Login | Signup

resource center

Threat Intelligence
Resources

BOOK DEMO >
SUBSCRIBE >

Threat SnapShots

We wish every one of our customers, partners and followers a safe and happy Thanksgiving! In this special edition of our Threat SnapShot series, we remind you to stay vigilant against cyber threats, which increase this time of year as SOC staff take time off or become distracted with the holiday hustle and bustle. You don't need to look much further than 2020 when the Robbinhood ransomware took down Baltimore public schools on the eve before Thanksgiving (the same ransomware affected Baltimore city the year before, causing $18M in damages to recover from the attack). For this week, we'll dive deeper into the Hive ransomware, which was detailed in a recent CISA alert. We'll discuss some common living-off-the-land techniques that ransomware authors use to destroy backups, as well as some detection techniques to more quickly spot a ransomware infection in your network. Resources: * https://www.cisa.gov/uscert/ncas/current-activity/2021/11/22/reminder-critical-infrastructure-stay-vigilant-against-threats * https://www.industrialcybersecuritypulse.com/facilities/throwback-attack-a-thanksgiving-ransomware-attack-shuts-down-baltimore-schools/ * https://www.cisa.gov/uscert/ncas/alerts/aa22-321a https://app.snapattack.com/threat/2f62f1bb-06af-ec0a-7a3c-fa3e81cb24f8 * Threat: Hive Ransomware https://app.snapattack.com/detection/6492389c-dd24-4d9c-92e1-af05efa500f5 - Detection: Shadow Copies Deletion Using Operating Systems Utilities * https://app.snapattack.com/detection/fe10e118-5073-41e8-a6d4-6616c501530d - Detection: Modification of Boot Configuration
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLjN3bWRpeTBFakw4

Hive Ransomware | Threat SnapShot

11/24/22

The Lorenz Ransomware Gang targets small and medium sized businesses with open source attack tools, including CrackMapExec and Chisel. In this week's Threat SnapShot, we'll dive into some of their tradecraft, in particular their use of Chisel to proxy and tunnel traffic through the victim networks. We'll discuss threat hunting and detection strategies, and demonstrate how you can quickly create and test high quality detections in the SnapAttack platform. References: https://www.avertium.com/resources/threat-reports/an-in-depth-look-at-lorenz-ransomware https://github.com/jpillora/chisel SnapAttack Content: https://app.snapattack.com/threat/420c9b2b-5ea6-a406-45ac-024e7d080cb8 - Threat: Chisel Tunnel Via DNS TXT and CrackMapExec https://app.snapattack.com/detection/5c72a359-116e-464a-b8d4-f99a0fd68eb2 - Detection: Chisel Tunnel Traffic https://app.snapattack.com/detection/85bb6ba1-f010-4168-92ac-4cc8479442c3 - Detection: Chisel Tunnelling Tool Usage https://app.snapattack.com/detection/1fb2852d-fdd1-4b39-bdf9-eae77ef49a71 - Detection: Possible Chisel Client Activity
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLmZSOWp0bFFXZGZJ

Detecting the Lorenz Ransomware Gang and Chisel Tunnelling Activity | Threat SnapShot

11/17/22

In this week's Threat SnapShot, we'll dive into some new threat intelligence for APT29 released by our partner Mandiant. APT29 (NOBELIUM, Cozy Bear) is attributed to Russia's Foreign Intelligence Service, and often targets government networks in Europe and NATO member countries. Mandiant witnessed APT29 abusing the built-in Windows Credential Roaming feature for persistence and lateral movement. This novel technique was assigned CVE-2022-30170 and patch in Microsoft's September update. We'll dive into the proof-of-concept and replicate the threat, as well as discuss detection and threat hunting strategies. References: https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming https://app.snapattack.com/threat/b3119f86-2dc5-d46d-33e1-1ed9d26c14a3 https://app.snapattack.com/detection/48e7f050-19ef-4ac6-9770-a87dc4b26ebd https://app.snapattack.com/detection/5c103b4e-1361-42d4-bc47-c476e0fa00e9 https://app.snapattack.com/detection/307001c9-3a27-4eef-bb37-0428db8b9261
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLlY3TmIwWXFYOUtJ

APT29 Persistence / Lateral Movement via Windows Credential Roaming | Threat SnapShot

11/10/22

In this week's Threat SnapShot, we discuss the recent CVEs in OpenSSL, as well as demonstrate the Raspberry Robin campaign. Raspberry Robin, as tracked by Red Canary since September 2021, is a cluster of activity that relies on msiexec.exe to call out to its infrastructure, often compromised QNAP devices, and download a malicious DLL for C2. The attacker's motivations are still unclear, but nonetheless this is an interesting set of living off the land techniques that are often difficult to detect or alert on. We'll dig into this threat, what it looks on the process graph, and discuss some possible hunting and detection strategies. 0:11 - OpenSSL Discussion 02:39 - Raspberry Robin Discussion References: https://securitylabs.datadoghq.com/articles/openssl-november-1-vulnerabilities/ https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/openssl-punycode-vulnerability https://redcanary.com/blog/intelligence-insights-october-2022/ https://redcanary.com/blog/raspberry-robin/ https://app.snapattack.com/threat/06117550-df69-de49-a78a-f5c1f5001834 https://app.snapattack.com/detection/70e1c0a3-6b8c-4c5b-a93e-620e65c08809 https://app.snapattack.com/detection/5481c5d1-b8ae-49b9-b7bf-2d71fbc9fd97 https://app.snapattack.com/detection/b5b4a8ba-bada-4633-8038-5e7d3262e61a https://app.snapattack.com/detection/9dc9f2b9-8804-4d4a-9c7d-27ebd25ea92e
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLlFqNDJvWlpIaHBR

OpenSSL X.509 E-mail Address Buffer Overflows + Raspberry Robin | Threat SnapShot

11/03/22

Load More... Subscribe

Threat SnapShots

We wish every one of our customers, partners and followers a safe and happy Thanksgiving! In this special edition of our Threat SnapShot series, we remind you to stay vigilant against cyber threats, which increase this time of year as SOC staff take time off or become distracted with the holiday hustle and bustle. You don't need to look much further than 2020 when the Robbinhood ransomware took down Baltimore public schools on the eve before Thanksgiving (the same ransomware affected Baltimore city the year before, causing $18M in damages to recover from the attack). For this week, we'll dive deeper into the Hive ransomware, which was detailed in a recent CISA alert. We'll discuss some common living-off-the-land techniques that ransomware authors use to destroy backups, as well as some detection techniques to more quickly spot a ransomware infection in your network. Resources: * https://www.cisa.gov/uscert/ncas/current-activity/2021/11/22/reminder-critical-infrastructure-stay-vigilant-against-threats * https://www.industrialcybersecuritypulse.com/facilities/throwback-attack-a-thanksgiving-ransomware-attack-shuts-down-baltimore-schools/ * https://www.cisa.gov/uscert/ncas/alerts/aa22-321a https://app.snapattack.com/threat/2f62f1bb-06af-ec0a-7a3c-fa3e81cb24f8 * Threat: Hive Ransomware https://app.snapattack.com/detection/6492389c-dd24-4d9c-92e1-af05efa500f5 - Detection: Shadow Copies Deletion Using Operating Systems Utilities * https://app.snapattack.com/detection/fe10e118-5073-41e8-a6d4-6616c501530d - Detection: Modification of Boot Configuration
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLjN3bWRpeTBFakw4

Hive Ransomware | Threat SnapShot

11/24/22

The Lorenz Ransomware Gang targets small and medium sized businesses with open source attack tools, including CrackMapExec and Chisel. In this week's Threat SnapShot, we'll dive into some of their tradecraft, in particular their use of Chisel to proxy and tunnel traffic through the victim networks. We'll discuss threat hunting and detection strategies, and demonstrate how you can quickly create and test high quality detections in the SnapAttack platform. References: https://www.avertium.com/resources/threat-reports/an-in-depth-look-at-lorenz-ransomware https://github.com/jpillora/chisel SnapAttack Content: https://app.snapattack.com/threat/420c9b2b-5ea6-a406-45ac-024e7d080cb8 - Threat: Chisel Tunnel Via DNS TXT and CrackMapExec https://app.snapattack.com/detection/5c72a359-116e-464a-b8d4-f99a0fd68eb2 - Detection: Chisel Tunnel Traffic https://app.snapattack.com/detection/85bb6ba1-f010-4168-92ac-4cc8479442c3 - Detection: Chisel Tunnelling Tool Usage https://app.snapattack.com/detection/1fb2852d-fdd1-4b39-bdf9-eae77ef49a71 - Detection: Possible Chisel Client Activity
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLmZSOWp0bFFXZGZJ

Detecting the Lorenz Ransomware Gang and Chisel Tunnelling Activity | Threat SnapShot

11/17/22

In this week's Threat SnapShot, we'll dive into some new threat intelligence for APT29 released by our partner Mandiant. APT29 (NOBELIUM, Cozy Bear) is attributed to Russia's Foreign Intelligence Service, and often targets government networks in Europe and NATO member countries. Mandiant witnessed APT29 abusing the built-in Windows Credential Roaming feature for persistence and lateral movement. This novel technique was assigned CVE-2022-30170 and patch in Microsoft's September update. We'll dive into the proof-of-concept and replicate the threat, as well as discuss detection and threat hunting strategies. References: https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming https://app.snapattack.com/threat/b3119f86-2dc5-d46d-33e1-1ed9d26c14a3 https://app.snapattack.com/detection/48e7f050-19ef-4ac6-9770-a87dc4b26ebd https://app.snapattack.com/detection/5c103b4e-1361-42d4-bc47-c476e0fa00e9 https://app.snapattack.com/detection/307001c9-3a27-4eef-bb37-0428db8b9261
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLlY3TmIwWXFYOUtJ

APT29 Persistence / Lateral Movement via Windows Credential Roaming | Threat SnapShot

11/10/22

In this week's Threat SnapShot, we discuss the recent CVEs in OpenSSL, as well as demonstrate the Raspberry Robin campaign. Raspberry Robin, as tracked by Red Canary since September 2021, is a cluster of activity that relies on msiexec.exe to call out to its infrastructure, often compromised QNAP devices, and download a malicious DLL for C2. The attacker's motivations are still unclear, but nonetheless this is an interesting set of living off the land techniques that are often difficult to detect or alert on. We'll dig into this threat, what it looks on the process graph, and discuss some possible hunting and detection strategies. 0:11 - OpenSSL Discussion 02:39 - Raspberry Robin Discussion References: https://securitylabs.datadoghq.com/articles/openssl-november-1-vulnerabilities/ https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/openssl-punycode-vulnerability https://redcanary.com/blog/intelligence-insights-october-2022/ https://redcanary.com/blog/raspberry-robin/ https://app.snapattack.com/threat/06117550-df69-de49-a78a-f5c1f5001834 https://app.snapattack.com/detection/70e1c0a3-6b8c-4c5b-a93e-620e65c08809 https://app.snapattack.com/detection/5481c5d1-b8ae-49b9-b7bf-2d71fbc9fd97 https://app.snapattack.com/detection/b5b4a8ba-bada-4633-8038-5e7d3262e61a https://app.snapattack.com/detection/9dc9f2b9-8804-4d4a-9c7d-27ebd25ea92e
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLlFqNDJvWlpIaHBR

OpenSSL X.509 E-mail Address Buffer Overflows + Raspberry Robin | Threat SnapShot

11/03/22

Load More... Subscribe

Site built by ModusMark