Blog
/

Inside the SOC

/
March 22, 2024

What are Botnets and How Darktrace Uncovers Them

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
22
Mar 2024
Learn how Darktrace detected and implemented defense protocols against Socks5Systemz botnet before any threat to intelligence had been published.

What are botnets?

Although not a recent addition to the threat landscape, botnets persist as a significant concern for organizations, with many threat actors utilizing them for political, strategic, or financial gain. Botnets pose a particularly persistent threat to security teams; even if one compromised device is detected, attackers will likely have infected multiple devices and can continue to operate. Moreover, threat actors are able to easily replace the malware communication channels between infected devices and their command-and-control (C2) servers, making it incredibly difficult to remove the infection.

Botnet example: Socks5Systemz

One example of a botnet recently investigated by the Darktrace Threat Research team is Socks5Systemz. Socks5Systemz is a proxy-for-rent botnet, whereby actors can rent blocks of infected devices to perform proxying services.  Between August and November 2023, Darktrace detected indicators of Socks5Systemz botnet compromise within a cross-industry section of the customer base. Although open-source intelligence (OSINT) research of the botnet only appeared in November 2023, the anomaly-based approach of Darktrace DETECT™ allowed it to identify multiple stages of the network-based activity on affected customer systems well before traditional rules and signatures would have been implemented.

Darktrace’s Cyber AI Analyst™ complemented DETECT’s successful identification of Socks5Systemz activity on customer networks, playing a pivotal role in piecing together the seemingly separate events that comprised the wider compromise. This allowed Darktrace to build a clearer picture of the attack, empowering its customers with full visibility over emerging incidents.

In the customer environments highlighted in this blog, Darktrace RESPOND™ was not configured to operate autonomously. As a result, Socks5Systemz attacks were able to advance through their kill chains until customer security teams acted upon Darktrace’s detections and began their remediation procedures.

What is Socks5Systemz?

The Socks5Systemz botnet is a proxy service where individuals can use infected devices as proxy servers.

These devices act as ‘middlemen’, forwarding connections from malicious actors on to their intended destination. As this additional connectivity conceals the true origin of the connections, threat actors often use botnets to increase their anonymity. Although unauthorized proxy servers on a corporate network may not appear at first glance to be a priority for organizations and their security teams, complicity in proxy botnets could result in reputational damage and significant financial losses.

Since it was first observed in the wild in 2016, the Socks5Systemz botnet has grown steadily, seemingly unnoticed by cyber security professionals, and has infected a reported 10,000 devices worldwide [1]. Cyber security researchers noted a high concentration of compromised devices in India, with lower concentrations of devices infected in the United States, Latin America, Australia and multiple European and African countries [2]. Renting sections of the Socks5Systemz botnet costs between 1 USD and 4,000 USD, with options to increase the threading and time-range of the rentals [2]. Due to the lack of affected devices in Russia, some threat researchers have concluded that the botnet’s operators are likely Russian [2].

Darktrace’s Coverage of Socks5Systemz

The Darktrace Threat Research team conducted investigations into campaign-like activity across the customer base between August and November 2023, where multiple indicators of compromise (IoCs) relating to the Socks5Systemz proxy botnet were observed. Darktrace identified several stages of the attack chain described in static malware analysis by external researchers. Darktrace was also able to uncover additional IoCs and stages of the Socks5Systemz attack chain that had not featured in external threat research.

Delivery and Execution

Prior research on Socks5Systemz notes how the malware is typically delivered via user input, with delivery methods including phishing emails, exploit kits, malicious ads, and trojanized executables downloaded from peer-to-peer (P2P) networks [1].

Threat actors have also used separate malware loaders such as PrivateLoader and Amadey deliver the Socks5Systemz payload. These loaders will drop executable files that are responsible for setting up persistence and injecting the proxy bot into the infected device’s memory [2]. Although evidence of initial payload delivery did not appear during its investigations, Darktrace did discover IoCs relating to PrivateLoader and Amadey on multiple customer networks. Such activity included HTTP POST requests using PHP to rare external IPs and HTTP connections with a referrer header field, indicative of a redirected connection.

However, additional adjacent activity that may suggest initial user execution and was observed during Darktrace’s investigations. For example, an infected device on one deployment made a HTTP GET request to a rare external domain with a “.fun” top-level domain (TLD) for a PDF file. The URI also appears to have contained a client ID. While this download and HTTP request likely corresponded to the gathering and transmission of further telemetry data and infection verification [2], the downloaded PDF file may have represented a malicious payload.

Advanced Search log details highlighting a device infected by Socks5Systemz downloading a suspicious PDF file.
Figure 1: Advanced Search log details highlighting a device infected by Socks5Systemz downloading a suspicious PDF file.

Establishing C2 Communication  

Once the proxy bot has been injected into the device’s memory, the malware attempts to contact servers owned by the botnet’s operators. Across several customer environments, Darktrace identified infected devices attempting to establish connections with such C2 servers. First, affected devices would make repeated HTTP GET requests over port 80 to rare external domains; these endpoints typically had “.ua” and “.ru” TLDs. The majority of these connection attempts were not preceded by a DNS host lookup, suggesting that the domains were already loaded in the device’s cache memory or hardcoded into the code of running processes.

Figure 2: Breach log data connections identifying repeated unusual HTTP connections over port 80 for domains without prior DNS host lookup.

While most initial HTTP GET requests across investigated incidents did not feature DNS host lookups, Darktrace did identify affected devices on a small number of customer environments performing a series of DNS host lookups for seemingly algorithmically generated domains (DGA). These domains feature the same TLDs as those seen in connections without prior DNS host lookups.  

Figure 3: Cyber AI Analyst data indicating a subset of DGAs queried via DNS by infected devices.

These DNS requests follow the activity reported by researchers, where infected devices query a hardcoded DNS server controlled by the threat actor for an DGA domain [2]. However, as the bulk of Darktrace’s investigations presented HTTP requests without a prior DNS host lookup, this activity indicates a significant deviation from the behavior reported by OSINT sources. This could indicate that multiple variations of the Socks5Systemz botnet were circulating at the time of investigation.

Most hostnames observed during this time of investigation follow a specific regular expression format: /[a-z]{7}\.(ua|net|info|com|ru)/ or /[a-z0-9]{15}\.(ua)/. Darktrace also noticed the HTTP GET requests for DGA domains followed a consistent URI pattern: /single.php?c=<STRING>. The requests were also commonly made using the “Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)” user agent over port 80.

This URI pattern observed during Darktrace’s investigations appears to reflect infected devices contacting Socks5Systemz C2 servers to register the system and details of the host, and signal it is ready to receive further instructions [2]. These URIs are encrypted with a RC4 stream cipher and contain information relating to the device’s operating system and architecture, as well as details of the infection.

The HTTP GET requests during this time, which involved devices made to a variety a variety of similar DGA domains, appeared alongside IP addresses that were later identified as Socks5Systemz C2 servers.

Figure 4: Cyber AI Analyst investigation details highlighting HTTP GET activity whereby RC4 encrypted data is sent to proxy C2 domains.

However, not all affected devices observed by Darktrace used DGA domains to transmit RC4 encoded data. Some investigated systems were observed making similar HTTP GET requests over port 80, albeit to the external domain: “bddns[.]cc”, using the aforementioned Mozilla user agent. During these requests, Darktrace identified a consistent URI pattern, similar to that seen in the DGA domain GET requests: /sign/<RC4 cipher text>.  

Darktrace DETECT recognized the rarity of the domains and IPs that were connected to by affected devices, as well as the usage of the new Mozilla user agent.  The HTTP connections, and the corresponding Darktrace DETECT model breaches, parallel the analysis made by external researchers: if the initial DGA DNS requests do not return a valid C2 server, infected devices connect to, and request the IP address of a server from, the above-mentioned domain [2].

Connection to Proxy

After sending host and infection details via HTTP and receiving commands from the C2 server, affected devices were frequently observed initiating activity to join the Sock5Systemz botnet. Infected hosts would first make HTTP GET requests to an IP identified as Socks5Systemz’s proxy checker application, usually sending the URI “proxy-activity.txt” to the domain over the HTTP protocol. This likely represents an additional validation check to confirm that the infected device is ready to join the botnet.

Figure 5: Cyber AI Analyst investigation detailing HTTP GET requests over port 80 to the Socks5Systemz Proxy Checker Application.

Following the final validation checks, devices would then attempt TCP connections to a range of IPs, which have been associated with BackConnect proxy servers, over port 1074. At this point, the device is able to receive commands from actors who login to and operate the corresponding BackConnect server. This BackConnect server will transmit traffic from the user renting the segment of the botnet [2].

Darktrace observed a range of activity associated with this stage of the attack, including the use of new or unusual user agents, connections to suspicious IPs, and other anomalous external connectivity which represented a deviation from affected devices’ expected behavior.

Additional Activities Following Proxy Addition

The Darktrace Threat Research team found evidence of the possible deployment of additional malware strains during their investigation into devices affected by Socks5Systemz. IoCs associated with both the Amadey and PrivateLoader loader malware strains, both of which are known to distribute Socks5Systemz, were also observed on affected devices. Additionally, Darktrace observed multiple infected systems performing cryptocurrency mining operations around the time of the Sock5Systemz compromise, utilizing the MinerGate protocol to conduct login and job functions, as well as making DNS requests for mining pools.

While such behavior would fall outside of the expected activity for Socks5Systemz and cannot be definitively attributed to it, Darktrace did observe devices affected by the botnet performing additional malicious downloads and operations during its investigations.

Conclusion

Ultimately, Darktrace’s anomaly-based approach to threat detection enabled it to effectively identify and alert for malicious Socks5Systemz botnet activity long before external researchers had documented its IoCs and tactics, techniques, and procedures (TTPs).  

In fact, Darktrace not only identified multiple distinct attack phases later outlined in external research but also uncovered deviations from these expected patterns of behavior. By proactively detecting emerging threats through anomaly detection rather than relying on existing threat intelligence, Darktrace is well positioned to detect evolving threats like Socks5Systemz, regardless of what their future iterations might look like.

Faced with the threat of persistent botnets, it is crucial for organizations to detect malicious activity in its early stages before additional devices are compromised, making it increasingly difficult to remediate. Darktrace’s suite of products enables the swift and effective detection of such threats. Moreover, when enabled in autonomous response mode, Darktrace RESPOND is uniquely positioned to take immediate, targeted actions to contain these attacks from the onset.

Credit to Adam Potter, Cyber Security Analyst, Anna Gilbertson, Cyber Security Analyst

Appendices

DETECT Model Breaches

  • Anomalous Connection / Multiple Failed Connections to Rare Endpoint
  • Anomalous Connection / Multiple Connections to New External TCP Port
  • Compromise / Beaconing Activity To External Rare
  • Compromise / DGA Beacon
  • Compromise / Beacon to Young Endpoint
  • Compromise / Slow Beaconing Activity To External Rare
  • Compromise / HTTP Beaconing to Rare Destination
  • Compromise / Quick and Regular Windows HTTP Beaconing
  • Compromise / Agent Beacon (Medium Period)
  • Compromise / Agent Beacon (Long Period)
  • Device / New User Agent
  • Device / New User Agent and New IP

Cyber AI Analyst Incidents

  • Possible HTTP Command and Control
  • Possible HTTP Command and Control to Multiple Endpoints
  • Unusual Repeated Connections
  • Unusual Repeated Connections to Multiple Endpoints
  • Multiple DNS Requests for Algorithmically Generated Domains

Indicators of Compromise

IoC - Type - Description

185.141.63[.]172 - IP Address - Socks5Systemz C2 Endpoint

193.242.211[.]141 - IP Address - Socks5Systemz C2 Endpoint

109.230.199[.]181 - IP Address - Socks5Systemz C2 Endpoint

109.236.88[.]134 - IP Address - Socks5Systemz C2 Endpoint

217.23.5[.]14 - IP Address - Socks5Systemz Proxy Checker App

88.80.148[.]8 - IP Address - Socks5Systemz Backconnect Endpoint

88.80.148[.]219 - IP Address - Socks5Systemz Backconnect Endpoint

185.141.63[.]4 - IP Address - Socks5Systemz Backconnect Endpoint

185.141.63[.]2 - IP Address - Socks5Systemz Backconnect Endpoint

195.154.188[.]211 - IP Address - Socks5Systemz Backconnect Endpoint

91.92.111[.]132 - IP Address - Socks5Systemz Backconnect Endpoint

91.121.30[.]185 - IP Address - Socks5Systemz Backconnect Endpoint

94.23.58[.]173 - IP Address - Socks5Systemz Backconnect Endpoint

37.187.148[.]204 - IP Address - Socks5Systemz Backconnect Endpoint

188.165.192[.]18 - IP Address - Socks5Systemz Backconnect Endpoint

/single.php?c=<RC4 data hex encoded> - URI - Socks5Systemz HTTP GET Request

/sign/<RC4 data hex encoded> - URI - Socks5Systemz HTTP GET Request

/proxy-activity.txt - URI - Socks5Systemz HTTP GET Request

datasheet[.]fun - Hostname - Socks5Systemz C2 Endpoint

bddns[.]cc - Hostname - Socks5Systemz C2 Endpoint

send-monitoring[.]bit - Hostname - Socks5Systemz C2 Endpoint

MITRE ATT&CK Mapping

Command and Control

T1071 - Application Layer Protocol

T1071.001 – Web protocols

T1568 – Dynamic Resolution

T1568.002 – Domain Generation Algorithms

T1132 – Data Encoding

T1132 – Non-Standard Encoding

T1090 – Proxy

T1090.002 – External Proxy

Exfiltration

T1041 – Exfiltration over C2 channel

Impact

T1496 – Resource Hijacking

References

1. https://www.bleepingcomputer.com/news/security/socks5systemz-proxy-service-infects-10-000-systems-worldwide/

2. https://www.bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Adam Potter
Cyber Analyst
Book a 1-1 meeting with one of our experts
Share this article
Use cases
No items found.
PRODUCT SPOTLIGHT
No items found.
Core coverages
No items found.

More in this series

No items found.

Blog

/

September 6, 2024

/

Inside the SOC

Lifting the Fog: Darktrace’s Investigation into Fog Ransomware

Default blog imageDefault blog image

Introduction to Fog Ransomware

As ransomware attacks continue to be launched at an alarming rate, Darktrace’s Threat Research team has identified that familiar strains like Akira, LockBit, and BlackBasta remain among the most prevalent threats impacting its customers, as reported in the First 6: Half-Year Threat Report 2024. Despite efforts by law agencies, like dismantling the infrastructure of cybercriminals and shutting down their operations [2], these groups continue to adapt and evolve.

As such, it is unsurprising that new ransomware variants are regularly being created and launched to get round law enforcement agencies and increasingly adept security teams. One recent example of this is Fog ransomware.

What is Fog ransomware?

Fog ransomware is strain that first appeared in the wild in early May 2024 and has been observed actively using compromised virtual private network (VPN) credentials to gain access to organization networks in the education sector in the United States.

Darktrace's detection of Fog Ransomware

In June 2024, Darktrace observed instances of Fog ransomware across multiple customer environments. The shortest time observed from initial access to file encryption in these attacks was just 2 hours, underscoring the alarming speed with which these threat actors can achieve their objectives.

Darktrace identified key activities typical of a ransomware kill chain, including enumeration, lateral movement, encryption, and data exfiltration. In most cases, Darktrace was able to successfully halt the progression Fog attacks in their early stages by applying Autonomous Response actions such as quarantining affected devices and blocking suspicious external connections.

To effectively illustrate the typical kill chain of Fog ransomware, this blog focuses on customer environments that did not have Darktrace’s Autonomous Response enabled. In these cases, the attack progressed unchecked and reached its intended objectives until the customer received Darktrace’s alerts and intervened.

Darktrace’s Coverage of Fog Ransomware

Initial Intrusion

After actors had successfully gained initial access into customer networks by exploiting compromised VPN credentials, Darktrace observed a series of suspicious activities, including file shares, enumeration and extensive scanning. In one case, a compromised domain controller was detected making outgoing NTLM authentication attempts to another internal device, which was subsequently used to establish RDP connections to a Windows server running Hyper-V.

Given that the source was a domain controller, the attacker could potentially relay the NTLM hash to obtain a domain admin Kerberos Ticket Granting Ticket (TGT). Additionally, incoming NTLM authentication attempts could be triggered by tools like Responder, and NTLM hashes used to encrypt challenge response authentication could be abused by offline brute-force attacks.

Darktrace also observed the use of a new administrative credential on one affected device, indicating that malicious actors were likely using compromised privileged credentials to conduct relay attacks.

Establish Command-and-Control Communication (C2)

In many instances of Fog ransomware investigated by Darktrace’s Threat Research team, devices were observed making regular connections to the remote access tool AnyDesk. This was exemplified by consistent communication with the endpoint “download[.]anydesk[.]com” via the URI “/AnyDesk.exe”. In other cases, Darktrace identified the use of another remote management tool, namely SplashTop, on customer servers.

In ransomware attacks, threat actors often use such legitimate remote access tools to establish command-and-control (C2) communication. The use of such services not only complicates the identification of malicious activities but also enables attackers to leverage existing infrastructure, rather than having to implement their own.

Internal Reconnaissance

Affected devices were subsequently observed making an unusual number of failed internal connections to other internal locations over ports such as 80 (HTTP), 3389 (RDP), 139 (NetBIOS) and 445 (SMB). This pattern of activity strongly indicated reconnaissance scanning behavior within affected networks. A further investigation into these HTTP connections revealed the URIs “/nice ports”/Trinity.txt.bak”, commonly associated with the use of the Nmap attack and reconnaissance tool.

Simultaneously, some devices were observed engaging in SMB actions targeting the IPC$ share and the named pipe “srvsvc” on internal devices. Such activity aligns with the typical SMB enumeration tactics, whereby attackers query the list of services running on a remote host using a NULL session, a method often employed to gather information on network resources and vulnerabilities.

Lateral Movement

As attackers attempted to move laterally through affected networks, Darktrace observed suspicious RDP activity between infected devices. Multiple RDP connections were established to new clients, using devices as pivots to propagate deeper into the networks, Following this, devices on multiple networks exhibited a high volume of SMB read and write activity, with internal share drive file names being appended with the “.flocked” extension – a clear sign of ransomware encryption. Around the same time, multiple “readme.txt” files were detected being distributed across affected networks, which were later identified as ransom notes.

Further analysis of the ransom note revealed that it contained an introduction to the Fog ransomware group, a summary of the encryption activity that had been carried out, and detailed instructions on how to communicate with the attackers and pay the ransom.

Packet capture (PCAP) of the ransom note file titled “readme.txt”.
Figure 1: Packet capture (PCAP) of the ransom note file titled “readme.txt”.

Data Exfiltration

In one of the cases of Fog ransomware, Darktrace’s Threat Research team observed potential data exfiltration involving the transfer of internal files to an unusual endpoint associated with the MEGA file storage service, “gfs302n515[.]userstorage[.]mega[.]co[.]nz”.

This exfiltration attempt suggests the use of double extortion tactics, where threat actors not only encrypt victim’s data but also exfiltrate it to threaten public exposure unless a ransom is paid. This often increases pressure on organizations as they face the risk of both data loss and reputational damage caused by the release of sensitive information.

Darktrace’s Cyber AI Analyst autonomously investigated what initially appeared to be unrelated events, linking them together to build a full picture of the Fog ransomware attack for customers’ security teams. Specifically, on affected networks Cyber AI Analyst identified and correlated unusual scanning activities, SMB writes, and file appendages that ultimately suggested file encryption.

Cyber AI Analyst’s analysis of encryption activity on one customer network.
Figure 2: Cyber AI Analyst’s analysis of encryption activity on one customer network.
Figure 3: Cyber AI Analysts breakdown of the investigation process between the linked incident events on one customer network.

Conclusion

As novel and fast-moving ransomware variants like Fog persist across the threat landscape, the time taken for from initial compromise to encryption has significantly decreased due to the enhanced skill craft and advanced malware of threat actors. This trend particularly impacts organizations in the education sector, who often have less robust cyber defenses and significant periods of time during which infrastructure is left unmanned, and are therefore more vulnerable to quick-profit attacks.

Traditional security methods may fall short against these sophisticated attacks, where stealthy actors evade detection by human-managed teams and tools. In these scenarios Darktrace’s AI-driven product suite is able to quickly detect and respond to the initial signs of compromise through autonomous analysis of any unusual emerging activity.

When Darktrace’s Autonomous Response capability was active, it swiftly mitigated emerging Fog ransomware threats by quarantining devices exhibiting malicious behavior to contain the attack and blocking the exfiltration of sensitive data, thus preventing customers from falling victim to double extortion attempts.

Credit to Qing Hong Kwa (Senior Cyber Analyst and Deputy Analyst Team Lead, Singapore) and Ryan Traill (Threat Content Lead

Appendices

Darktrace Model Detections:

- Anomalous Server Activity::Anomalous External Activity from Critical Network Device

- Anomalous Connection::SMB Enumeration

- Anomalous Connection::Suspicious Read Write Ratio and Unusual SMB

- Anomalous Connection::Uncommon 1 GiB Outbound

- Anomalous File::Internal::Additional Extension Appended to SMB File

- Compliance::Possible Cleartext LDAP Authentication

- Compliance::Remote Management Tool On Server

- Compliance::SMB Drive Write

- Compromise::Ransomware::SMB Reads then Writes with Additional Extensions

- Compromise::Ransomware::Possible Ransom Note Write

- Compromise::Ransomware::Ransom or Offensive Words Written to SMB

- Device::Attack and Recon Tools

- User::New Admin Credentials on Client

- Unusual Activity::Anomalous SMB Move & Write

- Unusual Activity::Internal Data Transfer

- Unusual Activity::Unusual External Data Transfer

- Unusual Activity::Enhanced Unusual External Data Transfer

Darktrace Model Detections:

- Antigena::Network::External Threat::Antigena Suspicious File Block

- Antigena::Network::External Threat::Antigena Suspicious File Pattern of Life Block

- Antigena::Network::External Threat::Antigena File then New Outbound Block

- Antigena::Network::External Threat::Antigena Ransomware Block

- Antigena::Network::External Threat::Antigena Suspicious Activity Block

- Antigena::Network::Significant Anomaly::Antigena Controlled and Model Breach

- Antigena::Network::Significant Anomaly::Antigena Enhanced Monitoring from Server Block

- Antigena::Network::Significant Anomaly::Antigena Breaches Over Time Block

- Antigena::Network::Significant Anomaly::Antigena Significant Server Anomaly Block

- Antigena::Network::Insider Threat::Antigena Internal Data Transfer Block

- Antigena::Network::Insider Threat::Antigena Large Data Volume Outbound Block

- Antigena::Network::Insider Threat::Antigena SMB Enumeration Block

AI Analyst Incident Coverage

- Encryption of Files over SMB

- Scanning of Multiple Devices

- SMB Writes of Suspicious Files

MITRE ATT&CK Mapping

(Technique Name) – (Tactic) – (ID) – (Sub-Technique of)

Data Obfuscation - COMMAND AND CONTROL - T1001

Remote System Discovery - DISCOVERY - T1018

SMB/Windows Admin Shares - LATERAL MOVEMENT - T1021.002 - T1021

Rename System Utilities - DEFENSE EVASION - T1036.003 - T1036

Network Sniffing - CREDENTIAL ACCESS, DISCOVERY - T1040

Exfiltration Over C2 Channel - EXFILTRATION - T1041

Data Staged - COLLECTION - T1074

Valid Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078

Taint Shared Content - LATERAL MOVEMENT - T1080

File and Directory Discovery - DISCOVERY - T1083

Email Collection - COLLECTION - T1114

Automated Collection - COLLECTION - T1119

Network Share Discovery - DISCOVERY - T1135

Exploit Public-Facing Application - INITIAL ACCESS - T1190

Hardware Additions - INITIAL ACCESS - T1200

Remote Access Software - COMMAND AND CONTROL - T1219

Data Encrypted for Impact - IMPACT - T1486

Pass the Hash - DEFENSE EVASION, LATERAL MOVEMENT - T1550.002 - T1550

Exfiltration to Cloud Storage - EXFILTRATION - T1567.002 - T1567

Lateral Tool Transfer - LATERAL MOVEMENT - T1570

List of Indicators of Compromise (IoCs)

IoC – Type – Description

/AnyDesk.exe - Executable File - Remote Access Management Tool

gfs302n515[.]userstorage[.]mega[.]co[.]nz- Domain - Exfiltration Domain

*.flocked - Filename Extension - Fog Ransomware Extension

readme.txt - Text File - Fog Ransom Note

xql562evsy7njcsngacphcerzjfecwotdkobn3m4uxu2gtqh26newid[.]onion - Onion Domain - Threat Actor’s Communication Channel

References

[1] https://arcticwolf.com/resources/blog/lost-in-the-fog-a-new-ransomware-threat/

[2] https://intel471.com/blog/assessing-the-disruptions-of-ransomware-gangs

[3] https://www.pcrisk.com/removal-guides/30167-fog-ransomware

Continue reading
About the author
Ryan Traill
Threat Content Lead

Blog

/

September 11, 2024

/
No items found.

What you need to know about FAA Security Protection Regulations 2024

Default blog imageDefault blog image

Overview of FAA Rules 2024

Objective

The goal of the Federal Aviation Administration amended rules is to create new design standards that protect airplane systems from intentional unauthorized electronic interactions (IUEI), which can pose safety risks. The timely motivation for this goal is due to the ongoing trend in aircraft design, which features a growing integration of airplane, engine, and propeller systems, along with expanded connectivity to both internal and external data networks and services.

“This proposed rulemaking would impose new design standards to address cybersecurity threats for transport category airplanes, engines, and propellers. The intended effect of this proposed action is to standardize the FAA’s criteria for addressing cybersecurity threats, reducing certification costs and time while maintaining the same level of safety provided by current special conditions.” (1)

Background

Increasing integration of aircraft systems with internal and external networks raises cybersecurity vulnerability concerns.

Key vulnerabilities include:  

  • Field Loadable Software
  • Maintenance laptops
  • Public networks (e.g., Internet)
  • Wireless sensors
  • USB devices
  • Satellite communications
  • Portable devices and flight bags  

Requirements for Applicants

Applicants seeking design approval must:

  • Provide isolation or protection from unauthorized access
  • Prevent inadvertent or malicious changes to aircraft systems
  • Establish procedures to maintain cybersecurity protections

Purpose

“These changes would introduce type certification and continued airworthiness requirements to protect the equipment, systems, and networks of transport category airplanes, engines, and propellers against intentional unauthorized electronic interactions (IUEI)1 that could create safety hazards. Design approval applicants would be required to identify, assess, and mitigate such hazards, and develop Instructions for Continued Airworthiness (ICA) that would ensure such protections continue in service.” (1)

Key points:

  • Introduce new design standards to address cybersecurity threats for transport category airplanes, engines, and propellers.
  • Aim to reduce certification costs and time while maintaining safety levels similar to current special conditions

Applicant Responsibilities for Identifying, Assessing, and Mitigating IUEI Risks

The proposed rule requires applicants to safeguard airplanes, engines, and propellers from intentional unauthorized electronic interactions (IUEI). To do this, they must:

  1. Identify and assess risks: Find and evaluate any potential electronic threats that could harm safety.
  2. Mitigate risks: Take steps to prevent these threats from causing problems, ensuring the aircraft remain safe and functional.

Let’s break down each of the requirements:

Performing risk analysis

“For such identification and assessment of security risk, the applicant would be required to perform a security risk analysis to identify all threat conditions associated with the system, architecture, and external or internal interfaces.”(3)

Challenge

The complexity and variety of OT devices make it difficult and time-consuming to identify and associate CVEs with assets. Security teams face several challenges:

  • Prioritization Issues: Sifting through extensive CVE lists to prioritize efforts is a struggle.
  • Patch Complications: Finding corresponding patches is complicated by manufacturer delays and design flaws.
  • Operational Constraints: Limited maintenance windows and the need for continuous operations make it hard to address vulnerabilities, often leaving them unresolved for years.
  • Inadequate Assessments: Standard CVE assessments may not fully capture the risks associated with increased connectivity, underscoring the need for a contextualized risk assessment approach.

This highlights the need for a more effective and tailored approach to managing vulnerabilities in OT environments.

Assessing severity of risks

“The FAA would expect such risk analysis to assess the severity of the effect of threat conditions on associated assets (system, architecture, etc.), consistent with the means of compliance the applicant has been using to meet the FAA’s special conditions on this topic.” (3)

Challenge

As shown by the MITRE ATT&CK® Techniques for ICS matrices, threat actors can exploit many avenues beyond just CVEs. To effectively defend against these threats, security teams need a broader perspective, considering lateral movement and multi-stage attacks.

Challenges in Vulnerability Management (VM) cycles include:

  • Initiation: VM cycles often start with email updates from the Cybersecurity and Infrastructure Security Agency (CISA), listing new CVEs from the NIST database.
  • Communication: Security practitioners must survey and forward CVE lists to networking teams at facilities that might be running the affected assets. Responses from these teams are inconsistent, leading vulnerability managers to push patches that may not fit within limited maintenance windows.
  • Asset Tracking: At many OT locations, determining if a company is running a specific firmware version can be extremely time-consuming. Teams often rely on spreadsheets and must perform manual checks by physically visiting production floors ("sneaker-netting").
  • Coordination: Plant engineers and centralized security teams must exchange information to validate asset details and manually score vulnerabilities, further complicating and delaying remediation efforts.

Determine likelihood of exploitation

“Such assessment would also need to analyze these vulnerabilities for the likelihood of exploitation.” (3)

Challenge

Even when a vulnerability is identified, its actual impact can vary significantly based on the specific configurations, processes, and technologies in use within the organization. This creates challenges for OT security practitioners:

  • Risk Assessment: Accurately assessing and prioritizing the risk becomes difficult without a clear understanding of how the vulnerability affects their unique systems.
  • Decision-Making: Practitioners may struggle to determine whether immediate action is necessary, balancing the risk of operational downtime against the need for security.
  • Potential Consequences: This uncertainty can lead to either leaving critical systems exposed or causing unnecessary disruptions by applying measures that aren't truly needed.

This complexity underscores the challenge of making informed, timely decisions in OT security environments.

Vulnerability mitigation

“The proposed regulation would then require each applicant to 'mitigate' the vulnerabilities, and the FAA expects such mitigation would occur through the applicant’s installation of single or multilayered protection mechanisms or process controls to ensure functional integrity, i.e., protection.” (3)

Challenge

OT security practitioners face a constant challenge in balancing security needs with the requirement to maintain operational uptime. In many OT environments, especially in critical infrastructure, applying security patches can be risky:

  • Risk of Downtime: Patching can disrupt essential processes, leading to significant financial losses or even safety hazards.
  • Operational Continuity vs. Security: Practitioners often prioritize operational continuity, sometimes delaying timely security updates.
  • Alternative Strategies: To protect systems without direct patching, they must implement compensating controls, further complicating security efforts.

This delicate balance between security and uptime adds complexity to the already challenging task of securing OT environments.

Establishing procedures/playbooks

“Finally, each applicant would be required to include the procedures within their instructions for continued airworthiness necessary to maintain such protections.” (3)

Challenge

SOC teams typically have a lag before their response, leading to a higher dwell time and bigger overall costs. On average, only 15% of the total cost of ransomware is affiliated with the ransom itself (2). The rest is cost from business interruption. This means it's crucial that organizations can respond and recover earlier. 

Darktrace / OT enabling compliance and enhanced cybersecurity

Darktrace's OT solution addresses the complex challenges of cybersecurity compliance in Operational Technology (OT) environments by offering a comprehensive approach to risk management and mitigation.

Key risk management features include:

  • Contextualized Risk Analysis: Darktrace goes beyond traditional vulnerability scoring, integrating IT, OT, and CVE data with MITRE techniques to map critical attack paths. This helps in identifying and prioritizing vulnerabilities based on their exposure, difficulty of exploitation, and network impact.
  • Guidance on Remediation: When patches are unavailable, Darktrace provides alternative strategies to bolster defenses around vulnerable assets, ensuring unpatched systems are not left exposed—a critical need in OT environments where operational continuity is essential.
  • AI-Driven Adaptability: Darktrace's AI continuously adapts to your organization as it grows; refining incident response playbooks bespoke to your environment in real-time. This ensures that security teams have the most up-to-date, tailored strategies, reducing response times and minimizing the impact of security incidents.

Ready to learn more?  

Darktrace / OT doesn’t just offer risk management capabilities. It is the only solution  
that leverages Self-Learning AI to understand your normal business operations, allowing you to detect and stop insider, known, unknown, and zero-day threats at scale.  

Dive deeper into how Darktrace / OT secures critical infrastructure organizations with in-depth insights on its advanced capabilities. Download the Darktrace / OT Solution Brief to explore the technology behind its AI-driven protection and see how it can transform your OT security strategy.

Curious about how Darktrace / OT enhances aviation security? Explore our customer story on Brisbane Airport to see how our solution is transforming security operations in the aviation sector.  

References

  1. https://research-information.bris.ac.uk/ws/portalfiles/portal/313646831/Catch_Me_if_You_Can.pdf
  1. https://www.bleepingcomputer.com/news/security/ransom-payment-is-roughly-15-percent-of-the-total-cost-of-ransomware-attacks/
  1. https://public-inspection.federalregister.gov/2024-17916.pdf?mod=djemCybersecruityPro&tpl=cs
Continue reading
About the author
Daniel Simonds
Director of Operational Technology
Your data. Our AI.
Elevate your network security with Darktrace AI