di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

Join Deep Instinct Security Researcher Eliran Nissan as he exposes a powerful new DCOM lateral movement attack that remotely writes custom payloads to create an embedded backdoor.

DCOM_1200x627.jpg

Forget PSEXEC: DCOM Upload & Execute Backdoor

Follow along with David Trigano, Deep Instinct's Director of Product Management, as he explains how DSX for Cloud - Amazon S3 fills the gaps in cloud data security left by legacy tools.

Shield_full.png

I have dedicated my career to safeguarding organizations’ most critical data assets. Throughout this journey, I’ve observed a recurring challenge: many organizations underestimate the risks of cloud storage, assuming their cloud providers secure their data in the cloud. The reality is that cloud providers protect their infrastructure, not customers’ data. They also don’t protect against misconfigurations, insufficient access controls, or overlooked permissions that leave sensitive data vulnerable. These gaps present significant risks from external attackers or insider threats, underscoring the need for a proactive, shared-responsibility approach to cloud security.Cloud storage is a vital data management tool and a significant target for cybercriminals, positioned in the middle of a quickly escalating technological battle. As the data storage market evolves and rapidly expands, organizations face increasing challenges from exponential data growth and a deluge of zero-day attacks generated using Dark AI. And the native security capabilities of cloud storage providers aren’t enough to stop these sophisticated threats.<h5>The Issue with Legacy Cybersecurity Tools</h5>Amazon S3, the world’s largest cloud storage provider, dominates the enterprise data storage market. With this massive scale comes critical vulnerabilities for organizations, especially when using <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">legacy cybersecurity tools</a> that can’t keep pace. These tools foster a false sense of confidence and leave blind spots. For example, attacks like malware time-bombs are designed to evade detection by traditional signature-reliant tools. They can sit undetected in storage until triggered, catching most security tools off guard. Simultaneously, a flood of AI-generated attacks is exposing any gap in the perimeter, and legacy tools aren’t advanced enough to stop them. The pressure is mounting. The danger is growing.&nbsp;Fortunately, there is a path forward.<h5>Solving a Massive Problem: Our Work with Amazon S3</h5>Introducing Deep Instinct’s <a href="https://www.deepinstinct.com/dsx/dsx-cloud-amazon-s3">Data Security X (DSX) for Cloud – Amazon S3</a>, a purpose-built solution providing Zero-Day Data Security (ZDDS) to defend Amazon S3 cloud storage environments against threats and preemptively neutralize malware.After a quick and easy deployment, DSX for Cloud – Amazon S3 scans files at rest or in motion before they can execute. An industry-best scan speed of &lt;20ms per file allows for scanning, categorization, quarantine of malicious files, and immediate alerts to security teams. And by reducing security events and minimizing infrastructure costs, DSX for Cloud contributes to a lower total cost of ownership (TCO). Best of all, it’s certified by AWS and works natively with Amazon S3.Importantly, these scan speeds leverage our <a href="https://www.deepinstinct.com/dsx-brain">deep learning framework</a>, which features &gt;99% efficacy against known and unknown threats and a &lt;0.1% false positive rate. Instead of just comparing files to a checklist of known threats, DSX for Cloud examines every file and determines if it's malicious, even if the code has never been seen before, by any service. With lightning-fast speeds, it can quickly scan your full S3 storage environment – something legacy tools can’t do – and scale with your storage needs. Put another way, DSX for Cloud effectively stops threats that other tools can’t find.<h5>Fighting AI with the Best AI: Available Now</h5>In the fight against zero-day threats and unknown malware, <a href="https://www.deepinstinct.com/dsx/dsx-cloud-amazon-s3" target="_self">DSX for Cloud – Amazon S3</a> is the only solution on the market capable of preventing Dark AI-generated malware, regardless of the novelty or volume of attacks. The ability to prevent attacks is a necessity in high data volume environments. Deep Instinct levels the playing field, enabling you to fight AI with better AI.DSX for Cloud – Amazon S3 is now available in the <a href="https://aws.amazon.com/marketplace/seller-profile?id=seller-2vxjapmpeczok" target="_self">AWS Marketplace</a>, enabling buyers to integrate the payment process with their existing AWS billing system and streamline their procurement experience.

Leveraging Deep Learning for Zero-Day Data Security in Cloud Storage

Deep Instinct security researchers Ron Ben-Yizhak and David Shandalov share the research they presented at DEF CON 32: an in-depth exploration of two different attack methods. Explore the methods they presented and follow along as they explain how they work.

DEFCON Speaker Image.jpg

SHIM Me What You Got: Manipulating Shim and Office for Code Injection

Last week, Black Hat and DEF CON took Las Vegas by storm and Deep Instinct was there to join the fun. It was an exhilarating week, packed with networking events, speaking sessions, and a lively crowd. Here are our main takeaways and notable highlights you may have missed.

Blackhat_930x400_3.png

<h5>As Vendors Continue to Tout “AI” Capabilities, Let’s Talk About Real AI</h5>Unsurprisingly, artificial intelligence (AI) continued to dominate onsite conversations, and similar to the RSA Conference earlier this year, both legacy and early-stage cybersecurity vendors felt compelled to tout “AI capabilities” in their marketing and booth collateral. But not all AI is created equal, and it sparked a conversation about the differences and nuances in AI technologies.Many cybersecurity vendors promoted generative AI capabilities that are tacked onto existing technologies, a marketing tactic used to remain relevant in today’s AI conversations. But AI is not their core competency, and it never will be – at the end of the day, their AI explains how you were breached, but doesn’t prevent it.We challenged booth visitors to ask vendors the hard-hitting questions about AI: Is it built on an archaic framework? Can it be air gapped? Is it the most advanced form of AI (deep learning), or just <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity?_ga=2.51158817.941771334.1715708232-1517144758.1706129447">basic ML</a>? The answers will tell you everything you need to know about vendors’ AI promises.Deep Instinct is different from any other vendor in the market. Our deep learning (DL) cybersecurity framework prevents and explains unknown zero-day threats, so that security teams can both stop a breach before it happens and learn to predict the next attack. We’re a zero-day data security platform using the most advanced form of AI – developed before AI became a hot topic – to protect storage, applications, and endpoints, so your data remains secure regardless of where it resides.<h5>Proven Prevention: Deep Instinct Wins CRN Award During Black Hat</h5>During Black Hat, <a href="https://www.deepinstinct.com/prevention-for-storage">Deep Instinct’s </a><a href="https://www.deepinstinct.com/prevention-for-storage">Prevention for Storage (DPS)</a> product was recognized by CRN in its <a href="https://www.crn.com/news/channel-news/2024/the-2024-tech-innovator-awards">2024 Tech Innovator Awards</a>. From more than 320 applicants, DPS rose to the top. DPS provides data storage threat prevention across NAS and cloud storage environments, preventing &gt;99% of zero-day exploits, ransomware, and unknown threats in these storage repositories.<h5>Highlighting Our Two Speaking Sessions at Black Hat and DEF CON</h5>Capping off a memorable week were our two speaking sessions during Black Hat and DEF CON. First, our CIO and CISO, Carl Froggett, joined our VP of Global Sales Engineering, Brian Black, in a Black Hat session titled, “<a href="https://www.blackhat.com/us-24/sponsored-sessions/schedule/index.html#the-future-of-cybersecurity-embracing-prevention-first-strategies-in-the-age-of-edge-ai-42167">The Future of Cybersecurity: Embracing Prevention-First Strategies in the Age of Edge AI</a>.” The duo discussed the new era of localized large language models (LLMs) amid the advent of neural processing units (NPUs) and neural engines in devices from Qualcomm and Apple. They also walked attendees through the implications of edge AI and localized LLMs, while highlighting the urgent need for prevention-focused approaches to safeguard against these evolving threats.Then during DEF CON, Deep Instinct researchers Ron Ben-Yizhak and David Shandalov presented “<a href="https://defcon.org/html/defcon-32/dc-32-speakers.html">SHIM Me What You Got - Manipulating Shim and Office for Code Injection</a>,” introducing a novel and stealthy technique to apply malicious shims on a code injection process that does not require registry modification or SDB files and leaves no traces on the disk.“Hacker summer camp” is always an exciting time, but what made this year even more memorable was the meteoric rise in AI visibility, and discussions centered on how to fight AI with better AI. The answer is deep learning. See for yourself what’s possible by <a href="https://info.deepinstinct.com/request-a-demo?_ga=2.123317326.470551219.1723466942-635130100.1705001786&_gac=1.88354281.1722959687.CjwKCAjwk8e1BhALEiwAc8MHiIGA96vDs3I1qyodZhPZHrwQ9pTgxWo5NEpFFArfiOucUXEX-lSRCRoCAdcQAvD_BwE">requesting a Deep Instinct demo today</a>.

"Hacker Summer Camp" Recap: Black Hat, DEF CON, and the Growing AI Arms Race

Follow along with Deep Instinct on a postmortem of the 2023 MGM attacks. Learn what went wrong, what could have been done to prevent the attack, and what having Deep Instinct would have changed.

MGM_930x400.png

In late 2023, MGM Resorts experienced the beginning of a ransomware cyberattack that would cost them nearly $100M USD. The multi-stage attack was launched by ShatteredSpider, a subgroup of AlphV, and progressed quickly from infiltration to exploitation. By taking advantage of social engineering tactics, injection, and inadequate security practices, ShatteredSpider pulled off one of the highest profile attacks in years. And it didn’t have to happen.&nbsp;<h5>The MGM Attack&nbsp;</h5>In the first phase of the attack, ShatteredSpider (<a href="https://therecord.media/mgm-hack-teenager-arrest-britain">who recently had a 17-year-old member arrested</a> in connection with the MGM hack) used LinkedIn to gather information about an MGM employee and then impersonated that employee on a call to MGM’s IT helpdesk. Using that access, ShatteredSpider was able to convince the helpdesk to grant them access, bypassing every existing security control. The attackers then quickly established persistence, installed sniffers, and exfiltrated key admin credentials for Azure, Windows, and Okta. MGM was, at this point, a very securely stuck fly in ShatteredSpider’s web. Because the credentials had already been exfiltrated, MGM’s subsequent attempt to stop the cyberattack by shutting down critical infrastructure was too little, too late.&nbsp;As soon as services came back online, ShatteredSpider was able to use the exfiltrated credentials and persistence to attack their main objective. They identified critical MGM business services running on VMware with 100 ESXi Hypervisors. Hitting this one target caused massive disruption to their hotel reservation systems, gambling, slot machines, digital key room access, and so much more - achieving their desired outcome. Having established Internet communication to their cloud services, they exfiltrated MGM customer data/PII, and deployed ransomware to 100 ESXi VMware Hypervisors: MGM’s entire Virtual Server and some virtual desktop environments. That, kids, is the ballgame.&nbsp;<h5>Rewriting a Successful Attack&nbsp;</h5>Learning the right lessons after a cyberattack is an important part of both remediation and preparation for the next attack. When a high-profile attack like MGM happens, the entire cybersecurity industry gets the chance to analyze, dissect, and ultimately battle game the attack to see what would have worked and what wouldn’t. Everyone should be admitting the same thing about the first phase of the attack: there is not a policy in place, a training you could give, or a tool available that can remove the human element from an attack. The tools malicious actors use are complex, effective, and malleable. With the rise of AI, they’ve only become more dangerous. AI voice and video impersonations are an excellent example of this danger.&nbsp;Initial infiltration was just step one. The real battle took place in the hours and days following the vishing. The attackers installed sniffers and compromised critical infrastructure. The strategy of ‘detect and respond’ falls short here: how much time does it take to detect an attack and how much more time does it take to adequately respond?&nbsp;It’s during that ‘detect and respond’ period that Deep Instinct could have been a difference maker, not just slowing the attack, but preventing it altogether. ShatteredSpider were smart about their attack. The payload was delivered directly to the hypervisor layer; it wasn’t staged on end points, in storage, or delivered via email, thus avoiding several detection and prevention layers. This leaves two points to prevent the attack: the hypervisor layer and the internet delivery. In our tests, Deep Instinct was able to secure both points.&nbsp;<a href="https://www.deepinstinct.com/endpoint-security" target="_self">Deep Instinct EPP</a> running on the hypervisor layer detected and quarantined the payload before it could execute. Similarly, <a href="https://www.deepinstinct.com/prevention-for-applications" target="_self">Deep Instinct Prevention for Applications (DPA)</a> integrated into the internet layer via API or ICAP would have also prevented the payload.&nbsp;&nbsp;<h5>Debrief, DIANNA, Do-Over&nbsp;</h5>MGM lost control of their situation the moment the social engineering attack was successful. Their lack of hypervisor partition, secondary credentials, scanning capabilities, and other industry-standard security controls meant that once the attackers had established persistence and exfiltrated admin credentials they would have free run of the place. Having those defenses would have at least hardened MGM as a target but they would not necessarily have prevented the attack completely.&nbsp;Unfortunately, much of the cybersecurity industry’s value-prop isn’t true prevention, it’s disaster mitigation. The biggest success of most tech stack configurations would be that they stopped the bleeding. This cybersecurity philosophy can be cynically distilled into one key question: How much are you willing to lose? At a large enterprise like MGM, even successfully defending against a cyberattack can be costly.&nbsp;Where Deep Instinct makes a difference is the focus on prevention. Barring the human element that allowed access to critical infrastructure, Deep Instinct DPE and DPA would have prevented the actual substantive parts of the MGM attack. The bleeding didn’t have to happen, and the “success” of only a small number of accounts being affected didn’t have to happen. The malicious payload used in the MGM attack could have been immediately caught, quarantined, and deleted pre-execution when scanned by Deep Instinct. Using DIANNA, MGM could have immediately figured out why the payload was caught and deleted.&nbsp;<a href="https://www.deepinstinct.com/news/deep-instinct-introduces-dianna">DIANNA, our generative AI powered cybersecurity companion</a>, was able to tell us nearly instantly (okay, seven seconds) in real language why the Alphv ransomware was malicious, including the markers it used to make that determination. In short order we had both stopped the attack and developed a framework for investigating the attack. In addition to stopping the attack, there are other key benefits for some groups:&nbsp;<ul><li>SOC Teams: In terms of both efficacy and stress, SOC teams are a main beneficiary of effective prevention-first cybersecurity. Given rising rates of burnout among SOC professionals, tools that support their mission are invaluable. Read more about the rates of burnout among SOC professionals in our <a href="https://www.deepinstinct.com/voice-of-secops-reports">2024 Voice of SecOps report</a>.&nbsp;</li></ul><ul><li>MGM: Better cybersecurity reduces organizational risk and increases confidence. A prevention-first approach eliminates the death-by-a-thousand-cuts damage to organizational reputation and budget caused by the current cybersecurity paradigm.&nbsp;</li></ul><ul><li>MGM Customers: Having personal data stolen is incredibly dangerous for consumers and puts them at risk for fraud, identity theft, and other targeted attacks. Not allowing a breach to occur at all increases confidence and mitigates the legal and personal ramifications of allowing personal data to be stolen.&nbsp;</li></ul>Novelty is a weapon. Most of the time it’s a very effective one. The introduction of deepfakes has revolutionized social engineering attacks. Malicious AI has similarly revolutionized cyberattacks. There are more methods than ever for bad actors to gain access to secure systems. AI-powered mutations allow attacks to constantly refresh and renew themselves in novel ways to evade existing cybersecurity. To keep up, defenders need tools that make them equally responsive.<a href="https://info.deepinstinct.com/request-a-demo">Get a demo</a> to see the power of a prevention-first approach for yourself.&nbsp;

Would Have, Could Have, Should Have: Dissecting the 2023 MGM Hack

Take a deep dive into BlackSuit ransomware and explore its capabilities, deployment, and some current targets. Explore how Deep Instinct is able to detect and prevent BlackSuit from taking advantage of your data.

BlackSuit_900x400_2.png

Five weeks ago, the KADOKAWA corporation began to experience service outages affecting multiple websites. The outages spread to other operations and were identified as a <a href="https://www.bleepingcomputer.com/news/security/blacksuit-ransomware-gang-claims-attack-on-kadokawa-corporation/">ransomware attack</a> by the BlackSuit ransomware group. BlackSuit claimed responsibility and threatened the public release of stolen information on July 1st unless their ransom demands were met.&nbsp;&nbsp;BlackSuit's ransomware is very similar to the Royal ransomware strain, which itself is considered the successor to the notorious Conti group. This suggests potential connections or shared developers. This connection can be explained in more detail in some of our older material that has been published on the subject: we examined both <a href="https://info.deepinstinct.com/conti-leaks-cyber-threat-reports">Conti</a> and <a href="https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence">BlackBasta</a>, a Conti offshoot.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt360d20b0f113f264/6696f82b06a674d134c5a4ee/fig1-blacksuit-victims.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: BlackSuit ransomware victims</figcaption></div></figure>Based on our analysis, we found that Deep Instinct prevents&nbsp;all new Blacksuit Windows Ransomware samples with an eight-month-old brain. Across the industry, however, these samples have a much lower detection rate than earlier sample versions of BlackSuit. As demonstrated in the graph above, that lower detection rate matches the sudden growth of BlackSuit ransomware victims.&nbsp;The samples BlackSuit is using are well designed for infiltration of legacy systems. Let’s take a closer look.&nbsp;<h5>Latest samples analysis:</h5>Newer samples of BlackSuit’s code mainly added additional layers of complications like encoding strings and imported DLLs for Anti-Analysis. They also added a mandatory ID argument to bypass automatic emulation, making the new samples more evasive.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2084d114ec3f8209/6696f82b77a7809e9044a25f/fig2-strings-encryption.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: String decryption</figcaption></div></figure>For example, according to VirusTotal, even though old Blacksuit samples have a high detection rate, the new samples from recent months have a much lower detection rate, indicating significant changes.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5bed08ab64e581fe/6696f82cd0c0ef789ec561b6/fig3-VT-detection-rate.png" width="auto" height="auto" style="text-align: center;max-width: auto;width: auto;height: auto;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Detection rate in VirusTotal of new Blacksuit samples when first submitted</figcaption></div></figure>One of the more impactful changes allowed the threat actor to mask the ransomware as a legitimate part of a known free antivirus, Qihoo 360, including false watermarking. This masking has drastically lowered detection. The ransomware is hidden deep inside the legitimate looking application and only has to be executed with a token in the command line to operate as a ransomware.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteae79a1729b07bfd/6696f82c77a780582d44a263/fig4-embedded-legitimate-urls.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: Embedded URLs</figcaption></div></figure><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4e96f1780d57f20a/6696f82c6c1019fd6f39795e/fig5-fake-metadata.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: Fake Metadata</figcaption></div></figure>The masquerade file is not signed, indicating this is not the real Qihoo application. The functionality post infiltration remained the same as the other new samples, including the same mutex used.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3971600a651708d4/6696f82c79f2042205390cf0/fig6-VT-detectio-rate-stealthy-sample.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: VirusTotal detection rate.</figcaption></div></figure>

The main portion of the executable is nearly identical to Qihoo's real QHAccount.exe file, resulting in security software evasion.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="image003.jpg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5dac21065b6f0d02/66990ac7d316c70da3b3419f/image003.jpg" height="auto" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: Side by side comparison of BlackSuit and Qihoo executables</figcaption></div></figure>Disclaimer: The official Qihoo 360 is not in any way involved with BlackSuit. The masking is the work of bad actors assuming Qihoo’s identity.&nbsp;<h5>Behaviors:</h5>The common behavior shared with all Windows samples didn’t change much and the main functionality remained the same, though some commands have changed:<table><tbody><tr><td>-p&nbsp;</td><td>Specifies the target directory where the ransomware will encrypt files&nbsp;</td></tr><tr><td>-killvm&nbsp;</td><td>Terminates the virtual machine (VM), preventing analysis&nbsp;</td></tr><tr><td>-allfilesEncrypt&nbsp;</td><td>Encrypts all accessible files, maximizing damage&nbsp;</td></tr><tr><td>-networkEncrypt&nbsp;</td><td>Encrypts files on connected network drives, spreading the attack&nbsp;</td></tr><tr><td>-localEncrypt&nbsp;</td><td>Restricts encryption to the local machine storage, limiting immediate impact&nbsp;</td></tr><tr><td>-percentEncrypt&nbsp;</td><td>Encrypts a specified percentage of files, potentially increasing performance&nbsp;</td></tr><tr><td>-demonoff&nbsp;</td><td>Operates in stealth mode, making detection harder&nbsp;</td></tr><tr><td>-list {file}&nbsp;</td><td>A targeted list of files to be included in the encryption process&nbsp;</td></tr><tr><td>-delete&nbsp;</td><td>The ransomware deletes itself after execution, hindering investigation&nbsp;</td></tr><tr><td>-thrcount {number}&nbsp;</td><td>Specifies the number of threads used for encryption, impacting both performance and resource usage.&nbsp;</td></tr><tr><td>-skip {file}&nbsp;</td><td>A list of files to be excluded from encryption&nbsp;</td></tr><tr><td>-noprotect&nbsp;</td><td>Disables self-protection mechanisms, allowing termination of the ransomware&nbsp;</td></tr></tbody></table>&nbsp;The new samples have encoded strings to complicate analysis, and need to be supplied with -id &lt;32 characters&gt;. They can also receive additional instructions, such as:&nbsp;&nbsp;<table><tbody><tr><td>-ep&nbsp;</td><td>(like the previous percentEncrypt) sets a percentage of each file that will be encrypted. Partial encryption&nbsp;</td></tr><tr><td>-path&nbsp;</td><td>Specific directory to encrypt&nbsp;</td></tr><tr><td>-localonly&nbsp;</td><td>(an addition to the previous networkEncrypt) without network drives&nbsp;</td></tr><tr><td>-networkonly&nbsp;</td><td>(an addition to the previous networkEncrypt) without local files&nbsp;</td></tr><tr><td>-aavm&nbsp;</td><td>(like the previous allfilesEncrypt) encrypts everything&nbsp;</td></tr></tbody></table>&nbsp;BlackSuit ransomware also boasts a few other functionalities:&nbsp;<ul><li>Initiates Asymmetric Key Exchange to get the secret encryption key.&nbsp;</li></ul><ul><li>Deletes shadow copies, in order to disable easy local restore:&nbsp;</li></ul><ul><ul><li>vssadmin delete shadow /all /quiet&nbsp;&nbsp;</li></ul></ul><ul><li>Encrypts&nbsp;</li></ul><ul><ul><li>Appends .blacksuit to the encrypted files&nbsp;</li></ul></ul><ul><li>Skips:&nbsp;</li></ul><ul><ul><li>Various file types like executables, drivers, and installers to avoid breaking the system.&nbsp;</li></ul></ul><ul><ul><li>Already encrypted files and the ransom note.&nbsp;</li></ul></ul><ul><li>Eventually, BlackSuit’s ransomware is capable of disabling safe mode and shutting down the system:&nbsp;</li></ul><ul><ul><li>bcdedit /deletevalue {current} safeboot&nbsp;&nbsp;</li></ul></ul><ul><ul><li>shutdown /r /t 0&nbsp;</li></ul></ul><ul><li>Drops ransom note: Usually named readme.blacksuit.txt. The content text is encrypted to avoid signature detection for the ransom note. The note includes a link for communication with the threat actor for ransom negotiations.</li></ul><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt771fca19a69b58a1" alt="fig7-ransom-note.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt771fca19a69b58a1/6696f82de13bf8b63bf84456/fig7-ransom-note.png" width="auto" height="128" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: BlackSuit’s ransom note</figcaption></div></figure><h5>Infection chain</h5>The common initial attack vectors are RDP (possibly with stolen credentials), VPN and firewall vulnerabilities, Office email attachments (Macros), Torrent websites, Malicious ads, and various 3rd-party trojans. And the attackers have also used tools like CobaltStrike, WinRAR, PUTTY, Rclone, Advanced IP Scanner, Mimikatz, and GMER. The variety of attack vectors opens the possibility for infection across a much broader target group, endangering large amounts of data.&nbsp;<h5>Leak and news site</h5>The BlackSuit group operates a news and leak site on the DarkWeb that includes all the known victims of the threat actors. Once the timer for the ransom payment ends, the exfiltrated data is published.&nbsp;Alleged victims of BlackSuit ransomware have their data published under a profile featuring key information about their organization, including industry, number of employees, revenue, and contact information.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Figure 8: An example of an alleged victim's profile on BlackSuit's leak site " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6451cbdff41a7b39/6697d044d0c0efef3ec5697e/fig9-darkweb-leak_redact_WB.png" width="auto" height="auto" style="width: auto; height: auto;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: An example of a victim profile on BlackSuit's leak site</figcaption></div></figure><a href="https://info.deepinstinct.com/request-a-demo">Request a demo</a> to see how Deep Instinct can protect you from BlackSuit ransomware.&nbsp;Explore the BlackSuit IOCs below.<h5>IOCs</h5>f1684fb118d4d8fc56653fcc49e12a659b64c4459ba037fa94f21783235cc6ba&nbsp;dede96fd44c0f78eb79ceb63b898874e8922efc59d8bfb9f86505b1992bc00a3&nbsp; 6a2e454942cfeebb1140e1a28cb05fd49461d07792e97663378399c719fbc9ee&nbsp;79ab73a0e9dd8eac045c00fd1bd172a7f359588901f93c83e6740157eb21e7df&nbsp;7f09c2e35783fca69f0e12f31d767cecf8a98567f2b6f1e2d81d2b2e93fe6307&nbsp;60a9785ec20ec08b6792e304fc4b363abd54b8a7a2945dca9f97ee07783c4759&nbsp;5aeaa5c4f4100b2084814be72a695a5bf4a95fdb8a0c65704523608baa79b726&nbsp;d96ff4b3e188f7ff96ed28c1381a6318dd76bb1fbd6ca02c6ab0236e1c7f35aa&nbsp;3be3a3c2c1abc1d401e845a2b8952f4f3e55b510f3d6c1eb2a4503c7be09bec1&nbsp;90ae0c693f6ffd6dc5bb2d5a5ef078629c3d77f874b2d2ebd9e109d8ca049f2c&nbsp;6ad8215bd6b52d897dcfa0a9829720d0532adc741460ecb4b8f00c4427b6141c&nbsp;8605dec4ae4bd9f51297d1f244d0647bc0637d6ce6a957a5f810c64ae63276cb&nbsp; 2adcf43d221de2f72ba5088dac3a3193219412882df711d095f04e3f5b40767c&nbsp;&nbsp;readme.blacksuit.txt&nbsp;.blacksuit&nbsp;vssadmin delete shadows /all /quiet&nbsp;Mutex: WLm87eV1oNRx6P3E4Cy9&nbsp;

Deep Dive: Exposing Stealthy New BlackSuit Ransomware

Explore how Deep Instinct integrated Deep Instinct Prevention for Applications (DPA) with our internal Microsoft SharePoint and OneDrive and strengthened our security. 

PracticeWhatWePreach_900x400_1.png

Deep Instinct is well-versed in the need for speed. The unique pressures of the startup environment necessitate near-constant communication and filesharing between employees and our eco-system of partners to meet the needs of our customers. Those files need to be two things: secure and speedy.&nbsp;&nbsp;
To address our needs, we’ve developed the capability to integrate <a href="https://www.deepinstinct.com/prevention-for-applications">Deep Instinct Prevention for Applications (DPA)</a> with our internal Microsoft SharePoint and OneDrive. Let’s look at what this means for us at Deep Instinct and how you can benefit from the same integration.&nbsp;
Exciting things first: this integration isn’t theoretical — it's already live for Deep Instinct and is delivering four key benefits that help us achieve more as a company:&nbsp;&nbsp;
<ul>
 <li>Real-time threat prevention&nbsp;</li>
 <li>Event-driven actions&nbsp;</li>
 <li>Seamless user experience&nbsp;</li>
 <li>Privacy&nbsp;</li>
</ul>
These benefits accelerate our already fast-paced environment and help safeguard the file sharing capabilities we rely on. Now we can be certain when we send or receive files via SharePoint or OneDrive, they’re not malicious.&nbsp;&nbsp;
<h5>Real-Time Threat Prevention&nbsp;</h5>
By integrating Deep Instinct Prevention for Applications with our SharePoint and OneDrive deployments, we scan and classify every file in the environment, quickly quarantining malicious files and stopping them in their tracks. (Of course, those malicious files are coming from outside our organization; we use <a href="https://www.deepinstinct.com/endpoint-security" target="_self">Deep Instinct Prevention for Endpoints</a> to ensure we're not the ones spreading malware.)
Because the scan process happens in near real time, users sharing and receiving files won’t notice the it taking place. Instead of waiting for a file to be scanned and returned, interrupting the flow of work, files scanned by DPA are available immediately, when we need them.
Regardless of size, DPA integrated in your organization would function much the same. It would give you the same real-time threat prevention capabilities without disrupting workflows. In addition to the regular benefits of a Deep Instinct deployment, your organization would no longer need to rely on inconsistent, cumbersome, and slow tools or worry about blind spots in the data estate. One of our biggest customers scans billions of files a month across their organization in a “real-time” data/file collaboration use case. Deep Instinct works on a huge scale.&nbsp;
<h5>Decide How You Defend&nbsp;</h5>
We see the efficacy of this integration every day at Deep Instinct. Clarity into file delivery and scanning gives us peace of mind, while automatic deletion and notification streamlines the security process – still letting people know why a file may not have arrived.&nbsp;
Rather than introducing a laborious identification and remediation process, users can choose to allow Deep Instinct to automatically delete malicious files and notify the recipient, or just issue an alert without deleting the file. Instead of waiting for a breach to happen or leaving you in the dark about the status of a file you’ve requested, this method empowers you to choose your next steps to defend against this attack and the next.
Sole reliance on endpoint security solutions should be a last resort. This integration gives us another layer of security before we have to rely on EDR and prevents bad actors from ever reaching the endpoint in the first place. We keep ourselves safe using the same combination of solutions and tools we use to protect our customers.
And when this integration is combined with <a href="https://www.deepinstinct.com/news/deep-instinct-introduces-dianna">DIANNA, the industry’s first generative AI cyberassistant to provide malware analysis</a> on known and unknown threats, our security teams can easily examine any quarantined and deleted file to determine in seconds why it was flagged, not hours or days.
<h5>Seamless User Experience</h5>
This integration continues to offer the seamless Deep Instinct user experience that only we can offer. It’s an experience we trust and that we’re happy to integrate into our own environment and security posture. The combination of speed, accuracy, and information makes Deep Instinct an invaluable tool for our own teams and accelerates our business processes and yours.
<h5>Privacy</h5>
Deep Instinct is focused on privacy, which is why users are always in control of their own data. Microsoft allows users to “bring your own keys” meaning only the “keyholder” can see the file content. In this case, users control the encryption of SharePoint and OneDrive, not Microsoft. Deep Instinct doesn’t need users to send their data elsewhere to be effective, meaning the chain of custody, encryption, and privacy isn’t broken by a third party. Unlike legacy scanning tools, file provenance can be safeguarded by keeping it within your environment.
The DPA + SharePoint and OneDrive integration is an excellent example of how Deep Instinct implements our products in our own environment. It also illustrates how we can integrate with the same tools your organization already uses to provide a better, safer experience.
Ready to dive deeper? Effective prevention and cybersecurity relies on speed and accuracy. Deep Instinct uses deep learning to prevent threats with more accuracy and speed than any other solution. <a href="https://www.deepinstinct.com/blog/defeat-AI-cyber-threats-with-deep-learning">Learn why deep learning powered threat prevention is at the forefront of the cybersecurity battle</a>.
Security doesn't end with just one tool. Defense in depth is a strategy to keep your organization safe using multiple tools to build an effective wall against breach and attack. <a href="https://info.deepinstinct.com/file-upload-security?_ga=2.109077509.1025104848.1720546918-1577162200.1714240296&_gac=1.238305844.1718135387.EAIaIQobChMIq7m80N3xhQMVc6VaBR19bAn5EAAYASAAEgIJRPD_BwE" target="_self">Explore how Deep Instinct secures your file uploads</a> to see another step you can take to secure your organization.
And if you're ready to take the next step, <a href="https://info.deepinstinct.com/request-a-demo?_ga=2.215978322.475833869.1717446548-1577162200.1714240296&_gac=1.208487718.1716560633.EAIaIQobChMIq7m80N3xhQMVc6VaBR19bAn5EAAYASAAEgIJRPD_BwE">request a demo</a> with one of our knowledgable team to see what Deep Instinct can do for you.

Practicing What We Preach: Preventing Threats in SharePoint and OneDrive

RSCA_Blog_Recap.jpg

<h2>Another exciting, whirlwind <a href="https://www.rsaconference.com/marketplace/search/Deep-Instinct-1632843795585001DKrw" target="_blank">RSA Conference</a> (RSAC) has officially wrapped, and the cybersecurity industry is still buzzing over some of the vendor news over the past week. In case you missed it, here are some of our top highlights and key takeaways from RSAC 2024.</h2><h5>Not All AI is Created Equal: Deep Learning in the Spotlight</h5>Generative AI was a hot topic of discussion at RSAC and numerous vendors showcased new capabilities and implementations. But, despite all the excitement, it’s important to note that not all AI is created equal. Our Deep Instinct leadership team spent time with customers, prospects, press, and industry peers to raise greater awareness of our differentiated deep learning (DL) cyber capabilities. In contrast to many machine learning (ML) tools, our technology uses a far more sophisticated set of algorithms that traditional ML models cannot match – which is what makes our <a href="https://www.deepinstinct.com/platform" target="_self">Predictive Prevention Platform</a> so effective.From a media breakfast panel on the topic, to more intimate one-on-one conversations, our team was intent on evangelizing how the only way to effectively combat increasingly sophisticated AI-powered cyber threats is with DL.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><a href="https://www.scmagazine.com/podcast-segment/12856-2024-rsac-3"><img asset_uid="blt789c574cea57f38d" alt="Fig 1_RSAC_Carl and Security Weekly.jpg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt789c574cea57f38d/6645438e16e6bf59d758f418/Fig_1_RSAC_Carl_and_Security_Weekly.jpg" width="auto" height="auto" style="text-align: center;"/></a><figcaption style="text-align: center;" style="text-align: center;">Our CIO Carl Froggett explains how DL combats cyber threats during his sit-down podcast interview with Security Weekly.</figcaption></div></figure><h5>Legacy Vendors Tout New AI Promises Based on False Claims</h5>It seemed every vendor felt compelled to promote their newest AI-based offerings, announcing a plethora of AI-related products and advancements, echoing past rushes to adopt and market new tech. While legacy vendors tack on generative AI capabilities to remain relevant, it is not their core competency; they merely use it to augment their existing solution set. In truth it only explains how you were breached. It doesn’t stop it.This short-sighted approach means the next breach will inevitably happen, forcing security teams to respond, over and over again. Instead of preventing incidents, these AI solutions still operate reactively, allowing disruptions to occur before attempting to mitigate the damage. This “assume breach” mindset is outdated and ineffective, contributing to industry fatigue and defender burnout.Cybersecurity buyers are jaded and skeptical. They’ve been burned before and can see that innovation is lacking. <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity?_ga=2.51158817.941771334.1715708232-1517144758.1706129447" target="_self">Basic ML</a>, the type of technology nearly all vendors leverage and promote, cannot keep pace with rapidly evolving AI-powered threats, leaving investments feeling stale almost immediately after purchase.According to Gartner, global IT spending in 2024 is set to grow by 8% to $5.1 trillion, with 80% of CIOs planning to increase cybersecurity budgets to $215 billion – a 14.3% increase from the $188 billion spent in 2023. This surge in spending underscores the pressing need for more effective solutions.Here’s the grim truth: 2023 was the worst year on record for defenders, with ransomware payments hitting an all-time high of over $1.1 billion – and we’re on pace to break that mark this year. Despite spending the most as an industry, by any measure, we had the worst year ever. It’s time to wake up and realize our current methods are not working. The cybersecurity community needs to move away from the traditional reactive approach and turn to one rooted in prevention.<h5>Meet DIANNA, the Industry’s Only Prevention-First AI Cyber Companion</h5>In the lead up to RSAC, <a href="https://www.deepinstinct.com/dianna-ai-cyber-companion" target="_self">Deep Instinct’s Artificial Neural Network Assistant (DIANNA)</a> made its grand debut as the industry’s first DL-based cybersecurity companion to provide explainability into unknown threats. DIANNA is like having a virtual team of malware analysts and incident response experts that provide security teams with deep analysis into known and unknown attacks, explaining the techniques of attackers and behaviors of malicious files. What takes a senior SOC analyst hours using multiple tools, DIANNA does in seconds. Our new offering was also featured in CRN’s list of "<a href="https://www.crn.com/news/ai/2024/10-hot-ai-cybersecurity-tools-at-rsac-2024?page=10" target="_blank">10 Hot AI Cybersecurity Tools At RSAC 2024</a>.”No other technology vendor on the market today can replicate this level of analysis and explainability, further underscoring our prevention-first approach to cybersecurity. Given its uniqueness, DIANNA was the talk of the town at our busy RSAC booth.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltcc1a937c79745430" alt="Fig 2_RSAC_Deep Instinct Booth.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcc1a937c79745430/6645438f16e6bf2bf558f41c/Fig_2_RSAC_Deep_Instinct_Booth.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">The Deep Instinct Team on the floor at RSAC.</figcaption></div></figure>RSAC made it clear – Deep Learning is the answer to the question of how to predict and prevent the next cyber threat, before it becomes a problem. Deep Instinct can help organizations adopt a proactive, prevention-first approach to cybersecurity, leaving the “assume breach” mindset of EDR in the past once and for all.Want to see DIANNA and the Deep Instinct Prevention Platform for yourself? <a href="https://info.deepinstinct.com/request-a-demo" target="_self">Request a demo</a>.

Blog

Recent Blog Posts

Forget PSEXEC: DCOM Upload & Execute Backdoor

Leveraging Deep Learning for Zero-Day Data Security in Cloud Storage

SHIM Me What You Got: Manipulating Shim and Office for Code Injection

"Hacker Summer Camp" Recap: Black Hat, DEF CON, and the Growing AI Arms Race

Would Have, Could Have, Should Have: Dissecting the 2023 MGM Hack

Deep Dive: Exposing Stealthy New BlackSuit Ransomware

Practicing What We Preach: Preventing Threats in SharePoint and OneDrive

RSAC Reflections: AI Takes Center Stage, But Deep Learning Reigns Supreme

Uncorking Old Wine: Zero-Day from 2017 + Cobalt Strike Loader in Unholy Alliance

DarkBeatC2: The Latest MuddyWater Attack Framework