Discover why Cyber Monday poses a cybersecurity nightmare and how security teams need to prepare for the 'hacking season' in this blog post by Darktrace.
As Black Friday and Cyber Monday approach, retailers are gearing up for what is predicted to be a holiday season worth around $214 billion in e-commerce sales. They are not alone in making special preparations: in the cyber-criminal underworld, hackers are looking to use the influx of limited-time offers to incite a sense of urgency and lure victims with phishing emails disguised as Black Friday deals.
And as the holiday season draws nearer, another familiar attack vector threatens to dampen the festive cheer. With security teams enjoying well-earned breaks, upcoming public holidays present the perfect opportunity for ransomware attackers to strike. We covered this topic in detail earlier this year, and over the Fourth of July bank holiday weekend, the ‘largest ever ransomware attack’ wreaked havoc across the world, affecting up to 1,500 organizations.
With sophisticated festive phishing and the recent well-documented surge in ransomware, the stage is set for this holiday season to be one filled with cyber disruption. Security teams need all the help they can get to face this year’s ‘hacking season’ with best-in-class technology that keeps a watchful eye over the digital enterprise 365 days a year.
Attacks know no boundaries
Most of us tend to use personal email addresses for our holiday shopping, but in an era of remote and hybrid working, this can easily have knock-on effects, granting attackers a backdoor into the corporate sphere. The pandemic has seen a greater number of organizations focused on enabling remote and flexible working in whatever ways possible to ‘get the job done.’
BYOD (‘Bring Your Own Device’) has seen a surge in popularity to enable flexible working, increase efficiency, reduce costs, and give employees the opportunity to use IT they feel comfortable with.
From a digital perspective, this has led to increasing convergence of our personal and professional lives. Phishing emails that target personal email accounts – often using more relaxed email security measures – therefore put organizations at risk. Malicious executable files may grant an attacker access to the device, and from here they can pivot into corporate activity, and infiltrate an organization through a single, careless employee.
It’s not just BYOD users who are at risk. Despite the warnings, password reuse continues to be widespread, meaning a successful credential-grab on a personal account can potentially give attackers the keys to a wide range of corporate accounts, whether it’s Microsoft 365 or any number of other internal systems.
A longer holiday calendar expands the attack ‘calendar’ surface
This year, disruptions in the global supply chain are already causing problems for shipping and delays. In response, retailers like Best Buy are offering special deals well ahead of Black Friday with the price promise that they’ll refund the difference should the price drop further on the day itself.
This extends the time period in which these offers are promoted, and thereby the attack ‘calendar’ surface, gifting attackers an extra few weeks through which to launch seasonal scams.
And we know from experience that attackers can get creative, not only with emails disguised as Black Friday offers and promotions, but also spoofing attacks posing as delivery firms, or other third-party logistics suppliers. They will try anything which might induce a click on a link or attachment.
They see you when you’re sleeping: Hackers won’t take holiday
During public holidays, IT and security teams drastically reduce in size. Attackers know this, and it no longer comes as a surprise when some of the largest cyber-attacks of the year are detonated during this time. Adopting reliable autonomous security, and in particular autonomous response, has never been more important in ensuring organizations stay protected.
With opportunistic hackers looking to spoil the holiday season for some quick returns, we cannot rely on human teams alone. Human beings are fallible: they get tired, they need breaks, and they get complacent. One simple misconfiguration can leave an unprotected device exposed to the Internet, opening up the wider digital ecosystem to attack.
Breaches are inevitable, and organizations are no longer throwing all their resources into stopping an attacker from getting inside. The focus is increasingly shifting to being able to spot their behavior once they do get in, and taking autonomous action at machine speed to minimize cyber disruption.
Self-Learning AI does exactly this, learning every user and device in the organization from the ground up, without relying on static rules or signatures, and with no pre-conceptions of what constitutes a ‘threat’. And unlike humans, the technology works around the clock, without needing breaks or unwinding as the year draws to an end.
Darktrace’s AI learns ‘self’ across the entire digital estate, from the email layer, to the cloud, network, and endpoints. And crucially, Autonomous Response takes action on behalf of security teams, and can respond to ransomware in under 10 seconds, minimizing disruption, and saving teams from facing the new year with a lengthy and costly incident clean-up.
Like this and want more?
Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Newsletter
Like this and want more?
Stay up to date on the latest industry news and insights.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Mariana Pereira
VP, Cyber Innovation
Mariana is the VP of Cyber Innovation at Darktrace, and works closely with the development, analyst, and marketing teams to advise technical and non-technical audiences on how best to augment cyber resilience, and how to implement AI technology as a means of defense. She speaks regularly at international events, with a specialism in presenting on sophisticated, AI-powered email attacks. She holds an MBA from the University of Chicago, and speaks several languages including French, Italian, and Portuguese.
Lifting the Fog: Darktrace’s Investigation into Fog Ransomware
Introduction to Fog Ransomware
As ransomware attacks continue to be launched at an alarming rate, Darktrace’s Threat Research team has identified that familiar strains like Akira, LockBit, and BlackBasta remain among the most prevalent threats impacting its customers, as reported in the First 6: Half-Year Threat Report 2024. Despite efforts by law agencies, like dismantling the infrastructure of cybercriminals and shutting down their operations [2], these groups continue to adapt and evolve.
As such, it is unsurprising that new ransomware variants are regularly being created and launched to get round law enforcement agencies and increasingly adept security teams. One recent example of this is Fog ransomware.
What is Fog ransomware?
Fog ransomware is strain that first appeared in the wild in early May 2024 and has been observed actively using compromised virtual private network (VPN) credentials to gain access to organization networks in the education sector in the United States.
Darktrace's detection of Fog Ransomware
In June 2024, Darktrace observed instances of Fog ransomware across multiple customer environments. The shortest time observed from initial access to file encryption in these attacks was just 2 hours, underscoring the alarming speed with which these threat actors can achieve their objectives.
Darktrace identified key activities typical of a ransomware kill chain, including enumeration, lateral movement, encryption, and data exfiltration. In most cases, Darktrace was able to successfully halt the progression Fog attacks in their early stages by applying Autonomous Response actions such as quarantining affected devices and blocking suspicious external connections.
To effectively illustrate the typical kill chain of Fog ransomware, this blog focuses on customer environments that did not have Darktrace’s Autonomous Response enabled. In these cases, the attack progressed unchecked and reached its intended objectives until the customer received Darktrace’s alerts and intervened.
Darktrace’s Coverage of Fog Ransomware
Initial Intrusion
After actors had successfully gained initial access into customer networks by exploiting compromised VPN credentials, Darktrace observed a series of suspicious activities, including file shares, enumeration and extensive scanning. In one case, a compromised domain controller was detected making outgoing NTLM authentication attempts to another internal device, which was subsequently used to establish RDP connections to a Windows server running Hyper-V.
Given that the source was a domain controller, the attacker could potentially relay the NTLM hash to obtain a domain admin Kerberos Ticket Granting Ticket (TGT). Additionally, incoming NTLM authentication attempts could be triggered by tools like Responder, and NTLM hashes used to encrypt challenge response authentication could be abused by offline brute-force attacks.
Darktrace also observed the use of a new administrative credential on one affected device, indicating that malicious actors were likely using compromised privileged credentials to conduct relay attacks.
Establish Command-and-Control Communication (C2)
In many instances of Fog ransomware investigated by Darktrace’s Threat Research team, devices were observed making regular connections to the remote access tool AnyDesk. This was exemplified by consistent communication with the endpoint “download[.]anydesk[.]com” via the URI “/AnyDesk.exe”. In other cases, Darktrace identified the use of another remote management tool, namely SplashTop, on customer servers.
In ransomware attacks, threat actors often use such legitimate remote access tools to establish command-and-control (C2) communication. The use of such services not only complicates the identification of malicious activities but also enables attackers to leverage existing infrastructure, rather than having to implement their own.
Internal Reconnaissance
Affected devices were subsequently observed making an unusual number of failed internal connections to other internal locations over ports such as 80 (HTTP), 3389 (RDP), 139 (NetBIOS) and 445 (SMB). This pattern of activity strongly indicated reconnaissance scanning behavior within affected networks. A further investigation into these HTTP connections revealed the URIs “/nice ports”/Trinity.txt.bak”, commonly associated with the use of the Nmap attack and reconnaissance tool.
Simultaneously, some devices were observed engaging in SMB actions targeting the IPC$ share and the named pipe “srvsvc” on internal devices. Such activity aligns with the typical SMB enumeration tactics, whereby attackers query the list of services running on a remote host using a NULL session, a method often employed to gather information on network resources and vulnerabilities.
Lateral Movement
As attackers attempted to move laterally through affected networks, Darktrace observed suspicious RDP activity between infected devices. Multiple RDP connections were established to new clients, using devices as pivots to propagate deeper into the networks, Following this, devices on multiple networks exhibited a high volume of SMB read and write activity, with internal share drive file names being appended with the “.flocked” extension – a clear sign of ransomware encryption. Around the same time, multiple “readme.txt” files were detected being distributed across affected networks, which were later identified as ransom notes.
Further analysis of the ransom note revealed that it contained an introduction to the Fog ransomware group, a summary of the encryption activity that had been carried out, and detailed instructions on how to communicate with the attackers and pay the ransom.
Data Exfiltration
In one of the cases of Fog ransomware, Darktrace’s Threat Research team observed potential data exfiltration involving the transfer of internal files to an unusual endpoint associated with the MEGA file storage service, “gfs302n515[.]userstorage[.]mega[.]co[.]nz”.
This exfiltration attempt suggests the use of double extortion tactics, where threat actors not only encrypt victim’s data but also exfiltrate it to threaten public exposure unless a ransom is paid. This often increases pressure on organizations as they face the risk of both data loss and reputational damage caused by the release of sensitive information.
Darktrace’s Cyber AI Analyst autonomously investigated what initially appeared to be unrelated events, linking them together to build a full picture of the Fog ransomware attack for customers’ security teams. Specifically, on affected networks Cyber AI Analyst identified and correlated unusual scanning activities, SMB writes, and file appendages that ultimately suggested file encryption.
Conclusion
As novel and fast-moving ransomware variants like Fog persist across the threat landscape, the time taken for from initial compromise to encryption has significantly decreased due to the enhanced skill craft and advanced malware of threat actors. This trend particularly impacts organizations in the education sector, who often have less robust cyber defenses and significant periods of time during which infrastructure is left unmanned, and are therefore more vulnerable to quick-profit attacks.
Traditional security methods may fall short against these sophisticated attacks, where stealthy actors evade detection by human-managed teams and tools. In these scenarios Darktrace’s AI-driven product suite is able to quickly detect and respond to the initial signs of compromise through autonomous analysis of any unusual emerging activity.
When Darktrace’s Autonomous Response capability was active, it swiftly mitigated emerging Fog ransomware threats by quarantining devices exhibiting malicious behavior to contain the attack and blocking the exfiltration of sensitive data, thus preventing customers from falling victim to double extortion attempts.
Credit to Qing Hong Kwa (Senior Cyber Analyst and Deputy Analyst Team Lead, Singapore) and Ryan Traill (Threat Content Lead
Appendices
Darktrace Model Detections:
- Anomalous Server Activity::Anomalous External Activity from Critical Network Device
- Anomalous Connection::SMB Enumeration
- Anomalous Connection::Suspicious Read Write Ratio and Unusual SMB
- Anomalous Connection::Uncommon 1 GiB Outbound
- Anomalous File::Internal::Additional Extension Appended to SMB File
What you need to know about FAA Security Protection Regulations 2024
Overview of FAA Rules 2024
Objective
The goal of the Federal Aviation Administration amended rules is to create new design standards that protect airplane systems from intentional unauthorized electronic interactions (IUEI), which can pose safety risks. The timely motivation for this goal is due to the ongoing trend in aircraft design, which features a growing integration of airplane, engine, and propeller systems, along with expanded connectivity to both internal and external data networks and services.
“This proposed rulemaking would impose new design standards to address cybersecurity threats for transport category airplanes, engines, and propellers. The intended effect of this proposed action is to standardize the FAA’s criteria for addressing cybersecurity threats, reducing certification costs and time while maintaining the same level of safety provided by current special conditions.” (1)
Background
Increasing integration of aircraft systems with internal and external networks raises cybersecurity vulnerability concerns.
Key vulnerabilities include:
Field Loadable Software
Maintenance laptops
Public networks (e.g., Internet)
Wireless sensors
USB devices
Satellite communications
Portable devices and flight bags
Requirements for Applicants
Applicants seeking design approval must:
Provide isolation or protection from unauthorized access
Prevent inadvertent or malicious changes to aircraft systems
Establish procedures to maintain cybersecurity protections
Purpose
“These changes would introduce type certification and continued airworthiness requirements to protect the equipment, systems, and networks of transport category airplanes, engines, and propellers against intentional unauthorized electronic interactions (IUEI)1 that could create safety hazards. Design approval applicants would be required to identify, assess, and mitigate such hazards, and develop Instructions for Continued Airworthiness (ICA) that would ensure such protections continue in service.” (1)
Key points:
Introduce new design standards to address cybersecurity threats for transport category airplanes, engines, and propellers.
Aim to reduce certification costs and time while maintaining safety levels similar to current special conditions
Applicant Responsibilities for Identifying, Assessing, and Mitigating IUEI Risks
The proposed rule requires applicants to safeguard airplanes, engines, and propellers from intentional unauthorized electronic interactions (IUEI). To do this, they must:
Identify and assess risks: Find and evaluate any potential electronic threats that could harm safety.
Mitigate risks: Take steps to prevent these threats from causing problems, ensuring the aircraft remain safe and functional.
Let’s break down each of the requirements:
Performing risk analysis
“For such identification and assessment of security risk, the applicant would be required to perform a security risk analysis to identify all threat conditions associated with the system, architecture, and external or internal interfaces.”(3)
Challenge
The complexity and variety of OT devices make it difficult and time-consuming to identify and associate CVEs with assets. Security teams face several challenges:
Prioritization Issues: Sifting through extensive CVE lists to prioritize efforts is a struggle.
Patch Complications: Finding corresponding patches is complicated by manufacturer delays and design flaws.
Operational Constraints: Limited maintenance windows and the need for continuous operations make it hard to address vulnerabilities, often leaving them unresolved for years.
Inadequate Assessments: Standard CVE assessments may not fully capture the risks associated with increased connectivity, underscoring the need for a contextualized risk assessment approach.
This highlights the need for a more effective and tailored approach to managing vulnerabilities in OT environments.
Assessing severity of risks
“The FAA would expect such risk analysis to assess the severity of the effect of threat conditions on associated assets (system, architecture, etc.), consistent with the means of compliance the applicant has been using to meet the FAA’s special conditions on this topic.” (3)
Challenge
As shown by the MITRE ATT&CK® Techniques for ICS matrices, threat actors can exploit many avenues beyond just CVEs. To effectively defend against these threats, security teams need a broader perspective, considering lateral movement and multi-stage attacks.
Challenges in Vulnerability Management (VM) cycles include:
Initiation: VM cycles often start with email updates from the Cybersecurity and Infrastructure Security Agency (CISA), listing new CVEs from the NIST database.
Communication: Security practitioners must survey and forward CVE lists to networking teams at facilities that might be running the affected assets. Responses from these teams are inconsistent, leading vulnerability managers to push patches that may not fit within limited maintenance windows.
Asset Tracking: At many OT locations, determining if a company is running a specific firmware version can be extremely time-consuming. Teams often rely on spreadsheets and must perform manual checks by physically visiting production floors ("sneaker-netting").
Coordination: Plant engineers and centralized security teams must exchange information to validate asset details and manually score vulnerabilities, further complicating and delaying remediation efforts.
Determine likelihood of exploitation
“Such assessment would also need to analyze these vulnerabilities for the likelihood of exploitation.” (3)
Challenge
Even when a vulnerability is identified, its actual impact can vary significantly based on the specific configurations, processes, and technologies in use within the organization. This creates challenges for OT security practitioners:
Risk Assessment: Accurately assessing and prioritizing the risk becomes difficult without a clear understanding of how the vulnerability affects their unique systems.
Decision-Making: Practitioners may struggle to determine whether immediate action is necessary, balancing the risk of operational downtime against the need for security.
Potential Consequences: This uncertainty can lead to either leaving critical systems exposed or causing unnecessary disruptions by applying measures that aren't truly needed.
This complexity underscores the challenge of making informed, timely decisions in OT security environments.
Vulnerability mitigation
“The proposed regulation would then require each applicant to 'mitigate' the vulnerabilities, and the FAA expects such mitigation would occur through the applicant’s installation of single or multilayered protection mechanisms or process controls to ensure functional integrity, i.e., protection.” (3)
Challenge
OT security practitioners face a constant challenge in balancing security needs with the requirement to maintain operational uptime. In many OT environments, especially in critical infrastructure, applying security patches can be risky:
Risk of Downtime: Patching can disrupt essential processes, leading to significant financial losses or even safety hazards.
Operational Continuity vs. Security: Practitioners often prioritize operational continuity, sometimes delaying timely security updates.
Alternative Strategies: To protect systems without direct patching, they must implement compensating controls, further complicating security efforts.
This delicate balance between security and uptime adds complexity to the already challenging task of securing OT environments.
Establishing procedures/playbooks
“Finally, each applicant would be required to include the procedures within their instructions for continued airworthiness necessary to maintain such protections.” (3)
Challenge
SOC teams typically have a lag before their response, leading to a higher dwell time and bigger overall costs. On average, only 15% of the total cost of ransomware is affiliated with the ransom itself (2). The rest is cost from business interruption. This means it's crucial that organizations can respond and recover earlier.
Darktrace / OT enabling compliance and enhanced cybersecurity
Darktrace's OT solution addresses the complex challenges of cybersecurity compliance in Operational Technology (OT) environments by offering a comprehensive approach to risk management and mitigation.
Key risk management features include:
Contextualized Risk Analysis: Darktrace goes beyond traditional vulnerability scoring, integrating IT, OT, and CVE data with MITRE techniques to map critical attack paths. This helps in identifying and prioritizing vulnerabilities based on their exposure, difficulty of exploitation, and network impact.
Guidance on Remediation: When patches are unavailable, Darktrace provides alternative strategies to bolster defenses around vulnerable assets, ensuring unpatched systems are not left exposed—a critical need in OT environments where operational continuity is essential.
AI-Driven Adaptability: Darktrace's AI continuously adapts to your organization as it grows; refining incident response playbooks bespoke to your environment in real-time. This ensures that security teams have the most up-to-date, tailored strategies, reducing response times and minimizing the impact of security incidents.
Ready to learn more?
Darktrace / OT doesn’t just offer risk management capabilities. It is the only solution that leverages Self-Learning AI to understand your normal business operations, allowing you to detect and stop insider, known, unknown, and zero-day threats at scale.
Dive deeper into how Darktrace / OT secures critical infrastructure organizations with in-depth insights on its advanced capabilities. Download the Darktrace / OT Solution Brief to explore the technology behind its AI-driven protection and see how it can transform your OT security strategy.