Blog
/

Inside the SOC

/
January 26, 2024

Post-Exploitation Activities of Ivanti CS/PS Appliances

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
26
Jan 2024
Darktrace’s teams have observed a surge in malicious activities targeting Ivanti Connect Secure (CS) and Ivanti Policy Secure (PS) appliances. Learn more!

What are 'Unknown Unknowns'?

When critical vulnerabilities in Internet-facing assets are not yet publicly disclosed, they can provide unfettered access to organizations’ networks. Threat actors’ exploitation of these vulnerabilities are prime examples of “unknown unknowns” – behaviors which security teams are not even aware that they are not aware of.  

Therefore, it is not surprising that zero-day vulnerabilities in Internet-facing assets are so attractive to state-linked actors and cybercriminals. These criminals will abuse the access these vulnerabilities afford them to progress towards harmful or disruptive objectives. This trend in threat actor activity was particularly salient in January 2024, following the disclosure of two critical vulnerabilities in Ivanti Connect Secure (CS) and Ivanti Policy Secure (PS) appliances. The widespread exploitation of these vulnerabilities was mirrored across Darktrace’s customer base in mid-January 2024, with Darktrace’s Security Operations Center (SOC) and Threat Research teams observing a surge in malicious activities targeting customers’ CS/PS appliances.

Vulnerabilities in Ivanti CS/PS

On January 10, 2024, Ivanti published a Security Advisory [1] and a Knowledge Base article [2] relating to the following two vulnerabilities in Ivanti Connect Secure (CS) and Ivanti Policy Secure (PS):

  • CVE-2023-46805 (CVSS: 8.2; Type: Authentication bypass vulnerability)
  • CVE-2024-21887 (CVSS: 9.1; Type: Command injection vulnerability)

Conjoined exploitation of these vulnerabilities allows for unauthenticated, remote code execution (RCE) on vulnerable Ivanti systems. Volexity [3] and Mandiant [4] reported clusters of CS/PS compromises, tracked as UTA0178 and UNC5221 respectively. UTA0178 and UNC5221 compromises involve exploitation of CVE-2023-46805 and CVE-2024-21887 to deliver web shells and JavaScript credential harvesters to targeted CS/PS appliances. Both Volexity and Mandiant linked these compromises to a likely espionage-motivated, state-linked actor. GreyNoise [5] and Volexity [6] also reported likely cybercriminal activities targeting CS/PS appliances to deliver cryptominers.

The scale of this recent Ivanti CS/PS exploitation is illustrated by research findings recently shared by Censys [7]. According to these findings, as of January 22, around 1.5% of 26,000 Internet-exposed Ivanti CS appliances have been compromised, with the majority of compromised hosts falling within the United States. As cybercriminal interest in these Ivanti CS/PS vulnerabilities continues to grow, it is likely that so too will the number of attacks targeting them.

Observed Malicious Activities

Since January 15, 2024, Darktrace’s SOC and Threat Research team have observed a significant volume of malicious activities targeting customers’ Ivanti CS/PS appliances. Amongst the string of activities that were observed, the following threads were identified as salient:

  • Exploit validation activity
  • Exfiltration of system information
  • Delivery of C2 implant from AWS
  • Delivery of JavaScript credential stealer
  • SimpleHelp usage
  • Encrypted C2 on port 53
  • Delivery of cryptominer

Exploit Validation Activity

Malicious actors were observed using the out-of-band application security testing (OAST) services, Interactsh and Burp Collaborator, to validate exploits for CS/PS vulnerabilities. Malicious use of OAST services for exploit validation is common and has been seen in the early stages of previous campaigns targeting Ivanti systems [8]. In this case, the Interact[.]sh exploit tests were evidenced by CS/PS appliances making GET requests with a cURL User-Agent header to subdomains of 'oast[.]live', 'oast[.]site', 'oast[.]fun', 'oast[.]me', 'oast[.]online' and 'oast[.]pro'.  Burp Collaborator exploit tests were evidenced by CS/PS appliances making GET requests with a cURL User-Agent header to subdomains of ‘collab.urmcyber[.]xyz’ and ‘dnslog[.]store’.

Figure 1: Event Log showing a CS/PS appliance contacting an 'oast[.]pro' endpoint.
Figure 2: Event Log showing a CS/PS appliance contacting a 'collab.urmcyber[.]xyz' endpoint.
Figure 3: Packet capture (PCAP) of an Interactsh GET request.
Figure 4: PCAP of a Burp Collaborator GET request.

Exfiltration of System Information

The majority of compromised CS/PS appliances identified by Darktrace were seen using cURL to transfer hundreds of MBs of data to the external endpoint, 139.180.194[.]132. This activity appeared to be related to a threat actor attempting to exfiltrate system-related information from CS/PS appliances. These data transfers were carried out via HTTP on ports 443 and 80, with the Target URIs ‘/hello’ and ‘/helloq’ being seen in the relevant HTTP POST requests. The files sent over these data transfers were ‘.dat’ and ‘.sys’ files with what seems to be the public IP address of the targeted appliance appearing in each file’s name.

Figure 5: Event Log shows a CS/PS appliance making a POST request to 139.180.194[.]132 whilst simultaneously receiving connections from suspicious external endpoints.
Figure 6: PCAP of a POST request to 139.180.194[.]132.

Delivery of Command-and-Control (C2) implant from Amazon Web Services (AWS)

In many of the compromises observed by Darktrace, the malicious actor in question was observed delivering likely Rust-based ELF payloads to the CS/PS appliance from the AWS endpoints, archivevalley-media.s3.amazonaws[.]com, abode-dashboard-media.s3.ap-south-1.amazonaws[.]com, shapefiles.fews.net.s3.amazonaws[.]com, and blooming.s3.amazonaws[.]com. In one particular case, these downloads were immediately followed by the delivery of an 18 MB payload (likely a C2 implant) from the AWS endpoint, be-at-home.s3.ap-northeast-2.amazonaws[.]com, to the CS/PS appliance. Post-delivery, the implant seems to have initiated SSL beaconing connections to the external host, music.farstream[.]org. Around this time, Darktrace also observed the actor initiating port scanning and SMB enumeration activities from the CS/PS appliance, likely in preparation for moving laterally through the network.

Figure 7: Advanced Search logs showing a CS/PS appliance beaconing to music.farstream[.]org after downloading several payloads from AWS.

Delivery of JavaScript credential stealer

In a small number of observed cases, Darktrace observed malicious actors delivering what appeared to be a JavaScript credential harvester to targeted CS/PS appliances. The relevant JavaScript code contains instructions to send login credentials to likely compromised websites. In one case, the website, www.miltonhouse[.]nl, appeared in the code snippet, and in another, the website, cpanel.netbar[.]org, was observed. Following the delivery of this JavaScript code, HTTPS connections were observed to these websites.  This likely credential harvester appears to strongly resemble the credential stealer observed by Mandiant (dubbed ‘WARPWIRE’) in UNC5221 compromises and the credential stealer observed by Veloxity in UTA0178 compromises.

Figure 8: PCAP of ‘/3.js’ GET request for JavaScript credential harvester.
Figure 9: Snippet of response to '/3.js’ GET request.
Figure 10: PCAP of ‘/auth.js’ GET request for JavaScript credential harvester.
Figure 11: Snippet of response to '/auth.js’ GET request.
Figure 12: Advanced Search logs showing VPN-connected devices sending data to www.miltonhouse[.]nl after the Ivanti CS appliance received the JavaScript code.

The usage of this JavaScript credential harvester did not occur in isolation, but rather appears to have occurred as part of a chain of activity involving several further steps. The delivery of the ‘www.miltonhouse[.]nl’ JavaScript stealer seems to have occurred as a step in the following attack chain:  

1. Ivanti CS/PS appliance downloads a 8.38 MB ELF file over HTTP (with Target URI ‘/revsocks_linux_amd64’) from 188.116.20[.]38

2. Ivanti CS/PS appliance makes a long SSL connection (JA3 client fingerprint: 19e29534fd49dd27d09234e639c4057e) over port 8444 to 185.243.112[.]245, with several MBs of data being exchanged

3. Ivanti CS/PS appliance downloads a Perl script over HTTP (with Target URI ‘/login.txt’) from 188.116.20[.]38

4. Ivanti CS/PS appliance downloads a 1.53 ELF MB file over HTTP (with Target URI ‘/aparche2’) from 91.92.240[.]113

5. Ivanti CS/PS appliance downloads a 4.5 MB ELF file over HTTP (with Target URI ‘/agent’) from 91.92.240[.]113

6. Ivanti CS/PS appliance makes a long SSL connection (JA3 client fingerprint: 19e29534fd49dd27d09234e639c4057e) over port 11601 to 45.9.149[.]215, with several MBs of data being exchanged

7. Ivanti CS/PS appliance downloads Javascript credential harvester over HTTP (with Target URI ‘/auth.js’) from 91.92.240[.]113

8. Ivanti CS/PS appliance downloads a Perl script over HTTP (with Target URI ‘/login.cgi’) from 91.92.240[.]113

9. Ivanti CS/PS appliance makes a long SSL connection (JA3 client fingerprint: 19e29534fd49dd27d09234e639c4057e) over port 11601 to 91.92.240[.]71, with several MBs of data being exchanged

10. Ivanti CS/PS appliance makes a long SSL connection (JA3 client fingerprint: 19e29534fd49dd27d09234e639c4057e) over port 11601 to 45.9.149[.]215, with several MBs of data being exchanged

11. Ivanti CS/PS appliance makes a long SSL connection (JA3 client fingerprint: 19e29534fd49dd27d09234e639c4057e) over port 8080 to 91.92.240[.]113, with several MBs of data being exchanged

12. Ivanti CS/PS appliance makes a long SSL connection (JA3 client fingerprint: 19e29534fd49dd27d09234e639c4057e) over port 11601 to 45.9.149[.]112, with several MBs of data being exchanged  

These long SSL connections likely represent a malicious actor creating reverse shells from the targeted CS/PS appliance to their C2 infrastructure. Whilst it is not certain that these behaviors are part of the same attack chain, the similarities between them (such as the Target URIs, the JA3 client fingerprint and the use of port 11601) seem to suggest a link.  

Figure 13: Advanced Search logs showing a chain of malicious behaviours from a CS/PS appliance.
Figure 14: Advanced Search data showing the JA3 client fingerprint ‘19e29534fd49dd27d09234e639c4057e’ exclusively appearing in the aforementioned, long SSL connections from the targeted CS/PS appliance.
Figure 15: PCAP of ‘/login.txt’ GET request for a Perl script.
Figure 16: PCAP of ‘/login.cgi’ GET request for a Pearl script.

SimpleHelp Usage

After gaining a foothold on vulnerable CS/PS appliances, certain actors attempted to deepen their foothold within targeted networks. In several cases, actors were seen using valid account credentials to pivot over RDP from the vulnerable CS/PS appliance to other internal systems. Over these RDP connections, the actors appear to have installed the remote support tool, SimpleHelp, onto targeted internal systems, as evidenced by these systems’ subsequent HTTP requests. In one of the observed cases, a lateral movement target downloaded a 7.33 MB executable file over HTTP (Target URI: /ta.dat; User-Agent header: Microsoft BITS/7.8) from 45.9.149[.]215 just before showing signs of SimpleHelp usage. The apparent involvement of 45.9.149[.]215 in these SimpleHelp threads may indicate a connection between them and the credential harvesting thread outlined above.

Figure 17: Advanced Search logs showing an internal system making SimpleHelp-indicating HTTP requests immediately after receiving large volumes of data over RDP from an CS/PS appliance.
Figure 18: PCAP of a SimpleHelp-related GET request.

Encrypted C2 over port 53

In a handful of the recently observed CS/PS compromises, Darktrace identified malicious actors dropping a 16 MB payload which appears to use SSL-based C2 communication on port 53. C2 communication on port 53 is a commonly used attack method, with various malicious payloads, including Cobalt Strike DNS, being known to tunnel C2 communications via DNS requests on port 53. Encrypted C2 communication on port 53, however, is less common. In the cases observed by Darktrace, payloads were downloaded from 103.13.28[.]40 and subsequently reached back out to 103.13.28[.]40 over SSL on port 53.

Figure 19: PCAP of a ‘/linb64.png’ GET request.
Figure 20: Advanced Search logs showing a CS/PS appliance making SSL conns over port 53 to 103.13.28[.]40 immediately after downloading a 16 MB payload from 103.13.28[.]40.

Delivery of cryptominer

As is often the case, financially motivated actors also appeared to have sought to exploit the Ivanti appliances, with actors observed exploiting CS/PS appliances to deliver cryptomining malware. In one case, Darktrace observed an actor installing a Monero cryptominer onto a vulnerable CS/PS appliance, with the miner being downloaded via HTTP on port 8089 from 192.252.183[.]116.

Figure 21: PCAP of GET request for a Bash script which appeared to kill existing cryptominers.
Figure 22: PCAP of a GET request for a JSON config file – returned config file contains mining details such as ‘auto.3pool[.]org:19999’.
Figure 23: PCAP of a GET request for an ELF payload

Potential Pre-Ransomware Post-Compromise Activity

In one observed case, a compromise of a customer’s CS appliance was followed by an attacker using valid account credentials to connect to the customer’s CS VPN subnet. The attacker used these credentials to pivot to other parts of the customer’s network, with tools and services such as PsExec, Windows Management Instrumentation (WMI) service, and Service Control being abused to facilitate the lateral movement. Other Remote Monitoring and Management (RMM) tools, such as AnyDesk and ConnectWise Control (previously known as ScreenConnect), along with certain reconnaissance tools such as Netscan, Nmap, and PDQ, also appear to have been used. The attacker subsequently exfiltrated data (likely via Rclone) to the file storage service, put[.]io, potentially in preparation for a double extortion ransomware attack. However, at the time of writing, it was not clear what the relation was between this activity and the CS compromise which preceded it.

Darktrace Coverage

Darktrace has observed malicious actors carrying out a variety of post-exploitation activities on Internet-exposed CS/PS appliances, ranging from data exfiltration to the delivery of C2 implants and crypto-miners. These activities inevitably resulted in CS/PS appliances displaying patterns of network traffic greatly deviating from their typical “patterns of life”.

Darktrace DETECT™ identified these deviations and generated a variety of model breaches (i.e, alerts) highlighting the suspicious activity. Darktrace’s Cyber AI Analyst™ autonomously investigated the ongoing compromises and connected the individual model breaches, viewing them as related incidents rather than isolated events. When active and configured in autonomous response mode, Darktrace RESPOND™ containted attackers’ operations by autonomously blocking suspicious patterns of network traffic as soon as they were identified by Darktrace DETECT.

The exploit validation activities carried out by malicious actors resulted in CS/PS servers making HTTP connections with cURL User-Agent headers to endpoints associated with OAST services such as Interactsh and Burp Collaborator. Darktrace DETECT recognized that this HTTP activity was suspicious for affected devices, causing the following models to breach:

  • Compromise / Possible Tunnelling to Bin Services
  • Device / Suspicious Domain
  • Anomalous Server Activity / New User Agent from Internet Facing System
  • Device / New User Agent
Figure 24: Event Log showing a CS/PS appliance breaching models due to its Interactsh HTTP requests.
Figure 25: Cyber AI Analyst Incident Event highlighting a CS/PS appliance's Interactsh connections.

Malicious actors’ uploads of system information to 139.180.194[.]132 resulted in cURL POST requests being sent from the targeted CS/PS appliances. Darktrace DETECT judged these HTTP POST requests to be anomalous, resulting in combinations of the following model breaches:

  • Anomalous Connection / Posting HTTP to IP Without Hostname
  • Anomalous Server Activity / Outgoing from Server
  • Anomalous Server Activity / New User Agent from Internet Facing System
  • Unusual Activity / Unusual External Data Transfer
  • Unusual Activity / Unusual External Data to New Endpoint
  • Anomalous Connection / Data Sent to Rare Domain
Figure 26: Event Log showing the creation of a model breach due to a CS/PS appliance’s POST request to 139.180.194[.]132.
Figure 27: Cyber AI Analyst Incident Event highlighting POST requests from a CS/PS appliance to 139.180.194[.]132.

The installation of AWS-hosted C2 implants onto vulnerable CS/PS appliances resulted in beaconing connections which Darktrace DETECT recognized as anomalous, leading to the following model breaches:

  • Compromise / Beacon to Young Endpoint
  • Compromise / Beaconing Activity To External Rare
  • Compromise / High Volume of Connections with Beacon Score

When enabled in autonomous response mode, Darktrace RESPOND was able to follow up these detections by blocking affected devices from connecting externally over port 80, 443, 445 or 8081, effectively shutting down the attacker’s beaconing activity.

Figure 28: Event Log showing the creation of a model breach and the triggering of an autonomous RESPOND action due to a CS/PS appliance's beaconing connections.

The use of encrypted C2 on port 53 by malicious actors resulted in CS/PS appliances making SSL connections over port 53. Darktrace DETECT judged this port to be uncommon for SSL traffic and consequently generated the following model breach:

  • Anomalous Connection / Application Protocol on Uncommon Port
Figure 29: Cyber AI Analyst Incident Event highlighting a ‘/linb64.png’ GET request from a CS/PS appliance to 103.13.28[.]40.
Figure 30: Event Log showing the creation of a model breach due to CS/PS appliance’s external SSL connection on port 53.
Figure 31: Cyber AI Analyst Incident Event highlighting a CS/PS appliance’s SSL connections over port 53 to 103.13.28[.]40.

Malicious actors’ attempts to run cryptominers on vulnerable CS/PS appliances resulted in downloads of Bash scripts and JSON files from external endpoints rarely visited by the CS/PS appliances themselves or by neighboring systems. Darktrace DETECT identified these deviations in device behavior and generated the following model breaches:

  • Anomalous File / Script from Rare External Location
  • Anomalous File / Internet Facing System File Download

Darktrace RESPOND, when configured to respond autonomously, was subsequently able to carry out a number of actions to contain the attacker’s activity. This included blocking all outgoing traffic on offending devices and enforcing a “pattern of life” on devices ensuring they had to adhere to expected network behavior.

Figure 32: Event Log showing the creation of model breaches and the triggering of autonomous RESPOND actions in response to a CS/PS appliance’s cryptominer download.
Figure 33: Cyber AI Analyst Incident Event highlighting a CS/PS appliance’s cryptominer download.

The use of RDP to move laterally and spread SimpleHelp to other systems resulted in CS/PS appliances using privileged credentials to initiate RDP sessions. These RDP sessions, and the subsequent traffic resulting from usage of SimpleHelp, were recognized by Darktrace DETECT as being highly out of character, prompting the following model breaches:

  • Anomalous Connection / Unusual Admin RDP Session
  • Device / New User Agent
  • Anomalous Connection / New User Agent to IP Without Hostname
  • Compromise / Suspicious HTTP Beacons to Dotted Quad
  • Anomalous File / Anomalous Octet Stream (No User Agent)
  • Anomalous Server Activity / Rare External from Server
Figure 34: Event Log showing the creation of a model breach due to a CS/PS appliance’s usage of an admin credential to RDP to another internal system.
Figure 35: Event Log showing the creation of model breaches due to SimpleHelp-HTTP requests from a device targeted for lateral movement.
Figure 36: Cyber AI Analyst Incident Event highlighting the SimpleHelp-indicating HTTP requests made by an internal system.

Conclusion

The recent widespread exploitation of Ivanti CS/PS is a stark reminder of the threat posed by malicious actors armed with exploits for Internet-facing assets.

Based on the telemetry available to Darktrace, a wide range of malicious activities were carried out against CS/PS appliances, likely via exploitation of the recently disclosed CVE-2023-46805 and CVE-2024-21887 vulnerabilities.

These activities include the usage of OAST services for exploit validation, the exfiltration of system information to 139.180.194[.]132, the delivery of AWS-hosted C2 implants, the delivery of JavaScript credential stealers, the usage of SimpleHelp, the usage of SSL-based C2 on port 53, and the delivery of crypto-miners. These activities are far from exhaustive, and many more activities will undoubtedly be uncovered as the situation develops and our understanding grows.

While there were no patches available at the time of writing, Ivanti stated that they were expected to be released shortly, with the “first version targeted to be available to customers the week of 22 January 2023 and the final version targeted to be available the week of 19 February” [9].

Fortunately for vulnerable customers, in their absence of patches Darktrace DETECT was able to identify and alert for anomalous network activity that was carried out by malicious actors who had been able to successfully exploit the Ivanti CS and PS vulnerabilities. While the activity that followed these zero-day vulnerabilities may been able to have bypass traditional security tools reliant upon existing threat intelligence and indicators of compromise (IoCs), Darktrace’s anomaly-based approach allows it to identify such activity based on the subtle deviations in a devices behavior that typically emerge as threat actors begin to work towards their goals post-compromise.

In addition to Darktrace’s ability to identify this type of suspicious behavior, its autonomous response technology, Darktrace RESPOND is able to provide immediate follow-up with targeted mitigative actions to shut down malicious activity on affected customer environments as soon as it is detected.

Credit to: Nahisha Nobregas, SOC Analyst, Emma Foulger, Principle Cyber Analyst, and the Darktrace Threat Research Team

Appendices

List of IoCs Possible IoCs:

-       curl/7.19.7 (i686-redhat-linux-gnu) libcurl/7.63.0 OpenSSL/1.0.2n zlib/1.2.3

-       curl/7.19.7 (i686-redhat-linux-gnu) libcurl/7.63.0 OpenSSL/1.0.2n zlib/1.2.7

Mid-high confidence IoCs:

-       http://139.180.194[.]132:443/hello

‍-       http://139.180.194[.]132:443/helloq

‍-       http://blooming.s3.amazonaws[.]com/Ea7fbW98CyM5O (SHA256 hash: 816754f6eaf72d2e9c69fe09dcbe50576f7a052a1a450c2a19f01f57a6e13c17)

-       http://abode-dashboard-media.s3.ap-south-1.amazonaws[.]com/kaffMm40RNtkg (SHA256 hash: 47ff0ae9220a09bfad2a2fb1e2fa2c8ffe5e9cb0466646e2a940ac2e0cf55d04)

-       http://archivevalley-media.s3.amazonaws[.]com/bbU5Yn3yayTtV (SHA256 hash: c7ddd58dcb7d9e752157302d516de5492a70be30099c2f806cb15db49d466026)

-       http://shapefiles.fews.net.s3.amazonaws[.]com/g6cYGAxHt4JC1 (SHA256 hash: c26da19e17423ce4cb4c8c47ebc61d009e77fc1ac4e87ce548cf25b8e4f4dc28)

-       http://be-at-home.s3.ap-northeast-2.amazonaws[.]com/2ekjMjslSG9uI

‍-       music.farstream[.]org  • 104.21.86[.]153 / 172.67.221[.]78

-       http://197.243.22[.]27/3.js

‍-       http://91.92.240[.]113/auth.js

‍-       www.miltonhouse[.]nl • 88.240.53[.]22

-       cpanel.netbar[.]org • 146.19.212[.]12

-       http://188.116.20[.]38/revsocks_linux_amd64

‍-       185.243.112[.]245:8444

-        http://188.116.20[.]38/login.txt

‍-       http://91.92.240[.]113/aparche2 (SHA256 hash: 9d11c3cf10b20ff5b3e541147f9a965a4e66ed863803c54d93ba8a07c4aa7e50)

-       http://91.92.240[.]113/agent (SHA256 hash: 7967def86776f36ab6a663850120c5c70f397dd3834f11ba7a077205d37b117f)

-       45.9.149[.]215:11601

-       45.9.149[.]112:11601

-       http://91.92.240[.]113/login.cgi

-       91.92.240[.]71:11601

-       91.92.240[.]113:8080

-       http://45.9.149[.]215/ta.dat (SHA256 hash: 4bcf1333b3ad1252d067014c606fb3a5b6f675f85c59b69ca45669d45468e923)

-       91.92.241[.]18

-       94.156.64[.]252

-       http://144.172.76[.]76/lin86

‍-       144.172.122[.]14:443

-       http://185.243.115[.]58:37586/

‍-       http://103.13.28[.]40/linb64.png

-       103.13.28[.]40:53

-       159.89.82[.]235:8081

-       http://192.252.183[.]116:8089/u/123/100123/202401/d9a10f4568b649acae7bc2fe51fb5a98.sh

-       http://192.252.183[.]116:8089/u/123/100123/202401/sshd

-       http://192.252.183[.]116:8089/u/123/100123/202401/31a5f4ceae1e45e1a3cd30f5d7604d89.json

-       http://103.27.110[.]83/module/client_amd64

‍-       http://103.27.110[.]83/js/bootstrap.min.js?UUID=...

-       http://103.27.110[.]83/js/jquery.min.js

-       http://95.179.238[.]3/bak

‍-       http://91.92.244[.]59:8080/mbPHenSdr6Cf79XDAcKEVA

‍-       31.220.30[.]244

-       http://172.245.60[.]61:8443/SMUkbpX-0qNtLGsuCIuffAOLk9ZEBCG7bIcB2JT6GA/

-       http://172.245.60[.]61/ivanti

-       http://89.23.107[.]155:8080/l-5CzlHWjkp23gZiVLzvUg

-       http://185.156.72[.]51:8080/h7JpYIZZ1-rrk98v3YEy6w

-       http://185.156.72[.]51:8080/8uSQsOTwFyEAsXVwbAJ2mA

-       http://185.156.72[.]51:8080/vuln

-       185.156.72[.]51:4440

-       185.156.72[.]51:8080

-       185.156.72[.]51:4433

-       185.156.72[.]51:4446

-       185.156.72[.]51:4445

-       http://185.156.72[.]51/set.py

-       185.156.72[.]51:7777

-       45.9.151[.]107:7070

-       185.195.59[.]74:7070

-       185.195.59[.]74:20958

-       185.195.59[.]74:34436

-       185.195.59[.]74:37464

-       185.195.59[.]74:41468    

References

[1] https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

[2] https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

[3] https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/

[4] https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day

[5] https://www.greynoise.io/blog/ivanti-connect-secure-exploited-to-install-cryptominers

[6] https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/

[7] https://censys.com/the-mass-exploitation-of-ivanti-connect-secure/

[8] https://darktrace.com/blog/entry-via-sentry-analyzing-the-exploitation-of-a-critical-vulnerability-in-ivanti-sentry


[9] https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US  

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Sam Lister
SOC Analyst
Watch the NIS2 Webinar
Book a 1-1 meeting with one of our experts
Get in touch
Share this article
Trending blogs
1
Darktrace is Positioned as a Leader in the IDC MarketScape: Worldwide Network Detection and Response 2024 Vendor Assessment
Dec 9, 2024
2
Cloud Security: Addressing Common CISO Challenges with Advanced Solutions
Nov 28, 2024
3
Preparing for 2025: Darktrace's Top 10 AI and Cybersecurity Predictions
Nov 3, 2024
4
Navigating Buying and Adoption Journeys for AI Cybersecurity Tools
Oct 15, 2024
5
How Darktrace won an email security trial by learning the business, not the breach
Oct 9, 2024

More in this series

No items found.

Blog

/

December 12, 2024

/
No items found.

Company Shuts Down Cyber-attacks with “Flawless” Detection and Response from Darktrace

Default blog imageDefault blog image

Growing pains: Balancing efficiency with risk  

This organization has recently scaled its operations, and numerous acquisitions have significantly boosted the organization’s capabilities and growth. However, this also creates work and high expectations for the organization’s IT and security teams. Within 12 months of an acquisition, the teams must fully integrate each new business onto the company’s platform. “A huge piece of that integration plan is rolling out our security controls,” said the CISO. “While our goal is to connect those facilities up as quickly as possible to drive efficiency, we also need to implement the proper security controls to protect the enterprise.”

Gap beyond the perimeter  

The organization had established strong security measures to safeguard its perimeter; however, the CISO identified a critical gap in real-time network monitoring. If the perimeter were breached, threats were only discovered after an endpoint was compromised and the issue was manually reported.

As digital transformation progresses, the need to adopt advanced technologies is becoming essential, particularly as organizations begin to open up operational environments to greater connectivity. Many processes still rely on traditional methods, and integrating innovative solutions could drive significant improvements in efficiency and productivity. “We’re committed to adopting cutting-edge technologies,” the CISO explained. “But we understood that without more robust network security controls, opening up our operational environments would expose us to heightened risks, including advanced threats like ransomware.”

Building a layered, proactive security strategy with Darktrace  

To close the gap beyond the perimeter, the company embarked on a free trial with Darktrace. The CISO recalls: “The trials were fantastic. It was obvious that Darktrace was exactly what we needed. The Darktrace team was also very knowledgeable and helpful throughout the process, which was impressive.”  

Today, the organization is using a combination of Darktrace solutions for its layered security approach, including:

Detecting unusual behavior with AI  

Darktrace’s use of machine learning and Self-Learning AI is one of the reasons the company chose Darktrace. Instead of teaching an AI system what an ‘attack’ looks like, training it on large data lakes of thousands of organizations’ data, Darktrace AI learns from the company’s own unique data and user activity to learn and create baseline models of what ‘normal’ looks like for their business.

Darktrace can then detect subtle deviations and unusual activity that signals a possible threat. “That fascinated us because what it really means is this technology doesn’t need to know about every single threat because the threat itself isn’t important, it’s the behavior of the activity that’s important. That capability is unique when it when it comes to threat detection,” said the CISO.

Identifying and mitigating high-impact attack paths

The security team appreciated that with Darktrace they could take a more proactive approach to security by exposing high-risk attack paths through modeling and AI risk assessments. Darktrace / Proactive Exposure Management gives them visibility into vulnerable entry points and assets, identifies active risks, and prioritizes the most important security issues to be addressed.

“Specific users and assets within our business have a higher risk of being targeted by a cyber-attack, for example our executives,” said the CISO. “With Darktrace, we get an adversarial view of our risk. We can see the attack path around those potential targets and proactively take measures to mitigate that vulnerability and prevent an attack.”

Driving up productivity while putting the brakes on cyber-attacks  

The security team collaborated with Darktrace to fine tune the models that really fit their business. With Darktrace now automating most of their threat detection and response efforts, productivity has soared, the security team is now focused on delivering greater value to the business and, most importantly, Darktrace proved it could quickly detect and shut down a major cyber-attack–and do so without impacting business operations.

Fueling team productivity with automation and AI

Prior to using Darktrace, the security team had little visibility into potential risks beyond the perimeter. Today, the team has full control and visibility over the network. “My team is now spending 80-90% of their time doing proactive work because Darktrace is managing the vast majority of our detect and response needs. The team really has faith in the Darktrace system,” said the CISO.  

With less time spent on low-level manual tasks, the security team can now focus on higher priority initiatives. For example, they have expanded their internal vulnerability assessments across the entire group. The team couldn’t focus on this additional audit and vulnerability management work if Darktrace wasn’t taking care of most of their security monitoring. “Darktrace has allowed us to move on to these additional kinds of governance projects that we otherwise would have to hire an army of staff to get through”.

Stopping email threats in their tracks

Using Darktrace / EMAIL, the company has identified and blocked a significant percentage of emails that were making it past their native email filters. “Darktrace is especially good at detecting impersonation emails, and we really appreciate its ability to automatically remove suspicious emails directly from a user’s inbox. It adds an extra level of confidence,” said the CISO.

Self-Learning AI understands anomalies within unique communication patterns to stop known and unknown threats. For example, when an employee sent an email to a brand new domain, Darktrace identified the behavior as unusual and inconsistent with baseline models and blocked the email.

Darktrace passes the biggest test of all

In 2024, the company experienced the value of the security system firsthand when attackers exploited a vulnerability in a third-party remote support solution that they was using. This solution provided remote access and tech support capabilities. If successful, the attackers could have infiltrated high-value end points and created their own administrative user, giving them full control over the server.

“We first became aware of the attack when Darktrace notified us of unusual behavior coming from the remote support server,” said the CISO. The attackers were attempting to put backdoors onto the service with the intent of selling access to the highest bidder who would then install ransomware on their servers. It all happened very quickly, as the attackers tried to connect to the internal network and other servers, while also firing off a host of other actions, like PowerShell commands, to escalate their privileges.  

“Darktrace worked flawlessly. There was no chance that ransomware was ever going to come in,” the CISO said. “Even though there was no signature to really look at, Darktrace realized this was not normal behavior for this server, shutting down connections and doing everything it could do to stop the attack.” Within eight hours, the security team identified and stopped the attack, severed its connection to the third-party solution, and completed additional analysis and clean-up. “In addition to our own investigation, third parties like our external SOC and legal department also confirmed that Darktrace performed as expected. We were able to report back to the executive team that there was zero risk that any data or systems were compromised.”

Post-attack, there was no need to make any changes to Darktrace. The team consistently reviews its models and baselines, often collaborating with Darktrace to make adjustments when needed to continuously improve performance. “Because of this relationship and constant engagement with Darktrace’s technical teams, we didn't have to go back and ask: ‘why wasn’t this updated’ or ‘why didn’t this model work.’ The models worked.”

His advice to other organizations facing similar challenges? First, focus on updating, patching, and vulnerability management, and act quickly when vulnerabilities are identified. His second piece of advice: “have an automated detection system like Darktrace in place so you can respond at the speed that these attacks evolve. Humans can no longer keep up with a scripted attack as it moves around and tries to compromise items on your network. You need the right technology to fight these types of attacks.”

Dynamic capabilities for a dynamic future

Real-time playbooks

With a proactive, enterprise-wide security strategy in place, the CISO now has the time to think about future projects and innovations. He’s particularly interested in the idea of generating playbooks on the fly in response to real-time events. He believes cyber-attacks are far too varied for a static playbook to be useful; when an attack strikes, teams need to quickly understand exactly what’s in front of them and how to shut it down. “This fits into our future cybersecurity strategy, and Darktrace is the only company I’ve seen talking about building playbooks dynamically. This kind of technology would really help bring our cybersecurity strategy full circle.”

“Darktrace ’s technology, experience and expertise is helping us staying ahead of cyber-attacks, minimizing our risk and driving greater productivity for our team,” said the CISO. In collaboration with Darktrace, the team have created a security foundation that is both powerful and agile. “While Darktrace is detecting and responding to attacks targeting our business today, we know that it’s always learning, adapting and scaling to ensure we’re protected tomorrow. That gives me peace of mind and the freedom to focus on our future.”

Download the Darktrace / NETWORK Solution Brief

Darktrace / NETWORK solution brief screenshot

Protect in real time: Defend against known and emerging threats without relying on historical data or external intelligence.

Full visibility: Gain comprehensive insights across all network environments, including on-premises, cloud, and remote devices.

AI-powered efficiency: Streamline incident response with AI automation, saving time and resources while ensuring minimal disruption to operations.

Continue reading
About the author
The Darktrace Community

Blog

/

December 11, 2024

/
No items found.

Darktrace is Positioned as a Leader in the IDC MarketScape: Worldwide Network Detection and Response 2024 Vendor Assessment

Default blog imageDefault blog image

Darktrace is pleased to announce that we have been positioned as a Leader in the IDC MarketScape: Worldwide Network Detection and Response 2024 Vendor Assessment. We believe this further highlights Darktrace’s position as a pioneer in the NDR market and follows similar recognition from KuppingerCole, who recently named Darktrace as an Overall Leader, Product Leader, Market Leader and Innovation Leader in the KuppingerCole Leadership Compass: Network Detection and Response (2024).

Network Detection and Response (NDR) solutions are uniquely positioned to provide visibility over the core hub of a business and employee activity, analyzing North-South and East-West traffic to identify threats across the modern network. NDR provides a rich and true source of anomalies and goes beyond process level data that is relied on by Endpoint Detection and Response (EDR) agents that do not provide network level visibility and can be misconfigured at any time.1

Metadata from network traffic can be used to detect a variety of different threats based on events such as anomalous port usage, unusual upload/download activity, impossible travel and many other activities. This has been accelerated by the increased usage of user behavioral analytics (UBA) in network security, which establishes statistical baselines about network entities and highlights deviations from expected activity.1

Darktrace is recognized as a Leader in the IDC MarketScape due to our leadership in the market and our pioneering leadership in AI over the past decade, alongside a variety of other unique differentiators and innovations in the NDR industry.

Darktrace / NETWORK™ delivers full visibility, real time threat detection and Autonomous Response capabilities across an organization’s on-premises, cloud, hybrid and virtual environments, including remote worker endpoints.

Unique Approach to AI

Most NDR vendors and network security tools such as IDS/IPS rely on detecting known attacks with historical data and supervised machine learning, leaving organizations blind and vulnerable to novel threats such as zero-days, variants of known attacks, supply chain attacks and insider threats.

These vendors also tend to apply AI models that are trained globally, and are not unique to each organization’s environment, which creates a high number of false positives and alerts that ultimately lack business context.

The IDC MarketScape recognizes that Darktrace takes a differentiated approach in the market with regards to delivering network detection and response capabilities, noting; “Darktrace is unique in that it does not rely on rules and signatures but rather learns what constitutes as normal for an organization and generates alerts when there is a deviation.”1

Darktrace / NETWORK achieves this through the use of Self-Learning AI and unsupervised machine learning to understand what is normal network behavior, continuously analyzing, mapping and modeling every connection to create a full picture of devices, identities, connections and potential attack paths. Darktrace Self-Learning AI autonomously optimizes itself to cut through the noise and quickly surface genuine, prioritized network security incidents – significantly reducing false positives and removing the hassle of needing to continually tuning alerts manually.

Darktrace’s unique approach to AI also extends to the investigation and triage of network alerts with Cyber AI Analyst. Unlike a chat or prompt based LLM, Cyber AI Analyst investigates all relevant alerts in an environment, including third party alerts, autonomously forming hypotheses and reaching conclusions just like a human analyst would, accelerating SOC Level 2 analyses of incidents by 10x. Cyber AI Analyst also typically providing SOC teams with up to 50,000 additional hours annually of Level 2 analysis producing high level alerts and written reporting, transforming security operations.2

Darktrace also uses its deep understanding of what is normal for a network to identify suspicious behavior, leveraging Autonomous Response capabilities to shut down both known and novel threats in real time, taking targeted actions without disrupting business operations. Darktrace / NETWORK is the only NDR solution that can autonomously enforce a pattern of life based on what is normal for a standalone device or group of peers, rapidly containing and disarming threats based on the overall context of the environment and a granular understanding of what is normal for a device or user – instead of relying on historical attack data.

Continued NDR Market Leadership

Darktrace has been recognized as a Leader in the NDR market, and the IDC MarketScape listed a variety of strengths:

  • Darktrace achieves roughly one-fifth of all global NDR revenue. This is important because other IT and cybersecurity solutions providers necessarily want to have integration with Darktrace.
  • The AI algorithms that Darktrace uses for NDR have had 10 years of deployments, tuning, and learning to draw from.
  • Darktrace is available as a SaaS, as an enterprise license, and as physical, hybrid, or virtual appliances. Darktrace also offers an endpoint agent and visibility into VPN and ZTNA.
  • Darktrace integrates with 30+ different interfaces including SIEM, SOAR, XDR platforms, IT ticketing solutions, and their own dashboards. The Darktrace Threat Visualizer highlights events and incidents from the entire deployment including cloud, apps, email, endpoint, zero trust, network, and OT.
  • Darktrace / NETWORK charts the progress that the SOC is making over time with key metrics such as MTTD/MTTR, alerts generated and processed, and other criteria.
  • Darktrace reported coverage of 14 MITRE ATT&CK categories, 158 techniques, and 184 subtechniques

Proactive Network Resilience

The IDC MarketScape notes, “Ultimately, NDR shines as a standalone detection and response technology but is especially powerful when combined with other platforms. NDR in combination with other control points such as endpoint, data, identity, and application provides the proper context when winnowing alerts and trying to uncover a single source of truth.” . Darktrace comprehensively addresses this as part of the ActiveAI Security Platform, by combining network alerts with data from / EMAIL, / IDENTITY, / ENDPOINT, / CLOUD and / OT, providing deeper contextual analysis for each network alert and automatically enriching investigations.

Darktrace also goes beyond NDR solutions with capabilities that are closely linked to our NDR offering, helping clients to achieve and maintain a state of proactive network resilience:

  • ‍Darktrace / Proactive Exposure Management – look beyond just CVE risks to discover, prioritize and validate risks by business impact and how to address them early, reducing the number of real threats that security teams need to handle.‍
  • Darktrace / Incident Readiness & Recovery – lets teams respond in the best way to each incident and proactively test their familiarity and effectiveness of IR workflows with sophisticated incident simulations based on their own analysts and assets.

Together, these solutions allow Darktrace / NETWORK to go beyond the traditional approach to NDR and shift teams to a more hardened and proactive stance.

Protecting Clients with Continued Innovation

Darktrace invests heavily in Research and Development to continue providing customers with market-leading NDR capabilities and innovations, which was reflected in our position in the Leader category of the MarketScape report for both capabilities and strategy. We are led by the needs and challenges of our customers, which serve as the driving force behind our continued innovation and leadership in the NDR market. The IDC MarketScape report underlines this approach with the following feedback presented by Darktrace customers:

“A customer intimated that 99% of their detections were OOTB with little need to tune or define parameters.”
“A customer reported that it had early warnings for adversarial tactics such as suspicious SMB scanning, suspicious remote execution, remote desktop protocol (RDP) scanning, data exfiltration, C2C, LDAP query, and suspicious Kerberos activity.”
“The client could use Regex to determine if suspicious behavior was found elsewhere on the network.”

Thousands of customers around the world across all industries and sectors rely on Darktrace / NETWORK to protect against known and novel threats. From the latest vulnerabilities in network hardware to sophisticated new strains of ransomware and everything in-between, Darktrace helps clients detect and respond to all types of threats affecting their networks and avoid business disruption, even from the latest attacks.

Find out more about the unique capabilities of Darktrace / NETWORK and our application of AI in network security in the IDC MarketScape excerpt.

References

  1. ‍ IDC MarketScape: Worldwide Network Detection and Response 2024 Vendor Assessment (Doc #US51752324, November 2024)
  2. Darktrace Cyber AI Analyst Customer Fleet Data
Continue reading
About the author
Mikey Anderson
Product Manager, Network Detection & Response
Your data. Our AI.
Elevate your network security with Darktrace AI