Blog
/

Ransomware

Threat Finds

Thought Leadership

/
March 31, 2021

Why Most Ransomware Attacks Occur "After Hours"

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
31
Mar 2021
Cyber-criminals target weekends and holidays to strike while employees are away. Discover how defensive AI can protect your business 24/7.

Ransomware: An unwanted present

Darktrace regularly observes an increase in cyber-attacks carried out during holidays, weekends, and outside of working hours. It is clear that such ‘off peak’ attacks allow easy exploitation of standard organizational practices and human vulnerabilities.

As reduced staff wind down and employees mentally and physically log off from the workplace, there is a decline in the speed of detection and triage within an enterprise. This allows threat actors to sneak in unnoticed. Without real-time autonomous systems, when executed these unexpected attacks have a much greater impact on response and recovery.

One of the most frequent threats detected out of hours is ransomware. In 76% of infections, the encryption process begins either after hours or during the weekend. Darktrace was alerted to a ransomware incident which was executed in the early hours of a client’s network on Christmas Day, when most employees were offline.

Figure 1: Timeline of the Christmas Day ransomware breach

Over a week before the encryption began, an initial foothold was established on an unassuming desktop. Using this vector, the threat actor was able to move laterally and gain access to two domain controllers – servers used to verify users and authenticate requests. The two servers then made unusual command and control (C2) connections to a rare endpoint linked to ransomware. Next, the threat went into hiding. Although Darktrace had alerted to this activity at every stage, the security team was under great stress during the December period and did not manage to action even these highly critical alerts. Without Darktrace / NETWORK or Proactive Threat Notifications (PTNs), the threat remained uninterrupted.

It suddenly re-emerged after hours on December 24 and utilized its additional privileges to write suspicious executable files to a range of internal devices. A pre-determined set of company data was exfiltrated and a ransomware payload downloaded from the same cloud destination.

A cyber-attack striking on a public holiday is likely to destabilize communication – who is responsible for dealing with it? Are they hard to reach? Are there different protocols for an out-of-hours breach? When unexpected during the holidays, these questions may be surprisingly hard to answer. When answers finally arrive, it is often too late – the damage has already been done.

Once dealt with, there are also repercussions for evaluation: security personnel will be needed to investigate what happened and the future consequences of the attack. If internal staff are hard to mobilize, and external security services come at a premium, this process can be arduous and key evidence may be lost. In turn, the company will be left open to similar attacks in the future.

Saturday night fearware

Holidays clearly pose a human and logistical vulnerability. However, it is often overlooked that these same down periods occur on a small scale throughout the year – at the end of every week. Darktrace has observed a huge surge in weekend attacks in recent months.

Figure 2: Diagram of the key terms Darktrace has observed over the past six months in out-of-hours model breaches

This includes another ransomware incident, which struck a hospitality organization based in the UK. A company device was compromised when a user unintentionally accessed a harmful email. The infection exploited cleartext password files to laterally move to four other devices, including critical servers which it then used to host outbound spam and further disseminate. For several following weekends, compromised devices made a large volume of open or Tor-hosted C2 connections to endpoints associated with the XINOF ransomware.

This example shows that out-of-hours infections can come from any vector, and human compliance errors can be exploited to quickly propagate malware and hide before the security team returns to work on Monday. With many data breaches already taking months to discover, threat actors are looking to extend their concealment by implementing the initial compromise at times with decreased monitoring.

Improving detection of these first compromises and adapting to smaller out-of-hours periods may lead to improved response and adjustment for larger holidays as well. But for a permanent fix, enterprises need a proactive approach.

The solution which never sleeps

In the case study above, Autonomous Response was possible at every attack stage, had it been switched on in active mode. Darktrace / EMAIL would have stopped the initial compromise by identifying the anomalous attachment and quarantining the infection before it could enter the network. Once inside, the critical servers exploited would not have been compromised, as the malicious login activity using gathered passwords would have been halted until verified. Finally, connections to the malicious sites containing the XINOF payload could have been blocked, stopping further damages from occurring.

Unlike a human, AI never sleeps, and never takes a holiday. Instead, the AI stays active around the clock, containing all types of threats in their earliest stages. This prevents malicious activity from escalating while giving human security teams valuable airtime to react and remediate the root cause of any incidents.

If a security team requires an extra set of eyes to augment their investigation, incidents can also be mitigated with Proactive Threat Notifications (PTNs). This service funnels high-severity detections straight into Darktrace’s customer-dedicated SOC to be investigated by expert cyber analysts. The Darktrace PTN SOC has a follow-the-sun approach to monitoring customer environments, meaning that organizations are protected from attacks around the clock.

Timing is everything

The case studies in this blog should serve as a reminder of the need for 24/7 attentiveness. As security professionals increase their skills and creativity in combating threats, malicious actors continue to adapt themselves and are using timing to their advantage during attacks. Now more than ever, it is clear that autonomous AI-based detection is the only means to remove the advantage of timing from threat actors so that even when the office is closed or the laptop is switched off, your security remains on.

Thanks to Darktrace Product Manager Gabriel Few-Wiegratz for his insights.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Max Heinemeyer
Chief Product Officer

Max is a cyber security expert with over a decade of experience in the field, specializing in a wide range of areas such as Penetration Testing, Red-Teaming, SIEM and SOC consulting and hunting Advanced Persistent Threat (APT) groups. At Darktrace, Max is closely involved with Darktrace’s strategic customers & prospects. He works with the R&D team at Darktrace, shaping research into new AI innovations and their various defensive and offensive applications. Max’s insights are regularly featured in international media outlets such as the BBC, Forbes and WIRED. Max holds an MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.

Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

November 7, 2024

/

Inside the SOC

Onomastics Gymnastics: How Darktrace Detects Spoofing and Business Email Compromise in Multi-Name Users

Default blog imageDefault blog image

Note: For privacy reasons, actual surnames and email addresses observed in these incidents below have been replaced with fictitious placeholder names, using the common Spanish names “Fulano” and “Mengano”.

Naming conventions

Modeling names and their variants of members of an organization is a critical component to properly detect if those same names and variants are being spoofed by malicious actors. For many predominantly English-speaking organizations, these variants can largely be captured by variants of a person’s given name (e.g. James-Jimmy-Jim) and a consistent, singular surname or family name (e.g. Smith). Naming conventions, however, are far from universal. This piece will review how Darktrace / EMAIL manages the common naming conventions of much of the Spanish-speaking world, and can use its modeling to create high-fidelity detections of multiple types of spoofing attempts.

A brief summary of the common convention across Spain and much of Spanish-speaking America: most people are given one or two given names (e.g. Roberto, Juan, María, Natalia), and their surnames are the first surname of their father, followed by the first surname of their mother. While there are various exceptions to this norm, the below graphic Wikipedia [1][2] highlights the general rule.

Example Spanish naming convention for father “José García Torres” and mother “María Acosta Gómez” for child “Pablo García Acosta”. If shortened to one surname, the convention holds the child would be referred to as “Pablo García”
Figure 1: Example Spanish naming convention for father “José García Torres” and mother “María Acosta Gómez” for child “Pablo García Acosta”. If shortened to one surname, the convention holds the child would be referred to as “Pablo García” [1].

Detection of improper name usage

Implicit in the above comment that shortening to one surname follows the convention of using the first surname, shortening to the second surname is often a tell-tale sign of someone unfamiliar with the person or their broader culture. This can be a useful corroborating feature in detecting a spoof attempt – analogous to a spelling error.

In the case of a Spanish customer, this misuse of name shortening contributed to the detection of a spoof attempt trying to solicit a response by impersonating an internal user forwarding information about ‘Data Protection’.

Figure 2: The Cyber AI Analyst summary of the Darktrace / EMAIL detections shows the use of the Gmail sender impersonating Isabel Maria Fulano Mengano, but incorrectly uses the second surname Mengano.

While the limited communication history from the sender and the nature of the text content already marks the mail as suspicious, Darktrace / EMAIL notes the personal name used in the email is similar to a high-value user (‘whale’ to use the terminology of spearphishing). The additional context provided by the detection of the attempted spoof prompted more severe actioning of this email, leading to a ‘Hold’ action instead of a less-severe ‘Unspoof’ action via a banner on the email.

The content summary of the sender showing the ‘Personal’ field of the email being ‘Isabel Mengano’, breaking from the standard name-shortening convention. The additional metrics identify features that might be anomalous about the sender.
Figure 3: The content summary of the sender showing the ‘Personal’ field of the email being ‘Isabel Mengano’, breaking from the standard name-shortening convention. The additional metrics identify features that might be anomalous about the sender.

Malicious email properly using both surnames

Misusing the name-shortening convention is not the only way that Darktrace / EMAIL can detect spoofing attempts. In the case of another Spanish customer,  Darktrace observed a whale impersonation being sent to 230 users with solicitation content, but no links or attachments. Although the name was modeled internally in the “Surname, Given-name” format, Darktrace identified the spoofing attempt targeting a high-value user and took action, blocking the series of emails from reaching end-user inboxes to prevent unsuspecting users from responding.

Cyber AI Analyst summary of a suspicious email
Figure 4: Cyber AI Analyst summary of a suspicious email. The personal field is visible as ‘juan fulano mengano’, which is consistent with the reverse-order modelled user ‘fulano mengano, juan’. The subject line ‘Urgent Request’ sent to 230 users gives an intuitive indicator of the emails potentially being part of a malicious solicitation campaign.

In Summary: A case of onomastics gymnastics

The variety in valid usage of human language can be a barrier to evaluating when a given text is benign or malicious. Despite this, Darktrace / EMAIL is designed to manage this variety, as exemplified by the detections of two spoofing attempts seen against organizations using the distinct Spanish-speaking world’s common naming convention. The scope of this design as seen in this onomastic context, extends to a wide range of detections surrounding emails and their behavioral anomalies.

Credit to Roberto Romeu (Principal Cyber Analyst), Justin Torres (Senior Cyber Analyst) and Natalia Sánchez Rocafort (Senior Analyst Consultant).

Darktrace / Email solution brief screenshot

Secure Your Inbox with Cutting-Edge AI Email Protection

Discover the most advanced cloud-native AI email security solution to protect your domain and brand while preventing phishing, novel social engineering, business email compromise, account takeover, and data loss.

  • Gain up to 13 days of earlier threat detection and maximize ROI on your current email security
  • Experience 20-25% more threat blocking power with Darktrace / EMAIL
  • Stop the 58% of threats bypassing traditional email security

References

[1] https://en.wikipedia.org/wiki/Naming_customs_of_Hispanic_America

[2] https://en.wikipedia.org/wiki/Spanish_naming_customs

Continue reading
About the author
Roberto Romeu
Senior SOC Analyst

Blog

/

October 31, 2024

/

OT

Understanding the NERC-CIP015 Internal Network Security Monitoring (INSM) Requirements

Default blog imageDefault blog image

Background: NERC CIP-015

In January of 2023 the Federal Energy Regulatory Commission (FERC) released FERC Order 887 which addresses a critical security gap in Critical Infrastructure Protection (CIP) standards, the lack of internal network security monitoring (INSM).

The current NERC CIP standards only require solutions that use traditional detection systems that identify malicious code based on known rules and signatures. The new legislation will now require electric cooperatives to implement INSMs to detect malicious activity in east-west network traffic. INSMs establish a baseline of network activity and detect anomalies that would bypass traditional detection systems, improving an organization’s ability to detect novel threats. Without INSM, organizations have limited visibility into malicious activities inside their networks, leaving them vulnerable if attackers breach initial defenses like firewalls and anti-virus software.

Implementation of NERC CIP-015

Once approved, Bulk Electronic Systems (BESs) will have 36 months to implement INSM, and medium-impact BESs with external routable connectivity (ERC) will have 60 months to do so.

While the approval of the NERC CIP-015 requirements have not been finalized, preparation on the part of electric cooperatives should start as soon as possible. Darktrace is committed to helping electric cooperatives meet the requirements for INSM and help reach compliance standards.

Why is internal network security monitoring important?

NERC CIP-015 aims to enhance the detection of anomalies or unauthorized network activity within CIP environments, underscoring the importance of monitoring East-West traffic within trust zones. This approach enables faster response and recovery times.

INSMs are essential to detecting threats that bypass traditional defenses. For example, insider threats, sophisticated new attack techniques, and threats that exploit compromised credentials—such as those obtained through phishing or other malicious activities—can easily bypass traditional firewalls and antivirus software. These threats either introduce novel methods or leverage legitimate access, making them difficult to detect.

INSMs don’t rely on rules and signatures to detect anomalous activity, they spot abnormalities in network traffic and create alerts based on this activity making them vital to detecting sophisticated threats. Additionally, INSM sits behind the firewall and provides detections utilizing the passive monitoring of east west and north south traffic within the enforcement boundary.

Buyers should be aware of the discrepancies between different INSMs. Some systems require constant tuning and updating, external connectivity forcing holes in segmentation or have intrusive deployments that put sensitive OT assets at risk.

What are the NERC CIP-015 requirements?

The goal of this directive is to ensure that cyber threats are identified early in the attack lifecycle by mandating implementation of security systems that detect and speed up mitigation of malicious activity.

The requirements are divided into three sections:

  • Network security monitoring
  • Data retention for anomalous activity
  • Data protection

NERC CIP-015 emphasizes the importance of having documented processes and evidence of implementation, with a focus on risk-based monitoring, anomaly detection, evaluation, retention of data, and protection against unauthorized access. Below is a breakdown of each requirement.

R1: Network Security Monitoring

The NERC CIP-015 requires the implementation of and a documented process for monitoring networks within Electronic Security Perimeters (ESPs) that contain high and medium impact BES Cyber Systems.

Key parts:

Part 1.1: Use a risk-based rationale to implement network data feeds that monitor connections, devices, and communications.

Part 1.2: Detect anomalous network activity using the data feeds.

Part 1.3: Evaluate the anomalous activity to determine necessary actions.

M1: Evidence for R1 Implementation: Documentation of processes, including risk-based rationale for data collection, detection events, configuration settings, and network baselines.

Incorporating automated solutions for network baselining is essential for effective internal monitoring, especially in diverse environments like substations and control centers. Each environment requires unique baselines—what’s typical for a substation may differ significantly from a control center, making manual monitoring impractical.

A continuous internal monitoring solution powered by artificial intelligence (AI) simplifies this challenge by instantly detecting all connected assets, dynamically learning the environment’s baseline behavior, and identifying anomalies in real-time. Unlike traditional methods, Darktrace’s AI-driven approach requires no external connectivity or repeated tuning, offering a seamless, adaptive solution for maintaining secure operations across all environments.

R2: Data Retention for Anomalous Activity

Documented processes must be in place to retain network security data related to detected anomalies until the required actions are completed.

Note: Data that does not relate to detected anomalies (Part 1.2) is not required to be retained.

M2: Evidence for Data Retention (R2): Documentation of data retention processes, system configurations, or reports showing compliance with R2.

R3: Data Protection: Implement documented processes to protect the collected security monitoring data from unauthorized deletion or modification.

M3: Evidence for Data Protection (R3): Documentation demonstrating how network security monitoring data is protected from unauthorized access or changes.

How to choose the right INSM for your organization?

Several vendors will offer INSM, but how do you choose the right solution for your organization?

Here are seven questions to help you get started evaluating potential INSM vendors:

  1. How does the solution help with ongoing compliance and reporting including CIP-015? Or any other regulations we comply with?
  2. Does the solution provide real-time monitoring of east-west traffic across critical systems? And what kind of threats has it proven capable of finding?
  3. How deep is the traffic visibility—does it offer Layer 7 (application) insights, or is it limited to Layers 3-4?
  4. Is the solution compatible with our existing infrastructure (firewalls, IDS/IPS, SIEM, OT networks)?
  5. Is this solution inline, passive, or hybrid? What impact will it have on network latency?
  6. Does the vendor have experience with electric utilities or critical infrastructure environments?
  7. Where and how are logs and monitoring data stored?

How Darktrace helps electric utilities with INSM requirements

Darktrace's ActiveAI Security Platform is uniquely designed to continuously monitor network activity and detect anomalous activity across both IT and OT environments successfully detecting insider threats and novel ransomware, while accelerating time to detection and incident reporting.

Most INSM solutions require repeated baselining, which creates more work and increases the likelihood of false positives, as even minor deviations trigger alerts. Since networks are constantly changing, baselines need to adjust in real time. Unlike these solutions, Darktrace does not depend on external connectivity or cloud access over the public internet. Our passive network analysis requires no agents or intrusive scanning, minimizing disruptions and reducing risks to OT systems.

Darktrace's AI-driven threat detection, asset management, and incident response capabilities can help organizations comply with the requirements of NERC CIP-015 for internal network security monitoring and data protection. Built specifically to deploy in OT environments, Darktrace / OT comprehensively manages, detects, evaluates, and protects network activity and anomalous events across IT and OT environments, facilitating adherence to regulatory requirements like data retention and anomaly management.

See how INSM with Darktrace can enhance your security operations, schedule a personalized demo today.

Disclaimer

The information provided in this blog is intended for informational purposes only and reflects Darktrace’s understanding of the NERC CIP-015 INSM requirements as of the publication date. While every effort has been made to ensure the accuracy and reliability of the content, Darktrace makes no warranties or representations regarding its accuracy, completeness, or applicability to specific situations. This blog does not constitute legal or compliance advice and readers are encouraged to consult with qualified professionals for guidance specific to their circumstances. Darktrace disclaims any liability for actions taken or not taken based on the information contained herein.

References

1.     https://www.nerc.com/pa/Stand/Reliability%20Standards/CIP-015-1.pdf

Continue reading
About the author
Daniel Simonds
Director of Operational Technology
Your data. Our AI.
Elevate your network security with Darktrace AI