Employee-Conscious Email Security Solutions in the Workforce
10
Apr 2023
Email threats commonly affect organizations. Read Darktrace's expert insights on how to safeguard your business by educating employees about email security.
When considering email security, IT teams have historically had to choose between excluding employees entirely, or including them but giving them too much power and implementing unenforceable, trust-based policies that try to make up for it.
However, just because email security should not rely on employees, this does not mean they should be excluded entirely. Employees are the ones interacting with emails daily, and their experiences and behaviors can provide valuable security insights and even influence productivity.
AI technology supports employee engagement in this non-intrusive, nuanced way to not only maintain email security, but also enhance it.
Finding a Balance of Employee Involvement in Security Strategies
Historically, security solutions offered ‘all or nothing’ approaches to employee engagement. On one hand, when employees are involved, they are unreliable. Employees cannot all be experts in security on top of their actual job responsibilities, and mistakes are bound to happen in fast-paced environments.
Although there have been attempts to raise security awareness, they often have shortcomings, as training emails lack context and realism, leaving employees with poor understandings that often lead to reporting emails that are actually safe. Having users constantly triaging their inboxes and reporting safe emails wastes time that takes away from their own productivity as well as the productivity of the security team.
Other historic forms of employee involvement also put security at risk. For example, users could create blanket rules through feedback, which could lead to common problems like safe-listing every email that comes from the gmail.com domain. Other times, employees could choose for themselves to release emails without context or limitations, introducing major risks to the organization. While these types of actions include employees to participate in security, they do so at the cost of security.
Even lower stakes employee involvement can prove ineffective. For example, excessive warnings when sending emails to external contacts can lead to banner fatigue. When employees see the same warning message or alert at the top of every message, it’s human nature that they soon become accustomed and ultimately immune to it.
On the other hand, when employees are fully excluded from security, an opportunity is missed to fine-tune security according to the actual users and to gain feedback on how well the email security solution is working.
So, both options of historically conventional email security, to include or exclude employees, prove incapable of leveraging employees effectively. The best email security practice strikes a balance between these two extremes, allowing more nuanced interactions that maintain security without interrupting daily business operations. This can be achieved with AI that tailors the interactions specifically to each employee to add to security instead of detracting from it.
Reducing False Reports While Improving Security Awareness Training
Humans and AI-powered email security can simultaneously level up by working together. AI can inform employees and employees can inform AI in an employee-AI feedback loop.
By understanding ‘normal’ behavior for every email user, AI can identify unusual, risky components of an email and take precise action based on the nature of the email to neutralize them, such as rewriting links, flattening attachments, and moving emails to junk. AI can go one step further and explain in non-technical language why it has taken a specific action, which educates users. In contrast to point-in-time simulated phishing email campaigns, this means AI can share its analysis in context and in real time at the moment a user is questioning an email.
The employee-AI feedback loop educates employees so that they can serve as additional enrichment data. It determines the appropriate levels to inform and teach users, while not relying on them for threat detection.
In the other direction, the AI learns from users’ activity in the inbox and gradually factors this into its decision-making. This is not a ‘one size fits all’ mechanism – one employee marking an email as safe will never result in blanket approval across the business – but over time, patterns can be observed and autonomous decision-making enhanced.
Figure 1: The employee-AI feedback loop increases employee understanding without putting security at risk.
The employee-AI feedback loop draws out the maximum potential benefits of employee involvement in email security. Other email security solutions only consider the security team, enhancing its workflow but never considering the employees that report suspicious emails. Employees who try to do the right thing but blindly report emails never learn or improve and end up wasting their own time. By considering employees and improving security awareness training, the employee-AI feedback loop can level up users. They learn from the AI explanations how to identify malicious components, and so then report fewer emails but with greater accuracy.
While AI programs have classically acted like black boxes, Darktrace trains its AI on the best data, the organization’s actual employees, and invites both the security team and employees to see the reasoning behind its conclusions. Over time, employees will trust themselves more as they better learn how to discern unsafe emails.
Leveraging AI to Generate Productivity Gains
Uniquely, AI-powered email security can have effects outside of security-related areas. It can save time by managing non-productive email. As the AI constantly learns employee behavior in the inbox, it becomes extremely effective at detecting spam and graymail – emails that aren't necessarily malicious, but clutter inboxes and hamper productivity. It does this on a per-user basis, specific to how each employee treats spam, graymail, and newsletters. The AI learns to detect this clutter and eventually learns which to pull from the inbox, saving time for the employees. This highlights how security solutions can go even further than merely protecting the email environment with a light touch, to the point where AI can promote productivity gains by automating tasks like inbox sorting.
Preventing Email Mishaps: How to Deal with Human Error
Improved user understanding and decision making cannot stop natural human error. Employees are bound to make mistakes and can easily send emails to the wrong people, especially when Outlook auto-fills the wrong recipient. This can have effects ranging anywhere from embarrassing to critical, with major implications on compliance, customer trust, confidential intellectual property, and data loss.
However, AI can help reduce instances of accidentally sending emails to the wrong people. When a user goes to send an email in Outlook, the AI will analyze the recipients. It considers the contextual relationship between the sender and recipients, the relationships the recipients have with each other, how similar each recipient’s name and history is to other known contacts, and the names of attached files.
If the AI determines that the email is outside of a user’s typical behavior, it may alert the user. Security teams can customize what the AI does next: it can block the email, block the email but allow the user to override it, or do nothing but invite the user to think twice. Since the AI analyzes each email, these alerts are more effective than consistent, blanket alerts warning about external recipients, which often go ignored. With this targeted approach, the AI prevents data leakage and reduces cyber risk.
Since the AI is always on and continuously learning, it can adapt autonomously to employee changes. If the role of an employee evolves, the AI will learn the new normal, including common behaviors, recipients, attached file names, and more. This allows the AI to continue effectively flagging potential instances of human error, without needing manual rule changes or disrupting the employee’s workflow.
Email Security Informed by Employee Experience
As the practical users of email, employees should be considered when designing email security. This employee-conscious lens to security can strengthen defenses, improve productivity, and prevent data loss.
In these ways, email security can benefit both employees and security teams. Employees can become another layer of defense with improved security awareness training that cuts down on false reports of safe emails. This insight into employee email behavior can also enhance employee productivity by learning and sorting graymail. Finally, viewing security in relation to employees can help security teams deploy tools that reduce data loss by flagging misdirected emails. With these capabilities, Darktrace/Email™ enables security teams to optimize the balance of employee involvement in email security.
Like this and want more?
Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Newsletter
Stay ahead of threats with the Darktrace blog newsletter
Get the latest insights from the cybersecurity landscape, including threat trends, incident analysis, and the latest Darktrace product developments – delivered directly to your inbox, monthly.
Thanks, your request has been received
A member of our team will be in touch with you shortly.
Oops! Something went wrong while submitting the form.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Dan Fein
VP, Product
Based in New York, Dan joined Darktrace’s technical team in 2015, helping customers quickly achieve a complete and granular understanding of Darktrace’s product suite. Dan has a particular focus on Darktrace/Email, ensuring that it is effectively deployed in complex digital environments, and works closely with the development, marketing, sales, and technical teams. Dan holds a Bachelor’s degree in Computer Science from New York University.
Carlos Gray
Product Manager
Carlos Gonzalez Gray is a Product Marketing Manager at Darktrace, based in the Madrid Office. As an email security Subject Matter Expert he collaborates with the global product team to align each product with the company’s ethos and ensures Darktrace are continuously pushing the boundaries of innovation. His prior role at Darktrace was in Sales Engineering, leading the Iberian team and specializing in both the email and OT sectors. Additionally, his prior experience as a consultant to IBEX 35 companies in Spain has made him well-versed in compliance, auditing, and data privacy. Carlos holds an Honors BA in Political Science and a Masters in Cybersecurity from IE University.
With the perimeter all but dissolved, Network Detection and Response (NDR) tools are quickly becoming a critical component of the security stack, as the main tool to span the modern network. NDRs connect on-premises infrastructure to cloud, remote workers, identities, SaaS applications, and IoT/OT – something not available to EDR that requires agents and isolates visibility to individual devices.
KuppingerCole Analysts AG designated Darktrace an ‘Overall Leader’ position because of our continual innovation around user-led security. Self-Learning AI together with automated triage through Cyber AI Analyst and real-time autonomous response actions have been instrumental to security teams in stopping potential threats before they become a breach. With this time saved, Darktrace is leading beyond reactive security to truly harden a network, allowing the team to spend more time in preventive security measures.
Network Detection and Response protects where others fail to reach
NDR solutions operate at the network level, deploying inside or parallel to your network to ingest raw traffic via virtual or physical sensors. This gives them unprecedented potential to identify anomalies and possible breaches in any network - far beyond simple on-prem, into dynamic virtual environments, cloud or hybrid networks, cloud applications, and even remote devices accessing the corporate network via ZTNA or VPN.
Rather than looking at processes level data, NDR can detect the lateral movement of an adversary across multiple assets by analyzing network traffic patterns which endpoint solutions may not be able to identify [1]. In the face of a growing, complex environment, organizations large and small, will benefit from using NDRs either in conjunction, or as the foundation for, their Extended Detection and Response (XDR) for a unified view that improves their overall threat detection, ease of investigation and faster response times.
Today's NDR solutions are expected to include advanced ML and artificial intelligence (AI) algorithms [1]
Traditional IDS & IPS systems are labor intensive, requiring continuous rule creation, outdated signature maintenance, and manual monitoring for false positives or incorrect actions. This is no longer viable against a higher volume and changing landscape, making NDR the natural network tool to level against these evolutions. The role of AI in NDRs is designed to meet this challenge, “to reduce both the labor need for analysis and false positives, as well as add value by improving anomaly detection and overall security posture” .
Celebrating success in leadership and innovation
Darktrace is proud to have been recognized as an NDR “Overall Leader” in KuppingerCole Analyst AG’s Leadership Compass. The report gave further recognition to Darktrace as a ‘Product Leader”, “Innovation Leader” and “Market Leader”.
Maximum scores were received for core product categories, in addition to market presence and financial strength. Particular attention was directed to our innovation. This year has seen several NDR updates via Darktrace’s ActiveAI Security Platform version 6.2 which has enhanced investigation workflows and provided new AI transparency within the toolset.
Positive scores were also received for Darktrace’s deployment ecosystem and surrounding support, minimizing the need for extraneous integrations through a unique platform architecture that connects with over 90 other vendors.
Figure 1: High Scores received in Darktrace’s KuppingerCole Spider Chart across Core NDR capability areas
Darktrace’s pioneering AI approach sets it apart
Darktrace / NETWORK’s approach is fundamentally different to other NDRs. Continual anomaly-based detection (our Self-Learning AI), understands what is normal across each of your network entities, and then examines deviations from these behaviors rather than needing to apply static rules or ML to adversary techniques. As a result, Darktrace / NETWORK can focus on surfacing the novel threats that cannot be anticipated, whilst our proactive solutions expose gaps that can be exploited and reduce the risk of known threats.
Across the millions of possible network events that may occur, Darktrace’s Cyber AI Analyst reduces that manual workload for SOC teams by presenting only what is most important in complete collated incidents. This accelerates SOC Level 2 analyses of incidents by 10x2, giving time back, first for any necessary response and then for preventive workflows.
Finally, when incidents begin to escalate, Darktrace can natively (or via third-party) autonomously respond and take precise actions based on a contextual understanding of both the affected assets and incident in question so that threats can be disarmed without impacting wider operations.
Within the KuppingerCole report, several standout strengths were listed:
Cyber AI Analyst was celebrated as a core differentiator, enhancing both visibility and investigation into critical network issues and allowing a faster response.
Darktrace / NETWORK was singled for its user benefits. Both a clear interface for analysts with advanced filtering and analytical tools, and efficient role-based access control (RBAC) and configuration options for administrators.
At the product level, Darktrace was recognized for complete network traffic analysis (NTA) capabilities allowing extensive analysis into components like application use/type, fingerprinting, source/destination communication, in addition to comprehensive protocol support across a range of network device types from IT, OT, IoT and mobiles and detailed MITRE ATT&CK mapping.
Finally, at the heart of it, Darktrace’s innovation was highlighted in relation to its intrinsic Self Learning AI, utilizing multiple layers of deep learning, neural networks, LLMs, NLP, Generative AI and more to understand network activity and filter it for what’s critical on an individual customer level.
Going beyond reactive security
Darktrace’s visibility and AI-enabled detection, investigation and response enable security teams to focus on hardening gaps in their network through contextual relevance & priority. Darktrace / NETWORK explicitly gives time back to security teams allowing them to focus on the bigger strategic and governance workflows that sometimes get overlooked. This is enabled through proactive solutions intrinsically connected to our NDR:
Darktrace / Proactive Exposure Management, which looks beyond just CVE risks to instead discover, prioritize and validate risks by business impact and how to mobilize against them early, to reduce the number of real threats security teams face.
Darktrace / Incident Readiness & Recovery, a solution rather than service-based approach to incident response (IR) that lets teams respond in the best way to each incident and proactively test their familiarity and effectiveness of IR workflows with sophisticated incident simulations involving their own analysts and assets.
Together, these solutions allow Darktrace / NETWORK to go beyond the traditional NDR and shift teams to a more hardened and proactive state.
Putting customers first
Customers continue to sit at the forefront of Darktrace R&D, with their emerging needs and pain points being the direct inspiration for our continued innovation.
This year Darktrace / NETWORK has protected thousands of customers against the latest attacks, from data exfil and destruction, to unapproved privilege escalation and ransomware including strains like Medusa, Qilin and AlphV BlackCat.
In each instance, Darktrace / NETWORK was able to provide a holistic lens of the anomalies present in their traffic, collated those that were important, and either responded or gave teams the ability to take targeted actions against their threats – even when adversaries pivoted. In one example of a Gootloader compromise, Darktrace ensured a SOC went from detection to recovery within 5 days, 92.8% faster than the average containment time of 69 days.
Results like these, focused on user-led security, have secured Darktrace’s position within the latest NDR Leadership Compass.
From Royal to BlackSuit: Understanding the Tactics and Impact of a Sophisticated Ransomware Strain
What is BlackSuit Ransomware?
Since late 2023, Darktrace has detected BlackSuit ransomware infiltrating multiple customer networks in the US. This ransomware has targeted a wide range of industries, including arts, entertainment, real estate, public administration, defense, and social security.
Emerging in May 2023, BlackSuit is believed to be a spinoff of Royal ransomware due to similarities in code and Conti, and most likely consists of Russian and Eastern European hackers [1]. Recorded Future reported that the ransomware had affected 95 organizations worldwide, though the actual number is likely much higher [2]. While BlackSuit does not appear to focus on any particular sector, it has targeted multiple organizations in the healthcare, education, IT, government, retail and manufacturing industries [3]. Employing double extortion tactics, BlackSuit not only encrypts files but also steals sensitive data to leverage ransom payments.
BlackSuit has demanded over USD 500 million in ransoms, with the highest individual demand reaching USD 60 million [4]. Notable targets include CDK Global, Japanese media conglomerate Kadokawa, multiple educational institutions, Octapharma Plasma, and the government of Brazil [5][6][7][8].
Darktrace’s Coverage of BlackSuit Ransomware Attack
Case 1, November 2023
The earliest attack on a Darktrace customer by BlackSuit was detected at the start of November 2023. The unusual network activity began on a weekend—a time commonly chosen by ransomware groups to increase their chances of success, as many security teams operate with reduced staff. Darktrace identified indicators of the attackers’ presence on the network for almost two weeks, during which a total of 15 devices exhibited suspicious behavior.
The attack commenced with unusual internal SMB (Server Message Block) connections using a compromised service account. An internal device uploaded an executable (zzza.exe) to a domain controller (DC) and shortly after, wrote a script (socks5.ps1) to another device. According to a Cybersecurity Advisory from the CISA (Cybersecurity and Infrastructure Security Agency, US), the script file was a PowerShell reverse proxy [9].
Approximately an hour and a half later, the device to which the script was written exhibited uncommon WMI (Windows Management Instrumentation) activity. Two hours after receiving the executable file, the DC was observed making an outgoing NTLM request, using PowerShell to remotely execute commands, distributing differently named executable files (<PART OF THE CUSTOMER’S NAME>.exe), and controlling services on other devices.
Eighteen hours after the start of the unusual activity, Darktrace detected another device making repeated connections to “mystuff.bublup[.]com”, which the aforementioned CISA Advisory identifies as a domain used by BlackSuit for data exfiltration [9].
About ten minutes after the suspicious executables were distributed across the network, and less than 24 hours after the start of the unusual activity, file encryption began. A total of ten devices were seen appending the “.blacksuit” extension to files saved on other devices using SMB, as well as writing ransom notes (readme.blacksuit.txt). The file encryption lasted less than 20 minutes.
Figure 1: An example of the contents of a BlackSuit ransom note being written over SMB.
During this compromise, external connections to endpoints related to ConnectWise’s ScreenConnect remote management tool were also seen from multiple servers, suggesting that the tool was likely being abused for command-and-control (C2) activity. Darktrace identified anomalous connectivity associated with ScreenConnect was seen up to 11 days after the start of the attack.
10 days after the start of the compromise, an account belonging to a manager was detected adding “.blacksuit” extensions to the customer’s Software-a-Service (SaaS) resources while connecting from 173.251.109[.]106. Six minutes after file encryption began, Darktrace flagged the unusual activity and recommended a block. However, since Autonomous Response mode was not enabled, the customer’s security team needed to manually confirm the action. Consequently, suspicious activity continued for about a week after the initial encryption. This included disabling authentication on the account and an unusual Teams session initiated from the suspicious external endpoint 216.151.180[.]147.
Case 2, February 2024
Another BlackSuit compromise occurred at the start of February 2024, when Darktrace identified approximately 50 devices exhibiting ransomware-related activity in another US customer’s environment. Further investigation revealed that a significant number of additional devices had also been compromised. These devices were outside Darktrace’s purview to the customer’s specific deployment configuration. The threat actors managed to exfiltrate around 4 TB of data.
Initial access to the network was gained via a virtual private network (VPN) compromise in January 2024, when suspicious connections from a Romanian IP address were detected. According to CISA, the BlackSuit group often utilizes the services of initial access brokers (IAB)—actors who specialize in infiltrating networks, such as through VPNs, and then selling that unauthorized access to other threat actors [9]. Other initial access vectors include phishing emails, RDP (Remote Desktop Protocol) compromise, and exploitation of vulnerable public-facing applications.
Similar to the first case, the file encryption began at the end of the working week. During this phase of the attack, affected devices were observed encrypting files on other internal devices using two compromised administrator accounts. The encryption activity lasted for approximately six and a half hours. Multiple alerts were sent to the customer from Darktrace’s Security Operations Centre (SOC) team, who began reviewing the activity within four minutes of the start of the file encryption.
Figure 2: Darktrace’s Cyber AI Analyst clustering together multiple events related to unusual activity on the network, including file encryption over SMB by BlackSuit.
Figure 3: A spike in model alerts on the day when file encryption by BlackSuit was observed in the network.
In this case, the threat actor utilized SystemBC proxy malware for command and control (C2). A domain controller (DC) was seen connecting to 137.220.61[.]94 on the same day the file encryption took place. The DC was also observed connecting to a ProxyScrape domain around the same time, which is related to the SOCKS5 protocol used by SystemBC. During this compromise, RDP, SSH, and SMB were used for lateral movement within the network.
Figure 4: A Cyber AI Analyst investigation alerting to a device on the VPN subnet making suspicious internal SSH connections due to malicious actors moving laterally within the network.
Signs of threat actors potentially being on the network were observed as early as two days prior to the file encryption. This included unusual internal network scanning via multiple protocols (ICMP, SMB, RDP, etc.), credential brute-forcing, SMB access failures, and anonymous SMBv1 sessions. These activities were traced to IP addresses belonging to two desktop devices in the VPN subnet associated with two regular employee user accounts. Threat actors were seemingly able to exploit at least one of these accounts due to LDAP legacy policies being in place on the customer’s environment.
Figure 5: A Cyber AI Analyst incident summary alerting to a device on the VPN subnet conducting internal reconnaissance.
Figure 6: Examples of the proposed Darktrace Autonomous Response actions on the day BlackSuit initiated file encryption.
Case 3, August 2024
The most recently observed BlackSuit compromise occurred in August 2024, when a device was observed attempting to brute-force the credentials of an IT administrator. This activity continued for 11 days.
Once the admin’s account was successfully compromised, network scanning, unusual WMI, and SAMR (Security Account Manager Remote protocol) activity followed. A spike in the use of this account was detected on a Sunday—once again, the attackers seemingly targeting the weekend—when the account was used by nearly 50 different devices.
The compromised admin’s account was exploited for data gathering via SMB, resulting in the movement of 200 GB of data between internal devices in preparation for exfiltration. The files were then archived using the naming convention “*.part<number>.rar”.
Around the same time, Darktrace observed data transfers from 19 internal devices to “bublup-media-production.s3.amazonaws[.]com,” totaling just over 200 GB—the same volume of data gathered internally. Connections to other Bublup domains were also detected. The internal data download and external data transfer activity took approximately 8-9 hours.
Unfortunately, Darktrace was not configured in Autonomous Response mode at the time of the attack, meaning any mitigative actions to stop the data gathering or exfiltration required human confirmation.
Figure 7: One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.
Once the information was stolen, the threat actor moved on to the final stage of the attack—file encryption. Five internal devices, using either the compromised admin account or connecting via anonymous SMBv1 sessions, were seen encrypting files and writing ransom notes to five other devices on the network. The attempts at file encryption continued for around two hours, but Darktrace’s Autonomous Response capability was able to block the activity and prevent the attack from escalating.
Conclusion
The persistent and evolving threat posed by ransomware like BlackSuit underscores the critical importance of robust cybersecurity measures across all sectors. Since its emergence in 2023, BlackSuit has demonstrated a sophisticated approach to infiltrating networks, leveraging double extortion tactics, and demanding substantial ransoms. The cases highlighted above illustrate the varied methods and persistence of BlackSuit attackers, from exploiting VPN vulnerabilities to abusing remote management tools and targeting off-hours to maximize impact.
Although many similar connection patterns, such as the abuse of Bublup services for data exfiltration or the use of SOCKS5 proxies for C2, were observed during cases investigated by Darktrace, BlackSuit actors are highly sophisticated and tailors their attacks to each target organization. The consequences of a successful attack can be highly disruptive, and remediation efforts can be time-consuming and costly. This includes taking the entire network offline while responding to the incident, restoring encrypted files from backups (if available), dealing with damage to the organization’s reputation, and potential lawsuits.
These BlackSuit ransomware incidents emphasize the need for continuous vigilance, timely updates to security protocols, and the adoption of autonomous response technologies to swiftly counteract such attacks. As ransomware tactics continue to evolve, organizations must remain agile and informed to protect their critical assets and data. By learning from these incidents and enhancing their cybersecurity frameworks, organizations can better defend against the relentless threat of ransomware and ensure the resilience of their operations in an increasingly digital world.
Credit to Signe Zaharka (Principal Cyber Analyst) and Adam Potter (Senior Cyber Analyst)
Darktrace’s First 6: Half-Year Threat Report 2024 highlights the latest attack trends and key threats observed by the Darktrace Threat Research team in the first six months of 2024.
Focuses on anomaly detection and behavioral analysis to identify threats
Maps mitigated cases to known, publicly attributed threats for deeper context
Offers guidance on improving security posture to defend against persistent threats
Appendices
Darktrace Model Detections
Anomalous Connection / Data Sent to Rare Domain
Anomalous Connection / High Volume of New or Uncommon Service Control
Anomalous Connection / New or Uncommon Service Control
Anomalous Connection / Rare WinRM Outgoing
Anomalous Connection / SMB Enumeration
Anomalous Connection / Suspicious Activity On High Risk Device
Anomalous Connection / Suspicious Read Write Ratio
Anomalous Connection / Suspicious Read Write Ratio and Unusual SMB
Anomalous Connection / Sustained MIME Type Conversion
.blacksuit - File extension – When encrypting the files, this extension is appended to the filename – High
readme.blacksuit.txt – ransom note - A file demanding cryptocurrency payment in exchange for decrypting the victim's files and not leaking the stolen data – High
mystuff.bublup[.]com, bublup-media-production.s3.amazonaws[.]com – data exfiltration domains related to an organization and project management app that has document sharing functionality – High
137.220.61[.]94:4001 – SystemBC C2 related IP address (this tool is often used by other ransomware groups as well) - Medium
173.251.109[.]106 – IP address seen during a SaaS BlackSuit compromise (during file encryption) – Medium
216.151.180[.]147 – IP address seen during a SaaS BlackSuit compromise (during an unusual Teams session) - Medium
MITRE ATT&CK Mapping
Tactic - Technqiue
Account Manipulation - PERSISTENCE - T1098
Alarm Suppression - INHIBIT RESPONSE FUNCTION - T0878
Application Layer Protocol - COMMAND AND CONTROL - T1071
Automated Collection - COLLECTION - T1119
Block Command Message - INHIBIT RESPONSE FUNCTION - T0803
Block Reporting Message - INHIBIT RESPONSE FUNCTION - T0804
![One of the compromised devices was seen sending 80 GB of data to bublup-media-production.s3.amazonaws[.]com within a span of 4 hours.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/673513f1135d0e009caf256f_6735136a725738f4afe4de2b_Fig%25207.png)
