Blog

Vordenkerrolle

Ransomware

Die Zukunft der Cybersicherheit: Ransomware-Gruppen zielen auf maximale Störung

Standard-BlogbildStandard-BlogbildStandard-BlogbildStandard-BlogbildStandard-BlogbildStandard-Blogbild
06
Februar 2022
06
Februar 2022
Diese zweite Vorhersage in unserer Reihe "Zukunft der Cybersicherheit" besagt, dass das Jahr 2022 eines der bisher profitabelsten Jahre für Ransomware werden könnte. Marcus Fowler erklärt, wie Ransomware-Angreifer vorgehen und was Unternehmen tun müssen, um Schritt zu halten.

In parallel to the global COVID-19 pandemic, there has been a growing ransomware pandemic. Darktrace researchers discovered that ransomware attacks on US organizations tripled in 2021 compared to 2020, and attacks on UK organizations doubled.

This crisis brought 30 nations together to discuss a counter-ransomware initiative focused on cryptocurrency regulation, security resilience, attack disruption, and international cyber diplomacy. Despite these landmark policies and law enforcement efforts, it’s safe to say that ransomware will remain as a top priority threat and is not going anywhere.

As ransomware permeates, cyber-attackers will continue evolving techniques in 2022

Ransomware gangs are becoming more sophisticated in how they select targets and how they carry out attacks. Many organizations think that ransomware shouldn’t be a serious concern if they have backups in place because they can quickly bring business operations back online. But modern attacks are about more than encryption or data exfiltration; they focus on maximizing disruption to business operations, including targeting backups for encryption and deletion. In 2022, we could see ransomware gangs target cloud service providers as well as backup and archiving providers.

Critical infrastructure organizations and businesses will continue to assess how quickly they can restore operations in the aftermath of an attack and how extensively they will be able to rely on, and the costs required for cyber insurers to cover entire ransom payments and costly systems repairs.

In early January, Microsoft researchers found evidence of malware targeting multiple Ukrainian organizations deploying what appeared to be ransomware but was actually a wiper. The malware displays a ransom note then executes the wiper when the target device is powered down. If adopted by other non-state actors, this evolution goes beyond ransomware, and some organizations won’t be able to survive these types of attacks.

Sophisticated ransomware gangs will expand their detailed targeting efforts from only ‘big game hunting,’ where they target large and well-known targets, to use more resources directly targeting midsize and smaller organizations. With increased scalability through automation and leveraging supply chain attacks, ransomware gangs will have the resources to expand their operations. Large organizations have more substantial budgets and more people, and they can prioritize resources to deal with ransomware’s effects — it will be far more difficult for small businesses.

Not only are ransomware operators expanding whom they can target, but the group of cyber-attackers able to execute attacks is expanding. The rise of Ransomware-as-a-Service (RaaS) gives low-skilled threat actors access to sophisticated malware strains, lowering the barrier to entry for attackers. RaaS has expanded the criminal ecosystem to include lower-level threat actors who find and attack the targets before installing the malicious software. Threat actors are increasingly using bots to automate the initial attack that gets them a foothold in the system.

There is also a varying degree of professionalism amongst cyber-criminals, from seasoned veterans (with current or previous nation-state experience) to ‘script kiddies’ with little expertise. This array translates to greater potential for untested or reckless use of sophisticated tools by unsophisticated actors.

Ransomware groups will bounce back

Ransomware groups are resilient. Even if government pressures force ransomware groups to disband or criminally charge them, they will continue to rebrand and crop back up. For example, DarkSide, confirmed by the FBI to be behind the attack on Colonial Pipeline, shut down a week after the attack. Shortly after, BlackMatter emerged, widely believed to be a rebranded version of the same cyber-crime group.

Figure 1: Darktrace breaks down the stages of a BlackMatter ransomware attack targeting a marketing firm in the US

Earlier this year, Russia’s security agency announced that it had arrested several members belonging to the notorious REvil ransomware gang and neutralized its operations. While this is a significant step against a major group, it is unlikely to reflect a long-term change in Russian policy towards cyber-criminal gangs. These arrests almost certainly do not mark the end of REvil.

Five ransomware groups have formed a cartel to exchange data and ‘best’ practices. These groups include Wizard Spider (linked to the Ryuk and Conti ransomware strains), Twisted Spider (which developed Maze and uses Egregor), Viking Spider (the group behind Ragnar), and LockBit.

Even if government pressures force ransomware groups to disband or criminally charge ransomware gangs, these groups will continue to rebrand and crop back up with even more sophisticated techniques and capabilities.

A static ‘hardened’ perimeter defense isn’t the answer – a dynamic self-defending one is

For organizations to build systems to withstand cyber-attacks, security leaders need to think and, more importantly, defend beyond the initial breach to maximize continuity of business operations. Security defenses like firewalls centered on defending the cyber perimeter are not enough to protect against evolving threats.

A truly dynamic defense is achievable. Organizations need to actively enforce ‘normal’ for businesses and disrupt attacks at the earliest indicators of malicious anomalous behavior, such as file encryption or data exfiltration. Security technology needs to learn, make micro-decisions, and take proportional responses to detect and stop attacks early enough before data exfiltration or encryption occurs.

Attackers are acutely aware of Threat Intelligence-reliant defensive tools they need to evade and know the limitations of the legacy, siloed approach many organizations employ. Attackers are finding valuable information, exfiltrating the files, and encrypting the data in a short period. The race condition and response window for defenders to detect and stop attacks is getting smaller; security teams and solution responses must get faster.

Cyber security is no longer a human-scale problem. Organizations need to adopt AI-based protections that can defend against increasingly automated ransomware attacks. In an era of fast-moving cyber-attacks, and with threat actors deliberately striking when security teams are out of the office, AI technologies have become essential in taking targeted action to contain attacks without interrupting normal business.

EINBLICKE IN DAS SOC-Team
Darktrace Cyber-Analysten sind erstklassige Experten für Threat Intelligence, Threat Hunting und Incident Response. Sie bieten Tausenden von Darktrace Kunden auf der ganzen Welt rund um die Uhr SOC-Support. Einblicke in das SOC-Team wird ausschließlich von diesen Experten verfasst und bietet Analysen von Cyber-Vorfällen und Bedrohungstrends, die auf praktischen Erfahrungen in diesem Bereich basieren.
AUTOR
ÜBER DEN AUTOR
Marcus Fowler
SVP, Strategische Engagements und Bedrohungen

As SVP of Strategic Engagements and Threats, Marcus works closely with senior security leaders across industries on cyber security strategy and business resilience, including across Darktrace’s Federal Division. Marcus focuses his research and analysis around emerging and next generation cyber threats, trends, and conflicts. Prior to joining Darktrace in 2019, Marcus spent 15 years at the Central Intelligence Agency developing global cyber operations and technical strategies. He has led cyber efforts with various US Intelligence Community elements and global partners. Prior to serving at the CIA, Marcus was an officer in the United States Marine Corps. Marcus has an engineering degree from the United States Naval Academy and a Masters’ Degree in International Security Studies from The Fletcher School. He also completed Harvard Business School’s Executive Education Advanced Management Program.

Book a 1-1 meeting with one of our experts
share this article
COre-Abdeckung
Keine Artikel gefunden.

More in this series

Keine Artikel gefunden.

Blog

Keine Artikel gefunden.

Customer Blog: Community Housing Limited Enhancing Incident Response

Standard-BlogbildStandard-Blogbild
04
Mar 2024

About Community Housing Limited

Community Housing Limited is a non-profit organization based in Australia that focuses on providing affordable, long-term housing and creating employment opportunities where possible. We give people the security of having a home so that they can focus on other essential pathways. As such, we are responsible for sensitive information on our clients.

As part of our commitment to strengthening our cyber security, we sought to simplify and unify our incident response plans and equip our engineers and desktop support teams with all the information we need at our fingertips.

Why Community Housing Limited chose Darktrace

Our team hoped to achieve a response procedure that allowed us to have oversight over any potential security risks, even cases that don’t overtly seem like a security risk. For example, an incident could start as a payroll issue and end up in the hands of HR, instead of surfacing as a security problem. In this case, our security team has no way of knowing the real number of events or how the threat had actually started and played out, making incident response and mitigation even more challenging.

We were already a customer of Darktrace’s autonomous threat detection, attack intervention, and attack surface management capabilities, and decided to add Darktrace for AI-assisted incident response and AI cyber-attack simulation.

AI-generated playbooks save time during incident response

I wanted to reduce the time and resources it took our security team to appropriately respond to a threat. Darktrace automates several steps of the recovery process to accelerate the rate of incident response by using AI that learns the granular details of the specific organization, building a dynamic understanding of the devices, connections, and user behaviors that make up the normal “pattern of life.”  

The AI then uses this understanding to create bespoke, AI-generated incident response playbooks that leverage an evolving understanding of our organization to determine recovery steps that are tailored not only to the specific incident but also to our unique environment.

For my security team, this means having access to all the information we need to respond to a threat. When running through an incident, rather than going to different places to synthesize relevant information, which takes up valuable resources and time, we can speed up its remediation with Darktrace.  

The playbooks created by Darktrace help lower the technical skills required to respond to incidents by elevating the workload of the staff, tripling our capacity for incident response.

Realistic attack simulations upskill teams while saving resources

We have differing levels of experience on the team which means some members know exactly what to do during incident response while others are slower and need more guidance. Thus, we have to either outsource skilled security professionals or add a security solution that could lower the technical skills bar.

You don’t want to be second guessing and searching for the right move – it’s urgent – there should be certainty. Our goal with running attack simulations is to test and train our team's response capabilities in a “realistic” scenario. But this takes considerable time to plan and execute or can be expensive if outsourced, which can be a challenge for organizations short on resources. 

Darktrace provides AI-assisted incident response and cyber-attack simulation using AI that understands the organization to run simulations that effectively map onto the real digital environment and the assets within it, providing training for actual incidents.

It is one thing to sit together in a meeting and discuss various outcomes of a cyber-attack, talking through the best response strategies. It is a huge benefit being able to run attack simulations that emulate real-world scenarios.

Our team can now see how an incident would play out over several days to resemble a real-world scenario or it can play through the simulation quickly to ascertain outcomes immediately. It then uses these insights to strengthen its technology, processes, and training.

AI-Powered Incident Response

Darktrace helps my security team save resources and upskill staff using AI to generate bespoke playbooks and run realistic simulations. Its real-time understanding of our business ensures incident preparedness and incident response are tailored to not only the specific threat in question, but also to the contextual infrastructure of the organization.  

Continue reading
About the author
Jamie Woodland
Head of Technology at Community Housing Limited

Blog

E-Mail

Beyond DMARC: Navigating the Gaps in Email Security

Standard-BlogbildStandard-Blogbild
29
Feb 2024

Email threat landscape  

Email has consistently ranked among the most targeted attack vectors, given its ubiquity and criticality to business operations. From September to December 2023, 10.4 million phishing emails were detected across Darktrace’s customer fleet demonstrating the frequency of attempted email-based attacks.

Businesses are searching for ways to harden their email security posture alongside email providers who are aiming to reduce malicious emails traversing their infrastructure, affecting their clients. Domain-based Message Authentication (DMARC) is a useful industry-wide protocol organizations can leverage to move towards these goals.  

What is DMARC?

DMARC is an email authentication protocol designed to enhance the security of email communication.

Major email service providers Google and Yahoo recently made the protocol mandatory for bulk senders in an effort to make inboxes safer worldwide. The new requirements demonstrate an increasing need for a standardized solution as misconfigured or nonexistent authentication systems continue to allow threat actors to evade detection and leverage the legitimate reputation of third parties.  

DMARC is a powerful tool that allows email administrators to confidently identify and stop certain spoofed emails; however, more organizations must implement the standard for it to reach its full potential. The success and effectiveness of DMARC is dependent on broad adoption of the standard – by organizations of all sizes.  

How does DMARC work?

DMARC builds on two key authentication technologies, Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) and helps to significantly improve their ability to prevent domain spoofing. SPF verifies that a sender’s IP address is authorized to send emails on behalf of a particular domain and DKIM ensures integrity of email content by providing a verifiable digital signature.  

DMARC adds to this by allowing domain owners to publish policies that set expectations for how SPF and DKIM verification checks relate to email addresses presented to users and whose authenticity the receiving mail server is looking to establish.  

These policies work in tandem to help authenticate email senders by verifying the emails are from the domain they say they are, working to prevent domain spoofing attacks. Key benefits of DMARC include:

  1. Phishing protection DMARC protects against direct domain spoofing in which a threat actor impersonates a legitimate domain, a common phishing technique threat actors use to trick employees to obtain sensitive information such as privileged credentials, bank information, etc.  
  2. Improving brand reputation: As DMARC helps to prevent impersonation of domains, it stands to maintain and increase an organization’s brand reputation. Additionally, as organizational reputation improves, so will the deliverability of emails.
  3. Increased visibility: DMARC provides enhanced visibility into email communication channels, including reports of all emails sent on behalf of your domain. This allows security teams to identify shadow-IT and any unauthorized parties using their domain.

Understanding DMARC’s Limitations

DMARC is often positioned as a way for organizations to ‘solve’ their email security problems, however, 65% of the phishing emails observed by Darktrace successfully passed DMARC verification, indicating that a significant number of threat actors are capable of manipulating email security and authentication systems in their exploits. While DMARC is a valuable tool in the fight against email-based attacks, the evolving threat landscape demands a closer look at its limitations.  

As threat actors continue to innovate, improving their stealth and evasion tactics, the number of attacks with valid DMARC authentication will only continue to increase in volume and sophistication. These can include:

  1. Phishing attacks that leverage non-spoofed domains: DMARC allows an organization to protect the domains that they own, preventing threat actors from being able to send phishing emails from their domains. However, threat actors will often create and use ‘look-a-like’ domains that closely resemble an organization’s domain to dupe users. 3% of the phishing emails identified by Darktrace utilized newly created domains, demonstrating shifting tactics.  
  2. Email Account Takeovers: If a threat actor gains access to a user’s email account through other social engineering means such as credential stuffing, they can then send phishing emails from the legitimate domain to pursue further attacks. Even though these emails are malicious, DMARC would not identify them as such because they are coming from an authorized domain or sender.  

Organizations must also ensure their inbound analysis of emails is not skewed by successful DMARC authentication. Security teams cannot inherently trust emails that pass DMARC, because the source cannot always be legitimized, like in the event of an account takeover. If a threat actor gains access to an authenticated email account, emails sent by the threat actor from that account will pass DMARC – however the contents of that email may be malicious. Sender behavior must be continuously evaluated and vetted in real time as past communication history and validated DMARC cannot be solely relied upon amid an ever-changing threat landscape.  

Security teams should lean on other security measures, such as anomaly detection tools that can identify suspicious emails without relying on historical attack rules and static data. While DMARC is not a silver bullet for email security, it is nevertheless foundational in helping organizations protect their brand identity and must be viewed as an essential layer in an organization's overall cyber security strategy.  

Implementing DMARC

Despite the criticality of DMARC for preserving brand reputation and trust, adoption of the standard has been inconsistent. DMARC can be complex to implement with many organizations lacking the time required to understand and successfully implement the standard. Because of this, DMARC set-up is often outsourced, giving security and infrastructure teams little to no visibility into or control of the process.  

Implementation of DMARC is only the start of this process, as DMARC reports must be consistently monitored to ensure organizations have visibility into who is sending mail from their domain, the volume of mail being sent and whether the mail is passing authentication protocols. This process can be time consuming for security teams who are already faced with mounting responsibilities, tight budgets, and personnel shortages. These complexities unfortunately delay organizations from using DMARC – especially as many today still view it as a ‘nice to have’ rather than an essential.  

With the potential complexities of the DMARC implementation process, there are many ways security and infrastructure teams can still successfully roll out the standard. Initial implementation should start with monitoring, policy adjustment and then enforcement. As business changes over time, DMARC should be reviewed regularly to ensure ongoing protection and maintain domain reputation.

The Future of Email Security

As email-based attacks continue to rise, the industry must recognize the importance of driving adoption of foundational email authentication protocols. To do this, a new and innovative approach to DMARC is needed. DMARC products must evolve to better support organizations throughout the ongoing DMARC monitoring process, rather than just initial implementation. These products must also be able to share intelligence across an organization’s security stack, extending beyond email security tools. Integration across these products and tools will help organizations optimize their posture, ensuring deep understanding of their domain and increased visibility across the entire enterprise.

DMARC is critical in protecting brand identity and mitigating exact-domain based attacks. However, organizations must understand DMARC’s unique benefits and limitations to ensure their inboxes are fully protected. In today’s evolving threat landscape, organizations require a robust, multi-layered approach to stop email threats – in inbound mail and beyond. Email threats have evolved – its time security does too.

Join Darktrace on 9 April for a virtual event to explore the latest innovations needed to get ahead of the rapidly evolving threat landscape. Register today to hear more about our latest innovations coming to Darktrace’s offerings. For additional insights check out Darktrace’s 2023 End of Year Threat Report.

Credit to Carlos Gray and Stephen Pickman for their contribution to this blog

Continue reading
About the author
Carlos Gray
Product Manager

Gute Nachrichten für Ihr Unternehmen.
Schlechte Nachrichten für die Bösewichte.

Starten Sie Ihren kostenlosen Test

Starten Sie Ihren kostenlosen Test

Flexible Lieferung
Cloud-based deployment.
Schnelle Installation
Nur 1 Stunde für die Einrichtung - und noch weniger für eine Testversion der E-Mail-Sicherheit.
Wählen Sie Ihre Reise
Testen Sie selbstlernende KI dort, wo Sie sie am meisten brauchen - in der Cloud, im Netzwerk oder für E-Mail.
Keine Verpflichtung
Voller Zugriff auf den Darktrace Threat Visualizer und drei maßgeschneiderte Bedrohungsberichte, ohne Kaufverpflichtung.
For more information, please see our Privacy Notice.
Thanks, your request has been received
A member of our team will be in touch with you shortly.
YOU MAY FIND INTERESTING
Huch! Beim Absenden des Formulars ist etwas schief gelaufen.

Demo anfordern

Flexible Lieferung
Sie können es entweder virtuell oder mit Hardware installieren.
Schnelle Installation
Nur 1 Stunde für die Einrichtung - und noch weniger für eine Testversion der E-Mail-Sicherheit.
Wählen Sie Ihre Reise
Testen Sie selbstlernende KI dort, wo Sie sie am meisten brauchen - in der Cloud, im Netzwerk oder für E-Mail.
Keine Verpflichtung
Voller Zugriff auf den Darktrace Threat Visualizer und drei maßgeschneiderte Bedrohungsberichte, ohne Kaufverpflichtung.
Vielen Dank! Ihre Anfrage ist eingegangen!
Huch! Beim Absenden des Formulars ist etwas schief gelaufen.