Yet this rapid proliferation of nontraditional IT has rendered traditional cyber security strategies insufficient, and the result has been highly damaging. Cyber-crime cost the world more than half a trillion dollars last year, in large part because conventional security tools are rarely compatible with IoT devices, while perimeter defenses struggle to protect the borderless networks engendered by the cloud. In fact, even visualizing these new forms of IT — much less safeguarding them against sophisticated cyber-attacks — has proven to be a daunting challenge for companies and governments around the world. As a result, cloud services and IoT appliances have become key security blind spots.
By monitoring and analyzing raw traffic from all our clients’ internet-connected devices and cloud deployments, we saw a number of trends emerge in 2018. As the first installment of a two-part series, this article will review the IoT, Cloud, and SaaS trends of last year and forecast what we expect to see in 2019.
IoT attacks have increased by 100%
Figure 1: The Internet of Things is projected to undergo major expansion.
Internet of Things devices now far outnumber human beings, further contributing to the challenge of identifying all such devices on an organization’s network. On average, upwards of 15% of the devices visualized by our cyber AI were unknown to our clients, and given that a single compromise can cost companies millions in damages and reputational harm, failing to comprehensively monitor the entire digital infrastructure is to play with fire. Indeed, Darktrace has discovered threats in everything from corporate CCTV cameras to parking payment kiosks to smart lockers at an amusement park. All of these devices were connected to the corporate network, and none were previously known to the security team.
This lack of visibility into the Internet of Things has enabled cyber-attackers to manipulate and exploit it as low-hanging fruit, with our cyber AI detecting a 100% increase in IoT attacks over the last year. And as innovative businesses and smart cities continue to adopt connected devices at an alarming rate, these attacks will almost certainly multiply in 2019. To address the fundamental limitations of IoT cyber hygiene, organizations must be willing to rethink their security tactics, both to gain visibility over their networks and to neutralize IoT attacks that have already breached weak perimeter defenses.
28% rise in cloud and SaaS threats
Figure 2: Cloud services will become increasingly ubiquitous in the coming years.
The global migration to cloud and SaaS infrastructures only intensified in 2018, while no less than 83% of enterprise workloads are projected to be run in the cloud by 2020. This development is hardly surprising: not only does the cloud cut expenses for organizations, it provides scalable and flexible services that can evolve as needed. But as these organizations take the next step in cloud innovation, they must also consider the evolution of their security stacks.
Security teams must now cope with an environment wherein they have limited visibility and control. Attackers are aware of the weaknesses inherent to most cloud security systems, and over the last year Darktrace has discovered 28% more threats within Cloud and SaaS than observed in 2017. In fact, the Gartner Risk Management Council identified cloud computing as the most significant emerging cyber-risk of 2018, since even CASBs and native security controls fail to identify the entire spectrum of cyber-threat.
The future of nontraditional IT attacks
Although the perpetual evolution of the cyber-threat landscape prevents anyone from forecasting tomorrow’s attacks with total confidence, we can use these insights to predict some major trends this year and beyond. One overarching trend is the increasing automation of attacks on IoT devices and in the cloud, while there is every reason to suspect that more automated, even artificial intelligence-powered attacks are on the horizon.
For the same reasons that cloud environments are a challenge to protect, they can also be difficult to infiltrate, since they expose attack surfaces that are expansive and constantly shifting. Malware equipped with AI elements, meanwhile, could continuously scan a company’s cloud deployment until it spots a vulnerability, and then use its own ‘judgment’ to exploit that vulnerability before it disappears — without having to ‘phone home’ to the criminals behind the attack for instructions. And when targeting an IoT device, this kind of AI malware could leverage contextualization to blend in to its surroundings, sitting passively while learning to emulate the device’s normal behavior.
The blind spots introduced by the explosion of IoT devices and cloud services — as well as the difficulty of securing the network perimeter given the vulnerabilities that these technologies present — will undoubtedly rank among the most severe security challenges of 2019. And as AI-powered attacks become a fact of life, securing such nontraditional IT will require thinking beyond traditional cyber defenses.
¿Te gusta esto y quieres más?
Reciba el último blog en su bandeja de entrada
Gracias. Hemos recibido su envío.
¡Ups! Algo salió mal al enviar el formulario.
¿Te gusta esto y quieres más?
Stay up to date on the latest industry news and insights.
Darktrace son expertos de talla mundial en inteligencia de amenazas, caza de amenazas y respuesta a incidentes, y proporcionan apoyo al SOC las 24 horas del día a miles de clientes de Darktrace en todo el mundo. Inside the SOC está redactado exclusivamente por estos expertos y ofrece un análisis de los ciberincidentes y las tendencias de las amenazas, basado en la experiencia real sobre el terreno.
SOBRE EL AUTOR
Chief Product Officer
Max is a cyber security expert with over a decade of experience in the field, specializing in a wide range of areas such as Penetration Testing, Red-Teaming, SIEM and SOC consulting and hunting Advanced Persistent Threat (APT) groups. At Darktrace, Max is closely involved with Darktrace’s strategic customers & prospects. He works closely with the R&D team at Darktrace’s Cambridge UK headquarters, leading research into new AI innovations and their various defensive and offensive applications. Max’s insights are regularly featured in international media outlets such as the BBC, Forbes and WIRED. When living in Germany, he was an active member of the Chaos Computer Club. Max holds an MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.
share this article
Stay up to date on the latest industry news and insights.
Using AI to Help Humans Function Better During a Cyber Crisis
Within cyber security, crises are a regular occurrence. Whether due to the ever-changing tactics of threat actors or the emergence of new vulnerabilities, security teams find themselves under significant pressure and frequently find themselves in what psychologists term "crisis states."1
A crisis state refers to an internal state marked by confusion and anxiety to such an extent that previously effective coping mechanisms give way to ineffective decision-making and behaviors.2
Given the prevalence of crises in the field of cyber security, practitioners are more prone to consistently making illogical choices due to the intense pressure they experience. They also grapple with a constant influx of rapidly changing information, the need for swift decision-making, and the severe consequences of errors in judgment. They are often asked to assess hundreds of variables and uncertain factors.
The frequency of crisis states is expected to rise as generative AI empowers cyber criminals to accelerate the speed, scale, and sophistication of their attacks.
Why is it so challenging to operate effectively and efficiently during a crisis state? Several factors come into play.
Firstly, individuals are inclined to rely on their instincts, rendering them susceptible to cognitive biases. This makes it increasingly difficult to assimilate new information, process it appropriately, and arrive at logical decisions. Since crises strike unexpectedly and escalate rapidly into new unknowns, responders experience heightened stress, doubt and insecurity when deciding on a course of action.
These cognitive biases manifest in various forms. For instance, confirmation bias prompts people to seek out information that aligns with their pre-existing beliefs, while hindsight bias makes past events seem more predictable in light of present context and information.
Crises also have a profound impact on information processing and decision-making. People tend to simplify new information and often cling to the initial information they receive rather than opting for the most rational decision.
For instance, if an organization has successfully thwarted a ransomware attack in the past, a defender might assume that employing the same countermeasures will suffice for a subsequent attack. However, ransomware tactics are constantly evolving, and a subsequent attack could employ different strategies that evade the previous defenses. In a crisis state, individuals may revert to their prior strategy instead of adapting based on the latest information.
Given there are deeply embedded psychological tendencies and hard-wired decision-making processes leading to a reduction in logic during a crisis, humans need support from technology that does not suffer from the same limitations, particularly in the post-incident phase, where stress levels go into overdrive.
In the era of rapidly evolving novel attacks, security teams require a different approach: AI.
AI can serve as a valuable tool to augment human decision-making, from detection to incident response and mitigation. This is precisely why Darktrace introduced HEAL, which leverages self-learning AI to assist teams in increasing their cyber resilience and managing live incidents, helping to alleviate the cognitive burden they face.
Darktrace HEAL™ learns from your environment, including data points from real incidents and generates simulations to identify the most effective approach for remediation and restoring normal operations. This reduces the overwhelming influx of information and facilitates more effective decision-making during critical moments.
Furthermore, HEAL offers security teams the opportunity to safely simulate realistic attacks within their own environment. Using specific data points from the native environment, simulated incidents prepare security teams for a variety of circumstances which can be reviewed on a regular basis to encourage effective habit forming and reduce cognitive biases from a one-size-fits-all approach. This allows them to anticipate how attacks might unfold and better prepare themselves psychologically for potential real-world incidents.
With the right models and data, AI can significantly mitigate human bias by providing remediation recommendations grounded in evidence and providing proportionate responses based on empirical evidence rather than personal interpretations or instincts. It can act as a guiding light through the chaos of an attack, providing essential support to human security teams.
Akira Ransomware: How Darktrace Foiled Another Novel Ransomware Attack
Threats Landscape: New Strains of Ransomware
In the face of a seemingly never-ending production line of novel ransomware strains, security teams across the threat landscape are continuing to see a myriad of new variants and groups targeting their networks. Naturally, new strains and threat groups present unique challenges to organizations. The use of previously unseen tactics, techniques, and procedures (TTPs) means that threat actors can often completely bypass traditional rule and signature-based security solutions, thus rendering an organization’s digital environment vulnerable to attack.
What is Akira Ransomware?
One such example of a novel ransomware family is Akira, which was first observed in the wild in March 2023. Much like many other strains, Akira is known to target corporate networks worldwide, encrypting sensitive files and demanding huge sums of money to retrieve the data and stop it from being posted online .
In late May 2023, Darktrace observed multiple instances of Akira ransomware affecting networks across its customer base. Thanks to its anomaly-based approach to threat detection, Darktrace DETECT™ successfully identified the novel ransomware attacks and provided full visibility over the cyber kill chain, from the initial compromise to the eventual file encryptions and ransom notes. In cases where Darktrace RESPOND™ was enabled in autonomous response mode, these attacks were mitigated the early stages of the attack, thus minimizing any disruption or damage to customer networks.
Initial access and privilege escalation
The Akira ransomware group typically uses spear-phishing campaigns containing malicious downloads or links as their primary initial access vector; however, they have also been known to use Remote Desktop Protocol (RDP) brute-force attacks to access target networks .
While Darktrace did observe the early access activities that are detailed below, it is very likely that the actual initial intrusion happened prior to this, through targeted phishing attacks that fell outside of Darktrace’s purview. The first indicators of compromise (IoCs) that Darktrace observed on customer networks affected by Darktrace were typically unusual RDP sessions, and the use of compromised administrative credentials.
On one Darktrace customer’s network (customer A), Darktrace DETECT identified a highly privileged credential being used for the first time on an internal server on May 21, 2023. Around a week later, this server was observed establishing RDP connections with multiple internal destination devices via port 3389. Further investigation carried out by the customer revealed that this credential had indeed been compromised. On May 30, Darktrace detected another device scanning internal devices and repeatedly failing to authenticate via Kerberos.
As the customer had integrated Darktrace with Microsoft Defender, their security team received additional cyber threat intelligence from Microsoft which, coupled with the anomaly alerts provided by Darktrace, helped to further contextualize these anomalous events. One specific detail gleaned from this integration was that the anomalous scanning activity and failed authentication attempts were carried out using the compromised administrative credentials mentioned earlier.
By integrating Microsoft Defender with Darktrace, customers can efficiently close security gaps across their digital infrastructure. While Darktrace understands customer environments and provides valuable network-level insights, by integrating with Microsoft Defender, customers can further enrich these insights with endpoint-specific information and activity.
In another customer’s network (customer B), Darktrace detected a device, later observed writing a ransom note, receiving an unusual RDP connection from another internal device. The RDP cookie used during this activity was an administrative RDP cookie that appeared to have been compromised. This device was also observed making multiple connections to the domain, api.playanext[.]com, and using the user agent , AnyDesk/7.1.11, indicating the use of the AnyDesk remote desktop service.
Although this external domain does not appear directly related to Akira ransomware, open-source intelligence (OSINT) found associations with multiple malicious files, and it appeared to be associated with the AnyDesk user agent, AnyDesk/6.0.1 . The connections to this endpoint likely represented the malicious use of AnyDesk to remotely control the customer’s device, rather than Akira command-and-control (C2) infrastructure or payloads. Alternatively, it could be indicative of a spoofing attempt in which the threat actor is attempting to masquerade as legitimate remote desktop service to remain undetected by security tools.
Around the same time, Darktrace observed many devices on customer B’s network making anomalous internal RDP connections and authenticating via Kerberos, NTLM, or SMB using the same administrative credential. These devices were later confirmed to be affected by Akira ransomware.
Figure 1 shows how Darktrace detected one of those internal devices failing to login via SMB multiple times with a certain credential (indication of a possible SMB/NTLM brute force), before successfully accessing other internal devices via SMB, NTLM and RDP using the likely compromised administrative credential mentioned earlier.
Darktrace DETECT models observed for initial access and privilege escalation:
Device / Anomalous RDP Followed By Multiple Model Breaches
The next step Darktrace observed during Akira ransomware attacks across the customer was internal reconnaissance and lateral movement.
In another customer’s environment (customer C), after authenticating via NTLM using a compromised credential, a domain controller was observed accessing a large amount of SMB shares it had never previously accessed. Darktrace DETECT understood that this SMB activity represented a deviation in the device’s expected behavior and recognized that it could be indicative of SMB enumeration. Darktrace observed the device making at least 196 connections to 34 unique internal IPs via port 445. SMB actions read, write, and delete were observed during those connections. This domain controller was also one of many devices on the customer’s network that was received incoming connections from an external endpoint over port 3389 using the RDP protocol, indicating that the devices were likely being remotely controlled from outside the network. While there were no direct OSINT links with this endpoint and Akira ransomware, the domain controller in question was later confirmed to be compromised and played a key role in this phase of the attack.
Moreover, this represents the second IoC that Darktrace observed that had no obvious connection to Akira, likely indicating that Akira actors are establishing entirely new infrastructure to carry out their attacks, or even utilizing newly compromised legitimate infrastructure. As Darktrace DETECT adopts an anomaly-based approach to threat detection, it can recognize suspicious activity indicative of an emerging ransomware attack based on its unusualness, rather than having to rely on previously observed IoCs and lists of ‘known-bads’.
Darktrace further observed a flurry of activity related to lateral movement around this time, primarily via SMB writes of suspicious files to other internal destinations. One particular device on customer C’s network was detected transferring multiple executable (.exe) and script files to other internal devices via SMB.
Darktrace recognized that these transfers represented a deviation from the device’s normal SMB activity and may have indicated threat actors were attempting to compromise additional devices via the transfer of malicious software.
Darktrace DETECT models observed for internal reconnaissance and lateral movement:
Device / RDP Scan
Anomalous Connection / SMB Enumeration
Anomalous Connection / Possible Share Enumeration Activity
Scanning of Multiple Devices (Cyber AI Analyst Incident)
Device / Possible SMB/NTLM Reconnaissance
Compliance / Incoming Remote Desktop
Compliance / Outgoing NTLM Request from DC
Unusual Activity / Internal Data Transfer
Security Integration / Lateral Movement and Integration Detection
Device / Anomalous SMB Followed By Multiple Model Breaches
In the final phase of Akira ransomware attacks detected on Darktrace customer networks, Darktrace DETECT identified the file extension “.akira” being added after encryption to a variety of files on the affected network shares, as well as a ransom note titled “akira_readme.txt” being dropped on affected devices.
On customer A’s network, after nearly 9,000 login failures and 2,000 internal connection attempts indicative of scanning activity, one device was detected transferring suspicious files over SMB to other internal devices. The device was then observed connecting to another internal device via SMB and continuing suspicious file activity, such as appending files on network shares with the “.akira” extension, and performing suspicious writes to SMB shares on other internal devices.
Darktrace’s autonomous threat investigator, Cyber AI Analyst™, was able to analyze the multiple events related to this encryption activity and collate them into one AI Analyst incident, presenting a detailed and comprehensive summary of the entire incident within 10 minutes of Darktrace’s initial detection. Rather than simply viewing individual breaches as standalone activity, AI Analyst can identify the individual steps of an ongoing attack to provide complete visibility over emerging compromises and their kill chains. Not only does this bolster the network’s defenses, but the autonomous investigations carried out by AI Analyst also help to save the security team’s time and resources in triaging and monitoring ongoing incidents.
In addition to analyzing and compiling Darktrace DETECT model breaches, AI Analyst also leveraged the host-level insights provided by Microsoft Defender to enrich its investigation into the encryption event. By using the Security Integration model breaches, AI Analyst can retrieve timestamp and device details from a Defender alert and further investigate any unusual activity surrounding the alert to present a full picture of the suspicious activity.
In customer B’s environment, following the unusual RDP sessions and rare external connections using the AnyDesk user agent, an affected device was later observed writing around 2,000 files named "akira_readme.txt" to multiple internal SMB shares. This represented the malicious actor dropping ransom notes, containing the demands and extortion attempts of the actors.
As a result of this ongoing activity, an Enhanced Monitoring model breach, a high-fidelity DETECT model type that detects activities that are more likely to be indicative of compromise, was escalated to Darktrace’s Security Operations Center (SOC) who, in turn were able to further investigate and triage this ransomware activity. Customers who have subscribed to Darktrace’s Proactive Threat Notification (PTN) service would receive an alert from the SOC team, advising urgent follow up action.
Darktrace DETECT models observed during ransomware deployment:
When Darktrace is configured in autonomous response mode, RESPOND is able to follow up successful threat identifications by DETECT with instant autonomous actions that stop malicious actors in their tracks and prevent them from achieving their end goals.
In the examples of Darktrace customers affected by Akira outlined above, only customer A had RESPOND enabled in autonomous response mode during their ransomware attack. The autonomous response capability of Darktrace RESPOND helped the customer to minimize disruption to the business through multiple targeted actions on devices affected by ransomware.
One action carried out by RESPOND was to block all on-going traffic from affected devices. In doing so, Darktrace effectively shuts down communications between devices affected by Akira and the malicious infrastructure used by threat actors, preventing the spread of data on the client network or threat actor payloads.
Another crucial RESPOND action applied on this customer’s network was combat Akira was to “Enforce a Pattern of Life” on affected devices. This action is designed to prevent devices from performing any activity that would constitute a deviation from their expected behavior, while allowing them to continue their ‘usual’ business operations without causing any disruption.
While the initial intrusion of the attack on customer A’s network likely fell outside of the scope of Darktrace’s visibility, Darktrace RESPOND was able to minimize the disruption caused by Akira, containing the ransomware and allowing the customer to further investigate and remediate.
Novel ransomware strains like Akira present a significant challenge to security teams across the globe due to the constant evolution of attack methods and tactics, making it huge a challenge for security teams to stay up to date with the most current threat intelligence.
Therefore, it is paramount for organizations to adopt a technology designed around an intelligent decision maker able to identify unusual activity that could be indicative of a ransomware attack without depending solely on rules, signatures, or statistic lists of malicious IoCs.
Darktrace DETECT identified Akira ransomware at every stage of the attack’s kill chain on multiple customer networks, even when threat actors were utilizing seemingly legitimate services (or spoofed versions of them) to carry out malicious activity. While this may have gone unnoticed by traditional security tools, Darktrace’s anomaly-based detection enabled it to recognize malicious activity for what it was. When enabled in autonomous response mode, Darktrace RESPOND is able to follow up initial detections with machine-speed preventative actions to stop the spread of ransomware and minimize the damage caused to customer networks.
There is no silver bullet to defend against novel cyber-attacks, however Darktrace’s anomaly-based approach to threat detection and autonomous response capabilities are uniquely placed to detect and respond to cyber disruption without latency.
Credit to: Manoel Kadja, Cyber Analyst, Nahisha Nobregas, SOC Analyst.
IOC - Type - Description/Confidence
202.175.136[.]197 - External destination IP -Incoming RDP Connection
api.playanext[.]com - External hostname - Possible RDP Host