How to Prevent Supply-Chain Attacks

Kaspersky researchers recently reported that they continue to observe in the 3rd quarter of 2021 supply-chain attacks.

“We continue to see supply-chain attacks, including those of SmudgeX, DarkHalo and Lazarus,” Kaspersky researchers said in their “APT trends report Q3 2021.”

What Is Supply-Chain Attack?

Supply-chain attack is a type of cyberattack in which an attacker inserts malicious code into a legitimate software.

In a supply-chain attack, an attacker turns the compromised software into a Trojan horse. A Trojan horse is a type of malicious software (malware) that’s introduced onto a victim’s computer as it’s disguised as legitimate software.

In a supply-chain attack, by compromising a single software, attackers gain access to hundreds or hundreds of thousands of customers of a legitimate software.

The three common supply-chain attack techniques include hijacking updates, undermining code signing, and compromising open-source code. Attackers may use these three common supply-chain attack techniques simultaneously.

Supply-Chain Attacks Examples

DarkHalo

DarkHalo is the name given by researchers to the group that launched the SolarWinds supply-chain attack. Other researchers call the group behind the SolarWinds supply-chain attack Nobelium.

SolarWinds supply-chain attack is one of the high-profile supply-chain attacks that was exposed in December 2020. According to SolarWinds, the "vulnerability" was inserted within the company's Orion products and existed in updates released between March and June 2020.

In a report to the U.S. Securities and Exchange Commission (SEC), SolarWinds said that nearly 33,000 of its more than 300,000 customers were Orion customers, and that fewer than 18,000 customers may have had installed the Orion product that contained the malicious code. One of the notable victims of the Solarwinds supply chain attack is Microsoft.

According to Kaspersky researchers, evidence suggests that DarkHalo had spent six months inside OrionIT’s networks to perfect their attack.

“In June, more than six months after DarkHalo had gone dark, we observed the DNS hijacking of multiple government zones of a CIS member state that allowed the attacker to redirect traffic from government mail servers to computers under their control – probably achieved by obtaining credentials to the control panel of the victims’ registrar,” Kaspersky researchers said. “When victims tried to access their corporate mail, they were redirected to a fake copy of the web interface. Following this, they were tricked into downloading previously unknown malware. The backdoor, dubbed Tomiris, bears a number of similarities to the second-stage malware, Sunshuttle (aka GoldMax), used by DarkHalo last year. ”

SmudgeX

Kaspersky researchers called the supply-chain incident in which a threat actor modified a fingerprint scanner software installer package as SmudgeX. The fingerprint scanner software is used by government employees of a country in South Asia for attendance recording.

Kaspersky researchers said the threat actor changed a configuration file and added a DLL with a .NET version of a PlugX injector to the installer package. “On installation, even without network connectivity, the .NET injector decrypts and injects a PlugX backdoor payload into a new svchost system process and attempts to beacon to a C2 [command and control infrastructure],” Kaspersky researchers said.

The Trojanized installer version of the fingerprint scanner software appeared to have been staged on the distribution server from March to June, Kaspersky researchers said.

Lazarus

According to Kaspersky researchers, evidence showed that the threat group known as Lazarus is building supply-chain attack capabilities. The researchers said that one supply-chain attack from this threat group originated from a compromised legitimate South Korean security software.

Another supply-chain attack launched by this group, Kaspersky researchers said, stemmed from a hijacked asset monitoring solution software in Latvia.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), meanwhile, reported that in 2017, Kaspersky Antivirus was being used by a foreign intelligence service for spying. The U.S. government directed government offices to remove the vendor’s products from networks.

Cybersecurity Best Practices Against Supply-Chain Attacks

Supply-chain attacks aren’t easy to protect against. Your organization’s software vendors, even the top big IT software vendors, are as vulnerable to supply-chain attacks.

Here are some of the cybersecurity best practices against supply-chain attacks:

• Maintain an inventory of all software licenses
• Find out how each software license is supported by its vendor. For example, are regular or out-of-schedule patches provided?
• Configure software to automatically check for patches or security updates.
• Follow the software vendor’s instructions on how to harden the security of the software.
• If software vendor specifies URLs or IP ranges and ports to and from which software should communicate, establish firewall rules to make sure that such communications don’t happen outside these parameters.
• Implement basic network segmentation, that is, sub-dividing your organization’s network into sub-networks to ensure that in case one sub-network is compromised, the other sub-networks won’t be compromised.
• Identify and remove unauthorized software that isn’t part of your organization’s software inventory.
• Have a contingency and continuity plan to switch to a new software vendor when critical software becomes unavailable or compromised.

Supply-chain attackers target not just software. They also target hardware. Attackers compromised hardware components with the end view of compromising hardware users. In 2016, attackers hijacked the design of a mobile phone. The phones sold to customers encrypted users’ text and call details and transmitted the data to a server every 72-hours.

Most of the cybersecurity best practices against software supply-chain attacks also apply to hardware supply-chain attacks.

How to Implement Best Cyber Defense Against BlackMatter Ransomware Attacks

Three U.S. government agencies, the Cybersecurity, and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA), recently issued a cyber security alert and defense tips against BlackMatter ransomware attacks.

What Is BlackMatter Ransomware?

BlackMatter is a relatively new ransomware. It was first observed in the wild in July 2021. This new ransomware exhibits the typical features of a modern-day ransomware, including the double extortion modus operandi.

In double extortion, the ransomware group steals data from victims. After stealing data, the attackers then encrypt victims’ data, preventing victims from accessing their data. After data encryption, attackers demand from victims ransom payment in exchange for a decryption tool that purportedly would unlock the encrypted data.

In double extortion, failure on the part of the victims to pay the ransom payment for the decryption tool leads to the activation of the second ransom demand, that is, victims are named on a leak site as victims of ransomware attacks. These victims are then threatened that their data will be published in case they won’t pay ransom.

Some ransomware actors still demand the second ransom payment – for the non-publication of the stolen data – despite the payment of the first ransom payment, that is, payment for the decryption tool.

Like other modern-day ransomware, BlackMatter ransomware is operated under the scheme called ransomware-as-service (RaaS). In RaaS, the ransomware developer (the one who creates the ransomware custom exploit code) works with affiliates – a different kind of cyberattackers who have existing access to corporate networks.

In a public advertisement posted on the underground forum Exploit, BlackMatter said it wants to buy access to corporate networks in the U.S., Canada, Australia, and Great Britain.

The group further said that it’s willing to pay $3,000 to $100,000 per network, provided the network passed the following criteria:

• Corporate revenue is $100 million or more
• Corporate network contains 500-15,000 devices
• Network hasn’t been previously targeted by other threat actors.

To signify that it's serious about its offer, BlackMatter has deposited 4 bitcoins ($256,000) on the forum Exploit.

“The [BlackMatter] ransomware is provided for several different operating systems versions and architectures and is deliverable in a variety of formats, including a Windows variant with SafeMode support (EXE / Reflective DLL / PowerShell) and a Linux variant with NAS support: Synology, OpenMediaVault, FreeNAS (TrueNAS). According to BlackMatter, the Windows ransomware variant was successfully tested on Windows Server 2003+ x86/x64 and Windows 7+ x64 / x86,” Recorded Future reported. “The Linux ransomware variant was successfully tested on ESXI 5+, Ubuntu, Debian, and CentOs. Supported file systems for Linux include VMFS, VFFS, NFS, VSAN.”

On BlackMatter website, the group said it doesn't attack hospitals, critical infrastructure, oil and gas industry, defense industry, non-profit companies, and government sector.

According to the joint cybersecurity advisory by CISA, FBI, and NSA, since July 2021, BlackMatter ransomware has targeted multiple U.S. critical infrastructure entities, including two food and agriculture sector organizations in the U.S., and have demanded ransom payments ranging from $80,000 to $15,000,000 in cryptocurrencies Bitcoin and Monero.

In September 2021, BlackMatter attacked the U.S. farmers cooperative NEW Cooperative and demanded from the victim $5.9 million for the decryptor and for the non-publication of the stolen data. 

"Your website says you do not attack critical infrastructure,” a NEW Cooperative representative told BlackMatter during a negotiation chat (screenshots of the said negotiation chat were shared online). “We are critical infrastructure... intertwined with the food supply chain in the US. If we are not able to recover very shortly, there is going to be very very public disruption to the grain, pork, and chicken supply chain."

BlackMatter Ransomware Tactics, Techniques, and Procedures

The CISA, FBI, and NSA advisory said that sample of BlackMatter ransomware analyzed in a sandbox environment as well from trusted third-party reporting showed that BlackMatter ransomware uses the following tactics, techniques, and procedures:

• BlackMatter harvests credentials from Local Security Authority Subsystem Service (LSASS) memory using procmon.
• BlackMatter uses Lightweight Directory Access Protocol (LDAP) and Server Message Block (SMB) protocol to discover all hosts in the Active Directory (AD).
• BlackMatter uses NtQuerySystemInformation to enumerate running processes.
• BlackMatter uses EnumServicesStatusExW to enumerate running services on the network.
• BlackMatter uses srvsvc.NetShareEnumAll MSRPC function to enumerate and SMB to connect to all discovered shares, including ADMIN$, C$, SYSVOL, and NETLOGON.
• BlackMatter uses legitimate remote monitoring and management software and remote desktop software, often by setting up trial accounts, to maintain persistence on victim networks.
• BlackMatter exfiltrates data.
• BlackMatter remotely encrypts shares via SMB protocol and drops a ransomware note in each directory.
• Rather than encrypting backup systems, BlackMatter wipes or reformats backup data stores and appliances.

Cybersecurity Best Practices

The CISA, FBI, and NSA advisory recommends the following cybersecurity defense tips against BlackMatter ransomware attacks:

• Use strong passwords for service account, admin accounts, and domain admin accounts.
• Use multi-factor authentication (MFA) for vital services, including webmail, virtual private networks (VPNs), and accounts that access critical systems.
• Keep all software up to date.
• Eliminate unnecessary access to administrative shares.
• Use a host-based firewall – a firewall installed on a server to monitor and control incoming and outgoing network traffic.
• Implement network segmentation to prevent the spread of ransomware.
• Disable command-line and scripting activities and permissions.
• Keep all backup data offline, encrypted, and immutable.
• Disable the storage of clear text passwords in LSASS memory.
• Disable or limit New Technology Local Area Network Manager (NTLM) and WDigest Authentication.

Microsoft recently revealed that one of its Azure customers was hit by a 2.4 Tbps distributed denial-of-service (DDoS) attack last August.

In the blog post “Business as usual for Azure customers despite 2.4 Tbps DDoS attack,” Amir Dahan Senior Program Manager at Microsoft’s Azure Networking said the 2.4 Tbps DDoS attack is 140 percent higher than 2020’s 1 Tbps attack and higher than any network volumetric event previously detected on Azure.

Dahan said the 2.4 Tbps DDoS attack on Azure infrastructure originated from approximately 70,000 sources and from multiple countries in the Asia-Pacific region, including Malaysia, Vietnam, Taiwan, Japan, and China, as well as from the United States.

“The attack vector was a UDP reflection spanning more than 10 minutes with very short-lived bursts, each ramping up in seconds to terabit volumes,” Dahan said. “In total, we monitored three main peaks, the first at 2.4 Tbps, the second at 0.55 Tbps, and the third at 1.7 Tbps.”

With the adoption of cloud services, Dahan said, “Bad actors, now more than ever, continuously look for ways to take applications offline.’

In the blog post "Azure DDoS Protection—2021 Q1 and Q2 DDoS attack trends," Alethea Toh Program Manager at Microsoft’s Azure Networking reported that the first half of 2021 saw a sharp increase in DDoS attacks on Azure resources per day. Toh said Microsoft’s Azure mitigated an average of 1,392 DDoS attacks per day in the first half of 2021, the maximum reaching 2,043 attacks on May 24, 2021.

“In total, we mitigated upwards of 251,944 unique [DDoS] attacks against our global infrastructure during the first half of 2021,” Toh said.

Toh added that in the first half of 2021, the average DDoS attack size was 325 Gbps, with 74 percent of the attacks being 30 minutes or less and 87 percent being one hour or less.

In 2020 Google, meanwhile, revealed a 2.5 Tbps DDoS attack on its infrastructure. In the blog post “Exponential growth in DDoS attack volumes,” Damian Menscher, Security Reliability Engineer at Google, said that Google’s infrastructure was hit by a 2.5 Tbps DDoS attack in September 2017. This 2.5 Tbps DDoS attack on Google infrastructure, Menscher said, was a culmination of a six-month campaign that utilized multiple methods of attack, simultaneously targeting Google’s thousands of IPs.

“The attacker used several networks to spoof 167 Mpps (millions of packets per second) to 180,000 exposed CLDAP, DNS, and SNMP servers, which would then send large responses to us,” Menscher said.

Top Attack Vectors

DDoS is a type of cyberattack that floods targets with gigantic traffic volumes with the aim of choking network capacity.

“While UDP attacks comprised the majority of attack vectors in Q1 of 2021, TCP overtook UDP as the top vector in Q2,” Toh of Microsoft's Azure said. “From Q1 to Q2, the proportion of UDP dropped from 44 percent to 33 percent, while the proportion of TCP increased from 48 percent to 60 percent.”

According to Toh, in Q1 of 2021, a total of 33% attack vectors came from UDP flood, 24% from TCP other flood, 21% from TCP ACK flood, 11% from UDP amplification, 7% from IP protocol flood, 3% from TCP SYN flood.

For Q2 of 2021, Toh said, a total of 23% attack vectors came from UDP flood, 29% from TCP other flood, 28% from TCP ACK flood, 10% from UDP amplification, 6% from IP protocol flood, and 3% from TCP SYN flood.

In January, Toh said, Microsoft Windows servers with Remote Desktop Protocol (RDP) enabled on UDP/3389 were being abused to launch UDP amplification attacks, with an amplification ratio of 85.9:1 and a peak at approximately 750 Gbps.

In February, Toh said, video streaming and gaming customers were getting hit by Datagram Transport Layer Security (D/TLS) attack vector which exploited UDP source port 443.

In June, Toh said, reflection attack iteration for the Simple Service Delivery Protocol (SSDP) emerged. SSDP normally uses source port 1900. The new mutation, Toh said, was either on source port 32414 or 32410, also known as Plex Media Simple Service Delivery Protocol (PMSSDP).

Cybersecurity Best Practices

Organizations with internet-exposed workloads are vulnerable to DDoS attacks. Some DDoS attacks focus on a specific target from application layer (web, DNS, and mail servers) to network layer (routers/switches and link capacity). Some DDoS attackers may not focus on a specific target, but rather, attack every IP in your organization’s network.

Microsoft and Google have their own DDoS mitigating measures that can absorb multi-terabit DDoS attacks. On the part of Google, the company said it reported thousands of vulnerable servers to their network providers, and also worked with network providers to trace the source of the spoofed packets so they could be filtered.

Small and medium-sized organizations can now avail of a DDoS protection solution that can absorb multi-terabit DDoS attacks. Today’s DDoS protection solution operates autonomously, without human intervention. Failure to protect your organization’s resources from DDoS attacks can lead to outages and loss of customer trust.

We can also help in preventing DDoS attacks from happening by ensuring that our computers and IoT devices are patched and secured.

2 ‘Prolific’ Ransomware Operators Arrested in Ukraine

Europol has announced the arrest of two “prolific” ransomware operators known for extorting ransom demands between $6 million to $81 million.

In a statement, Europol said that the arrest of the two ransomware operators last September 28th in Ukraine was a coordinated strike by the French National Gendarmerie, the Ukrainian National Police, and the United States Federal Bureau of Investigation (FBI), with the coordination of Europol and INTERPOL.

The arrest of the two ransomware operators, Europol said, led to the seizure of $375,000 in cash, seizure of two luxury vehicles worth $251,000, and asset freezing of $1.3 million in cryptocurrencies.

The arrested individuals, Europol said, are part of an organized ransomware group suspected of having committed a string of ransomware attacks targeting large organizations in Europe and North America from April 2020 onwards.

The group’s modus operandi, Europol said, includes deployment of malicious software (malware), stealing sensitive data from target companies before encrypting these sensitive files.

After data encryption and stealing of data, Europol further said, the group then offers a decryption tool in exchange for a ransom payment. When ransom demand isn’t met, Europol added, the group threatens to leak the stolen data on the dark web.

Authorities refused to give the names of the two arrested individuals. The name of the ransomware group wasn’t disclosed as well.

Disrupting Ransomware Operations

In June 2021, the Cyber Police Department of the National Police of Ukraine arrested six members of the Clop ransomware group. Computer equipment, cars, and about $185,000 in cash were confiscated by the authorities.

“Together, law enforcement has managed to shut down the infrastructure from which the virus spreads and block channels for legalizing criminally acquired cryptocurrencies,” the Cyber Police Department of the National Police of Ukraine said in a statement.

According to the Cyber Police Department of the National Police of Ukraine, the Clop ransomware group is responsible for $500 million worth of damages worldwide. The arrest of the six members of the Clop ransomware group was a joint operation from law enforcement agencies in Ukraine, South Korea, and the United States.

A few days after the arrest of the six members of the Clop ransomware group, the group claimed other victims, showing that the arrest of the members didn’t disrupt the operation of the Clop ransomware group. 

In February 2021, French and Ukrainian law enforcement agencies arrested in Ukrain several members of the Egregor ransomware group. Trend Micro, in a statement, said that the arrest of several members of the Egregor ransomware group was made possible, in part, of its assistance.

“Since its first appearance in September 2020, Egregor ransomware has been involved in high-profile attacks against retailers, human resource service companies, and other organizations,” Trend Micro said. “It operated under the ransomware-as-a-service (RaaS) model where groups sell or lease ransomware variants to affiliates, making it relatively easier even for inexperienced cybercriminals to launch attacks. Like some prominent ransomware variants, Egregor employs a ‘double extortion’ technique where the operators threaten affected users with both the loss and public exposure of the encrypted data.”

Ransomware

Ransomware is a persistent and rapidly evolving cybersecurity problem. Ransomware, in general, is a malware that’s traditionally meant to encrypt victim files – preventing victims from accessing their files. After data encryption, attackers then demand from victims ransom payment in exchange for the decryption tool that purportedly could unlock the encrypted files.

Early ransomware attackers demand from their victims to pay only one ransom payment, that is, for the decryption tool. Today’s ransomware attackers demand from their victims two ransom payments, also known as double extortion, one for the decryption tool and the second for the non-publication of the stolen data exfiltrated prior to data encryption.

Clop ransomware enters the victims’ networks through any of the following methods:

. Phishing emails sent to employees of the target organization

. Remote Desktop Protocol (RDP) compromise via brute-force attacks

. Exploitation of known software security vulnerabilities

Similar to Clop ransomware, Egregor ransomware enters the victims’ networks through phishing emails sent to employees of the target organization and RDP compromise. Egregor ransomware has also been known to access victims’ networks through VPN exploits.

Many of today’s notorious ransomware programs are operated under the ransomware-as-a-service (RaaS) model. In a RaaS model, the ransomware developer sells or leases the ransomware program to affiliates who are responsible for spreading the ransomware and generating infections. The developer takes a percentage of the ransom payment and provides the affiliates share of the ransom payment. 

Cybersecurity Best Practices

Here are some of the cybersecurity best practices in preventing or mitigating the effects of ransomware attacks:

. Avoid clicking on links and downloading attachments in emails from questionable sources

. Keep all software up to date

. Protect RDP servers with strong passwords, multi-factor authentication (MFA), virtual private networks (VPNs), and other security protections

. Implement the 3-2-1 backup rule: Make three copies of sensitive data, two copies should be in different formats, and keep one duplicate should be kept offsite.