Blog
/

Inside the SOC

/
October 30, 2024

Post Exploitation Activities on Fortinet Devices: A Network-Based Analysis

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
30
Oct 2024
This blog explores recent findings from Darktrace's Threat Research team on active exploitation campaigns targeting Fortinet appliances. This analysis focuses on the September 2024 exploitation of FortiManager via CVE-2024-47575, alongside related malicious activity observed in June 2024.

Introduction: Uncovering active exploitation of Fortinet vulnerabilities

As part of the Darktrace Threat Research team's routine analysis of October's Patch Tuesday vulnerabilities, the team began searching for signs of active exploitation of a critical vulnerability (CVE-2024-23113) affecting the FortiGate to FortiManager (FGFM) protocol.[1]

Although the investigation was prompted by an update regarding CVE 2024-23113, results of the inquiry yielded evidence of widespread exploitation of Fortinet devices in both June and September 2024 potentially via multiple vulnerabilities including CVE 2024-47575. Analysts identified two clusters of activity involving overlapping indicators of compromise (IoCs), likely constituting unique campaigns targeting Fortinet appliances.

This blog will first highlight the finding and analysis of the network-based indicators of FortiManager post-exploitation activity in September, likely involving CVE 2024-47575. The article will then briefly detail a similar pattern of malicious activity observed in June 2024 that involved similar IoCs that potentially comprises a distinct campaign targeting Fortinet perimeter devices.

Fortinet CVE Disclosures

FortiManager devices allow network administrators to manage Fortinet devices on organizations’ networks.[2] One such subset of devices managed through this method are Fortinet firewalls known as FortiGate. These manager and firewall devices communicate with each other via a custom protocol known as FortiGate to FortiManager (FGFM), whereby devices can perform reachability tests and configuration-related actions and reporting.[3] By default, FortiManager devices operate this protocol via port 541.[4]

Fortinet Product Security Incident Response Team released multiple announcements revealing vulnerabilities within the daemon responsible for implementing operability of the FGFM service. Specifically, CVE 2024-23113 enables attackers to potentially perform arbitrary remote command execution through the use of a specially crafted format string to a FortiGate device running the “fgfm daemon”.[5][6]  Similarly, the exploitation of CVE 2024-47575  could also allow remote command execution due to a missing authentication mechanism when targeting specifically FortiManager devices.[7][8]  Given how prolific both FortiGate and FortiManager devices are within the global IT security ecosystem, Darktrace analysts hypothesized that there may have been specific targeting of such devices within the customer base using these vulnerabilities throughout mid to late 2024.

Campaign Analysis

In light of these vulnerability disclosures, Darktrace’s Threat Research team began searching for signs of active exploitation by investigating file download, lateral movement or tooling activity from devices that had previously received suspicious connections on port 541. The team first noticed increases in suspicious activity involving Fortinet devices particularly in mid-September 2024. Further analysis revealed a similar series of activities involving some overlapping devices identified in June 2024. Analysis of these activity clusters revealed a pattern of malicious activity against likely FortiManager devices, including initial exploitation, payload retrieval, and exfiltration of probable configuration data.

Below is an overview of malicious activity we have observed by sector and region:

Sector and region affected by malicious activity on fortigate devices
The sectors of affected customers listed above are categorized according to the United Kingdom’s Standard Industrial Classification (SIC).

Initial Exploitation of FortiManager Devices

Across many of the observed cases in September, activity began with the initial exploitation of FortiManager devices via incoming connectivity over TLS/SSL. Such activity was detected due to the rarity of the receiving devices accepting connections from external sources, particularly over destination port 541. Within nearly all investigated incidents, connectivity began with the source IP, 45.32.41[.]202, establishing an SSL session with likely FortiManager devices.  Device types were determined through a combination of the devices’ hostnames and the noted TLS certificate issuer for such encrypted connections.

Due to the encrypted nature of the connection, it was not possible to ascertain the exploit used in the analyzed cases. However, given the similarity of activities targeting FortiManager devices and research conducted by outside firms, attackers likely utilized CVE 2024-47575.[9] For example, the source IP initiating the SSL sessions also has been referenced by Mandiant as engaging in CVE 2024-47575 exploitation. In addition to a consistent source IP for the connections, a similar JA3 hash was noted across multiple examined accounts, suggesting a similarity in source process for the activity.

In most cases observed by Darktrace, the incoming connectivity was followed by an outgoing connection on port 443 to the IP 45.32.41[.]202. Uncommon reception of encrypted connections over port 541, followed by the initiation of outgoing SSL connections to the same endpoint would suggest probable successful exploitation of FortiManager CVEs during this time.

Model alert logs highlighting the incoming connectivity over port 541 to the FortiManager devices followed by outgoing connection to the external IP.
Figure 1: Model alert logs highlighting the incoming connectivity over port 541 to the FortiManager devices followed by outgoing connection to the external IP.

Payload Retrieval

Investigated devices commonly retrieved some form of additional content after incoming connectivity over port 541. Darktrace’s Threat Research team noted how affected devices would make HTTP GET requests to the initial exploitation IP for the URI: /dom.js. This URI, suggestive of JavaScript content retrieval, was then validated by the HTTP response content type. Although Darktrace could see the HTTP content of the connections, usage of destination port 443 featured prominently during these HTTP requests, suggesting an attempt at encryption of the session payload details.

Advanced search HTTP log to the exploitation IP noting the retrieval of JavaScript content using the curl user agent.
Figure 2: Advanced search HTTP log to the exploitation IP noting the retrieval of JavaScript content using the curl user agent.
Cyber AI Analyst investigation into the initial exploitation activity. This incident emphasizes the rare external connectivity over port 443 requesting JavaScript content following the incoming connections over port 541.
Figure 3: Cyber AI Analyst investigation into the initial exploitation activity. This incident emphasizes the rare external connectivity over port 443 requesting JavaScript content following the incoming connections over port 541.

The operators of the campaign also appear to have used a consistent user agent for payload retrieval: curl 8.4.0. Usage of an earlier version of the curl (version 7 .86.0) was only observed in one instance. The incorporation of curl utility to establish HTTP connections therefore suggests interaction with command-line utilities on the inspected Fortinet hosts. Command-line interaction also adds validity to the usage of exploits such as CVE 2024-47575 which enable unauthenticated remote command execution. Moreover, given the egress of data seen by the devices receiving this JavaScript content, Darktrace analysts concluded that this payload likely resulted in the configuration aggregation activity noted by external researchers.

Data Exfiltration

Nearly all devices investigated during the September time period performed some form of data exfiltration using the HTTP protocol. Most frequently, devices would initiate these HTTP requests using the same curl user agent already observed during web callback activity.  Again, usage of this tool heavily suggests interaction with the command-line interface and therefore command execution.

The affected device typically made an HTTP POST request to one or both of the following two rare external IPs: 104.238.141[.]143 and 158.247.199[.]37. One of the noted IPs, 104.238.141[.]143, features prominently within external research conducted by Mandiant during this time. These HTTP POST requests nearly always sent data to the /file endpoint on the destination IPs. Analyzed connections frequently noted an HTTP mime type suggestive of compressed archive content. Some investigations also revealed specific filenames for the data sent externally: “.tm”. HTTP POST requests occurred without a specified hostname. This would suggest the IP address may have already been cached locally on the device from a running process or the IP address was hardcoded into the details of unwarranted code running on the system. Moreover, many such POSTs occurred without a GET request, which can indicate exfiltration activity.

Model alert logs noting both the connection to the IP 158.247.199[.]37 over port 443 without a hostname, and the unusual activity metric describing how the request was made without a prior HTTP GET request. Such activity can indicate malicious data exfiltration.
Figure 4: Model alert logs noting both the connection to the IP 158.247.199[.]37 over port 443 without a hostname, and the unusual activity metric describing how the request was made without a prior HTTP GET request. Such activity can indicate malicious data exfiltration.

Interestingly, in many investigations, analysts noticed a lag period between the initial access and exploitation, and the exfiltration of data via HTTP. Such a pause, sometimes over several hours to over a day, could reflect the time needed to aggregate data locally on the host or as a strategic pause in activity to avoid detection. While not present within every compromise activity logs inspected, the delay could represent slight adjustments in behavior during the campaign by the threat actor.

Figure 5: Advanced search logs showing both the payload retrieval and exfiltration activity, emphasizing the gap in time between payload retrieval and exfiltration via HTTP POST request.

HTTP and file identification details identified during this time also directly correspond to research conducted by Mandiant. Not only do we see overlap in IPs identified as receiving the posted data (104.238.141[.]143) we also directly observed an overlap in filenames for the locally aggregated configuration data. Moreover, the gzip mime type identified in multiple customer investigations also corresponds directly to exfiltration activity noted by Mandiant researchers.

Advanced search logs noting the filename and URL of the posted data to one of the exfiltration IPs. The .tm filename corresponds to the locally stored file on affected FortiManager devices analyzed by external researchers.
Figure 6: Advanced search logs noting the filename and URL of the posted data to one of the exfiltration IPs. The .tm filename corresponds to the locally stored file on affected FortiManager devices analyzed by external researchers.

Activity detected in June 2024

Common indicators

Analysts identified a similar pattern of activity between June 23 and June 25. Activity in this period involved incoming connections from the aforementioned IP 45.32.41[.]202 on either port 541 or port 443 followed by an outgoing connection to the source. This behavior was then followed by HTTP POSTs to the previously mentioned IP address 158.247.199[.]37 in addition to the novel IP: 195.85.114[.]78  using same URI ‘/file’ noted above. Given the commonalties in indicators, time period, and observed behaviors, this grouping of exploitation attempts appears to align closely with the campaign described by Mandiant and may represent exploitation of CVE 2024-47575 in June 2024. The customers targeted in June fall into the same regions and sectors as seen those in the September campaign.

Deviations in behavior

Notably, Darktrace detected a different set of actions during the same June timeframe despite featuring the same infrastructure. This activity involved an initial incoming connection from 158.247.199[.]37 to an internal device on either port 541 or port 443. This was then followed by an outgoing HTTP connection to 158.247.199[.]37 on port 443 with a URI containing varying external IPs. Upon further review, analysts noticed the IPs listed may be the public IPs of the targeted victim, suggesting a potential form device registration by the threat actor or exploit validation. While the time period and infrastructure closely align with the previous campaign described, the difference in activity may suggest another threat actor sharing infrastructure or the same threat actor carrying out a different campaign at the same time. Although the IP 45.32.41[.]202 was contacted, paralleling activity seen in September, analysts did notice a different payload received from the external host, a shell script with the filename ver.sh.

AI Analyst timeline noting the suspicious HTTP behavior from a FortiManager device involving the IP: 158.247.199[.] 37.
Figure 7: AI Analyst timeline noting the suspicious HTTP behavior from a FortiManager device involving the IP: 158.247.199[.] 37.

Darktrace's depth of detection and investigation

Darktrace detected spikes in anomalous behavior from Fortinet devices within the customer base between September 22 and 23, 2024. Following an in-depth investigation into affected accounts and hosts, Darktrace identified a clear pattern where one, or multiple, threat actors leveraged CVEs affecting likely FortiManager devices to execute commands on the host, retrieve malicious content, and exfiltrate sensitive data. During this investigation, analysts then identified possibly related activity in June 2024 highlighted above.

The gathering and exfiltration of configuration data from network security management or other perimeter hosts is a technique that can enable future access by threat actors. This parallels activity previously discussed by Darktrace focused on externally facing devices, such as Palo Alto Networks firewall devices.  Malicious entities could utilize stolen configuration data and potentially stored passwords/hashes to gain initial access in the future, irrespective of the state of device patching. This data can also be potentially sold by initial access brokers on illicit sites. Moreover, groups can leverage this information to establish persistence mechanisms within devices and host networks to enable more impactful compromise activity.

Uncover threat pattens before they strike your network

Network and endpoint management services are essential tools for network administrators and will remain a critical part of IT infrastructure. However, these devices are often configured as internet-facing systems, which can unintentionally expose organizations networks' to attacks. Internet exposure provides malicious groups with novel entry routes into target environments. Although threat actors can swap vulnerabilities to access target networks, the exploitation process leaves behind unusual traffic patterns, making their presence detectable with the right network detection tools.

By detecting the unusual patterns of network traffic which inevitably ensue from exploitation of novel vulnerabilities, Darktrace’s anomaly-based detection and response approach can continue to identify and inhibit such intrusion activities irrespective of exploit used. Eulogizing the principle of least privilege, configuration and asset management, and maintaining the CIA Triad across security operations will continue to help security teams boost their defense posture. ‍

See how anomaly-based detection can enhance your security operations—schedule a personalized demo today.

Get a demo button for Darktrace

Credit to Adam Potter (Senior Cyber Analyst), Emma Foulger (Principal Cyber Analyst), Nahisha Nobregas (Senior Cyber Analyst), Hyeongyung Yeom (Principal Cyber Analyst & Analyst Team Lead, East Asia), Sam Lister (Senior Cyber Analyst)

Appendix

Model Alerts

  • Anomalous Connection / Posting HTTP to IP without Hostname
  • Anomalous Connection / Callback on Web Facing Device
  • Anomalous Server Activity / New Internet Facing Server
  • Anomalous Server Activity / Outgoing from Server

Cyber AI Analyst Incidents

  • Possible HTTP Command and Control
  • Possible HTTP Command and Control to Multiple Endpoints

IoCs

Indicator – Type - Description

104.238.141[.]143 -  IP Address  - C2 infrastructure

158.247.199[.]37 - IP Address - C2 infrastructure

45.32.41[.]202 - IP Address - C2 infrastructure

104.238.141[.]143/file – URL - C2 infrastructure

158.247.199[.]37/file  - URL - C2 infrastructure

45.32.41[.]202/dom.js – URL - C2 infrastructure

.tm – Filename - Gzip file

MITRE Attack Framework

Tactic - Technique - Initial Access      

T1190 – Exploiting Public-Facing Application

Execution   T1059 – Command and Scripting Interpreter

T1059.004 – Unix Shell

T1059.008 – Network Device CLI

Discovery   T1083 – File and System Discovery

T1057 – Process Discovery

Collection T1005 – Data From Local System

Command and Control           T1071 – Application Layer Protocols

T1071.001 – Web Protocols

T1573 – Encrypted Channel

T1573.001 – Symmetric Cryptography

T1571 – Non-Standard Port

T1105 – Ingress Tool Transfer

T1572 – Protocol Tunnelling

Exfiltration T1048.003 – Exfiltration Over Unencrypted Non-C2 Protocol

References

{1} https://cloud.google.com/blog/topics/threat-intelligence/fortimanager-zero-day-exploitation-cve-2024-47575/‍

{2} https://docs.fortinet.com/document/fortimanager/6.4.0/ports-and-protocols/606094/fortigate-fortimanager-protocol#:~:text=The%20FortiGate%2DFortiManager%20(FGFM),by%20using%20the%20FGFM%20protocol.

{3)https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/373486/fgfm-fortigate-to-fortimanager-protocol
{4} https://www.fortiguard.com/psirt/FG-IR-24-029
{5} https://www.fortiguard.com/psirt/FG-IR-24-423
{6}https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortimanager.pdf

{7} https://doublepulsar.com/burning-zero-days-fortijump-fortimanager-vulnerability-used-by-nation-state-in-espionage-via-msps-c79abec59773

{8} https://darktrace.com/blog/post-exploitation-activities-on-pan-os-devices-a-network-based-analysis

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Adam Potter
Senior Cyber Analyst
Watch the NIS2 Webinar
Book a 1-1 meeting with one of our experts
Get in touch
Share this article
Trending blogs
1
Darktrace Releases 2024 Half-Year Threat Insights
Aug 6, 2024
2
Introducing ‘Defend Beyond’: Our promise to customers in the face of evolving threats
Aug 27, 2024
3
Darktrace: Microsoft UK Partner of the Year 2024
Jun 27, 2024
4
Navigating buying and adoption journeys for AI cybersecurity tools
Oct 15, 2024
5
How Darktrace won an email security trial by learning the business, not the breach
Oct 9, 2024

More in this series

No items found.

Blog

/

October 31, 2024

/

OT

Understanding the NERC-CIP015 Internal Network Security Monitoring (INSM) Requirements

Default blog imageDefault blog image

Background: NERC CIP-015

In January of 2023 the Federal Energy Regulatory Commission (FERC) released FERC Order 887 which addresses a critical security gap in Critical Infrastructure Protection (CIP) standards, the lack of internal network security monitoring (INSM).

The current NERC CIP standards only require solutions that use traditional detection systems that identify malicious code based on known rules and signatures. The new legislation will now require electric cooperatives to implement INSMs to detect malicious activity in east-west network traffic. INSMs establish a baseline of network activity and detect anomalies that would bypass traditional detection systems, improving an organization’s ability to detect novel threats. Without INSM, organizations have limited visibility into malicious activities inside their networks, leaving them vulnerable if attackers breach initial defenses like firewalls and anti-virus software.

Implementation of NERC CIP-015

Once approved, Bulk Electronic Systems (BESs) will have 36 months to implement INSM, and medium-impact BESs with external routable connectivity (ERC) will have 60 months to do so.

While the approval of the NERC CIP-015 requirements have not been finalized, preparation on the part of electric cooperatives should start as soon as possible. Darktrace is committed to helping electric cooperatives meet the requirements for INSM and help reach compliance standards.

Why is internal network security monitoring important?

NERC CIP-015 aims to enhance the detection of anomalies or unauthorized network activity within CIP environments, underscoring the importance of monitoring East-West traffic within trust zones. This approach enables faster response and recovery times.

INSMs are essential to detecting threats that bypass traditional defenses. For example, insider threats, sophisticated new attack techniques, and threats that exploit compromised credentials—such as those obtained through phishing or other malicious activities—can easily bypass traditional firewalls and antivirus software. These threats either introduce novel methods or leverage legitimate access, making them difficult to detect.

INSMs don’t rely on rules and signatures to detect anomalous activity, they spot abnormalities in network traffic and create alerts based on this activity making them vital to detecting sophisticated threats. Additionally, INSM sits behind the firewall and provides detections utilizing the passive monitoring of east west and north south traffic within the enforcement boundary.

Buyers should be aware of the discrepancies between different INSMs. Some systems require constant tuning and updating, external connectivity forcing holes in segmentation or have intrusive deployments that put sensitive OT assets at risk.

What are the NERC CIP-015 requirements?

The goal of this directive is to ensure that cyber threats are identified early in the attack lifecycle by mandating implementation of security systems that detect and speed up mitigation of malicious activity.

The requirements are divided into three sections:

  • Network security monitoring
  • Data retention for anomalous activity
  • Data protection

NERC CIP-015 emphasizes the importance of having documented processes and evidence of implementation, with a focus on risk-based monitoring, anomaly detection, evaluation, retention of data, and protection against unauthorized access. Below is a breakdown of each requirement.

R1: Network Security Monitoring

The NERC CIP-015 requires the implementation of and a documented process for monitoring networks within Electronic Security Perimeters (ESPs) that contain high and medium impact BES Cyber Systems.

Key parts:

Part 1.1: Use a risk-based rationale to implement network data feeds that monitor connections, devices, and communications.

Part 1.2: Detect anomalous network activity using the data feeds.

Part 1.3: Evaluate the anomalous activity to determine necessary actions.

M1: Evidence for R1 Implementation: Documentation of processes, including risk-based rationale for data collection, detection events, configuration settings, and network baselines.

Incorporating automated solutions for network baselining is essential for effective internal monitoring, especially in diverse environments like substations and control centers. Each environment requires unique baselines—what’s typical for a substation may differ significantly from a control center, making manual monitoring impractical.

A continuous internal monitoring solution powered by artificial intelligence (AI) simplifies this challenge by instantly detecting all connected assets, dynamically learning the environment’s baseline behavior, and identifying anomalies in real-time. Unlike traditional methods, Darktrace’s AI-driven approach requires no external connectivity or repeated tuning, offering a seamless, adaptive solution for maintaining secure operations across all environments.

R2: Data Retention for Anomalous Activity

Documented processes must be in place to retain network security data related to detected anomalies until the required actions are completed.

Note: Data that does not relate to detected anomalies (Part 1.2) is not required to be retained.

M2: Evidence for Data Retention (R2): Documentation of data retention processes, system configurations, or reports showing compliance with R2.

R3: Data Protection: Implement documented processes to protect the collected security monitoring data from unauthorized deletion or modification.

M3: Evidence for Data Protection (R3): Documentation demonstrating how network security monitoring data is protected from unauthorized access or changes.

How to choose the right INSM for your organization?

Several vendors will offer INSM, but how do you choose the right solution for your organization?

Here are seven questions to help you get started evaluating potential INSM vendors:

  1. How does the solution help with ongoing compliance and reporting including CIP-015? Or any other regulations we comply with?
  2. Does the solution provide real-time monitoring of east-west traffic across critical systems? And what kind of threats has it proven capable of finding?
  3. How deep is the traffic visibility—does it offer Layer 7 (application) insights, or is it limited to Layers 3-4?
  4. Is the solution compatible with our existing infrastructure (firewalls, IDS/IPS, SIEM, OT networks)?
  5. Is this solution inline, passive, or hybrid? What impact will it have on network latency?
  6. Does the vendor have experience with electric utilities or critical infrastructure environments?
  7. Where and how are logs and monitoring data stored?

How Darktrace helps electric utilities with INSM requirements

Darktrace's ActiveAI Security Platform is uniquely designed to continuously monitor network activity and detect anomalous activity across both IT and OT environments successfully detecting insider threats and novel ransomware, while accelerating time to detection and incident reporting.

Most INSM solutions require repeated baselining, which creates more work and increases the likelihood of false positives, as even minor deviations trigger alerts. Since networks are constantly changing, baselines need to adjust in real time. Unlike these solutions, Darktrace does not depend on external connectivity or cloud access over the public internet. Our passive network analysis requires no agents or intrusive scanning, minimizing disruptions and reducing risks to OT systems.

Darktrace's AI-driven threat detection, asset management, and incident response capabilities can help organizations comply with the requirements of NERC CIP-015 for internal network security monitoring and data protection. Built specifically to deploy in OT environments, Darktrace / OT comprehensively manages, detects, evaluates, and protects network activity and anomalous events across IT and OT environments, facilitating adherence to regulatory requirements like data retention and anomaly management.

See how INSM with Darktrace can enhance your security operations, schedule a personalized demo today.

‍

Disclaimer

The information provided in this blog is intended for informational purposes only and reflects Darktrace’s understanding of the NERC CIP-015 INSM requirements as of the publication date. While every effort has been made to ensure the accuracy and reliability of the content, Darktrace makes no warranties or representations regarding its accuracy, completeness, or applicability to specific situations. This blog does not constitute legal or compliance advice and readers are encouraged to consult with qualified professionals for guidance specific to their circumstances. Darktrace disclaims any liability for actions taken or not taken based on the information contained herein.

References

1.     https://www.nerc.com/pa/Stand/Reliability%20Standards/CIP-015-1.pdf

Continue reading
About the author
Daniel Simonds
Director of Operational Technology

Blog

/

October 24, 2024

/

Inside the SOC

Phishing and Persistence: Darktrace’s Role in Defending Against a Sophisticated Account Takeover

Default blog imageDefault blog image

The exploitation of SaaS platforms

As businesses continue to grow and evolve, the need for sharing ideas through productivity and cloud Software-as-a-Service (SaaS) platforms is becoming increasingly crucial. However, these platforms have also become prime targets for cyber attackers.

Threat actors often exploit these widely-used services to gain unauthorized access, steal sensitive information, and disrupt business operations. The growing reliance on SaaS platforms makes them attractive entry points for cybercriminals, who use sophisticated techniques such as phishing, social engineering, and malware to compromise these systems.

Services like Microsoft 365 are regularly targeted by threat actors looking for an entry point into an organization’s environment to carry out malicious activities. Securing these platforms is crucial to protect business data and ensure operational continuity.

Darktrace / EMAIL detection of the phishing attack

In a recent case, Darktrace observed a customer in the manufacturing sector receiving a phishing email that led to a threat actor logging in and creating an email rule. Threat actors often create email rules to move emails to their inbox, avoiding detection. Additionally, Darktrace detected a spoofed domain registered by the threat actor. Despite already having access to the customer’s SaaS account, the actor seemingly registered this domain to maintain persistence on the network, allowing them to communicate with the spoofed domain and conduct further malicious activity.

Darktrace / EMAIL can help prevent compromises like this one by blocking suspicious emails as soon as they are identified. Darktrace’s AI-driven email detection and response recognizes anomalies that might indicate phishing attempts and applies mitigative actions autonomously to prevent the escalation of an attack.

Unfortunately, in this case, Darktrace was not configured in Autonomous Response mode at the time of the attack, meaning actions had to be manually applied by the customer’s security team. Had it been fully enabled, it would have held the emails, preventing them from reaching the intended recipient and stopping the attack at its inception.

However, Darktrace’s Managed Threat Detection alerted the Security Operations Center (SOC) team to the compromise, enabling them to thoroughly investigate the incident and notify the customer before further damage could occur.

The Managed Threat Detection service continuously monitors customer networks for suspicious activities that may indicate an emerging threat. When such activities are detected, alerts are sent to Darktrace’s expert Cyber Analysts for triage, significantly speeding up the remediation process.

Attack Overview

On May 2, 2024, Darktrace detected a threat actor targeting a customer in the manufacturing sector then an unusual login to their SaaS environment was observed prior to the creation of a new email rule.

Darktrace immediately identified the login as suspicious due to the rarity of the source IP (31.222.254[.]27) and ASN, coupled with the absence of multi-factor authentication (MFA), which was typically required for this account.

The new email rule was intended to mark emails as read and moved to the ‘Conversation History’ folder for inbound emails from a specific domain. The rule was named “….,,,”, likely the attacker attempting to setup their new rule with an unnoteworthy name to ensure it would not be noticed by the account’s legitimate owner. Likewise, by moving emails from a specific domain to ‘Conversation History’, a folder that is rarely used by most users, any phishing emails sent by that domain would remain undetected by the user.

Darktrace’s detection of the unusual SaaS login and subsequent creation of the new email rule “….,,,”.
Figure 1: Darktrace’s detection of the unusual SaaS login and subsequent creation of the new email rule “….,,,”.

The domain in question was identified as being newly registered and an example of a typosquat domain. Typosquatting involves registering new domains with intentional misspelling designed to convince users to visit fake, and often malicious, websites. This technique is often used in phishing campaigns to create a sense of legitimacy and trust and deceive users into providing sensitive information. In this case, the suspicious domain closely resembled several of the customer’s internal domains, indicating an attempt to impersonate the organization’s legitimate internal sites to gain the target’s trust. Furthermore, the creation of this lookalike domain suggests that the attack was highly targeted at this specific customer.

Interestingly, the threat actor registered this spoofed domain despite already having account access. This was likely intended to ensure persistence on the network without having to launch additional phishing attacks. Such use of spoofed domain could allow an attacker to main a foothold in their target network and escalate their malicious activities without having to regain access to the account. This persistence can be used for various purposes, including data exfiltration, spreading malware, or launching further attacks.

Following this, Darktrace detected a highly anomalous email being sent to the customer’s account from the same location as the initial unsual SaaS login. Darktrace’s anomaly-based detection is able to identify threats that human security teams and traditional signature-based methods might miss. By analyzing the expected behavior of network users, Darktrace can recognize the subtle deviations from the norm that may indicate malicious activity. Unfortunately, in this instance, without Darktrace’s Autonomous Response capability enabled, the phishing email was able to successfully reach the recipient. While Darktrace / EMAIL did suggest that the email should be held from the recipients inbox, the customer was required to manually approve it.

Despite this, the Darktrace SOC team were still able to support the customer as they were subscribed to the Managed Threat Detection service. Following the detection of the highlight anomalous activity surrounding this compromise, namely the unusual SaaS login followed by a new email rule, an alert was sent to the Darktrace SOC for immediate triage, who then contacted the customer directly urging immediate action.

Conclusion

This case underscores the need to secure SaaS platforms like Microsoft 365 against sophisticated cyber threats. As businesses increasingly rely on these platforms, they become prime targets for attackers seeking unauthorized access and disruption.

Darktrace’s anomaly-based detection and response capabilities are crucial in identifying and mitigating such threats. In this instance, Darktrace detected a phishing email that led to a threat actor logging in and creating a suspicious email rule. The actor also registered a spoofed domain to maintain persistence on the network.

Darktrace / EMAIL, with its AI-driven detection and analysis, can block suspicious emails before they reach the intended recipient, preventing attacks at their inception. Meanwhile, Darktrace’s SOC team promptly investigated the activity and alerted the customer to the compromise, enabling them to take immediate action to remediate the issue and prevent any further damage.

Credit to Vivek Rajan (Cyber Security Analyst) and Ryan Traill (Threat Content Lead).

Appendices

Darktrace Model Detections

  • ‍SaaS / Access / Unusual External Source for SaaS Credential Use‍
  • ‍SaaS / Compromise / Login From Rare Endpoint While User Is Active
  • SaaS / Resource / Unusual Access to Delegated Resource by Non Owner
  • SaaS / Email Nexus / Unusual Login Location Following Sender Spoof
  • Compliance / Anomalous New Email Rule
  • SaaS / Compromise / Unusual Login and New Email Rule

Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

‍31.222.254[.]27 – IP -  Suspicious Login Endpoint

MITRE ATT&CK Mapping

Tactic – Technqiue – Sub-technique of (if applicable)

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Cloud Service Dashboard – DISCOVERY - T1538

Compromise Accounts - RESOURCE DEVELOPMENT - T1586

Steal Web Session Cookie - CREDENTIAL ACCESS - T1539

Outlook Rules – PERSISTENCE - T1137.005 - T1137

Continue reading
About the author
Vivek Rajan
Cyber Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI