as custom scripts like TotalExec, have been used to disable security software to distribute the ransomware binary. CACTUS ransomware is unique in that it adopts a double-extortion tactic, stealing data from target networks and then encrypting it on compromised systems [2].

At the end of November 2023, cybersecurity firm Arctic Wolf reported instances of CACTUS attacks exploiting vulnerabilities on the Windows version of the business analytics platform Qlik, specifically CVE-2023-41266, CVE-2023-41265, and CVE-2023-48365, to gain initial access to target networks [3]. The vulnerability tracked as CVE-2023-41266 can be exploited to generate anonymous sessions and perform HTTP requests to unauthorized endpoints, whilst CVE-2023-41265 does not require authentication and can be leveraged to elevate privileges and execute HTTP requests on the backend server that hosts the application [2].

Darktrace’s Coverage of CACTUS Ransomware

In November 2023, Darktrace observed malicious actors leveraging the aforementioned method of exploiting Qlik to gain access to the network of a customer in the US, more than a week before the vulnerability was reported by external researchers.

Here, Qlik vulnerabilities were successfully exploited, and a malicious executable (.exe) was detonated on the network, which was followed by network scanning and failed Kerberos login attempts. The attack culminated in the encryption of numerous files with extensions such as “.cts1”, and SMB writes of the ransom note “cAcTuS.readme.txt” to multiple internal devices, all of which was promptly identified by Darktrace DETECT™.

While traditional rules and signature-based detection tools may struggle to identify the malicious use of a legitimate business platform like Qlik, Darktrace’s Self-Learning AI was able to confidently identify anomalous use of the tool in a CACTUS ransomware attack by examining the rarity of the offending device’s surrounding activity and comparing it to the learned behavior of the device and its peers.

Unfortunately for the customer in this case, Darktrace RESPOND™ was not enabled in autonomous response mode during their encounter with CACTUS ransomware meaning that attackers were able to successfully escalate their attack to the point of ransomware detonation and file encryption. Had RESPOND been configured to autonomously act on any unusual activity, Darktrace could have prevented the attack from progressing, stopping the download of any harmful files, or the encryption of legitimate ones.

Cactus Ransomware Attack Overview

Holiday periods have increasingly become one of the favoured times for malicious actors to launch their attacks, as they can take advantage of the festive downtime of organizations and their security teams, and the typically more relaxed mindset of employees during this period [4].

Following this trend, in late November 2023, Darktrace began detecting anomalous connections on the network of a customer in the US, which presented multiple indicators of compromise (IoCs) and tactics, techniques and procedures (TTPs) associated with CACTUS ransomware. The threat actors in this case set their attack in motion by exploiting the Qlik vulnerabilities on one of the customer’s critical servers.

Darktrace observed the server device making beaconing connections to the endpoint “zohoservice[.]net” (IP address: 45.61.147.176) over the course of three days. This endpoint is known to host a malicious payload, namely a .zip file containing the command line connection tool PuttyLink [5].

Darktrace’s Cyber AI Analyst was able to autonomously identify over 1,000 beaconing connections taking place on the customer’s network and group them together, in this case joining the dots in an ongoing ransomware attack. AI Analyst recognized that these repeated connections to highly suspicious locations were indicative of malicious command-and-control (C2) activity.

Figure 1: Cyber AI Analyst Incident Log showing the offending device making over 1,000 connections to the suspicious hostname “zohoservice[.]net” over port 8383, within a specific period.

The infected device was then observed downloading the file “putty.zip” over a HTTP connection using a PowerShell user agent. Despite being labelled as a .zip file, Darktrace’s detection capabilities were able to identify this as a masqueraded PuttyLink executable file. This activity resulted in multiple Darktrace DETECT models being triggered. These models are designed to look for suspicious file downloads from endpoints not usually visited by devices on the network, and files whose types are masqueraded, as well as the anomalous use of PowerShell. This behavior resembled previously observed activity with regards to the exploitation of Qlik Sense as an intrusion technique prior to the deployment of CACTUS ransomware [5].

Figure 2: The downloaded file’s URI highlighting that the file type (.exe) does not match the file's extension (.zip). Information about the observed PowerShell user agent is also featured.

Following the download of the masqueraded file, Darktrace observed the initial infected device engaging in unusual network scanning activity over the SMB, RDP and LDAP protocols. During this activity, the credential, “service_qlik” was observed, further indicating that Qlik was exploited by threat actors attempting to evade detection. Connections to other internal devices were made as part of this scanning activity as the attackers attempted to move laterally across the network.

Figure 3: Numerous failed connections from the affected server to multiple other internal devices over port 445, indicating SMB scanning activity.

The compromised server was then seen initiating multiple sessions over the RDP protocol to another device on the customer’s network, namely an internal DNS server. External researchers had previously observed this technique in CACTUS ransomware attacks where an RDP tunnel was established via Plink [5].

A few days later, on November 24, Darktrace identified over 20,000 failed Kerberos authentication attempts for the username “service_qlik” being made to the internal DNS server, clearly representing a brute-force login attack. There is currently a lack of open-source intelligence (OSINT) material definitively listing Kerberos login failures as part of a CACTUS ransomware attack that exploits the Qlik vulnerabilities. This highlights Darktrace’s ability to identify ongoing threats amongst unusual network activity without relying on existing threat intelligence, emphasizing its advantage over traditional security detection tools.

Figure 4: Kerberos login failures being carried out by the initial infected device. The destination device detected was an internal DNS server.

In the month following these failed Kerberos login attempts, between November 26 and December 22, Darktrace observed multiple internal devices encrypting files within the customer’s environment with the extensions “.cts1” and “.cts7”. Devices were also seen writing ransom notes with the file name “cAcTuS.readme.txt” to two additional internal devices, as well as files likely associated with Qlik, such as “QlikSense.pdf”. This activity detected by Darktrace confirmed the presence of a CACTUS ransomware infection that was spreading across the customer’s network.

Figure 5: The model, 'Ransom or Offensive Words Written to SMB', triggered in response to SMB file writes of the ransom note, ‘cAcTuS.readme.txt’, that was observed on the customer’s network.

Figure 6: CACTUS ransomware extensions, “.cts1” and “.cts7”, being appended to files on the customer’s network.

Following this initial encryption activity, two affected devices were observed attempting to remove evidence of this activity by deleting the encrypted files.

Figure 7: Attackers attempting to remove evidence of their activity by deleting files with appendage “.cts1”.

Schlussfolgerung

In the face of this CACTUS ransomware attack, Darktrace’s anomaly-based approach to threat detection enabled it to quickly identify multiple stages of the cyber kill chain occurring in the customer’s environment. These stages ranged from ‘initial access’ by exploiting Qlik vulnerabilities, which Darktrace was able to detect before the method had been reported by external researchers, to ‘actions on objectives’ by encrypting files. Darktrace’s Self-Learning AI was also able to detect a previously unreported stage of the attack: multiple Kerberos brute force login attempts.

If Darktrace’s autonomous response capability, RESPOND, had been active and enabled in autonomous response mode at the time of this attack, it would have been able to take swift mitigative action to shut down such suspicious activity as soon as it was identified by DETECT, effectively containing the ransomware attack at the earliest possible stage.

Learning a network’s ‘normal’ to identify deviations from established patterns of behaviour enables Darktrace’s identify a potential compromise, even one that uses common and often legitimately used administrative tools. This allows Darktrace to stay one step ahead of the increasingly sophisticated TTPs used by ransomware actors.

Credit to Tiana Kelly, Cyber Analyst & Analyst Team Lead, Anna Gilbertson, Cyber Analyst

Appendices

References

[1] https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection

[2] https://www.bleepingcomputer.com/news/security/cactus-ransomware-exploiting-qlik-sense-flaws-to-breach-networks/

[3] https://explore.avertium.com/resource/new-ransomware-strains-cactus-and-3am

[4] https://www.soitron.com/cyber-attackers-abuse-holidays/

[5] https://arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/

Darktrace DETECT Models

Compromise / Agent Beacon (Long Period)

Anomalous Connection / PowerShell to Rare External

Device / New PowerShell User Agent

Device / Suspicious SMB Scanning Activity

Anomalous File / EXE from Rare External Location

Anomalous Connection / Unusual Internal Remote Desktop

User / Kerberos Password Brute Force

Compromise / Ransomware / Ransom or Offensive Words Written to SMB

Unusual Activity / Anomalous SMB Delete Volume

Anomalous Connection / Multiple Connections to New External TCP Port

Compromise / Slow Beaconing Activity To External Rare

Compromise / SSL Beaconing to Rare Destination

Anomalous Server Activity / Rare External from Server

Compliance / Remote Management Tool On Server

Compromise / Agent Beacon (Long Period)

Compromise / Suspicious File and C2

Device / Internet Facing Device with High Priority Alert

Device / Large Number of Model Breaches

Anomalous File / Masqueraded File Transfer

Anomalous File / Internet facing System File Download

Anomalous Server Activity / Outgoing from Server

Device / Initial Breach Chain Compromise

Compromise / Agent Beacon (Medium Period)

Compromise / Agent Beacon (Long Period)

List of IoCs

IoC - Type - Description‍

zohoservice[.]net: 45.61.147[.]176 - Domain name: IP Address - Hosting payload over HTTP

Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17763.2183 - User agent -PowerShell user agent

.cts1 - File extension - Malicious appendage

.cts7- File extension - Malicious appendage

cAcTuS.readme.txt - Filename -Ransom note

putty.zip – Filename - Initial payload: ZIP containing PuTTY Link

MITRE ATT&CK Mapping

Tactic - Technique - SubTechnique

Web Protocols: COMMAND AND CONTROL - T1071 -T1071.001

Powershell: EXECUTION - T1059 - T1059.001

Exploitation of Remote Services: LATERAL MOVEMENT - T1210 – N/A

Vulnerability Scanning: RECONAISSANCE - T1595 - T1595.002

Network Service Scanning: DISCOVERY - T1046 - N/A

Malware: RESOURCE DEVELOPMENT - T1588 - T1588.001

Drive-by Compromise: INITIAL ACCESS - T1189 - N/A

Remote Desktop Protocol: LATERAL MOVEMENT – 1021 -T1021.001

Brute Force: CREDENTIAL ACCESS T – 1110 - N/A

Data Encrypted for Impact: IMPACT - T1486 - N/A

Data Destruction: IMPACT - T1485 - N/A

File Deletion: DEFENSE EVASION - T1070 - T1070.004

About the author

Tiana Kelly

Deputy Team Lead, London & Cyber Analyst

Blog

Keine Artikel gefunden.

The State of AI in Cybersecurity: How AI will impact the cyber threat landscape in 2024

Apr 2024

About the AI Cybersecurity Report

We surveyed 1,800 CISOs, security leaders, administrators, and practitioners from industries around the globe. Our research was conducted to understand how the adoption of new AI-powered offensive and defensive cybersecurity technologies are being managed by organizations.

This blog is continuing the conversation from our last blog post “The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners” which was an overview of the entire report. This blog will focus on one aspect of the overarching report, the impact of AI on the cyber threat landscape.

To access the full report click here.

Are organizations feeling the impact of AI-powered cyber threats?

Nearly three-quarters (74%) state AI-powered threats are now a significant issue. Almost nine in ten (89%) agree that AI-powered threats will remain a major challenge into the foreseeable future, not just for the next one to two years.

However, only a slight majority (56%) thought AI-powered threats were a separate issue from traditional/non AI-powered threats. This could be the case because there are few, if any, reliable methods to determine whether an attack is AI-powered.

Identifying exactly when and where AI is being applied may not ever be possible. However, it is possible for AI to affect every stage of the attack lifecycle. As such, defenders will likely need to focus on preparing for a world where threats are unique and are coming faster than ever before.

a hypothetical cyber attack augmented by AI at every stage

Are security stakeholders concerned about AI’s impact on cyber threats and risks?

The results from our survey showed that security practitioners are concerned that AI will impact organizations in a variety of ways. There was equal concern associated across the board – from volume and sophistication of malware to internal risks like leakage of proprietary information from employees using generative AI tools.

What this tells us is that defenders need to prepare for a greater volume of sophisticated attacks and balance this with a focus on cyber hygiene to manage internal risks.

One example of a growing internal risks is shadow AI. It takes little effort for employees to adopt publicly-available text-based generative AI systems to increase their productivity. This opens the door to “shadow AI”, which is the use of popular AI tools without organizational approval or oversight. Resulting security risks such as inadvertent exposure of sensitive information or intellectual property are an ever-growing concern.

Are organizations taking strides to reduce risks associated with adoption of AI in their application and computing environment?

71.2% of survey participants say their organization has taken steps specifically to reduce the risk of using AI within its application and computing environment.

16.3% of survey participants claim their organization has not taken these steps.

These findings are good news. Even as enterprises compete to get as much value from AI as they can, as quickly as possible, they’re tempering their eager embrace of new tools with sensible caution.

Still, responses varied across roles. Security analysts, operators, administrators, and incident responders are less likely to have said their organizations had taken AI risk mitigation steps than respondents in other roles. In fact, 79% of executives said steps had been taken, and only 54% of respondents in hands-on roles agreed. It seems that leaders believe their organizations are taking the needed steps, but practitioners are seeing a gap.

Do security professionals feel confident in their preparedness for the next generation of threats?

A majority of respondents (six out of every ten) believe their organizations are inadequately prepared to face the next generation of AI-powered threats.

The survey findings reveal contrasting perceptions of organizational preparedness for cybersecurity threats across different regions and job roles. Security administrators, due to their hands-on experience, express the highest level of skepticism, with 72% feeling their organizations are inadequately prepared. Notably, respondents in mid-sized organizations feel the least prepared, while those in the largest companies feel the most prepared.

Regionally, participants in Asia-Pacific are most likely to believe their organizations are unprepared, while those in Latin America feel the most prepared. This aligns with the observation that Asia-Pacific has been the most impacted region by cybersecurity threats in recent years, according to the IBM X-Force Threat Intelligence Index.

The optimism among Latin American respondents could be attributed to lower threat volumes experienced in the region, but it's cautioned that this could change suddenly (1).

What are biggest barriers to defending against AI-powered threats?

The top-ranked inhibitors center on knowledge and personnel. However, issues are alluded to almost equally across the board including concerns around budget, tool integration, lack of attention to AI-powered threats, and poor cyber hygiene.

The cybersecurity industry is facing a significant shortage of skilled professionals, with a global deficit of approximately 4 million experts (2). As organizations struggle to manage their security tools and alerts, the challenge intensifies with the increasing adoption of AI by attackers. This shift has altered the demands on security teams, requiring practitioners to possess broad and deep knowledge across rapidly evolving solution stacks.

Educating end users about AI-driven defenses becomes paramount as organizations grapple with the shortage of professionals proficient in managing AI-powered security tools. Operationalizing machine learning models for effectiveness and accuracy emerges as a crucial skill set in high demand. However, our survey highlights a concerning lack of understanding among cybersecurity professionals regarding AI-driven threats and the use of AI-driven countermeasures indicating a gap in keeping pace with evolving attacker tactics.

The integration of security solutions remains a notable problem, hindering effective defense strategies. While budget constraints are not a primary inhibitor, organizations must prioritize addressing these challenges to bolster their cybersecurity posture. It's imperative for stakeholders to recognize the importance of investing in skilled professionals and integrated security solutions to mitigate emerging threats effectively.

To access the full report click here.

References

1. IBM, X-Force Threat Intelligence Index 2024, Available at: https://www.ibm.com/downloads/cas/L0GKXDWJ

2. ISC2, Cybersecurity Workforce Study 2023, Available at: https://media.isc2.org/-/media/Project/ISC2/Main/Media/ documents/research/ISC2_Cybersecurity_Workforce_Study_2023.pdf?rev=28b46de71ce24e6ab7705f6e3da8637e

About the author

Our ai. Your data.

Elevate your cyber defenses with Darktrace AI

Starten Sie Ihren kostenlosen Test

Darktrace AI protecting a business from cyber threats.

Check out this article by Darktrace: Pulling back the curtain on Grief ransomware

Blog

Ransomware

Der Vorhang über die Grief-Ransomware wird gelüftet

Doppelpack: Grief und DoppelPaymer

Cyber AI Analyst durchschaut Grief

Ungewöhnlicher Verdacht

Technische Einzelheiten

Abweichungen von Darktrace Modellen

Abweichungen von Darktrace Modellen

MITRE ATT&CK-Techniken beobachtet

Sie mögen das und wollen mehr?

More in this series

Blog

Einblicke in das SOC-Team

A Thorn in Attackers’ Sides: How Darktrace Uncovered a CACTUS Ransomware Infection

What is CACTUS Ransomware?

How does CACTUS Ransomware work?

Darktrace’s Coverage of CACTUS Ransomware

Cactus Ransomware Attack Overview

Schlussfolgerung

Appendices

References

Darktrace DETECT Models

List of IoCs

MITRE ATT&CK Mapping

Blog

The State of AI in Cybersecurity: How AI will impact the cyber threat landscape in 2024

About the AI Cybersecurity Report

Are organizations feeling the impact of AI-powered cyber threats?

Are security stakeholders concerned about AI’s impact on cyber threats and risks?

Are organizations taking strides to reduce risks associated with adoption of AI in their application and computing environment?

Do security professionals feel confident in their preparedness for the next generation of threats?

What are biggest barriers to defending against AI-powered threats?

To access the full report click here.

References

Elevate your cyber defenses with Darktrace AI

Additional Products