Top Blogs of Q1 2021

It’s safe to say that the first quarter of 2021 gave strong 2020 vibes. As many places are starting to get back to normal after 2020, cybercriminals continue to make things harder and cause chaos. We’re here to go through the top five blogs of Q1 2021, review why they are still important, and help each other be better prepared for the rest of 2021. 

Threat Intelligence Can Be Noisy: SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) Helps

Threat intelligence can be exciting and rewarding with the possibility of data evolving into intelligence reports provided to executives. However, the average company is mentioned across the open, deep, and dark web approximately 15 million times a year, creating a significant workload for security teams. In Threat Intelligence Can Be Noisy: SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) Helps, we discuss what we have done to kill the alert noise and help organizations start building up a more actionable, and less overwhelming, threat intelligence capability. 

To work effectively, allow software to do the heavy lifting. Software using a combination of set filters and machine learning algorithms can eliminate millions of results that would otherwise consume your team’s time. This approach helps your security team weed out the vast majority of the unimportant or irrelevant mentions and reduce time to triage of the critical alerts. 

The power of SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) is also to focus humans on trickier problems. Although software can help filter out millions of mentions, having a human in the loop helps your team by removing alerts that are not a threat to your organization. Of the 13,000 potential alerts detected by SearchLight, our analysts remove approximately 91% of them before being raised to security teams. This allows your team to spend more time remediating real threats.

The nature of security operations is often many repeat actions—validating exposed credentials, investigating threats, etc. Thankfully, automation can help your team remove repetitive alerts and actions, such as exposed credentials. Organizations that have enabled the automatic validation feature in SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) have seen an average of 11,000 exposed credentials auto-rejected with success. Of the 15 million mentions, the average organization only gets 1,277 alerts a year, allowing teams to focus their time on mitigating the organization’s actionable threats. 

Ransomware: Analyzing the data from 2020

Ransomware groups hit the spotlight in 2020 as more and more groups began creating data leak sites and jumping on the “pay-or-get-breached” trend. In our Ransomware: Analyzing The Data From 2020, we discuss the ransomware trends we saw throughout 2020. Six groups made up 84% of our alerts— Maze, Egregor, Conti, Sodinokibi, DoppelPaymer, and NetWalker.

Digital Shadows (now ReliaQuest) monitored 20 data leak sites by the end of 2020, and there did not appear to be any sector that was off-limits to these groups. Industrial Goods & Services was the most targeted industry, accounting for 29% of our alerts. Although the ransomware groups did not appear to be biased when targeting sectors in 2020, the groups did have a geographical preference. North America was the most targeted geographic area, with 66% of our ransomware alerts from organizations located in the region.

The end of an era occurred in 2020 with the Maze ransomware group announcing an end to its operations. Among the groups adopting the double extortion method, the Maze group surprised us the most when they announced closing operations on 01 Nov 2020. However, the Egregor group quickly rose to the top and gained recognition with attacks on US bookstore chain Barnes & Noble and video game producers Ubisoft and Crytek. Reporting suggested that Maze ransomware operators had shifted to Egregor; this theory was supported by the level of sophistication demonstrated by Egregor in a short time frame, and Egregor’s victimology was consistent with targeting conducted by the operators of the Maze ransomware variant.

Ransomware remains a hot topic in the digital landscape as groups continue to improve tactics and find new ways to extort victims. 

The Rise of Initial Access Brokers

Speaking of ransomware groups, have you ever wondered how the group or its affiliates gain access to a victim network? In our blog, The Rise Of Initial Access Brokers, we discuss Initial Access Brokers (IABs) and their role in the threat landscape. Digital Shadows (now ReliaQuest)’ monitoring of IABs goes back as far as 2014 since the practice first began making ripples in the cybercriminal underground. 

IABs act as the middleman by finding vulnerable organizations, completing the dirty technical work, and selling an organization’s access to the highest bidder. Once an IAB gains network access to a victim organization, they establish the access’ value and turn to their cybercriminal forums of choice to advertise the access. In the beginning, outright naming the organization offered was common practice. However, the listings are now usually heavily redacted of company names and logos so that IABs can avoid detection by law enforcement and security researchers. By avoiding naming the victim outright, IABs can offer prospective buyers an indication of the target without offering security researchers and law enforcement an easy chance to stop their operations.

Of the more than 500 listings analyzed by Digital Shadows (now ReliaQuest) in 2020, the top three accesses included Remote Desktop Protocol (RDP), Domain Admin, and Virtual Private Network (VPN). As remote working models became the norm in 2020, seeing VPN make the top three shouldn’t come as a surprise—unpatched software and weak credentials are unfortunately present on corporate laptops, making organizations vulnerable to external cyber threats.

One thing stood out during 2020: IABs will target anyone. The top three sectors listed were retail, financial services, and technology; with the Technology sector having an average list price of USD 13,607. Technology is a prime target as technology providers can be compromised to pivot towards other organizations across all verticals. As with ransomware, IABs may not prefer a sector but they do have a preferred geography, with 31.14 percent of listings being targets in the United States. Mitigation strategies largely depend on the type of access being listed by the threat actor. Our recent research piece, Initial Access Brokers: An Excess of Access, we provide some access type-specific tips to help that can be implemented to help mitigate the threat of IABs. 

Looking back at 2020: A Year in Review

2020 will go down as one of the years to remember; on top of COVID-19 and lockdowns, the year included pretty significant events in the cyber threat landscape. In our blog, Looking Back At 2020: A Year In Review, we discuss three of the most critical events in the cyber threat landscape. 

One of the most notable events of 2020 was the supply-chain attack leveraging the SolarWinds’ Orion platform. When we thought 2020 was coming to a close, security researchers uncovered the highly sophisticated and targeted attack using trojanized versions of Orion, with approximately 18,000 SolarWinds’ corporate clients receiving trojanized versions of its Orion software. When this blog was written, there was little information related to the attack and threat groups involved. On 15 February 2021, Microsoft president Brad Smith confirmed that over 1000 attackers were believed to have worked as part of the supply chain compromise that impacted SolarWinds. Digital Shadows (now ReliaQuest) has continued to monitor the SolarWinds compromise.

In 2020, ransomware reigned. Dozens of ransomware operators began using the double extortion technique—encrypting systems alongside threatening the release of victims’ information publicly. The “monkey see, monkey do” game gained traction in 2020 and showed the ransomware industry’s growing professionalization. The massive growth of this technique may represent the default technique as we advance, and we can expect to see future ransomware attacks involve the public release of stolen information. 

The elevation of privilege vulnerability in Netlogon, aka “ZeroLogon” (CVE-2020-1472), was the year’s vulnerability in 2020. This vulnerability was exploited by several threat groups, including the Iran-linked “MuddyWater” APT, the “Chimborazo” threat group, and state-sponsored actors linked to the People’s Republic of China. Additionally, in October, it was reported that the operators behind the “Ryuk” ransomware managed to conduct an attack, from initial infection to full encryption, in just five hours using the ZeroLogon vulnerability—compared to 29 hours before the vulnerability. 

Of course, the event of all events impacting the cyber threat landscape is the COVID-19 pandemic. Threat actors took advantage of the fear and uncertainty surrounding the virus, and the quick shift from office work to remote work left some organizations vulnerable. Under the surface, threat actors conducted business as usual across the cyber threat landscape; data breaches continued to be reported at a staggering rate, and APT groups continued their traditional information-gathering operations. 

Targets and Predictions for the COVID-19 Threat Landscape

It’s officially been a year since the outbreak of the COVID-19 pandemic. Threat actors have notoriously been quick to adapt their tactics, techniques, and procedures (TTPs) to exploit fear and curiosity during times of uncertainty. The last year of the COVID-19 era is no different. In our blog, Targets and Predictions for the COVID-19 Threat Landscape, we discuss some of the threats observed over the last year and predictions for the COVID-19 threat intelligence landscape.

As some businesses shut down during lockdowns and, in some cases, permanently, many people have lost their jobs or partially lost their income. Governments around the world developed ad hoc COVID-19 relief measures to help relieve the financial burden of citizens and small businesses. Cybercriminals saw an opportunity to gain illegal income with an explosion of dark web marketplace offerings of fraudulent methods to access government grants. Additionally, cybercriminals targeted financial support programs by impersonating government entities and sending phishing emails. Many fell victim to these attacks as the curiosity and fear around COVID-19 brought down many peoples’ defenses. These successful attacks enable threat actors to extract valuable personal identifiable information (PII) and financial information from their targets. 

As individuals and companies alike purchased supplies, such as masks and gloves, we quickly began hearing reports of shortages of the products. Cybercriminals who were previously selling illegal drugs and substances on dark web marketplaces quickly pivoted to selling medical supplies. From masks and gloves to hydroxychloroquine doses to COVID rapid tests, it could all be found across various criminal marketplaces for sale. As vaccines are being distributed, there have been instances of COVID-19 vaccines listed on cybercriminal marketplaces.

As vaccines were created and mass vaccination began in parts of the world, we observed cybercriminals adapting once again to take advantage of the process. In July 2020, the United Kingdom’s National Cyber Security Center (NCSC) published a joint advisory claiming that APT29 (aka “Cozy Bear”), a Russian-state-linked advanced persistent threat (APT) group, developed custom malware to target vaccine development facilities in the UK, Canada, and the US. The group’s objective was to obtain intellectual property from organizations in the government, health care, diplomatic, and energy sector. Additionally, as countries have started mass vaccinations, cybercriminals take advantage of the sense of urgency some citizens feel by sending out fraudulent phishing URLs with malicious survey links to secure their place in an imaginary vaccine queue. 

The arrival of COVID-19 shaped the cyber threat landscape of 2020, and cybercriminals demonstrated how adaptable they could be to a quickly changing standard. The fear, uncertainty, and doubt surrounding COVID-19 have made cybercriminals’ jobs much easier. Digital Shadows (now ReliaQuest) continues to monitor the development in threat actor activity leveraging COVID-19 for malicious purposes.