di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

Deep Instinct security researchers Ron Ben-Yizhak and David Shandalov share the research they presented at DEF CON 32: an in-depth exploration of two different attack methods. Explore the methods they presented and follow along as they explain how they work.

DEFCON Speaker Image.jpg

SHIM Me What You Got: Manipulating Shim and Office for Code Injection

Last week, Black Hat and DEF CON took Las Vegas by storm and Deep Instinct was there to join the fun. It was an exhilarating week, packed with networking events, speaking sessions, and a lively crowd. Here are our main takeaways and notable highlights you may have missed.

Blackhat_930x400_3.png

<h5>As Vendors Continue to Tout “AI” Capabilities, Let’s Talk About Real AI</h5>Unsurprisingly, artificial intelligence (AI) continued to dominate onsite conversations, and similar to the RSA Conference earlier this year, both legacy and early-stage cybersecurity vendors felt compelled to tout “AI capabilities” in their marketing and booth collateral. But not all AI is created equal, and it sparked a conversation about the differences and nuances in AI technologies.Many cybersecurity vendors promoted generative AI capabilities that are tacked onto existing technologies, a marketing tactic used to remain relevant in today’s AI conversations. But AI is not their core competency, and it never will be – at the end of the day, their AI explains how you were breached, but doesn’t prevent it.We challenged booth visitors to ask vendors the hard-hitting questions about AI: Is it built on an archaic framework? Can it be air gapped? Is it the most advanced form of AI (deep learning), or just <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity?_ga=2.51158817.941771334.1715708232-1517144758.1706129447">basic ML</a>? The answers will tell you everything you need to know about vendors’ AI promises.Deep Instinct is different from any other vendor in the market. Our deep learning (DL) cybersecurity framework prevents and explains unknown zero-day threats, so that security teams can both stop a breach before it happens and learn to predict the next attack. We’re a zero-day data security platform using the most advanced form of AI – developed before AI became a hot topic – to protect storage, applications, and endpoints, so your data remains secure regardless of where it resides.<h5>Proven Prevention: Deep Instinct Wins CRN Award During Black Hat</h5>During Black Hat, <a href="https://www.deepinstinct.com/prevention-for-storage">Deep Instinct’s </a><a href="https://www.deepinstinct.com/prevention-for-storage">Prevention for Storage (DPS)</a> product was recognized by CRN in its <a href="https://www.crn.com/news/channel-news/2024/the-2024-tech-innovator-awards">2024 Tech Innovator Awards</a>. From more than 320 applicants, DPS rose to the top. DPS provides data storage threat prevention across NAS and cloud storage environments, preventing &gt;99% of zero-day exploits, ransomware, and unknown threats in these storage repositories.<h5>Highlighting Our Two Speaking Sessions at Black Hat and DEF CON</h5>Capping off a memorable week were our two speaking sessions during Black Hat and DEF CON. First, our CIO and CISO, Carl Froggett, joined our VP of Global Sales Engineering, Brian Black, in a Black Hat session titled, “<a href="https://www.blackhat.com/us-24/sponsored-sessions/schedule/index.html#the-future-of-cybersecurity-embracing-prevention-first-strategies-in-the-age-of-edge-ai-42167">The Future of Cybersecurity: Embracing Prevention-First Strategies in the Age of Edge AI</a>.” The duo discussed the new era of localized large language models (LLMs) amid the advent of neural processing units (NPUs) and neural engines in devices from Qualcomm and Apple. They also walked attendees through the implications of edge AI and localized LLMs, while highlighting the urgent need for prevention-focused approaches to safeguard against these evolving threats.Then during DEF CON, Deep Instinct researchers Ron Ben-Yizhak and David Shandalov presented “<a href="https://defcon.org/html/defcon-32/dc-32-speakers.html">SHIM Me What You Got - Manipulating Shim and Office for Code Injection</a>,” introducing a novel and stealthy technique to apply malicious shims on a code injection process that does not require registry modification or SDB files and leaves no traces on the disk.“Hacker summer camp” is always an exciting time, but what made this year even more memorable was the meteoric rise in AI visibility, and discussions centered on how to fight AI with better AI. The answer is deep learning. See for yourself what’s possible by <a href="https://info.deepinstinct.com/request-a-demo?_ga=2.123317326.470551219.1723466942-635130100.1705001786&_gac=1.88354281.1722959687.CjwKCAjwk8e1BhALEiwAc8MHiIGA96vDs3I1qyodZhPZHrwQ9pTgxWo5NEpFFArfiOucUXEX-lSRCRoCAdcQAvD_BwE">requesting a Deep Instinct demo today</a>.

"Hacker Summer Camp" Recap: Black Hat, DEF CON, and the Growing AI Arms Race

Follow along with Deep Instinct on a postmortem of the 2023 MGM attacks. Learn what went wrong, what could have been done to prevent the attack, and what having Deep Instinct would have changed.

MGM_930x400.png

In late 2023, MGM Resorts experienced the beginning of a ransomware cyberattack that would cost them nearly $100M USD. The multi-stage attack was launched by ShatteredSpider, a subgroup of AlphV, and progressed quickly from infiltration to exploitation. By taking advantage of social engineering tactics, injection, and inadequate security practices, ShatteredSpider pulled off one of the highest profile attacks in years. And it didn’t have to happen.&nbsp;<h5>The MGM Attack&nbsp;</h5>In the first phase of the attack, ShatteredSpider (<a href="https://therecord.media/mgm-hack-teenager-arrest-britain">who recently had a 17-year-old member arrested</a> in connection with the MGM hack) used LinkedIn to gather information about an MGM employee and then impersonated that employee on a call to MGM’s IT helpdesk. Using that access, ShatteredSpider was able to convince the helpdesk to grant them access, bypassing every existing security control. The attackers then quickly established persistence, installed sniffers, and exfiltrated key admin credentials for Azure, Windows, and Okta. MGM was, at this point, a very securely stuck fly in ShatteredSpider’s web. Because the credentials had already been exfiltrated, MGM’s subsequent attempt to stop the cyberattack by shutting down critical infrastructure was too little, too late.&nbsp;As soon as services came back online, ShatteredSpider was able to use the exfiltrated credentials and persistence to attack their main objective. They identified critical MGM business services running on VMware with 100 ESXi Hypervisors. Hitting this one target caused massive disruption to their hotel reservation systems, gambling, slot machines, digital key room access, and so much more - achieving their desired outcome. Having established Internet communication to their cloud services, they exfiltrated MGM customer data/PII, and deployed ransomware to 100 ESXi VMware Hypervisors: MGM’s entire Virtual Server and some virtual desktop environments. That, kids, is the ballgame.&nbsp;<h5>Rewriting a Successful Attack&nbsp;</h5>Learning the right lessons after a cyberattack is an important part of both remediation and preparation for the next attack. When a high-profile attack like MGM happens, the entire cybersecurity industry gets the chance to analyze, dissect, and ultimately battle game the attack to see what would have worked and what wouldn’t. Everyone should be admitting the same thing about the first phase of the attack: there is not a policy in place, a training you could give, or a tool available that can remove the human element from an attack. The tools malicious actors use are complex, effective, and malleable. With the rise of AI, they’ve only become more dangerous. AI voice and video impersonations are an excellent example of this danger.&nbsp;Initial infiltration was just step one. The real battle took place in the hours and days following the vishing. The attackers installed sniffers and compromised critical infrastructure. The strategy of ‘detect and respond’ falls short here: how much time does it take to detect an attack and how much more time does it take to adequately respond?&nbsp;It’s during that ‘detect and respond’ period that Deep Instinct could have been a difference maker, not just slowing the attack, but preventing it altogether. ShatteredSpider were smart about their attack. The payload was delivered directly to the hypervisor layer; it wasn’t staged on end points, in storage, or delivered via email, thus avoiding several detection and prevention layers. This leaves two points to prevent the attack: the hypervisor layer and the internet delivery. In our tests, Deep Instinct was able to secure both points.&nbsp;<a href="https://www.deepinstinct.com/endpoint-security" target="_self">Deep Instinct EPP</a> running on the hypervisor layer detected and quarantined the payload before it could execute. Similarly, <a href="https://www.deepinstinct.com/prevention-for-applications" target="_self">Deep Instinct Prevention for Applications (DPA)</a> integrated into the internet layer via API or ICAP would have also prevented the payload.&nbsp;&nbsp;<h5>Debrief, DIANNA, Do-Over&nbsp;</h5>MGM lost control of their situation the moment the social engineering attack was successful. Their lack of hypervisor partition, secondary credentials, scanning capabilities, and other industry-standard security controls meant that once the attackers had established persistence and exfiltrated admin credentials they would have free run of the place. Having those defenses would have at least hardened MGM as a target but they would not necessarily have prevented the attack completely.&nbsp;Unfortunately, much of the cybersecurity industry’s value-prop isn’t true prevention, it’s disaster mitigation. The biggest success of most tech stack configurations would be that they stopped the bleeding. This cybersecurity philosophy can be cynically distilled into one key question: How much are you willing to lose? At a large enterprise like MGM, even successfully defending against a cyberattack can be costly.&nbsp;Where Deep Instinct makes a difference is the focus on prevention. Barring the human element that allowed access to critical infrastructure, Deep Instinct DPE and DPA would have prevented the actual substantive parts of the MGM attack. The bleeding didn’t have to happen, and the “success” of only a small number of accounts being affected didn’t have to happen. The malicious payload used in the MGM attack could have been immediately caught, quarantined, and deleted pre-execution when scanned by Deep Instinct. Using DIANNA, MGM could have immediately figured out why the payload was caught and deleted.&nbsp;<a href="https://www.deepinstinct.com/news/deep-instinct-introduces-dianna">DIANNA, our generative AI powered cybersecurity companion</a>, was able to tell us nearly instantly (okay, seven seconds) in real language why the Alphv ransomware was malicious, including the markers it used to make that determination. In short order we had both stopped the attack and developed a framework for investigating the attack. In addition to stopping the attack, there are other key benefits for some groups:&nbsp;<ul><li>SOC Teams: In terms of both efficacy and stress, SOC teams are a main beneficiary of effective prevention-first cybersecurity. Given rising rates of burnout among SOC professionals, tools that support their mission are invaluable. Read more about the rates of burnout among SOC professionals in our <a href="https://www.deepinstinct.com/voice-of-secops-reports">2024 Voice of SecOps report</a>.&nbsp;</li></ul><ul><li>MGM: Better cybersecurity reduces organizational risk and increases confidence. A prevention-first approach eliminates the death-by-a-thousand-cuts damage to organizational reputation and budget caused by the current cybersecurity paradigm.&nbsp;</li></ul><ul><li>MGM Customers: Having personal data stolen is incredibly dangerous for consumers and puts them at risk for fraud, identity theft, and other targeted attacks. Not allowing a breach to occur at all increases confidence and mitigates the legal and personal ramifications of allowing personal data to be stolen.&nbsp;</li></ul>Novelty is a weapon. Most of the time it’s a very effective one. The introduction of deepfakes has revolutionized social engineering attacks. Malicious AI has similarly revolutionized cyberattacks. There are more methods than ever for bad actors to gain access to secure systems. AI-powered mutations allow attacks to constantly refresh and renew themselves in novel ways to evade existing cybersecurity. To keep up, defenders need tools that make them equally responsive.<a href="https://info.deepinstinct.com/request-a-demo">Get a demo</a> to see the power of a prevention-first approach for yourself.&nbsp;

Would Have, Could Have, Should Have: Dissecting the 2023 MGM Hack

Take a deep dive into BlackSuit ransomware and explore its capabilities, deployment, and some current targets. Explore how Deep Instinct is able to detect and prevent BlackSuit from taking advantage of your data.

BlackSuit_900x400_2.png

Five weeks ago, the KADOKAWA corporation began to experience service outages affecting multiple websites. The outages spread to other operations and were identified as a <a href="https://www.bleepingcomputer.com/news/security/blacksuit-ransomware-gang-claims-attack-on-kadokawa-corporation/">ransomware attack</a> by the BlackSuit ransomware group. BlackSuit claimed responsibility and threatened the public release of stolen information on July 1st unless their ransom demands were met.&nbsp;&nbsp;BlackSuit's ransomware is very similar to the Royal ransomware strain, which itself is considered the successor to the notorious Conti group. This suggests potential connections or shared developers. This connection can be explained in more detail in some of our older material that has been published on the subject: we examined both <a href="https://info.deepinstinct.com/conti-leaks-cyber-threat-reports">Conti</a> and <a href="https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence">BlackBasta</a>, a Conti offshoot.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt360d20b0f113f264/6696f82b06a674d134c5a4ee/fig1-blacksuit-victims.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: BlackSuit ransomware victims</figcaption></div></figure>Based on our analysis, we found that Deep Instinct prevents&nbsp;all new Blacksuit Windows Ransomware samples with an eight-month-old brain. Across the industry, however, these samples have a much lower detection rate than earlier sample versions of BlackSuit. As demonstrated in the graph above, that lower detection rate matches the sudden growth of BlackSuit ransomware victims.&nbsp;The samples BlackSuit is using are well designed for infiltration of legacy systems. Let’s take a closer look.&nbsp;<h5>Latest samples analysis:</h5>Newer samples of BlackSuit’s code mainly added additional layers of complications like encoding strings and imported DLLs for Anti-Analysis. They also added a mandatory ID argument to bypass automatic emulation, making the new samples more evasive.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2084d114ec3f8209/6696f82b77a7809e9044a25f/fig2-strings-encryption.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: String decryption</figcaption></div></figure>For example, according to VirusTotal, even though old Blacksuit samples have a high detection rate, the new samples from recent months have a much lower detection rate, indicating significant changes.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5bed08ab64e581fe/6696f82cd0c0ef789ec561b6/fig3-VT-detection-rate.png" width="auto" height="auto" style="text-align: center;max-width: auto;width: auto;height: auto;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Detection rate in VirusTotal of new Blacksuit samples when first submitted</figcaption></div></figure>One of the more impactful changes allowed the threat actor to mask the ransomware as a legitimate part of a known free antivirus, Qihoo 360, including false watermarking. This masking has drastically lowered detection. The ransomware is hidden deep inside the legitimate looking application and only has to be executed with a token in the command line to operate as a ransomware.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteae79a1729b07bfd/6696f82c77a780582d44a263/fig4-embedded-legitimate-urls.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: Embedded URLs</figcaption></div></figure><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4e96f1780d57f20a/6696f82c6c1019fd6f39795e/fig5-fake-metadata.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: Fake Metadata</figcaption></div></figure>The masquerade file is not signed, indicating this is not the real Qihoo application. The functionality post infiltration remained the same as the other new samples, including the same mutex used.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3971600a651708d4/6696f82c79f2042205390cf0/fig6-VT-detectio-rate-stealthy-sample.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: VirusTotal detection rate.</figcaption></div></figure>

The main portion of the executable is nearly identical to Qihoo's real QHAccount.exe file, resulting in security software evasion.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="image003.jpg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5dac21065b6f0d02/66990ac7d316c70da3b3419f/image003.jpg" height="auto" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: Side by side comparison of BlackSuit and Qihoo executables</figcaption></div></figure>Disclaimer: The official Qihoo 360 is not in any way involved with BlackSuit. The masking is the work of bad actors assuming Qihoo’s identity.&nbsp;<h5>Behaviors:</h5>The common behavior shared with all Windows samples didn’t change much and the main functionality remained the same, though some commands have changed:<table><tbody><tr><td>-p&nbsp;</td><td>Specifies the target directory where the ransomware will encrypt files&nbsp;</td></tr><tr><td>-killvm&nbsp;</td><td>Terminates the virtual machine (VM), preventing analysis&nbsp;</td></tr><tr><td>-allfilesEncrypt&nbsp;</td><td>Encrypts all accessible files, maximizing damage&nbsp;</td></tr><tr><td>-networkEncrypt&nbsp;</td><td>Encrypts files on connected network drives, spreading the attack&nbsp;</td></tr><tr><td>-localEncrypt&nbsp;</td><td>Restricts encryption to the local machine storage, limiting immediate impact&nbsp;</td></tr><tr><td>-percentEncrypt&nbsp;</td><td>Encrypts a specified percentage of files, potentially increasing performance&nbsp;</td></tr><tr><td>-demonoff&nbsp;</td><td>Operates in stealth mode, making detection harder&nbsp;</td></tr><tr><td>-list {file}&nbsp;</td><td>A targeted list of files to be included in the encryption process&nbsp;</td></tr><tr><td>-delete&nbsp;</td><td>The ransomware deletes itself after execution, hindering investigation&nbsp;</td></tr><tr><td>-thrcount {number}&nbsp;</td><td>Specifies the number of threads used for encryption, impacting both performance and resource usage.&nbsp;</td></tr><tr><td>-skip {file}&nbsp;</td><td>A list of files to be excluded from encryption&nbsp;</td></tr><tr><td>-noprotect&nbsp;</td><td>Disables self-protection mechanisms, allowing termination of the ransomware&nbsp;</td></tr></tbody></table>&nbsp;The new samples have encoded strings to complicate analysis, and need to be supplied with -id &lt;32 characters&gt;. They can also receive additional instructions, such as:&nbsp;&nbsp;<table><tbody><tr><td>-ep&nbsp;</td><td>(like the previous percentEncrypt) sets a percentage of each file that will be encrypted. Partial encryption&nbsp;</td></tr><tr><td>-path&nbsp;</td><td>Specific directory to encrypt&nbsp;</td></tr><tr><td>-localonly&nbsp;</td><td>(an addition to the previous networkEncrypt) without network drives&nbsp;</td></tr><tr><td>-networkonly&nbsp;</td><td>(an addition to the previous networkEncrypt) without local files&nbsp;</td></tr><tr><td>-aavm&nbsp;</td><td>(like the previous allfilesEncrypt) encrypts everything&nbsp;</td></tr></tbody></table>&nbsp;BlackSuit ransomware also boasts a few other functionalities:&nbsp;<ul><li>Initiates Asymmetric Key Exchange to get the secret encryption key.&nbsp;</li></ul><ul><li>Deletes shadow copies, in order to disable easy local restore:&nbsp;</li></ul><ul><ul><li>vssadmin delete shadow /all /quiet&nbsp;&nbsp;</li></ul></ul><ul><li>Encrypts&nbsp;</li></ul><ul><ul><li>Appends .blacksuit to the encrypted files&nbsp;</li></ul></ul><ul><li>Skips:&nbsp;</li></ul><ul><ul><li>Various file types like executables, drivers, and installers to avoid breaking the system.&nbsp;</li></ul></ul><ul><ul><li>Already encrypted files and the ransom note.&nbsp;</li></ul></ul><ul><li>Eventually, BlackSuit’s ransomware is capable of disabling safe mode and shutting down the system:&nbsp;</li></ul><ul><ul><li>bcdedit /deletevalue {current} safeboot&nbsp;&nbsp;</li></ul></ul><ul><ul><li>shutdown /r /t 0&nbsp;</li></ul></ul><ul><li>Drops ransom note: Usually named readme.blacksuit.txt. The content text is encrypted to avoid signature detection for the ransom note. The note includes a link for communication with the threat actor for ransom negotiations.</li></ul><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt771fca19a69b58a1" alt="fig7-ransom-note.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt771fca19a69b58a1/6696f82de13bf8b63bf84456/fig7-ransom-note.png" width="auto" height="128" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: BlackSuit’s ransom note</figcaption></div></figure><h5>Infection chain</h5>The common initial attack vectors are RDP (possibly with stolen credentials), VPN and firewall vulnerabilities, Office email attachments (Macros), Torrent websites, Malicious ads, and various 3rd-party trojans. And the attackers have also used tools like CobaltStrike, WinRAR, PUTTY, Rclone, Advanced IP Scanner, Mimikatz, and GMER. The variety of attack vectors opens the possibility for infection across a much broader target group, endangering large amounts of data.&nbsp;<h5>Leak and news site</h5>The BlackSuit group operates a news and leak site on the DarkWeb that includes all the known victims of the threat actors. Once the timer for the ransom payment ends, the exfiltrated data is published.&nbsp;Alleged victims of BlackSuit ransomware have their data published under a profile featuring key information about their organization, including industry, number of employees, revenue, and contact information.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Figure 8: An example of an alleged victim's profile on BlackSuit's leak site " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6451cbdff41a7b39/6697d044d0c0efef3ec5697e/fig9-darkweb-leak_redact_WB.png" width="auto" height="auto" style="width: auto; height: auto;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: An example of a victim profile on BlackSuit's leak site</figcaption></div></figure><a href="https://info.deepinstinct.com/request-a-demo">Request a demo</a> to see how Deep Instinct can protect you from BlackSuit ransomware.&nbsp;Explore the BlackSuit IOCs below.<h5>IOCs</h5>f1684fb118d4d8fc56653fcc49e12a659b64c4459ba037fa94f21783235cc6ba&nbsp;dede96fd44c0f78eb79ceb63b898874e8922efc59d8bfb9f86505b1992bc00a3&nbsp; 6a2e454942cfeebb1140e1a28cb05fd49461d07792e97663378399c719fbc9ee&nbsp;79ab73a0e9dd8eac045c00fd1bd172a7f359588901f93c83e6740157eb21e7df&nbsp;7f09c2e35783fca69f0e12f31d767cecf8a98567f2b6f1e2d81d2b2e93fe6307&nbsp;60a9785ec20ec08b6792e304fc4b363abd54b8a7a2945dca9f97ee07783c4759&nbsp;5aeaa5c4f4100b2084814be72a695a5bf4a95fdb8a0c65704523608baa79b726&nbsp;d96ff4b3e188f7ff96ed28c1381a6318dd76bb1fbd6ca02c6ab0236e1c7f35aa&nbsp;3be3a3c2c1abc1d401e845a2b8952f4f3e55b510f3d6c1eb2a4503c7be09bec1&nbsp;90ae0c693f6ffd6dc5bb2d5a5ef078629c3d77f874b2d2ebd9e109d8ca049f2c&nbsp;6ad8215bd6b52d897dcfa0a9829720d0532adc741460ecb4b8f00c4427b6141c&nbsp;8605dec4ae4bd9f51297d1f244d0647bc0637d6ce6a957a5f810c64ae63276cb&nbsp; 2adcf43d221de2f72ba5088dac3a3193219412882df711d095f04e3f5b40767c&nbsp;&nbsp;readme.blacksuit.txt&nbsp;.blacksuit&nbsp;vssadmin delete shadows /all /quiet&nbsp;Mutex: WLm87eV1oNRx6P3E4Cy9&nbsp;

Deep Dive: Exposing Stealthy New BlackSuit Ransomware

Explore how Deep Instinct integrated Deep Instinct Prevention for Applications (DPA) with our internal Microsoft SharePoint and OneDrive and strengthened our security. 

PracticeWhatWePreach_900x400_1.png

Deep Instinct is well-versed in the need for speed. The unique pressures of the startup environment necessitate near-constant communication and filesharing between employees and our eco-system of partners to meet the needs of our customers. Those files need to be two things: secure and speedy.&nbsp;&nbsp;
To address our needs, we’ve developed the capability to integrate <a href="https://www.deepinstinct.com/prevention-for-applications">Deep Instinct Prevention for Applications (DPA)</a> with our internal Microsoft SharePoint and OneDrive. Let’s look at what this means for us at Deep Instinct and how you can benefit from the same integration.&nbsp;
Exciting things first: this integration isn’t theoretical — it's already live for Deep Instinct and is delivering four key benefits that help us achieve more as a company:&nbsp;&nbsp;
<ul>
 <li>Real-time threat prevention&nbsp;</li>
 <li>Event-driven actions&nbsp;</li>
 <li>Seamless user experience&nbsp;</li>
 <li>Privacy&nbsp;</li>
</ul>
These benefits accelerate our already fast-paced environment and help safeguard the file sharing capabilities we rely on. Now we can be certain when we send or receive files via SharePoint or OneDrive, they’re not malicious.&nbsp;&nbsp;
<h5>Real-Time Threat Prevention&nbsp;</h5>
By integrating Deep Instinct Prevention for Applications with our SharePoint and OneDrive deployments, we scan and classify every file in the environment, quickly quarantining malicious files and stopping them in their tracks. (Of course, those malicious files are coming from outside our organization; we use <a href="https://www.deepinstinct.com/endpoint-security" target="_self">Deep Instinct Prevention for Endpoints</a> to ensure we're not the ones spreading malware.)
Because the scan process happens in near real time, users sharing and receiving files won’t notice the it taking place. Instead of waiting for a file to be scanned and returned, interrupting the flow of work, files scanned by DPA are available immediately, when we need them.
Regardless of size, DPA integrated in your organization would function much the same. It would give you the same real-time threat prevention capabilities without disrupting workflows. In addition to the regular benefits of a Deep Instinct deployment, your organization would no longer need to rely on inconsistent, cumbersome, and slow tools or worry about blind spots in the data estate. One of our biggest customers scans billions of files a month across their organization in a “real-time” data/file collaboration use case. Deep Instinct works on a huge scale.&nbsp;
<h5>Decide How You Defend&nbsp;</h5>
We see the efficacy of this integration every day at Deep Instinct. Clarity into file delivery and scanning gives us peace of mind, while automatic deletion and notification streamlines the security process – still letting people know why a file may not have arrived.&nbsp;
Rather than introducing a laborious identification and remediation process, users can choose to allow Deep Instinct to automatically delete malicious files and notify the recipient, or just issue an alert without deleting the file. Instead of waiting for a breach to happen or leaving you in the dark about the status of a file you’ve requested, this method empowers you to choose your next steps to defend against this attack and the next.
Sole reliance on endpoint security solutions should be a last resort. This integration gives us another layer of security before we have to rely on EDR and prevents bad actors from ever reaching the endpoint in the first place. We keep ourselves safe using the same combination of solutions and tools we use to protect our customers.
And when this integration is combined with <a href="https://www.deepinstinct.com/news/deep-instinct-introduces-dianna">DIANNA, the industry’s first generative AI cyberassistant to provide malware analysis</a> on known and unknown threats, our security teams can easily examine any quarantined and deleted file to determine in seconds why it was flagged, not hours or days.
<h5>Seamless User Experience</h5>
This integration continues to offer the seamless Deep Instinct user experience that only we can offer. It’s an experience we trust and that we’re happy to integrate into our own environment and security posture. The combination of speed, accuracy, and information makes Deep Instinct an invaluable tool for our own teams and accelerates our business processes and yours.
<h5>Privacy</h5>
Deep Instinct is focused on privacy, which is why users are always in control of their own data. Microsoft allows users to “bring your own keys” meaning only the “keyholder” can see the file content. In this case, users control the encryption of SharePoint and OneDrive, not Microsoft. Deep Instinct doesn’t need users to send their data elsewhere to be effective, meaning the chain of custody, encryption, and privacy isn’t broken by a third party. Unlike legacy scanning tools, file provenance can be safeguarded by keeping it within your environment.
The DPA + SharePoint and OneDrive integration is an excellent example of how Deep Instinct implements our products in our own environment. It also illustrates how we can integrate with the same tools your organization already uses to provide a better, safer experience.
Ready to dive deeper? Effective prevention and cybersecurity relies on speed and accuracy. Deep Instinct uses deep learning to prevent threats with more accuracy and speed than any other solution. <a href="https://www.deepinstinct.com/blog/defeat-AI-cyber-threats-with-deep-learning">Learn why deep learning powered threat prevention is at the forefront of the cybersecurity battle</a>.
Security doesn't end with just one tool. Defense in depth is a strategy to keep your organization safe using multiple tools to build an effective wall against breach and attack. <a href="https://info.deepinstinct.com/file-upload-security?_ga=2.109077509.1025104848.1720546918-1577162200.1714240296&_gac=1.238305844.1718135387.EAIaIQobChMIq7m80N3xhQMVc6VaBR19bAn5EAAYASAAEgIJRPD_BwE" target="_self">Explore how Deep Instinct secures your file uploads</a> to see another step you can take to secure your organization.
And if you're ready to take the next step, <a href="https://info.deepinstinct.com/request-a-demo?_ga=2.215978322.475833869.1717446548-1577162200.1714240296&_gac=1.208487718.1716560633.EAIaIQobChMIq7m80N3xhQMVc6VaBR19bAn5EAAYASAAEgIJRPD_BwE">request a demo</a> with one of our knowledgable team to see what Deep Instinct can do for you.

Practicing What We Preach: Preventing Threats in SharePoint and OneDrive

RSCA_Blog_Recap.jpg

<h2>Another exciting, whirlwind <a href="https://www.rsaconference.com/marketplace/search/Deep-Instinct-1632843795585001DKrw" target="_blank">RSA Conference</a> (RSAC) has officially wrapped, and the cybersecurity industry is still buzzing over some of the vendor news over the past week. In case you missed it, here are some of our top highlights and key takeaways from RSAC 2024.</h2><h5>Not All AI is Created Equal: Deep Learning in the Spotlight</h5>Generative AI was a hot topic of discussion at RSAC and numerous vendors showcased new capabilities and implementations. But, despite all the excitement, it’s important to note that not all AI is created equal. Our Deep Instinct leadership team spent time with customers, prospects, press, and industry peers to raise greater awareness of our differentiated deep learning (DL) cyber capabilities. In contrast to many machine learning (ML) tools, our technology uses a far more sophisticated set of algorithms that traditional ML models cannot match – which is what makes our <a href="https://www.deepinstinct.com/platform" target="_self">Predictive Prevention Platform</a> so effective.From a media breakfast panel on the topic, to more intimate one-on-one conversations, our team was intent on evangelizing how the only way to effectively combat increasingly sophisticated AI-powered cyber threats is with DL.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><a href="https://www.scmagazine.com/podcast-segment/12856-2024-rsac-3"><img asset_uid="blt789c574cea57f38d" alt="Fig 1_RSAC_Carl and Security Weekly.jpg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt789c574cea57f38d/6645438e16e6bf59d758f418/Fig_1_RSAC_Carl_and_Security_Weekly.jpg" width="auto" height="auto" style="text-align: center;"/></a><figcaption style="text-align: center;" style="text-align: center;">Our CIO Carl Froggett explains how DL combats cyber threats during his sit-down podcast interview with Security Weekly.</figcaption></div></figure><h5>Legacy Vendors Tout New AI Promises Based on False Claims</h5>It seemed every vendor felt compelled to promote their newest AI-based offerings, announcing a plethora of AI-related products and advancements, echoing past rushes to adopt and market new tech. While legacy vendors tack on generative AI capabilities to remain relevant, it is not their core competency; they merely use it to augment their existing solution set. In truth it only explains how you were breached. It doesn’t stop it.This short-sighted approach means the next breach will inevitably happen, forcing security teams to respond, over and over again. Instead of preventing incidents, these AI solutions still operate reactively, allowing disruptions to occur before attempting to mitigate the damage. This “assume breach” mindset is outdated and ineffective, contributing to industry fatigue and defender burnout.Cybersecurity buyers are jaded and skeptical. They’ve been burned before and can see that innovation is lacking. <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity?_ga=2.51158817.941771334.1715708232-1517144758.1706129447" target="_self">Basic ML</a>, the type of technology nearly all vendors leverage and promote, cannot keep pace with rapidly evolving AI-powered threats, leaving investments feeling stale almost immediately after purchase.According to Gartner, global IT spending in 2024 is set to grow by 8% to $5.1 trillion, with 80% of CIOs planning to increase cybersecurity budgets to $215 billion – a 14.3% increase from the $188 billion spent in 2023. This surge in spending underscores the pressing need for more effective solutions.Here’s the grim truth: 2023 was the worst year on record for defenders, with ransomware payments hitting an all-time high of over $1.1 billion – and we’re on pace to break that mark this year. Despite spending the most as an industry, by any measure, we had the worst year ever. It’s time to wake up and realize our current methods are not working. The cybersecurity community needs to move away from the traditional reactive approach and turn to one rooted in prevention.<h5>Meet DIANNA, the Industry’s Only Prevention-First AI Cyber Companion</h5>In the lead up to RSAC, <a href="https://www.deepinstinct.com/dianna-ai-cyber-companion" target="_self">Deep Instinct’s Artificial Neural Network Assistant (DIANNA)</a> made its grand debut as the industry’s first DL-based cybersecurity companion to provide explainability into unknown threats. DIANNA is like having a virtual team of malware analysts and incident response experts that provide security teams with deep analysis into known and unknown attacks, explaining the techniques of attackers and behaviors of malicious files. What takes a senior SOC analyst hours using multiple tools, DIANNA does in seconds. Our new offering was also featured in CRN’s list of "<a href="https://www.crn.com/news/ai/2024/10-hot-ai-cybersecurity-tools-at-rsac-2024?page=10" target="_blank">10 Hot AI Cybersecurity Tools At RSAC 2024</a>.”No other technology vendor on the market today can replicate this level of analysis and explainability, further underscoring our prevention-first approach to cybersecurity. Given its uniqueness, DIANNA was the talk of the town at our busy RSAC booth.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltcc1a937c79745430" alt="Fig 2_RSAC_Deep Instinct Booth.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcc1a937c79745430/6645438f16e6bf2bf558f41c/Fig_2_RSAC_Deep_Instinct_Booth.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">The Deep Instinct Team on the floor at RSAC.</figcaption></div></figure>RSAC made it clear – Deep Learning is the answer to the question of how to predict and prevent the next cyber threat, before it becomes a problem. Deep Instinct can help organizations adopt a proactive, prevention-first approach to cybersecurity, leaving the “assume breach” mindset of EDR in the past once and for all.Want to see DIANNA and the Deep Instinct Prevention Platform for yourself? <a href="https://info.deepinstinct.com/request-a-demo" target="_self">Request a demo</a>.

RSAC Reflections: AI Takes Center Stage, But Deep Learning Reigns Supreme

DI_Uncorking Old Wine_TRT

Uncorking Old Wine: Zero-Day from 2017 + Cobalt Strike Loader in Unholy Alliance

DI_Threat_Research_Team_Blog_930x400.png

DarkBeatC2: The Latest MuddyWater Attack Framework

DI_Trellix_Blog.png

<h2>Deep Instinct wins in efficacy, scalability, speed, and total cost of ownership</h2>Enterprise data storage has become a lucrative attack vector for cybercriminals. The explosive growth of data, especially for large financial institutions that have deep stores of sensitive material, has made them attractive targets. Banks face numerous challenges in securing their storage environments, including the following:<ol><li>An ever-evolving threat landscape: Cybercriminals are constantly developing new and more sophisticated methods to infiltrate storage systems, particularly with the emergence of generative AI and LLM-aided malware tools.</li><li>Performance and latency issues: Traditional security solutions often struggle to efficiently scan large volumes of data without impacting system performance and causing unacceptable latency.</li><li>High infrastructure costs: Infrastructure costs can be expensive because of the sheer number of servers required to scan storage data.</li><li>Complexity of deployment and management: Implementing and managing storage security solutions can be cumbersome, especially when using products not purpose-built for the task.</li></ol>Deep Instinct, a leading provider of <a href="https://www.deepinstinct.com/why-deep-instinct">deep learning-based cybersecurity solutions</a>, recently had the opportunity to prove the value of its data storage protection capabilities to a top-five global bank facing these challenges. The bank needed a solution to secure its network attached storage (NAS) against the growing threat of ransomware and other malware. Deep Instinct’s prevention-first approach was especially intriguing.<h5>Bank puts Deep Instinct and Trellix head-to-head</h5>They evaluated <a href="https://www.deepinstinct.com/prevention-for-storage">Deep Instinct Prevention for Storage (DPS)</a> head-to-head against the incumbent, Trellix ENS (Endpoint Security). Trellix had been struggling to complete scans within designated maintenance windows, and the bank wanted to reduce its total infrastructure spend from running over 3,200 scanning servers while strengthening overall storage security.<blockquote>The bank compared DPS and Trellix across several key criteria: efficacy, scalability, scan speed, ease of deployment &amp; operation, and TCO. The evaluation used the latest versions of both products under identical conditions — the same hardware, network speed, and data set.</blockquote>Here are the results of the comparison.Efficacy: In the evaluation, Deep Instinct prevented &gt;99% of known and unknown threats across multiple file types and sizes. Trellix, on the other hand, had much lower efficacy. Additionally, Deep Instinct had a significantly lower false positive rate, enabling the bank’s security team to focus on real threats instead of chasing false positives.Scalability/Speed: DPS outperformed Trellix in terms of performance and scan speed, scanning files ~10x faster, on average. This is a significant advantage in network attached storage environments with inherent latency, as our local deep learning models don’t require cloud calls, making it extremely efficient. DPS’s remarkable speed enables full-volume scans that weren’t feasible with Trellix.Ease of Deployment: The bank gave high marks to DPS for ease of deployment and operation because it is purpose-built for storage security. This includes streamlined implementation and management, intuitive policy configuration, scan stats, and visibility. In contrast, Trellix ENS is essentially an endpoint security product repurposed for storage, making deployment and management cumbersome.Total Cost of Ownership: Based on the performance data, the bank determined that it could secure its storage environment with ~500 DPS servers versus the ~3,200 required by Trellix, an astonishing reduction of ~2,700 servers while offering superior, prevention-first cybersecurity. This reduction has a significant ROI upside — worth millions in infrastructure and licensing costs.<h5>The switch to Deep Instinct</h5>Upon completion of the head-to-head evaluation, the choice was clear: the bank decided to replace its Trellix solution and standardize on Deep Instinct Prevention for Storage across its NAS infrastructure.Here’s why. DPS is tough to beat for organizations securing their storage systems and data against known and unknown threats without compromising performance or driving up costs. It is purpose-built for storage and <a href="https://www.deepinstinct.com/why-deep-instinct">powered by a static analysis engine based on deep learning</a>, delivering unmatched efficacy, speed, efficiency, and ease of use.The hype around Deep Instinct’s cyberstorage offering is real — and is now validated in one of the world's largest and most demanding enterprise environments.<a href="https://info.deepinstinct.com/request-a-demo" target="_self">Request a demo</a> with us to see it for yourself.

Deep Instinct vs. Trellix: A Banking Giant Cyberstorage Bakeoff

Blog Image - Not All AI is Equal

<h2>Preventing Cyber Threats Requires Deep Learning, Not Just AI</h2>The rapid advancement of artificial intelligence (AI) is fundamentally reshaping the cybersecurity landscape. On one hand, AI-powered tools hold tremendous potential for automating threat detection and making security teams more efficient. However, these same technologies also empower threat actors to create increasingly sophisticated and hard-to-detect attacks. Organizations now face a critical challenge: leveraging “good” AI while also defending against this new breed of “bad” AI.On the positive side, AI can automate threat monitoring, reduce human error, and give time back to security operations (SOC) teams who are underwater chasing alerts, making prevention and detection more effective and efficient. Recent reports found that false positives from antiquated cybersecurity tools significantly strain these team members’ time, accounting for <a href="https://www.deepinstinct.com/voice-of-secops-reports">over two working days of lost productivity</a> per week.Conversely, AI makes it much easier for bad actors to create and manipulate malware that continuously changes to evade detection from traditional cyber tools – like <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">legacy Anti-Virus (AV)</a> – and steal sensitive data. According to the <a href="https://www.verizon.com/business/resources/reports/dbir/#industry-reports">Verizon 2023 Data Breach Investigation Report</a>, the success rate for attacks has escalated to more than 30% due to threat actors’ use of AI. These advancements in attack methods and the harsh realities of AI are making existing security measures obsolete.The potential for unlocking competitive advantage led <a href="https://www.deepinstinct.com/voice-of-secops-reports">69% of organizations</a> last year to adopt generative AI tools. However, with so much on the line, organizations need to understand the risks and limitations of AI and what’s required to get ahead of adversaries and predict advanced cyber threats.<h5>Evaluating the Challenges and Limitations of AI</h5>With the widespread availability of generative AI, new cyber threats are emerging daily, and much faster than in previous years. Recent examples include hyper-realistic deepfakes and phishing attacks. Threat actors are using tools like ChatGPT to craft well-written and grammatically correct emails, videos, and images that are difficult for spam filters and readers/viewers to catch. We’ve seen popular reports of deepfakes using high-profile figures such as <a href="https://streaklinks.com/BwzsOuG8vB-hEI-DrQZ7iCcv/https%3A%2F%2Fapnews.com%2Farticle%2Ffact-check-kelly-clarkson-weight-loss-gummies-702026826728%23%3A~%3Atext%3DCLAIM%253A%2520A%2520video%2520on%2520Kelly%2Cpromotions%2520for%2520the%2520diet%2520product.?email=kjohnson%40inkhouse.com">Kelly Clarkson</a>, <a href="https://fortune.com/2019/06/12/deepfake-mark-zuckerberg/">Mark Zuckerberg</a>, and <a href="https://fortune.com/2024/01/30/ai-policing-taylor-swift-porn-deepfakes-porn/">Taylor Swift</a>. We also saw <a href="https://www.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html">a hacker posing as a CFO</a> trick a finance worker at a multinational firm into transferring $25 million.Concerns with the use of large language models extend beyond phishing and social engineering techniques. There are widespread concerns about the unintended consequences of companies using these generative AI tools in typical business scenarios. For example, after a recent <a href="https://www.forbes.com/sites/siladityaray/2023/05/02/samsung-bans-chatgpt-and-other-chatbots-for-employees-after-sensitive-code-leak/?sh=73e2b17f6078">Samsung</a> breach, the company banned ChatGPT and other AI-based tools among its employees to cut back on potential security gaps if the technology – and the sensitive data shared on these platforms – were to fall into the wrong hands. In the Samsung case, a crackdown occurred after an accidental leak of sensitive internal source code was uploaded to ChatGPT by an engineer.We’re seeing similar complications with threat actors using tools like FraudGPT, WormGPT, and EvilGPT opening advanced attack techniques up to a broader audience of less sophisticated users. With these tools, a cybercriminal can perform an array of tasks to write new malware code, reverse engineer existing code, and identify vulnerabilities to generate novel attack vectors.&nbsp;As threat actors use AI to make their attacks smarter, stealthier, and quicker, we’ve seen more and more organizations deploy new solutions that tout AI capabilities. However, <a href="https://www.deepinstinct.com/blog/are-your-cybersecurity-vendors-really-fighting-ai-with-ai-">not all AI is created equal</a>, creating limitations with many solutions that claim to be powered by AI. Advanced adversarial AI can’t be defeated with basic machine learning (ML), the type of technology most vendors are leveraging and promoting (and calling it AI, generically). The cybersecurity community needs to shift away from a reactive, “assume breach” approach and turn to one focused on prevention.&nbsp;Furthermore, we’ve reached the notable <a href="https://www.idc.com/getdoc.jsp?containerId=US49349323">end of the Endpoint Detection and Response (EDR) honeymoon period.</a> EDR is too outdated, reactive, and ineffective against today’s sophisticated, adversarial AI-driven cyber threats. Most cybersecurity tools leverage ML models that present several shortcomings. For example, they are trained on limited subsets of available data (typically 2-5%), offer just 50-70% accuracy with unknown threats, and introduce an avalanche of false positives. ML solutions also require heavy human intervention and are trained on small data sets, exposing them to human bias and error.We’ve entered a pivotal time in the evolution of cybersecurity, one that can only be resolved by fighting AI with better, more advanced AI.<blockquote>“In this new era of generative AI, the only way to combat emerging AI threats is by using advanced AI – one that can prevent and predict unknown threats. Relying on antiquated tools like EDR is the equivalent of fighting a five-alarm fire with a garden hose. Assuming breach has been an accepted stance but the belief that EDR can get out ahead of threats is simply not true. A shift toward predictive prevention for data security is required to remain ahead of vulnerabilities, limit false positives, and alleviate security team stress.” -- <a href="https://www.deepinstinct.com/voice-of-secops-reports" target="_self">Voice of SecOps, 4th Edition 2023, The Power of Deep Learning</a></blockquote><h5>The Power of Deep Learning</h5>Due to AI advancements, we can now prevent ransomware and other cyber attacks rather than detect and respond to them afterward. Deep Learning (DL) is the most advanced form of AI and is the only way to deliver true prevention. When applied to cybersecurity, DL trains its neural networks to autonomously predict threats to prevent known and unknown malware, ransomware, and zero-day attacks.Traditional AI can’t keep pace with the sheer volume of data entering an organization. It only leverages a portion of the data to make high-level business decisions. With DL, data is never discarded, making it much more accurate and enabling it to predict and prevent known and unknown threats quickly.There are less than a dozen major DL frameworks in the world – and only one is dedicated fully to cybersecurity: the <a href="/platform" target="_self">Deep Instinct Prevention Platform</a>. It continuously <a href="https://www.deepinstinct.com/blog/congratulations-now-smarter-than-ever-we-got-a-new-brain">trains</a><a href="https://www.deepinstinct.com/blog/congratulations-now-smarter-than-ever-we-got-a-new-brain"> itself on millions of raw data points</a>, becoming more accurate and intelligent over time. Because DL models understand the building blocks of malicious files, it makes it possible to implement and deploy a predictive prevention-based security solution. This allows savvy cybersecurity teams to shift from an outdated “assume breach” mentality to a predictive prevention approach.Only deep learning has the power to match the speed and agility of this next-gen adversarial AI.

Watch Deep Learning Explainer

AI, Machine Learning and Deep Learning: What They Are and Why They Are Different?

Deep Instinct Provides Broad Protection Without Human Intervention

Solution-EPP-Reduce-Risk-Deep-Learning.svg

<h5>AI and the End of the "Assume Breach" Mentality</h5>2023 was the year when we saw AI burst onto the scene; 2024 will be the year AI alters the way threat actors create and deploy cyber-attacks, forcing organizations to emphasize prevention.At Deep Instinct, we firmly believe that the “assume breach” mentality is ineffective and extremely destructive to organizations. Businesses can – and should – protect themselves from advanced forms of attacks by leveraging a more sophisticated form of AI, such as deep learning, to fight against AI-driven threats.For more information about <a href="https://www.deepinstinct.com/blog/mit-explores-how-deep-learning-is-transforming-cybersecurity">how deep learning is transforming cybersecurity</a>, read our blog post.

Announcing DSX for Cloud - Amazon S3, natively integrated zero-day data security for AWS S3.

Blog

Recent Blog Posts

SHIM Me What You Got: Manipulating Shim and Office for Code Injection

"Hacker Summer Camp" Recap: Black Hat, DEF CON, and the Growing AI Arms Race

Would Have, Could Have, Should Have: Dissecting the 2023 MGM Hack

Deep Dive: Exposing Stealthy New BlackSuit Ransomware

Practicing What We Preach: Preventing Threats in SharePoint and OneDrive

RSAC Reflections: AI Takes Center Stage, But Deep Learning Reigns Supreme

Uncorking Old Wine: Zero-Day from 2017 + Cobalt Strike Loader in Unholy Alliance

DarkBeatC2: The Latest MuddyWater Attack Framework

Deep Instinct vs. Trellix: A Banking Giant Cyberstorage Bakeoff

Why All AI Isn’t Created Equally in Cybersecurity

Deep Instinct DSX

Use Cases

Resources

Company

Quick Links