This post was authored by Andrea Allievi, Douglas Goddard, Shaun Hurley, and Alain Zidouemba.
Recently, there was a blog post on the takedown of a botnet used by threat actor group known as Group 72 and their involvement in Operation SMN. This group is sophisticated, well funded, and exclusively targets high profile organizations with high value intellectual property in the manufacturing, industrial, aerospace, defense, and media sector. The primary attack vectors are watering-hole, spear phishing, and other web-based attacks.
Frequently, a remote administration tool (RAT) is used to maintain persistence within a victim’s organization. These tools are used to further compromise the organization by attacking other hosts inside the targets network.
ZxShell (aka Sensocode) is a Remote Administration Tool (RAT) used by Group 72 to conduct cyber-espionage operations. Once the RAT is installed on the host it will be used to administer the client, exfiltrate data, or leverage the client as a pivot to attack an organization’s internal infrastructure. Here is a short list of the types of tools included with ZxShell:
- Keylogger (used to capture passwords and other interesting data)
- Command line shell for remote administration
- Remote desktop
- Various network attack tools used to fingerprint and compromise other hosts on the network
- Local user account creation tools
For a complete list of tools please see the MainConnectionIo section.
The following paper is a technical analysis on the functionality of ZxShell. The analysts involved were able to identify command and control (C2) servers, dropper and installation methods, means of persistence, and identify the attack tools that are core to the RAT’s purpose. In addition, the researchers used their analysis to provide detection coverage for Snort, Fireamp, and ClamAV.
Read More »
Tags: APT, Group 72, malware, Operation SMN, security, SMN, Talos, threats
Securing our digital lives used to be simpler. Up until a few years ago, we primarily used email as a means for transferring or exchanging files between two parties. A handful of companies emerged to provide email encryption for those who needed it. Most other people did not worry about it.
Today, file exchange has gone beyond email. Users regularly transfer important and sensitive business and personal information using a variety of applications. It takes only a few button clicks to transfer files using Dropbox or Box. People regularly exchange files via instant messengers like Skype, Whatsapp, or Gtalk. Employees log into cloud service providers such as Salesforce and click on icons to send out invoices, proposals, quotations, and the like. Security online is no longer simple and there are many more threats to worry about.
Read More »
Tags: Cisco EIR, Cisco Entrepreneurs in Residence, encryption, Pawaa, SecurelyShare, security
There is a great debate in the security world right now: have SIEM and logging products run their course? Will Hadoop ride to the rescue? Can machines “learn” about security and reliably spot threats that no other approach can find?
Gartner calls this phenomenon Big Data Security Analytics, and they make a strong point to define BDSA solutions as a three-layer pyramid. At the bottom is the “data lake,” which is what most people equate with Hadoop. The next layer is context—the addition of relevant business, location, and other non-traditional security information to increase the precision of the next layer: applications and analytics (such as Machine Learning). It is this top layer where the real value of BDSA is realized in terms of finding new threats and remediating them before they do damage.
Read More »
Tags: big data analytics, Cisco EIR, Cisco Entrepreneurs in Residence, Hadoop, PetaSecure, security
As an IT security practitioner, you have a lot on your plate. Malware attacks are ever present. Hackers are smarter than ever and have the resources and persistence to compromise your organization. The malware being created today is more sophisticated. And the number and types of devices being used in the workplace are expanding, which is increasing the attack surface for malware delivery. With all of these new endpoints being used in the workplace, it’s no surprise that more than 70% of respondents in the 2014 State of Endpoint Risk study by Ponemon say that endpoint security risk is more difficult than ever to manage. Without visibility into potential malicious activity on the endpoints, how are you expected to effectively defend against an attack launched from an endpoint?
Let’s face it: endpoints are everywhere now. The definition of an endpoint has expanded vastly from its first iteration as a tethered desktop computer. We have Windows and Mac laptops; tablets and smartphones; virtual environments; and now even smart watches. We rely on these devices every day. Furthermore, with the advent of the Internet of Everything (IoE), the number and variety of connected devices are set to explode. Cisco estimates that as many as 50 billion devices will be connected to the network by the end of the decade.
The number of attacks targeting these devices is on the rise. In the same Ponemon study, 68% of respondents reported that their mobile endpoints have been the target of malware in the last 12 months. Examples are plentiful. A user with a personal Android phone that has been infected with malware plugs the phone into the office computer to charge it and the malware infiltrates the corporate network. An employee connects their work laptop to their home wi-fi connection and malware lying dormant seizes the opportunity to launch an attack through the back door. Someone surfing the web visits a legitimate website and clicks on an ad that is actually infected. Third-party applications downloaded from seemingly reputable sites can also introduce security risks.
Attackers understand how to exploit these gaps in protection that a proliferation of endpoints can create and work relentlessly to drive their attacks home. Their attacks are dynamic and multidimensional and require continuous scrutiny. As an IT security practitioner, you can’t protect what you can’t see. You need security solutions on the endpoint that couple continuous visibility and control so that you can not only see what’s happening on all of the endpoints on your extended network, but have the power to stop an outbreak quickly if an attack gets through.
Cisco Advanced Malware Protection (AMP) for Endpoints gives you unmatched visibility and control on endpoints, including PCs, Macs, mobile devices, and virtual environments. AMP is continuously monitoring activity on your endpoints, recording everything that it sees, which gives you the ability to roll back time on would-be attackers. When a file starts behaving badly, AMP is there to catch it, and gives you detailed information on how the malware got there in the first place, where it has gone, what other systems have been affected, and what exactly the malware is doing. With this information on root cause and point-of-entry, the complete ancestry and lifecycle of the file, and detailed analysis on the malware’s activity, you can surgically remediate malware from all of the affected areas on your endpoints and extended network. Whether you’re dealing with endpoints connected to a protected network or roaming on public or personal in-home wi-fi, AMP provides you with continuous and integrated detection, response, and remediation capabilities. Download this whitepaper to learn more about a new model to protect the endpoint.
To learn more about AMP for Endpoints, visit www.cisco.com/go/amp
 Cisco Internet of Things: http://www.cisco.com/web/solutions/trends/iot/indepth.html
Tags: Advanced Malware Protection, AMP, security
This post was written by Jaeson Schultz.
On October 14th information related to a new Windows vulnerability, CVE-2014-4114, was published. This new vulnerability affects all supported versions of Microsoft Windows. Windows XP, however, is not affected by this vulnerability. The problem lies in Windows’ OLE package manager. When triggered it allows for remote code execution.
Read More »
Tags: 0-day, malware, Talos