Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
- Xtreme RAT and Cryptominer have been delivered in pirated Windows operating system software.
- Several malicious Windows services on the system were responsible for modifying system permissions, disabling Windows Defender, and retrieving payloads from msz[.]su.
- Xtreme RAT gains persistence on the host by service creations. We have observed the following service names used:
- Registration for device management
- Previous Versions Library
- TRU had observed several instances of this threat dating from late 2021 to early 2022. In these instances, our MDR for Endpoint service was deployed to systems suspected of operating pirated versions of Microsoft’s Windows operating system.
How did we find it?
- BlueSteel, our machine learning engine that automates malicious PowerShell detections, identified PowerShell activity associated with the malware’s persistence mechanism.
What did we do?
- Our team of 24/7 Cyber SOC Analysts investigated and contained the threat rapidly on the customer’s behalf.
- The SOC alerted the customer’s team about the malicious endpoint activity and provided recommendations on next steps for remediation and further forensic investigation in follow-up communications.
What can you learn from this TRU positive?
- The backdoored OS contains the necessary tools to monetize infected systems.
- Cryptominer, RAT, and adware all provide various means to monetize infected systems through abuse of system resources, fraud, advertisements, etc.
- The infection scheme and malware deployed aren’t overly sophisticated; it’s likely the threat actors are focused on poorly secured personal devices that can quietly generate revenue over time.
Recommendations from our Threat Response Unit (TRU) Team:
Protecting against these threats requires a multi-layered defense approach to defend endpoints from malware and detect or block unauthorized login activity against applications and remote access services. Therefore, we recommend:
- Always using trusted sources for downloading and acquiring software.
- Protecting endpoints against malware:
- Establishing a strong password policy that includes rotating passwords every 60-90 days, using password managers, and checking for unusual connections/logons through the corporate VPN or Remote Desktop.
- Using Multi-Factor Authentication (MFA) services may reduce the impact of stolen credentials, but solely relying on MFA isn’t enough to deter threat actors from gaining access to your environment.
- Adopt a defense-in-depth strategy that includes identity-based threat detection and response to allow your team to minimize attacker dwell time and identify insider threats that elude signature-based detections.
Ask Yourself…
- Can your employees identify websites hosting pirated software?
- Can you respond to remote access Trojans in a timely manner before it causes further damage?
- What level of visibility do you have across your endpoint and network environment, and at the identity-level, to detect malicious behavior at scale?
eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.
If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.
Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.
