Blog
/

Inside the SOC

/
August 2, 2023

Darktrace's Detection of Ransomware & Syssphinx

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
02
Aug 2023
Read how Darktrace identified an attack technique by the threat group, Syssphinx. Learn how Darktrace's quick identification process can spot a threat.

Introduction

As the threat of costly cyber-attacks continues represent a real concern to security teams across the threat landscape, more and more organizations are strengthening their defenses with additional security tools to identify attacks and protect their networks. As a result, malicious actors are being forced to adapt their tactics, modify existing variants of malicious software, or utilize entirely new variants.  

Symantec recently released an article about Syssphinx, the financially motivated cyber threat group previously known for their point-of-sale attacks. Syssphinx attempts to deploy ransomware on customer networks via a modified version of their ‘Sardonic’ backdoor. Such activity highlights the ability of threat actors to alter the composition and presentation of payloads, tools, and tactics.

Darktrace recently detected some of the same indicators suggesting a likely Syssphinx compromise within the network of a customer trialing the Darktrace DETECT™ and RESPOND™ products. Despite the potential for variations in the construction of backdoors and payloads used by the group, Darktrace’s anomaly-based approach to threat detection allowed it to stitch together a detailed account of compromise activity and identify the malicious activity prior to disruptive events on the customer’s network.

What is Syssphinx?

Syssphinx is a notorious cyber threat entity known for its financially motivated compromises.  Also referred to as FIN8, Syssphinx has been observed as early as 2016 and is largely known to target private sector entities in the retail, hospitality, insurance, IT, and financial sectors.[1]

Although Syssphinx primarily began focusing on point-of-sale style attacks, the activity associated with the group has more recently incorporated ransomware variants into their intrusions in a potential bid to further extract funds from target organizations.[2]

Syssphinx Sardonic Backdoor

Given this gradual opportunistic incorporation of ransomware, it should not be surprising that Syssphinx has slowly expanded its repertoire of tools.  When primarily performing point-of-sale compromises, the group was known for its use of point-of-sale specific malwares including BadHatch, PoSlurp/PunchTrack, and PowerSniff/PunchBuggy/ShellTea.[3]

However, in a seeming response to updates in detection systems while using previous indicators of compromise (IoCs), Syssphinx began to modify its BadHatch malware.  This resulted in the use of a C++ derived backdoor known as “Sardonic”, which has the ability to aggregate host credentials, spawn additional command sessions, and deliver payloads to compromised devices via dynamic-link library (DLL).[4],[5]

Analysis of the latest version of Sardonic reveals further changes to the malware to elude detection. These shifts include the implementation of the backdoor in the C programming language, and additional over-the-network communication obfuscation techniques. [6]

During the post-exploitation phase, the group tends to rely on “living-off-the-land” tactics, whereby an attacker utilizes tools already present within the organization’s digital environment to avoid detection. Syssphinx seems to utilize system-native tools such as PowerShell and the Windows Management Instrumentation (WMI) interface.[7] It is also not uncommon to see Windows-based vulnerability exploits employed on compromised devices. This has been observed by researchers who have examined previous iterations of Syssphinx backdoors.[8] Syssphinx also appears to exhibit elements of strategic patience and discipline in its operations, with significant time gaps in operations noted by researchers. During this time, it appears likely that updates and tweaks were applied to Syssphinx payloads.

Compromise Details

In late April 2023, Darktrace identified an active compromise on the network of a prospective customer who was trialing Darktrace DETECT+RESPOND. The customer, a retailer in EMEA with hundreds of tracked devices, reached out to the Darktrace Analyst team via the Ask the Expert (ATE) service for support and further investigation, following the encryption of their server and backup data storage in an apparent ransomware attack. Although the encryption events fell outside Darktrace’s purview due to a limited set up of trial appliances, Darktrace was able to directly track early stages of the compromise before exfiltration and encryption events began. If a full deployment had been set up and RESPOND functionality had been configured in autonomous response mode, Darktrace may have helped mitigate such encryption events and would have aided in the early identification of this ransomware attack.

Initial Intrusion and Establishment of Command and Control (C2) Infrastructure

As noted by security researchers, Syssphinx largely relies on social engineering and phishing emails to deliver its backdoor payloads. As there were no Darktrace/Email™ products deployed for this customer, it would be difficult to directly observe the exact time and manner of initial payload delivery related to this compromise. This is compounded by the fact that the customer had only recently began using Darktrace’s products during their trial period. Given the penchant for patience and delay by Syssphinx, it is possible that the intrusion began well before Darktrace had visibility of the organization’s network.

However, beginning on April 30, 2023, at 07:17:31 UTC, Darktrace observed the domain controller dc01.corp.XXXX  making repeated SSL connections to the endpoint 173-44-141-47[.]nip[.]io. In addition to the multiple open-source intelligence (OSINT) flags for this endpoint, the construction of the domain parallels that of the initial domain used to deliver a backdoor, as noted by Symantec in their analysis (37-10-71-215[.]nip[.]io). This activity likely represented the initial beaconing being performed by the compromised device. Additionally, an elevated level of incoming external data over port 443 was observed during this time, which may be associated with the delivery of the Sardonic backdoor payload. Given the unusual use of port 443 to perform SSH connections later seen in the kill chain of this attack, this activity could also parallel the employment of embedded backdoor payloads seen in the latest iteration of the Sardonic backdoor noted by Symantec.

Figure 1: Graph of the incoming external data surrounding the time of the initial establishment of command and control communication for the domain controller. As seen in the graph, the spike in incoming external data during this time may parallel the delivery of Syssphinx Sardonic backdoor.

Regardless, the domain controller proceeded to make repeated connections over port 443 to the noted domain.

Figure 2: Breach event log for the domain controller making repeated connections over port 443 to the rare external destination endpoint in constitute the establishment of C2 communication.

Internal Reconnaissance/Privilege Escalation

Following the establishment of C2 communication, Darktrace detected numerous elements of internal reconnaissance. On Apr 30, 2023, at 22:06:26 UTC, the desktop device desktop_02.corp.XXXX proceeded to perform more than 100 DRSGetNCChanges requests to the aforementioned domain controller. These commands, which are typically implemented over the RPC protocol on the DRSUAPI interface, are frequently utilized in Active Directory sync attacks to copy Active Directory information from domain controllers. Such activity, when not performed by new domain controllers to sync Active Directory contents, can indicate malicious domain or user enumeration, credential compromise or Active Directory enumeration.

Although the affected device made these requests to the previously noted domain controller, which was already compromised, such activity may have further enabled the compromise by allowing the threat actor to transfer these details to a more easily manageable device.

The device performing these DRSGetNCChanges requests would later be seen performing lateral movement activity and making connections to malicious endpoints.

Figure 3: Breach log highlighting the DRS operations performed by the corporate device to the destination domain controller. Such activity is rarely authorized for devices not tagged as administrative or as domain controllers.

Execution and Lateral Movement

At 23:09:53 UTC on April 30, 2023, the original domain server proceeded to make multiple uncommon WMI calls to a destination server on the same subnet (server01.corp.XXXX). Specifically, the device was observed making multiple RPC calls to IWbem endpoints on the server, which included login and ExecMethod (method execution) commands on the destination device. This destination device later proceeded to conduct additional beaconing activity to C2 endpoints and exfiltrate data.

Figure 4: Breach log for the domain controller performing WMI commands to the destination server during the lateral movement phase of the breach.

Similarly, beginning on May 1, 2023, at 00:11:09 UTC, the device desktop_02.corp.XXXX made multiple WMI requests to two additional devices, one server and one desktop, within the same subnet as the original domain controller. During this time, desktop_02.corp.XXXX  also utilized SMBv1, an outdated and typically non-compliant version communication protocol, to write the file rclone.exe to the same two destination devices. Rclone.exe, and its accompanying bat file, is a command-line tool developed by IT provider Rclone, to perform file management tasks. During this time, Darktrace also observed the device reading and deleting an unexpected numeric file on the ADMIN$ of the destination server, which may represent additional defense evasion techniques and tool staging.

Figure 5: Event log highlighting the writing of rclone.exe using the outdated SMBv1 communication protocol.
Figure 6: SMB logs indicating the reading and deletion of numeric string files on ADMIN$ shares of the destination devices during the time of the rclone.exe SMB writes. Such activity may be associated with tool staging and could indicate potential defense evasion techniques.

Given that the net loader sample analyzed by Symantec injects the backdoor into a WmiPrvSE.exe process, the use of WMI operations is not unexpected. Employment of WMI also correlates with the previously mentioned “living-off-the-land” tactics, as WMI services are commonly used for regular network and system administration purposes. Moreover, the staging of rclone.exe, a legitimate file management tool, for data exfiltration underscores attempts to blend into existing and expected network traffic and remain undetected on the customer’s network.

Data Exfiltration and Impact

Initial stages of data exfiltration actually began prior to some of the lateral movement events described above. On April 30, 2023, 23:09:47 the device server01.corp.XXXX, transferred nearly 11 GB of data to 173.44[.]141[.]47, as well as to the rare external IP address 170.130[.]55[.]77, which appears to have served as the main exfiltration destination during this compromise. Furthermore, the host made repeated connections to the same external IP associated with the initial suspicious beaconing activity (173.44[.]141[.]47) over SSL.

While the data exfiltration event unfolded, the device, server01.corp.XXXX, made multiple HTTP requests to 37.10[.]71[.]215, which featured URIs requesting the rclone.exe and rclone.bat files. This IP address was directly involved in the sample analyzed by Symantec. Furthermore, one of the devices that received the SMB file writes of rclone.exe and the WMI commands from desktop_02.corp.XXXX also performed SSL beaconing to endpoints associated with the compromise.

Between 01:20:45 - 03:31:41 UTC on May 1, 2023, a Darktrace detected a series of devices on the network performing a repeated pattern of activity, namely external connectivity followed by suspicious file downloads and external data transfer operations. Specifically, each affected device made multiple HTTP requests to 37.10[.]71[.]215 for rclone files. The devices proceeded to download the executable and/or binary files, and then transfer large amounts of data to the aforementioned endpoints, 170.130[.]55[.]77 and or 173-44-141-47[.]nip[.]io. Although the devices involved in data exfiltration utilized port 443 as a destination port, the connections actually used the SSH protocol. Darktrace recognized this behavior as unusual as port 443 is typically associated with the SSL protocol, while port 22 is reserved for SSH. Therefore, this activity may represent the threat actor’s attempts to remain undetected by security tools.

This unexpected use of SSH over port 443 also correlates with the descriptions of the new Sardonic backdoor according to threat researchers. Further beaconing and exfiltration activity was performed by an additional host one day later whereby the device made suspicious repeated connections to the aforementioned external hosts.

Figure 7: Connection details highlighting the use of port 443 for SSH connections during the exfiltration events.

In total, nine separate devices were involved in this pattern of activity. Five of these devices were labeled as ‘administrative’ devices according to their hostnames. Over the course of the entire exfiltration event, the attackers exfiltrated almost 61 GB of data from the organization’s environment.

Figure 8: Graph showing the levels of external data transfer from a breach device for one day on either side of the breach time. There is a large spike in such activity during the time of the breach that underscores the exfiltration events.

In addition to the individual anomaly detections by DETECT, Darktrace’s Cyber AI Analyst™ launched an autonomous investigation into the unusual behavior carried out by affected devices, connecting and collating multiple security events into one AI Analyst Incident. AI Analyst ensures that Darktrace can recognize and link the individual steps of a wider attack, rather than just identifying isolated incidents. While traditional security tools may mistake individual breaches as standalone activity, Darktrace’s AI allows it to provide unparalleled visibility over emerging attacks and their kill chains. Furthermore, Cyber AI Analyst’s instant autonomous investigations help to save customer security teams invaluable time in triaging incidents in comparison with human teams who would have to commit precious time and resources to conduct similar pattern analysis.

In this specific case, AI Analyst identified 44 separate security events from 18 different devices and was able to tie them together into one incident. The events that made up this AI Analyst Incident included:

  • Possible SSL Command and Control
  • Possible HTTP Command and Control
  • Unusual Repeated Connections
  • Suspicious Directory Replication ServiceActivity
  • Device / New or Uncommon WMI Activity
  • SMB Write of Suspicious File
  • Suspicious File Download
  • Unusual External Data Transfer
  • Unusual External Data Transfer to MultipleRelated Endpoints
Figure 9: Cyber AI Incident log highlighting multiple unusual anomalies and connecting them into one incident.

Had Darktrace RESPOND been enabled in autonomous response mode on the network of this prospective customer, it would have been able to take rapid mitigative action to block the malicious external connections used for C2 communication and subsequent data exfiltration, ideally halting the attack at this stage. As previously discussed, the limited network configuration of this trial customer meant that the encryption events unfortunately took place outside of Darktrace’s scope. When fully configured on a customer environment, Darktrace DETECT can identify such encryption attempts as soon as they occur. Darktrace RESPOND, in turn, would be able to immediately intervene by applying preventative actions like blocking internal connections that may represent file encryption, or limiting potentially compromised devices to a previously established pattern of life, ensuring they cannot carry out any suspicious activity.

Conclusion

Despite the limitations posed by the customer’s trial configuration, Darktrace demonstrated its ability to detect malicious activity associated with Syssphinx and track it across multiple stages of the kill chain.

Darktrace’s ability to identify the early stages of a compromise and various steps of the kill chain, highlights the necessity for machine learning-enabled, anomaly-based detection. In the face of threats such as Syssphinx, that exhibit the propensity to recast backdoor payloads and incorporate on “living-off-the-land” tactics, signatures and rules-based detection may not prove as effective. While Syssphinx and other threat groups will continue to adopt new tools, methods, and techniques, Darktrace’s Self-Learning AI is uniquely positioned to meet the challenge of such threats.

Appendix

DETECT Model Breaches Observed

•      Anomalous Server Activity / Anomalous External Activity from Critical Network Device

•      Anomalous Connection / Anomalous DRSGetNCChanges Operation

•      Device / New or Uncommon WMI Activity

•      Compliance / SMB Drive Write

•      Anomalous Connection / Data Sent to Rare Domain

•      Anomalous Connection / Uncommon 1 GiB Outbound

•      Unusual Activity / Unusual External Data Transfer

•      Unusual Activity / Unusual External Data to New Endpoints

•      Compliance / SSH to Rare External Destination

•      Anomalous Connection / Unusual SMB Version 1 Connectivity

•      Anomalous File / EXE from Rare External Location

•      Anomalous File / Script from Rare External Location

•      Compromise / Suspicious File and C2

•      Device / Initial Breach Chain Compromise

‍

AI Analyst Incidents Observed

•      Possible SSL Command and Control

•      Possible HTTP Command and Control

•      Unusual Repeated Connections

•      Suspicious Directory Replication Service Activity

•      Device / New or Uncommon WMI Activity

•      SMB Write of Suspicious File

•      Suspicious File Download

•      Unusual External Data Transfer

•      Unusual External Data Transfer to Multiple Related Endpoints

IoCs

IoC - Type - Description

37.10[.]71[.]215 – IP – C2 + payload endpoint

173-44-141-47[.]nip[.]io – Hostname – C2 – payload

173.44[.]141[.]47 – IP – C2 + potential payload

170.130[.]55[.]77 – IP – Data exfiltration endpoint

Rclone.exe – Exe File – Common data tool

Rclone.bat – Script file – Common data tool

MITRE ATT&CK Mapping

Command and Control

T1071 - Application Layer Protocol

T1071.001 – Web protocols

T1573 – Encrypted channels

T1573.001 – Symmetric encryption

T1573.002 – Asymmetric encryption

T1571 – Non-standard port

T1105 – Ingress tool transfer

Execution

T1047 – Windows Management Instrumentation

Credential Access‍

T1003 – OS Credential Dumping

T1003.006 – DCSync

Lateral Movement

T1570 – Lateral Tool Transfer

T1021 - Remote Services

T1021.002 - SMB/Windows Admin Shares

T1021.006 – Windows Remote Management

Exfiltration

T1048 - Exfiltration Over Alternative Protocol

T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol

T1048.002 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol

T1041 - Exfiltration Over C2 Channel

References

[1] https://cyberscoop.com/syssphinx-cybercrime-ransomware/

[2] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/Syssphinx-FIN8-backdoor

[3] https://www.bleepingcomputer.com/news/security/fin8-deploys-alphv-ransomware-using-sardonic-malware-variant/

[4] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/Syssphinx-FIN8-backdoor

[5] https://thehackernews.com/2023/07/fin8-group-using-modified-sardonic.html

[6] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/Syssphinx-FIN8-backdoor

[7] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/Syssphinx-FIN8-backdoor

[8] https://www.mandiant.com/resources/blog/windows-zero-day-payment-cards

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Adam Potter
Senior Cyber Analyst
Watch the NIS2 Webinar
Book a 1-1 meeting with one of our experts
Get in touch
Share this article
Trending blogs
1
The State of AI in Cybersecurity: The Impact of AI on Cybersecurity Solutions
May 13, 2024
2
How Empowering End Users can Improve Your Email Security and Decrease the Burden on the SOC
May 8, 2024
3
Elevating Network Security: Confronting Trust, Ransomware, & Novel Attacks
Jun 21, 2024
4
The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners
Apr 9, 2024
5

More in this series

No items found.

Blog

/

November 19, 2024

/
No items found.

Darktrace Leading the Future of Network Detection and Response with Recognition from KuppingerCole

Default blog imageDefault blog image

KuppingerCole has recognized Darktrace as an overall Leader, Product Leader, Market Leader and Innovation Leader in the KuppingerCole Leadership Compass: Network Detection and Response (2024).

With the perimeter all but dissolved, Network Detection and Response (NDR) tools are quickly becoming a critical component of the security stack, as the main tool to span the modern network. NDRs connect on-premises infrastructure to cloud, remote workers, identities, SaaS applications, and IoT/OT – something not available to EDR that requires agents and isolates visibility to individual devices.

KuppingerCole Analysts AG designated Darktrace an ‘Overall Leader’ position because of our continual innovation around user-led security. Self-Learning AI together with automated triage through Cyber AI Analyst and real-time autonomous response actions have been instrumental to security teams in stopping potential threats before they become a breach. With this time saved, Darktrace is leading beyond reactive security to truly harden a network, allowing the team to spend more time in preventive security measures.

Network Detection and Response protects where others fail to reach

NDR solutions operate at the network level, deploying inside or parallel to your network to ingest raw traffic via virtual or physical sensors. This gives them unprecedented potential to identify anomalies and possible breaches in any network - far beyond simple on-prem, into dynamic virtual environments, cloud or hybrid networks, cloud applications, and even remote devices accessing the corporate network via ZTNA or VPN.

Rather than looking at processes level data, NDR can detect the lateral movement of an adversary across multiple assets by analyzing network traffic patterns which endpoint solutions may not be able to identify [1]. In the face of a growing, complex environment, organizations large and small, will benefit from using NDRs either in conjunction, or as the foundation for, their Extended Detection and Response (XDR) for a unified view that improves their overall threat detection, ease of investigation and faster response times.

Today's NDR solutions are expected to include advanced ML and artificial intelligence (AI) algorithms [1]

Traditional IDS & IPS systems are labor intensive, requiring continuous rule creation, outdated signature maintenance, and manual monitoring for false positives or incorrect actions. This is no longer viable against a higher volume and changing landscape, making NDR the natural network tool to level against these evolutions. The role of AI in NDRs is designed to meet this challenge, “to reduce both the labor need for analysis and false positives, as well as add value by improving anomaly detection and overall security posture” .

Celebrating success in leadership and innovation

Darktrace is proud to have been recognized as an NDR “Overall Leader” in KuppingerCole Analyst AG’s Leadership Compass. The report gave further recognition to Darktrace as a ‘Product Leader”, “Innovation Leader” and “Market Leader”.

Maximum scores were received for core product categories, in addition to market presence and financial strength. Particular attention was directed to our innovation. This year has seen several NDR updates via Darktrace’s ActiveAI Security Platform version 6.2 which has enhanced investigation workflows and provided new AI transparency within the toolset.

Positive scores were also received for Darktrace’s deployment ecosystem and surrounding support, minimizing the need for extraneous integrations through a unique platform architecture that connects with over 90 other vendors.

High Scores received in Darktrace’s KuppingerCole Spider Chart across Core NDR capability areas
Figure 1: High Scores received in Darktrace’s KuppingerCole Spider Chart across Core NDR capability areas

Darktrace’s pioneering AI approach sets it apart

Darktrace / NETWORK’s approach is fundamentally different to other NDRs. Continual anomaly-based detection (our Self-Learning AI), understands what is normal across each of your network entities, and then examines deviations from these behaviors rather than needing to apply static rules or ML to adversary techniques. As a result, Darktrace / NETWORK can focus on surfacing the novel threats that cannot be anticipated, whilst our proactive solutions expose gaps that can be exploited and reduce the risk of known threats.    

Across the millions of possible network events that may occur, Darktrace’s Cyber AI Analyst reduces that manual workload for SOC teams by presenting only what is most important in complete collated incidents. This accelerates SOC Level 2 analyses of incidents by 10x2, giving time back, first for any necessary response and then for preventive workflows.

Finally, when incidents begin to escalate, Darktrace can natively (or via third-party) autonomously respond and take precise actions based on a contextual understanding of both the affected assets and incident in question so that threats can be disarmed without impacting wider operations.

Within the KuppingerCole report, several standout strengths were listed:

  • Cyber AI Analyst was celebrated as a core differentiator, enhancing both visibility and investigation into critical network issues and allowing a faster response.
  • Darktrace / NETWORK was singled for its user benefits. Both a clear interface for analysts with advanced filtering and analytical tools, and efficient role-based access control (RBAC) and configuration options for administrators.
  • At the product level, Darktrace was recognized for complete network traffic analysis (NTA) capabilities allowing extensive analysis into components like application use/type, fingerprinting, source/destination communication, in addition to comprehensive protocol support across a range of network device types from IT, OT, IoT and mobiles and detailed MITRE ATT&CK mapping.
  • Finally, at the heart of it, Darktrace’s innovation was highlighted in relation to its intrinsic Self Learning AI, utilizing multiple layers of deep learning, neural networks, LLMs, NLP, Generative AI and more to understand network activity and filter it for what’s critical on an individual customer level.

Going beyond reactive security

Darktrace’s visibility and AI-enabled detection, investigation and response enable security teams to focus on hardening gaps in their network through contextual relevance & priority. Darktrace / NETWORK explicitly gives time back to security teams allowing them to focus on the bigger strategic and governance workflows that sometimes get overlooked. This is enabled through proactive solutions intrinsically connected to our NDR:

  • Darktrace / Proactive Exposure Management, which looks beyond just CVE risks to instead discover, prioritize and validate risks by business impact and how to mobilize against them early, to reduce the number of real threats security teams face.
  • Darktrace / Incident Readiness & Recovery, a solution rather than service-based approach to incident response (IR) that lets teams respond in the best way to each incident and proactively test their familiarity and effectiveness of IR workflows with sophisticated incident simulations involving their own analysts and assets.

Together, these solutions allow Darktrace / NETWORK to go beyond the traditional NDR and shift teams to a more hardened and proactive state.

Putting customers first

Customers continue to sit at the forefront of Darktrace R&D, with their emerging needs and pain points being the direct inspiration for our continued innovation.

This year Darktrace / NETWORK has protected thousands of customers against the latest attacks, from data exfil and destruction, to unapproved privilege escalation and ransomware including strains like Medusa, Qilin and AlphV BlackCat.

In each instance, Darktrace / NETWORK was able to provide a holistic lens of the anomalies present in their traffic, collated those that were important, and either responded or gave teams the ability to take targeted actions against their threats – even when adversaries pivoted. In one example of a Gootloader compromise, Darktrace ensured a SOC went from detection to recovery within 5 days, 92.8% faster than the average containment time of 69 days.

Results like these, focused on user-led security, have secured Darktrace’s position within the latest NDR Leadership Compass.

To find out more about what makes Darktrace / NETWORK special, read the full KuppingerCole report.

References

[1] Osman Celik, KuppingerCole Leadership Compass:Network Detection and Response (2024)

[2] Darktrace's AI Analyst customer fleet data

[3] https://www.ibm.com/reports/data-breach

Continue reading
About the author
Gabriel Few-Wiegratz
Product Marketing Manager

Blog

/

November 1, 2024

/

Inside the SOC

Phishing and Persistence: Darktrace’s Role in Defending Against a Sophisticated Account Takeover

Default blog imageDefault blog image

The exploitation of SaaS platforms

As businesses continue to grow and evolve, the need for sharing ideas through productivity and cloud Software-as-a-Service (SaaS) platforms is becoming increasingly crucial. However, these platforms have also become prime targets for cyber attackers.

Threat actors often exploit these widely-used services to gain unauthorized access, steal sensitive information, and disrupt business operations. The growing reliance on SaaS platforms makes them attractive entry points for cybercriminals, who use sophisticated techniques such as phishing, social engineering, and malware to compromise these systems.

Services like Microsoft 365 are regularly targeted by threat actors looking for an entry point into an organization’s environment to carry out malicious activities. Securing these platforms is crucial to protect business data and ensure operational continuity.

Darktrace / EMAIL detection of the phishing attack

In a recent case, Darktrace observed a customer in the manufacturing sector receiving a phishing email that led to a threat actor logging in and creating an email rule. Threat actors often create email rules to move emails to their inbox, avoiding detection. Additionally, Darktrace detected a spoofed domain registered by the threat actor. Despite already having access to the customer’s SaaS account, the actor seemingly registered this domain to maintain persistence on the network, allowing them to communicate with the spoofed domain and conduct further malicious activity.

Darktrace / EMAIL can help prevent compromises like this one by blocking suspicious emails as soon as they are identified. Darktrace’s AI-driven email detection and response recognizes anomalies that might indicate phishing attempts and applies mitigative actions autonomously to prevent the escalation of an attack.

Unfortunately, in this case, Darktrace was not configured in Autonomous Response mode at the time of the attack, meaning actions had to be manually applied by the customer’s security team. Had it been fully enabled, it would have held the emails, preventing them from reaching the intended recipient and stopping the attack at its inception.

However, Darktrace’s Managed Threat Detection alerted the Security Operations Center (SOC) team to the compromise, enabling them to thoroughly investigate the incident and notify the customer before further damage could occur.

The Managed Threat Detection service continuously monitors customer networks for suspicious activities that may indicate an emerging threat. When such activities are detected, alerts are sent to Darktrace’s expert Cyber Analysts for triage, significantly speeding up the remediation process.

Attack Overview

On May 2, 2024, Darktrace detected a threat actor targeting a customer in the manufacturing sector then an unusual login to their SaaS environment was observed prior to the creation of a new email rule.

Darktrace immediately identified the login as suspicious due to the rarity of the source IP (31.222.254[.]27) and ASN, coupled with the absence of multi-factor authentication (MFA), which was typically required for this account.

The new email rule was intended to mark emails as read and moved to the ‘Conversation History’ folder for inbound emails from a specific domain. The rule was named “….,,,”, likely the attacker attempting to setup their new rule with an unnoteworthy name to ensure it would not be noticed by the account’s legitimate owner. Likewise, by moving emails from a specific domain to ‘Conversation History’, a folder that is rarely used by most users, any phishing emails sent by that domain would remain undetected by the user.

Darktrace’s detection of the unusual SaaS login and subsequent creation of the new email rule “….,,,”.
Figure 1: Darktrace’s detection of the unusual SaaS login and subsequent creation of the new email rule “….,,,”.

The domain in question was identified as being newly registered and an example of a typosquat domain. Typosquatting involves registering new domains with intentional misspelling designed to convince users to visit fake, and often malicious, websites. This technique is often used in phishing campaigns to create a sense of legitimacy and trust and deceive users into providing sensitive information. In this case, the suspicious domain closely resembled several of the customer’s internal domains, indicating an attempt to impersonate the organization’s legitimate internal sites to gain the target’s trust. Furthermore, the creation of this lookalike domain suggests that the attack was highly targeted at this specific customer.

Interestingly, the threat actor registered this spoofed domain despite already having account access. This was likely intended to ensure persistence on the network without having to launch additional phishing attacks. Such use of spoofed domain could allow an attacker to maintain a foothold in their target network and escalate their malicious activities without having to regain access to the account. This persistence can be used for various purposes, including data exfiltration, spreading malware, or launching further attacks.

Following this, Darktrace detected a highly anomalous email being sent to the customer’s account from the same location as the initial unsual SaaS login. Darktrace’s anomaly-based detection is able to identify threats that human security teams and traditional signature-based methods might miss. By analyzing the expected behavior of network users, Darktrace can recognize the subtle deviations from the norm that may indicate malicious activity. Unfortunately, in this instance, without Darktrace’s Autonomous Response capability enabled, the phishing email was able to successfully reach the recipient. While Darktrace / EMAIL did suggest that the email should be held from the recipients inbox, the customer was required to manually approve it.

Despite this, the Darktrace SOC team were still able to support the customer as they were subscribed to the Managed Threat Detection service. Following the detection of the highlight anomalous activity surrounding this compromise, namely the unusual SaaS login followed by a new email rule, an alert was sent to the Darktrace SOC for immediate triage, who then contacted the customer directly urging immediate action.

Conclusion

This case underscores the need to secure SaaS platforms like Microsoft 365 against sophisticated cyber threats. As businesses increasingly rely on these platforms, they become prime targets for attackers seeking unauthorized access and disruption.

Darktrace’s anomaly-based detection and response capabilities are crucial in identifying and mitigating such threats. In this instance, Darktrace detected a phishing email that led to a threat actor logging in and creating a suspicious email rule. The actor also registered a spoofed domain to maintain persistence on the network.

Darktrace / EMAIL, with its AI-driven detection and analysis, can block suspicious emails before they reach the intended recipient, preventing attacks at their inception. Meanwhile, Darktrace’s SOC team promptly investigated the activity and alerted the customer to the compromise, enabling them to take immediate action to remediate the issue and prevent any further damage.

Credit to Vivek Rajan (Cyber Security Analyst) and Ryan Traill (Threat Content Lead).

Appendices

Darktrace Model Detections

  • ‍SaaS / Access / Unusual External Source for SaaS Credential Use‍
  • ‍SaaS / Compromise / Login From Rare Endpoint While User Is Active
  • SaaS / Resource / Unusual Access to Delegated Resource by Non Owner
  • SaaS / Email Nexus / Unusual Login Location Following Sender Spoof
  • Compliance / Anomalous New Email Rule
  • SaaS / Compromise / Unusual Login and New Email Rule

Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

‍31.222.254[.]27 – IP -  Suspicious Login Endpoint

MITRE ATT&CK Mapping

Tactic – Technqiue – Sub-technique of (if applicable)

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Cloud Service Dashboard – DISCOVERY - T1538

Compromise Accounts - RESOURCE DEVELOPMENT - T1586

Steal Web Session Cookie - CREDENTIAL ACCESS - T1539

Outlook Rules – PERSISTENCE - T1137.005 - T1137

Continue reading
About the author
Vivek Rajan
Cyber Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI