di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

blog-image-mitre-2023.jpg

The results are in! In this blog post we’ll outline the results of the 2023 MITRE Engenuity ATT&amp;CK Evaluations for Enterprise and cover the following:<ul><li>What the ATT&amp;CK Evaluations are and what it means for enterprises</li><li>The tactics, techniques, and procedures (TTPs) employed by Turla to perform an attack</li><li>How Deep Instinct’s platform prevents Turla attacks and protects your organization</li></ul>

Register Now

Peeling Back the Layers on MITRE Engenuity’s Latest Evaluations for Enterprise

About_Hero.png

<h5>Background: MITRE Engenuity ATT&amp;CK Evaluations</h5>The MITRE ATT&amp;CK Framework is an excellent tool for organizations to plan and understand their defense-in-depth strategy. Mapping the <a href="https://attack.mitre.org/tactics/enterprise/" target="_blank">tactics</a>, <a href="https://attack.mitre.org/techniques/enterprise/" target="_blank">techniques</a>, and procedures (TTPs) coverage to understand where your gaps lie is important to protecting your organization against cyber threats.<h5>MITRE Engenuity’s ATT&amp;CK Evaluation Results Released</h5>Earlier today MITRE Engenuity released the results from their latest round of <a href="https://attackevals.mitre-engenuity.org/enterprise/turla/" target="_blank">ATT&amp;CK Evaluations for Enterprise</a> that focused on complex, multi-stage, impact-focused attacks carried out by <a href="https://attack.mitre.org/groups/G0010/" target="_blank">Turla</a>, a sophisticated Russian-based threat group that has infected victims in over 45 countries. The group is known to target government agencies, diplomatic missions, military groups, and research and media organizations. Without the right tools and capabilities, defending against Turla is like wrestling a bear. That’s because Turla adopts novel and sophisticated techniques to maintain operational security, including the use of a distinctive command-and-control network in concert with their repertoire of open-source and in-house tools.In the past, MITRE Engenuity ATT&amp;CK Evaluations had been more focused on evaluating detection and response, post infection. This approach was tied closely with the reactive, “assume breach” mindset of the past decade which looks for anomalous behaviors to stop a breach after an attack has executed on the endpoint. Beginning in 2020, MITRE Engenuity added a protection portion to the test which aims to evaluate a solution’s ability to prevent attacks and not just provide breach details and rollback.This is fundamentally the difference between Deep Instinct’s predictive prevention, which keeps threats out, vs EDRs who are only enabling detection and response after a breach has occurred. Learn more here about why <a href="https://www.deepinstinct.com/endpoint-detection-response" target="_self">you need Deep Instinct even if you have an EDR</a>.In this most recent round of testing, which took place in Q2/Q3 of 2023, the results of the protection segment of the test validated the strength and robustness of Deep Instinct’s multi-layered, proactive predictive prevention and highlighted the value our customers are seeing every day. Deep Instinct also achieved exemplary detection coverage across various execution, persistence, and impact techniques emulated. These are exactly the results we would expect as a proactive prevention solution.4 Key Takeaways from Deep Instinct’s MITRE Engenuity participation:<ol><li>Deep Instinct provided excellent prevention, detection, and visibility into all 18 attack steps tested.</li><li>Deep Instinct’s prevention and detection engines achieved excellent detection coverage and visibility on all techniques included in the test including execution, persistence, privilege escalation, lateral movement, and more.</li><li>Deep Instinct’s detection engine improved tremendously compared to the 2022 MITRE evaluation with 90% detection (up from 70%).</li><li>The tests that were prevented by the D-brain static analysis (Deep Instinct’s patented deep learning technology engine) didn’t succeed in writing the file to the disk, which emphasizes our superior prevention capabilities based on AI.</li></ol><h5>The Importance of Prevention</h5>Prevention has an extremely positive impact on your overall security posture by filling the gaps that exist in your coverage while reducing reliance on the downstream impacts of detection and response. Defense-in-Depth is needed; with greater prevention you can lower security costs, improve efficiency, and reduce your overall risk. That way security teams can spend more time focusing on alerts that matter and less time chasing false positives. MITRE recognized this reality when they added protection testing.<blockquote>Michael Suby, IDC Research VP, Security &amp; Trust, states “There will be a rebirth in endpoint protection as organizations seek a better balance with detection and response capabilities and gravitate to vendor offerings that contain innovative leaps in endpoint protection efficacy.”</blockquote>MITRE Engenuity testing is important, but sometimes a customer evaluation can say it all.<blockquote>"I am now a believer of the capabilities of Deep Instinct as I had conducted my own pre-purchase trial where I tested some of the top vendors' engines and pitted them all against Deep Instinct (the competitors all lost badly in the detection phase of my testing). Deep Instinct handled many near zero-day threats that had been in the wild a much shorter time than Deep Instinct's detection engine's release date. It simply didn't matter to Deep Instinct. It found them all and stopped them at pre-execution. Since pre-execution was my strategic goal with a zero-defect mentality driving that concept — Deep Instinct rocketed to the top of my wish list. Other products I tested allowed some damage to occur or didn't detect a zero-day threat at all while they wreaked havoc in a sandboxed environment.” *</blockquote><h5>Conclusion</h5>Deep Instinct excels at proactively preventing unknown, never-before-seen threats. Our innovative approach allows organizations to proactively prevent &gt;99% of ransomware, zero-days, and other known and unknown malware. Deep Instinct also lowers false positives to &lt;0.1%, reducing the burden on your security team and improving your ability to detect the most advanced threats. And proactive prevention can lower downstream costs, improve the efficiency of your SOC, and lower your overall risk.We found significant value in participating in the MITRE Engenuity testing, but in reality, we do it every day. Our customers are our real proof points as they benefit from a true prevention-first approach with Deep Instinct, lowering the resource requirements of their security professionals by reducing false positives and improving investigation and remediation. When the next unknown threat hits, you need the best preventative solution to keep the attackers out and ensure you can automate responses with your EDR. This approach delivers the best of both worlds.We invite you to <a href="https://info.deepinstinct.com/request-a-demo" target="_self">request a demo</a> and test us out to see the positive impact a prevention-first approach will have on your organization’s security posture.For further reading please see our <a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough" target="_self">EDR is Not Enough eBook</a> and Deep Instinct’s latest <a href="https://www.deepinstinct.com/voice-of-secops-reports" target="_self">Voice of SecOps Report</a>.*Gartner Peer Insights reviews constitute the subjective opinions of individual end users based on their own experiences and do not represent the views of Gartner or its affiliates.<h5>Learn More</h5><a href="https://www.brighttalk.com/webcast/16681/595246" target="_self">Register</a> for our webinar, Peeling Back the Layers on MITRE Engenuity’s Lates Evaluations for Enterprise, on Wednesday, October 4th at 2 PM ET / 11 AM PT to hear members of our Research &amp; Development Teams review what the MITRE ATT&amp;CK Evaluations truly are and walk through the best ways to interpret the results, including details about how the tests are performed.<h5>About MITRE Engenuity ATT&amp;CK® Evaluations</h5>ATT&amp;CK® Evaluations is built on the backbone of MITRE’s objective insight and conflict-free perspective. Cybersecurity providers turn to the Evaluations program to improve their offerings and to provide defenders with insights into their product’s capabilities and performance. Evaluations enable defenders to make better informed decisions on how to leverage the products that secure their networks. The program follows a rigorous, transparent methodology using a collaborative, threat-informed, purple-teaming approach that brings together providers and MITRE experts to evaluate solutions within the context of ATT&amp;CK. In line with MITRE Engenuity’s commitment to serve the public good, Evaluations results and threat emulation plans are freely accessible.<h5>About MITRE Engenuity</h5>MITRE Engenuity, a subsidiary of MITRE, is a tech foundation for public good. MITRE’s mission-driven teams are dedicated to solving problems for a safer world. Through our public-private partnerships and federally funded R&amp;D centers, we work across government and in partnership with industry to tackle challenges to the safety, stability, and well-being of our nation.MITRE Engenuity brings MITRE’s deep technical know-how and systems thinking to the private sector to solve complex challenges that government alone cannot solve. MITRE Engenuity catalyzes the collective R&amp;D strength of the broader U.S. federal government, academia, and private sector to tackle national and global challenges, such as protecting critical infrastructure, creating a resilient semiconductor ecosystem, investing in pandemic preparedness, accelerating use case innovation in 5G, and democratizing threat-informed cyber defense. <a href="https://mitre-engenuity.org/" target="_blank">https://mitre-engenuity.org</a>.

Deep Insight Results: 2023 MITRE Engenuity ATT&CK Evaluations for Enterprise

2022-mitre-engenuity-att&k-evaluations-blog.jpg

The MITRE ATT&CK Framework is an excellent tool for organizations to plan and understand their defense-in-depth strategy. Mapping the <a href="https://attack.mitre.org/tactics/enterprise/" target="_blank">tactics</a>, <a href="https://attack.mitre.org/techniques/enterprise/" target="_blank">techniques</a>, and procedures (TTPs) coverage to understand where your gaps lie is important to protecting your organization against cyber threats.<h2>MITRE Engenuity’s ATT&CK Evaluation Results Released</h2>This week, MITRE Engenuity released the results from their latest round of <a href="https://attackevals.mitre-engenuity.org/enterprise/wizard-spider-sandworm/" target="_blank">ATT&CK Evaluations for Enterprise</a> that focused on two complex, multi-stage impact-focused attacks carried out by advanced threat groups, <a href="https://attack.mitre.org/groups/G0102/" target="_blank">Wizard Spider</a> and the <a href="https://attack.mitre.org/groups/G0034/" target="_blank">Sandworm Team</a>. The evaluations emulated the TTPs of these threat actors throughout the kill chain and across ATT&CK tactics and techniques. Wizard Spider is a financially motivated group that operates financial malware and ransomware campaigns, and the Sandworm Team is focused on destructive encryption and wiper attacks.In this most recent round of testing, which took place in Q4 2021, the results of the protection segment of the test validated the strength and robustness of Deep Instinct’s multi-layered, prevention-first approach and highlighted the value our customers are seeing every day. Deep Instinct also achieved exemplary detection coverage across various execution, persistence, and impact techniques emulated. These are exactly the results we would expect as a prevention-first solution.In the past, MITRE Engenuity ATT&CK Evaluations had been more focused on evaluating detection and response, post infection. This tied closely with the reactive, “assume breach” mindset of the past decade – which looks for anomalous behaviors to stop a breach after an attack has executed on the endpoint. Beginning last year, MITRE Engenuity added a protection part to the test which aims to evaluate a solution’s ability to prevent attacks and not just provide detection and insight into the adversary’s activity.<h3>3 Key Takeaways from Deep Instinct’s MITRE Engenuity Participation</h3>The main takeaways from Deep Instinct’s participation in the MITRE Engenuity ATT&CK evaluation:<ol><li>Deep Instinct provided visibility and detection to adversary activities in all 15 attack steps tested.</li><li>Our prevention and suspicious activity detection engines achieved excellent detection coverage on techniques related to execution, persistence, command and control, and impact tactics, as well as additional visibility and insight into all other tactics included in the test.</li><li>Over 93% of Deep Instinct’s detections were at an analytic level (beyond simple telemetry), with 92% being at the highest detection level and technique. This attests to the high level of context, correlation, and actionability of the events and data presented to the user, reducing time and manual hunting and analysis resources. *Please refer to <a href="https://attackevals.mitre-engenuity.org/enterprise/wizard-spider-sandworm/#sn-detection-categories" target="_blank">MITRE methodology</a> to understand the differences between the four levels of detection</li></ol>The MITRE Windows protection test included eight (8) attack scenarios comprised of a series of sub-steps (90 in total for Windows) that were emulated in the detection portion of the test. Each of the scenarios tested, although part of a longer kill chain attack, represents an individual attack that is intrinsically malicious. It is expected that each individual scenario can and should be prevented. As mentioned above, the <a href="https://www.deepinstinct.com/platform" target="_self">Deep Instinct Prevention Platform</a> succeeded in preventing all eight scenarios. The results validated the importance of our multi-layer approach that deploys prevention mechanisms across the MITRE ATT&CK kill-chain and increases the likelihood of successful prevention.The table summarizes the eight tested scenarios and the Deep Instinct engines/capabilities which triggered the prevention.<table><colgroup data-width='750'><col style="width:33.3333%"/><col style="width:24%"/><col style="width:42.6667%"/></colgroup><thead class="bg-grey"><tr><th> Scenario</th><th> Threat Actor</th><th> Deep Instinct Prevention Engine/Mechanism</th></tr></thead><tbody><tr><td><a href="https://attack.mitre.org/software/S0367/" target="_blank">Emotet</a> Initial Access, Persistence, and Collection</td><td>Wizard Spider</td><td>Script Protection - PowerShell</td></tr><tr><td><a href="https://attack.mitre.org/software/S0266/" target="_blank">TrickBot</a> Execution, Discovery, and <a href="https://attack.mitre.org/techniques/T1558/003/" target="_blank">Kerberoasting</a></td><td>Wizard Spider</td><td>Deep Static Analysis + Suspicious Activity Detection (Automatic Remediation Mode – Process Termination)</td></tr><tr><td>TrickBot Registry Persistence</td><td>Wizard Spider</td><td>Script Protection - PowerShell</td></tr><tr><td>TrickBot ActiveDirectory Dumping</td><td>Wizard Spider</td><td>Suspicious Activity Detection (Automatic Remediation Mode – Process Termination)</td></tr><tr><td><a href="https://attack.mitre.org/software/S0446/" target="_blank">Ryuk</a> – Inhibiting System Recovery</td><td>Wizard Spider</td><td>Suspicious Activity Detection (Automatic Remediation Mode – Process Termination)</td></tr><tr><td>Ryuk – Data Encryption</td><td>Wizard Spider</td><td>Deep Static Analysis + Behavioral Analysis (Malicious Code Injection)</td></tr><tr><td><a href="https://attack.mitre.org/software/S0368/" target="_blank">NotPetya</a> – Lateral Movement and Domain Host Compromise</td><td>Sandworm</td><td>Deep Static Analysis + Suspicious Activity Detection (Automatic Remediation Mode – File Quarantine)</td></tr><tr><td>NotPetya – Data Encryption</td><td>Sandworm</td><td>Deep Static Analysis + Behavioral Analysis (Ransomware Protection) + Suspicious Activity Detection –(Automatic Remediation Mode – Process Termination)</td></tr></tbody></table><h5>The Importance of Prevention</h5>Prevention can have an extremely positive impact on your overall security posture by filling in the gaps that exist in your coverage today while reducing your reliance on the downstream impacts of detection and response. Defense-in-Depth is needed; with greater prevention you can lower security costs, improve efficiency, and reduce your overall risk. MITRE recognized this reality when they added the protection testing in 2021.MITRE Engenuity testing is important, but sometimes a customer evaluation can say it all.<blockquote class="ml-3 pl-3 border-l">"I am now a believer of the capabilities of Deep Instinct as I had conducted my own pre-purchase trial in late 2020 and early 2021 where I tested some of the top vendors' engines and pitted them all against Deep Instinct (The competitors all lost badly in the detection phase of my testing). Deep Instinct handled many near zero-day threats that had been in the wild a much shorter time than Deep Instinct's detection engine's release date. It simply didn't matter to Deep Instinct. It found them all and stopped them at pre-execution. Since pre-execution was my strategic goal with a zero-defect mentality driving that concept - Deep Instinct rocketed to the top of my wish list. Other products I tested allowed some damage to occur or didn't detect a zero-day threat at all while they wreaked havoc in a sandboxed environment.”*</blockquote><h5>Conclusion</h5>What the MITRE Engenuity evaluation does not assess is what it costs to run the solutions tested. In the end cost matters – and not just the hard costs associated with buying a solution, but also what it takes to manage and maintain it. Detection and response solutions are reactive and require an abundance of resources to tune models, investigate threats, and remediate breaches. Threat Hunting and Incident Response teams require skilled employees and there are not enough experienced cybersecurity professionals to fill the roles we have today. In fact, “there were 3.5 million unfilled cybersecurity jobs globally [in] 2021, up from one million positions in 2014” according to <a href="https://cybersecurityventures.com/jobs/" target="_blank">Cybersecurity Ventures</a>. Most EDRs require extensive in-house services to configure and manage the technology. As a result, many organizations have turned to outsourcing this service to an MDR, which is not without its own risks.Deep Instinct excels at predicting the unknown, never-before-seen threats. Our innovative approach means that organizations can proactively prevent &gt;99% of known, unknown, ransomware, and zero-day threats. Deep Instinct also lowers false positives to &lt;0.1%, reducing the burden on your security team and improving your ability to detect the most advanced threats. And proactive prevention can lower downstream costs, improve the efficiency of your SOC, and lower your overall risk.We found significant value in participating in our first MITRE Engenuity testing, but in reality, we do it every day. Our customers are our real proof points as they benefit from a true prevention-first approach with Deep Instinct, lowering the resource requirements of their security professionals by reducing false positives and improving investigation and remediation. When the next unknown threat hits, you need the best preventative solution to keep the attackers out and ensure you can automate responses with your EDR. This approach delivers the best of both worlds.We invite you to <a href="https://www.deepinstinct.com/request-a-demo" target="_blank">request a demo</a> and test us out to see the positive impact a prevention-first approach will have on your organization’s security posture.For further reading please see the <a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough" target="_self">EDR is not Enough eBook</a> and Deep Instinct’s latest <a href="https://info.deepinstinct.com/cyber-threat-landscape-report" target="_self">Cyber Threat Landscape Report</a>.*Gartner Peer Insights reviews constitute the subjective opinions of individual end users based on their own experiences and do not represent the views of Gartner or its affiliates."<h2>Learn More</h2>Watch our on-demand webinar "Clarifying the vendor spin on MITRE ATT&CK Evaluations." In this webinar, Hector Monsegur, Security Researcher and Charles Everette, Director, Cybersecurity Advocacy at Deep Instinct, review what the MITRE ATT&CK Evaluations truly are and walk through the best ways to interpret the results, including going into detail about how tests are performed.<div class="wistia_responsive_padding" style="padding-top: 56.25%;padding-right: 0px;padding-bottom: 0px;padding-left: 0px;position: relative;"><div class="wistia_responsive_wrapper" style="height: 100%;left: 0px;position: absolute;top: 0px;width: 100%;"><span id="popover_preview_embed" class="wistia_embed wistia_async_agqhaudmqi container=popover_preview_embed popover=true popoverAnimateThumbnail=true videoFoam=true" style="display: inline-block;height: 100%;position: relative;width: 100%;">&nbsp;</div></div>

2022 MITRE Engenuity ATT&CK® Evaluations Highlight Deep Instinct’s Unique Prevention-First Approach to Cybersecurity

Threat-Report-2022-Blog.png

Deep Instinct’s Threat Research team has published its review of the most significant cyber threats and trends from 2021 along with predictions for 2022. The report is an annual review of the top malware and <a href="https://www.deepinstinct.com/ransomware-protection-solution" target="_self">ransomware</a> families, leading malware trends, and a look into new cyber threats like IcedID, Qakbot, Dridex, and Trickbot aimed at the financial services sector.&nbsp;<h5>2021: 125% Increase in Cyber Threats&nbsp;</h5>While ransomware attacks increased less rapidly in 2021 than in the previous two years (15.8%), the overall complexity of attacks increased significantly. Our research team found more attacks that had the ability to evade many established <a href="https://www.deepinstinct.com/endpoint-protection-platforms" target="_self">endpoint protection tools</a>. We observed a 125% increase in all threat types combined. This diverse range of threats requires organizations to remain hyper vigilant to the ever-evolving nature of attacks.&nbsp;&nbsp;<h5>Expanded Threat Landscape Report: New Techniques and Vulnerabilities&nbsp;</h5>We are committed to continuous report enhancements and have introduced several new sections in the 2022 edition.&nbsp;&nbsp;Top 10 MITRE Techniques. Our scope has expanded to include Linux malware families, such as XorDDoS, Gafgyt, and Mirai. The MITRE ATT&CK® is an important industry-standard framework, and the new report explores the Top-10 MITRE techniques and capabilities based on our D-Cloud event analysis. &nbsp;Emerging Vulnerabilities. Probably the most important addition and a topic that has made continued headlines is the range of vulnerabilities that emerged during 2021. <a href="https://www.deepinstinct.com/blog/log4shell-cve-2021-44228-what-you-need-to-know" target="_self">Log4Shell</a>, <a href="https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside" target="_self">ProxyShell</a> (a combination of three Microsoft Exchange vulnerabilities), and <a href="https://www.deepinstinct.com/blog/stopping-printnightmare" target="_self">PrintNightmare</a> all had a significant impact. We have witnessed the incredible speed with which bad actors have taken advantage of vulnerabilities.&nbsp;&nbsp;Malware Trends. The report also dives into specific malware trends by campaign, with an assessment of Excel 4.0 macros, JavaScript, and most importantly, the various Microsoft Exchange Server vulnerabilities, all which were globally pervasive. &nbsp;&nbsp;New Discoveries. We are pleased to share details of several discoveries that the Threat Research team has made over the last 12 months, including Asaf Gilboa’s publication on credential dumps, focused on <a href="https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before" target="_self">LSASS memory dumps</a>. <a href="https://www.deepinstinct.com/blog/black-hat-2021-def-con-29-new-research-on-excel-4-0-macros" target="_self">DefCon</a> saw researcher Elad Ciuraru and Tal Leibovich, Head of Threat Research, explain how to identify Excel 4.0 macros using anomaly detection. &nbsp;&nbsp;New Tools. Security Researcher&nbsp;Ron Ben Yizhak developed and <a href="https://github.com/deepinstinct/DeMotet" target="_self">published</a> a novel tool called “DeMotet” that automates the analysis of Emotet samples on a large scale. The tool includes an unpacker for the loader and decryption scripts for the payload itself.&nbsp;&nbsp;<h5>2022 Predictions: Cyber Threat Landscape&nbsp;</h5>Each of our threat reports includes predictions for the year, and in parallel, reviews of how accurate our previous predictions were. Unsurprisingly, the impact of COVID-19 has remained an evergreen topic, with the pandemic still acting as a catalyst for the spread of malware. Despite the slow return to the office within a hybrid work model, we expect to see attackers capitalizing on VPNs as a breach vector and the exploitation of organizations that are in the <a href="https://www.forbes.com/sites/deep-instinct/2022/01/13/how-the-cloud-has-come-to-aid-our-attackers/?sh=76c032817d7c" target="_self">early stages of cloud security maturity</a>. &nbsp;&nbsp;Fast-impact and high-reward campaigns targeted at mission-critical infrastructure have also been prominent, with shorter dwell times and maximum damage inflicted as soon as possible in order to obtain a ransomware payment —&nbsp;and we expect these attacks to continue throughout 2022. &nbsp;Want to know more about our Threat Research team’s findings? Download the <a href="https://info.deepinstinct.com/cyber-threat-landscape-report" target="_self">2022 Cyber Threat Landscape Report</a> to read our full analysis.&nbsp;<h2>Learn More</h2>Watch our on-demand webinar "2022 Threat Landscape Report Unpacked." Moshe Hayun, Threat Intelligence Team Lead at Deep Instinct and one of the report's authors, highlights some of the findings and latest developments to help you stay one step ahead.<div class="wistia_responsive_padding" style="padding-top: 56.25%;padding-right: 0px;padding-bottom: 0px;padding-left: 0px;position: relative;"><div class="wistia_responsive_wrapper" style="height: 100%;left: 0px;position: absolute;top: 0px;width: 100%;"><span id="popover_preview_embed" class="wistia_embed wistia_async_f7gkqubpdy container=popover_preview_embed popover=true popoverAnimateThumbnail=true videoFoam=true" style="display: inline-block;height: 100%;position: relative;width: 100%;">&nbsp;</div></div>

Cyber Threat Landscape Report 2022: Summary & Predictions

Deep Instinct 2021 Mid Year Cyber Report Blog

mid-year-cyber-report

It’s usual at Deep Instinct to compile an annual Threat Report. However, this year has been exceptional for cyber threats, and as a result, we decided to create an interim version taking into consideration the last six months and our key observations. While shorter, many of the sections are consistent with the full-year report.In “Malware trends,” we explore an extended period (January 2020 through June 2021), and the arbitrary amount of new samples across malware campaigns such as Miner, Dropper, Spyware, Worm, and Backdoor. Unsurprisingly, ransomware is still the dominant trend.Ransomware has been a featured in major news headlines throughout 2021, and our “Ransomware campaigns” sections looks at the five leading threats such as STOP (Djvu), Ryuk, and Sodinokibi (REvil), which has been featured in many recent high-profile attacks. We dive into the key attributes of these and provide some wider context where possible.“Banking Trojan campaigns” looks at the successors to Emotet, such as Ramnit, Qbot, and IcedID. These and other campaigns have all had a significant impact on financial services and eCommerce, as these sectors battle with online banking fraud. We are also seeing the Dridex campaign enabling even cryptocurrency wallet credential theft – no matter what the currency or its format, every one of these is fair game for threat actors.“Takeaways” focuses on our key observations on the first six months of 2021. The global pandemic has sadly given cyber criminals multiple opportunities to exploit technology and human vulnerabilities. From phishing emails disguised as Pfizer, to healthcare institutions being specifically targeted, and the exploring of back doors in hastily developed COVID vaccination applications, the pandemic has gifted hackers with multiple opportunities to make the most of an extraordinary situation.Looking ahead to the rest of 2021, “Predictions” is always a topic of enthusiastic debate on our team, as we consider how the cyber threat landscape is likely to evolve. A key expectation we have is around the long-term implications of employees working from home, whether permanently or in a hybrid model. The absence of the classic perimeter within an office-based environment is a major game changer for the cybersecurity industry.The Colonial Pipeline attack made worldwide news, but it is just one of many attempts to hit mission-critical infrastructure, whether law enforcement, hospitals, education, or the energy and utility sectors. We do not expect to see this potentially lucrative and high-profile strategy changing anytime soon, and it forms one of our other major predictions.Want to know more about our findings? Download the <a href="https://info.deepinstinct.com/en/tof/cyber-threat-report-2021">report</a> and read the full analysis.

2021 Mid-Year Cyber Threat Landscape Report

Learn From Yesterday, Live for Today, Hope for Tomorrow – Albert Einstein

2019 was a highly eventful year for those working in the cybersecurity sp

threatReport_blog.png

Learn From Yesterday, Live for Today, Hope for Tomorrow – Albert Einstein
2019 was a highly eventful year for those working in the cybersecurity space. Security staff did not have it easy, with arguably the least enviable role within an IT department. As the sophistication, daring and evasiveness of threats developed, the financial damage caused to companies as a result of Cyber-attacks became more apparent, and as it did, more of a heightened concern.
Perhaps the singular concern most responsible for raising anxiety levels was that of ransomware attacks which over the course of 2019 became more targeted. Hackers appeared to narrow in their focus against large enterprises from whom they surmised they could extract larger payouts. Over the course of 2019 ransom demands from successful attacks reached millions of dollars, even despite internal industry pressure to resist the relative “ease” of paying off ransom demands. 2019 also saw the start of ransomware actors leaking the data of attacked organizations uncooperative in paying the ransom. Although this had been threatened before, no-one, until this point, had actually followed through on the threat.
Over the duration of the year, <a href="https://www.deepinstinct.com/2020/10/12/why-emotets-latest-wave-is-harder-to-catch-than-ever-before-part-2/">Emotet malware</a>, the highly destructive banking trojan, becomes the most prominent threat in the cyber-landscape. After a relatively inactive period during the summer months (it appears hackers need to take holidays too), Emotet resurfaced in September, with a very large attack wave, and a quick succession of mutations. Throughout 2019 Emotet was seen working in collaboration with many other malware campaigns where hackers used it to drop ransomware, spyware, and backdoors onto systems that were initially infected by Emotet.
Research undertaken by Deep Instinct’s Threat Intelligence Research team indicated a growing connection between nation-states and financially motivated hackers. In December 2019 it was found that the leader of “Evil Corp” a hacking group indicted in the U.S. for stealing over $100 million by using a Dridex banking trojan, was a citizen of Russia. The individual was alleged to have been working in collaboration with the FSB, Russia’s Federal Security Services, since 2017. It was reported that the Russian state authority had provided the hacker with sensitive information used to help execute their attack.
During 2019, the Threat Intelligence research team at Deep Instinct uncovered several new and unique malware campaigns, while protecting our customers from ceaseless attacks. The campaigns uncovered include Trickbooster, an email harvesting module, used by Trickbot, which had successfully collected over 250 million email addresses, including those of government departments, educational institutions, and large corporations; Legion Loader, a malware loader which can drop multiple different malware campaigns in a single deposit on a victim’s computer; and Separ, a credential stealer which was responsible for the credential theft of hundreds of organizations.
More insights like these can be found within <a href="https://info.deepinstinct.com/tof/cyber-threat-landscape-report-2019-2020" target="_blank" rel="noopener noreferrer">Deep Instinct’s Cyber Threat Landscape Report for 2019 to 2020</a>. The report discusses trends seen during 2019 and provides concrete data on the changes in the landscape throughout the year. We expect this report will provide the reader with a better understanding of the present threat landscape and its trajectory. A critical resource for those working in the <a href="https://www.deepinstinct.com/product-overview/">cybersecurity solutions</a> space, the report addresses the security challenges of last year and how to be best mitigate the coming threats of 2020.

The Cybersecurity Threat Landscape

On January 14, 2020, the U.S. National Security Agency (NSA) took the extraordinary step of publicly announcing it had discovered a vulnerability in t

certificates.jpg

On January 14, 2020, the U.S. National Security Agency (NSA) took the extraordinary step of publicly announcing it had discovered a vulnerability in the Windows 10 operating system. This flaw (tracked as CVE-2020-0601 and later given the name “Curveball”) compromised Window’s CryptoAPI, used to verify digital certificates.  Digital certificates – and the ability of other digital tools to verify them – is fundamental to cybersecurity infrastructure, as it is a foundation that security tools (as well as other software and applications) rely upon. The severity and extent of the potential impact and risk stemming from “Curveball” are most likely behind the NSA’s rare decision to expose, share and announce it with Microsoft and the world.
To understand why ”Curveball” is so dangerous, we need to talk about certificates and why they’re essential to cybersecurity.
Certificates are the Passports of the Internet (and much more...)
Every day billions of people use the web which has terabytes of data flowing throughout it. For that data to get where it needs to go, it needs to get accepted by the recipient. Certificates are the mechanism by which digital applications verify the identity of the sender, giving the recipient confidence that the sender is a safe and legitimate source. They are also used to set-up secure, encrypted communication between parties, or to attest to a file’s owner/writer.
When we try to enter a country, we need to show our passports before they’ll let us in. The border control agents don’t know who you are, and therefore have to rely on your passport. Your passport is therefore issued with a degree of authority, it is trusted as having the highest level of credibility, absent signs of forgery, attesting to who you say you are. Border control officers look for those signs when they inspect your passport. Perhaps an official seal is missing or has an error. Maybe the information isn't presented correctly. Unless the border agent sees such an anomaly, the information on the passport is assumed to be credible. Of course, it doesn’t mean you’d be allowed to enter, but the decision will be based on your passport, its issuer (namely your country) and your identity as specified by the passport. A passport opens the gateway.
Digital certificates operate the same way. For example, when we try to establish an encrypted session on a website or install a driver, they must have a valid digital signature certificate, issued and further signed by a certificate authority. As Windows is the OS that provides the most widely used interface to verify the validity and authenticity of the certificates, it serves as our main border control agent. If your system couldn't properly verify and authenticate a digital certificate – you have a problem. Especially, if it can be fooled by a forged certificate. And this is what “Curveball” is all about - the bad actor's ability to exploit that mechanism. “Curveball” means a capable attacker can send a file that appears to be a Microsoft file (or another highly trusted software vendor), but in fact runs a malware dropper on your system when you click on it. Nearly all our online activity – files, data, communications - use certificates behind the scenes and therefore are potentially vulnerable.
This vulnerability in the CryptoAPI had the potential to create a <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601">“digital signature [that] would appear to be from a trusted provider.”</a>  The potential to spoof digital certificates raises an unprecedented risk to cybersecurity. Hackers trying to steal a valid digital certificate is a known tactic that cybersecurity tools help thwart. However, being able to spoof a perfectly valid certificate is a game-changer. Consequently, users and networks that trust the legitimate- appearing digital signature would’ve been allowing that malware into their systems.
Without being able to verify a digital signature on a certificate, it is impossible for machines, networks, and applications to communicate safely and securely. This includes cybersecurity tools that wouldn’t be able to operate on the premise that a certificate is valid or issuing valid signatures. In other words, the ability to fabricate certificates would usher in a state of chaos. There would be no underlying security framework that analyzes this underlying basis of trust.
Now you can understand why the NSA went public with its discovery. While there's no evidence that anyone exploited this vulnerability, it's still a potential hazard that demands immediate attention. Windows had rolled out a security patch, which your computer has probably since updated. However the catch is, now that bad actors know about this vulnerability, it’s mostly a question of “when” and not “if” they will try to exploit it on unpatched machines and environments.
In summary, the first order of the day is to patch. This remains to be the only practical and reliable remedy to this vulnerability. Beyond that are solutions that will require industry-wide collective partnership and co-operation to minimize the impact of this vulnerability and ensure ongoing protection. Curevball, unlike nothing before it, taught us an important lesson in the vulnerability having single points of failure. It taught us about the underlying principles of trust which the entire cybersecurity ecosystem relies upon. Lastly, it taught us about the importance of agility and quick adaptation to change in today’s digital era, primarily the process from patch management to adopting new technologies for more comprehensive security.  If fortification is going to happen it will need to be through this newly acquired insight.

Certified and Undermined: The CVE-2020-1601 Security Flaw

By: blt2b8a66ae602e419b

We’re excited to announce the release of a new and updated D-brain version!

D-Brain is a critical part of Deep Instinct’s D

new_brain_2-1.jpg

By: blt2b8a66ae602e419b
We’re excited to announce the release of a new and updated D-brain version!
D-Brain is a critical part of Deep Instinct’s <a href="https://www.deepinstinct.com/">Deep Learning</a> based malware detection and prevention engine. D-Brain, built of Deep Instinct’s proprietary deep learning architecture, is the core component of our cybersecurity solution. D-Brain provides unparalleled accuracy in known and unknown malware detection and prevention and covers a wide range of attack vectors and file types. A new D-Brain version with new capabilities and improved performance is now released as part of our continued efforts to provide the best <a href="https://www.deepinstinct.com/product-overview/">malware prevention</a> and detection available.
<h3>Background</h3>
D-Brain training cycles, in which millions of benign and malicious samples are fed into deep neural network architecture, occur in Deep Instinct’s labs. In the training process D-Brain learns to identify, recognize and distinguish between malware and good-ware. This process happens only a few times a year due to deep learning’s powerful prediction capabilities and resilience to the ever-changing threat landscape.
The end- result of a training cycle is a production-ready D-Brain. D-Brain containing a trained neural network, can then be deployed, and run in prediction (inference) mode. Prevention and detection decisions made by D-Brain are used to prevent and detect the newest, most evasive and most challenging attacks in today’s threat landscape, across multiple file types, ranging from PE (executables, DLLs, drivers) to document files and additional formats carrying sophisticated exploits. D-Brain is used to prevent even the most unique and rare attack vectors such as exploits in malicious font and TIFF files.
<h3>From Collection to Training in Deep Instinct’s deep learning architecture of neural network </h3>
Data Collection and Labeling
Data-sets used for training the latest D-Brain version were sourced from a sample collection that includes well over a billion files, both malicious and benign. This sample collection, along with all associated metadata, file reputation and prevalence data is processed, labeled and stored in D-Cloud, Deep Instinct’s threat-intelligence and file reputation cloud. D-Cloud is continuously fed with samples and metadata from many different threat intelligence and file reputation sources. D-Cloud’s wide accessibility and accurate triage and classification schemes, enable us to create training data-sets which are not only extensive in numbers, but also highly accurate in labeling, and provide the widest possible coverage of the threat landscape from various aspects such as attack vectors, threat actors, regions, mutations and more.
Challenging the Brain
In addition to collecting massive amounts of in-the-wild malware, we challenge D-Brain as it’s trained even further, by introducing never-seen-before and highly evasive samples and exploits. These samples are curated based on several sources: unique access to dark-web forums and communities, publicly available malware which we independently mutate, and our very own home-made, self-developed (never to be used ?) malware.
Deep Learning and Training infrastructure
Publicly available DL frameworks are not intended and indeed cannot deliver the performance, adaptation, scale and data-handling requirements for cyber-security related implementations. Therefore, Deep Instinct, has internally developed an end-to-end deep learning framework customized to meet cybersecurity needs and deliverables. Our deep learning framework allows us to train on hundreds of millions of files in a matter of 24-48 hours.
Latest improvements introduced to the framework make it faster than ever and more robust. During the creation of the latest D-Brain version, multiple training cycles based on a few dozen different data-sets were run, which resulted in dozens of different neural network model versions. We selected the very best D-Brain version for production release.
<h3>Performance and detection capabilities</h3>
Here are just a few examples for some of the improvements and capabilities of the new D-Brain version:
Office and RTF
D-Brain detects the newest, most widely used and most challenging threats and exploits found in today’s landscape of document-based attacks, including those based on embedded or dynamically loaded OLE objects. The detection of more traditional malicious document using Macros (VBA) and older Office/RTF related exploits is higher than ever. The unparalleled detection is matched with a false-positive rate as low as several digits after the percentage point.
PE files
D-Brain now demonstrates detection rates that are better than ever, across threat types, attack vectors and threat-actors. This ranges from simple unwanted applications (PUA) to sophisticated ransomware, crypto-miners, financial malware and APTs. In addition, accuracy has been improved in the PE landscape as-well, with false-positive rates lower by an order of magnitude compared to competing solutions.
<h3>Summary </h3>
D-Brain is the only static engine that is purely based on deep learning and has the widest coverage of the threat landscape based on artificial intelligence. D-Brain 109 is another milestone in our continued efforts to provide the best prevention technology ever.
&nbsp;
Do learn more about <a href="https://www.deepinstinct.com/architecture/">deep learning architecture</a> and neural networks, and how it is reinventing prevention - download this free whitepaper &gt;&gt;
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/ffcc9f6f-5f5b-4387-90d3-58d48b011274"><img id="hs-cta-img-ffcc9f6f-5f5b-4387-90d3-58d48b011274" class="hs-cta-img" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/ffcc9f6f-5f5b-4387-90d3-58d48b011274.png" alt="New call-to-action" width="800" height="200" /></a>

Announcing DSX for Cloud - Amazon S3, natively integrated zero-day data security for AWS S3.

Shimon Noam Oren

From Shimon Noam Oren.