Cisco recently published their Annual Security Report (ASR) for 2015 and there was quite a bit of interesting information on what happened in 2014, but also trends for 2015. We saw the rise in the number of highly publicized attacks in 2014 and the fact that C-Level Executives are under a lot of pressure to improve the security of their networks and protect sensitive client data. While attackers have always targeted IT users, in 2015 the trend is shifting where the primary target is to take advantage of user behaviors to breach the network. This last point is important because once the user has been compromised or their credentials have been lifted, the attacker then has access to anything important that is connected. The Cisco 2015 ASR shows that only 43% of organizations leverage identity administration and provisioning to properly secure their networks and data. This means that over half of organizations don’t know who is accessing their networks, where they’re going or coming from, or what they’re using and if it is even authorized based on business policy. As we all know, once someone unauthorized gets inside it can be challenging to track down the incursion and negate the threat.
Microsoft’s Patch Tuesday for February 2015 has arrived. This month’s round of security updates is large with Microsoft releasing 9 bulletins addressing 56 CVEs. 3 of the bulletins are rated critical and address vulnerabilities within Internet Explorer, Windows, and Group Policy. The remaining 6 bulletins are rated important and address vulnerabilities in Office, Windows, Group Policy, and System Center Manager.
Ransomware continues to impact a large number of organizations and the malware continues to evolve. In January, we examined Cryptowall 2.0 and highlighted new features incorporated into the dropper and Cryptowall binary. When Cryptowall 3.0 appeared, we were interested in seeing what new functionality was incorporated into this latest variant in the Cryptowall series.
The latest 3.0 sample that we analyzed was in a zip file. This zip file contains multiple dropper files which are essentially identical in functionality except for the encryption algorithm used to obfuscate the dropper and eventually build the Cryptowall 3.0 binary.
Two weeks ago, multiple Cisco Managed Threat Defense (MTD) customers received an email that appeared to come from the Microsoft Volume Licensing Service Center (VLSC). The email shown below is very similar to the real email Microsoft sends. It had a personalized welcome line and appears to contain a link to login to the Volume Licensing Service Center:
As a result of Cisco’s acquisition last May, ThreatGRID is now part of the Cisco Advanced Malware Protection (AMP) portfolio as AMP Threat Grid. The acquisition expands Cisco AMP capabilities in the areas of dynamic analysis and threat intelligence technology, both on-premise and in the cloud. AMP Threat Grid extends Cisco AMP with even greater visibility, context, and control over sophisticated threats. Security analysts and incident response teams can augment their forensics analysis to detect and stop evasive attacks faster than ever.
AMP Threat Grid is not simply another dynamic analysis platform or sandbox. While the solution does leverage various dynamic analysis techniques and ‘sandboxing’ to produce content, it also acts as a content engine so that you can more quickly and easily extract insights from the data. AMP Threat Grid treats all of its analysis as content, making it available to the user via a portal or API. AMP Threat Grid also doesn’t stop at a single analysis technique; instead it applies multiple dynamic and static analysis engines to submitted samples – all produced disk, network, and memory artifacts – in order to generate as rich a source of data as possible.