Executive summary

• Recently, Darktrace detected an attack targeting an Internet connected camera commonly used in CCTV surveillance. This attack is a variant of the Mirai malware, an old threat that is still used to target IoT devices.
• IoT devices, such as Internet-connected cameras, are becoming common in personal and business environments. However, threats targeting IoT are difficult to detect and often go unnoticed since these devices effortlessly connect to digital infrastructure. This results in a greatly increased attack surface for businesses.
• Attackers know that security for IoT devices is often severely lacking and continue to target these vulnerable devices.
• Since traditional methods of antivirus and other legacy security approaches are powerless on IoT devices, Darktrace’s Cyber AI Platform fills the gap in protecting these essential appliances.

Introduction

In late May, Darktrace detected the Mirai malware infecting an Internet-facing DVR camera owned by a logistics company in Canada. Mirai, first discovered in 2016, continuously scans the Internet for the IP addresses of vulnerable devices in the Internet of Things (IoT), and then turns these devices into bots that can be used as part of botnets for large-scale network attacks.

By drawing on a bespoke, evolving understanding of what is normal for the network, Darktrace caught each stage in this attack’s lifecycle. However, because this company was still conducting their 30-day Proof of Value, Antigena was not in active mode and the attack continued past the point of initial compromise. Had Antigena been in active mode, the attack would not have advanced past initial compromise.

Timeline

Figure 1: This timeline roughly outlines the major attack phases over three days of activity

Technical analysis

At the time of the initial breach, this specific botnet’s infrastructure was not yet known to open source intelligence (OSINT). Darktrace, however, detected an EXE download from a location not previously visited by the network.

After the first anomalous EXE download, another was downloaded approximately twenty minutes later. The malware then reached out to multiple IP addresses that were statistically rare for the network. Specifically, the compromised device began transferring large amounts of data to an IP address in China.

Figure 2: An overview of Darktrace detections

Darktrace, by leveraging machine learning algorithms in a protocol agnostic capacity, analyzed this individual device’s transfers within the context of a continuously evolving understanding of what is normal both for this device and for the wider organization. It was therefore able to immediately flag all of these transfers as unusual.

This activity was fully investigated and reported on by Darktrace’s Cyber AI Analyst. A sample of the AI Analyst’s report is shown below. The Suspicious File Download, the Unusual Repeated Connections, and the Unusual External Data Transfer are all presented as unexpected events that call for further investigation. The destination IP of the suspicious download was determined to have 100% hostname rarity relative to what is normal for the organization.

Figure 3: Darktrace’s Cyber AI Analyst autonomously triages the attack

Moreover, the hash of the file, highlighted in a red box in the figure above, revealed that it was a well-known file related to the Mirai Botnet. However, with no antivirus or other security defending the IoT camera, this had gone undetected.

A one-click analysis of the infected device shows a timeline of the model breaches that occurred and graphs the activity to give the report’s readers a quick understanding of the successive stages of the attack. Here, we see the second and third stages of the attack’s lifecycle, in which it starts DDoS against other devices in order to complete its mission while simultaneously continuing outgoing connections to rare destinations in order to sustain its presence.

Figure 4: The device event log showing the list of model breaches on May 23

Conclusion

Interestingly, the client saw no indicators of this activity beyond a sluggish network. This change in network activity was only explained after being identified by Darktrace. Once the client was promptly notified, the compromise was deescalated, and discovering it was a DVR security camera, the client took the device offline.

As this customer was still concluding their trial deployment, Antigena was not in full autonomous mode. However, if it had been, Antigena would have responded with a two-tiered action to prevent the device from communicating with the malicious endpoint, cutting the compromised connection before the attack had gained its foothold.

Learn more about Darktrace Antigena

IoCs:

IoCComment37.49.226[.]246Camera seen downloading software from rare destination117.27.239[.]28Camera seen sending data to a new external device37.49.226[.]246, 43.227.220[.]153, 43.248.188[.]28Camera has been detected breaching multiple models within a single hour216.146.43[.]70, 216.146.43[.]71Camera making connections to command and control infrastructure related to dyndns[.]org

Darktrace model breaches:

• Anomalous Connection / Uncommon 1GiB Outbound
• Unusual Activity / Unusual External Activity
• Unusual Activity / Enhanced Unusual External Data Transfer
• Unusual Activity / Unusual External Data to New IPs
• Device / Initial Breach Chain Compromise
• Anomalous Server Activity / Outgoing from Server
• Anomalous Connection / Data Sent to New External Device
• Anomalous Connection / Multiple Connections to New External UDP Port
• Anomalous Connection / Data Sent to Rare Domain
• Anomalous File / EXE from Rare External Location
• Anomalous File / Internet Facing System File Download