Blog
PREVENT
PREVENT Use Cases: Identifying High Impact Attack Paths
What are the people, process and technology assets that would do the most harm, if compromised by an attacker?
Attack path modeling provides a detailed map of all the roads that lead to an organization's crown jewels, prioritized in order of likelihood and potential impact. CISO's are increasingly looking to this kind of solution to complement their security stack because it highlights risks that are specific to this organization's structure, as well as potentially unexpected relationships between devices or users that would prove catastrophic if they were exploited.
What makes Darktrace's Attack Path Modeling solution stand out?
- Data sources are varied and information from the entire digital estate is considered
- Modeling is real-time and continuously re-evaluated
- Output does not require expert technical knowledge to be leveraged
- Valuable as a standalone for vulnerability prioritization
- As a component of the Cyber AI Loop, the solution provides immediate value by feeding back into DETECT and RESPOND (e.g. tag critical assets for detection) but also provides long term systemic improvements as outcomes are followed up.
Thinking like an attacker
In 2023, CISOs will move beyond just insurance and checkbox compliance, as underwriters include more and more exclusions for certain types of cyber-attacks and the limits of compliance ticking the protection box rather than bolstering operational assurance become more apparent. They will push their teams to opt for more proactive cyber security measures to maximize ROI in the face of budget cuts, shifting investment into tools and capabilities that continuously improve their cyber resilience and demonstrate cyber risk reduction.
While red teams can provide insight into where effort and resource should be most immediately applied, the exercises themselves are often costly, non-exhaustive and infrequently run.
Hackers are constantly seeking pathways, preferably those of least resistance, to compromise a system by exploiting its vulnerabilities. Attack path modeling enables security teams to look at their environment from the perspective of the attacker. In turn, this helps them eliminate attack paths progressively, reducing the options an attacker would have, should they breach the walls.
A deeper dive into Attack Path Modeling
An attack path is a visual representation of the path that an attacker takes to exploit a weakness in the system. It highlights the series of steps (attack vectors) that a threat actor might take from one of the doors into the organization (attack surface) to access valuable assets.
It is typically unusual for an attacker to have a boulevard straight down to the crown jewels. They will most likely leverage a couple of loopholes, unexpected relationships and blind spots in the security stack to piece together a path to these confidential assets. Attack path modeling can help to highlight the attack vectors that connect, to form this path to compromise.
How to model attack paths
Darktrace's proprietary Self-Learning AI models relationships, and graph theory is incorporated to understand the importance of users, documents and relationships between these.
Darktrace PREVENT's Attack Path Modeling component identifies target nodes (users, accounts, devices), it then calculates the shortest paths to these target nodes and weights the results according to the likelihood of this attack path and the damage caused if the target asset was compromised. This is exactly what an attacker would do when planning an attack, albeit with a significant advantage to Darktrace PREVENT's AI Engine, which has access to more information than the attacker. For the first time, defenders have the upper hand against attackers.
Avoiding siloed efforts
According to a Gartner survey, 75% of organizations are looking at consolidating security tools, not primarily because of cost, but because it helps drive cyber risk reduction. Ensuring that security efforts are part of a wider security ecosystem, rather than siloed efforts, is crucial to maximize the return on these investments. Darktrace's Attack Path Modeling solution is a component of Darktrace PREVENT's End-to-End (E2E) offering.
Darktrace PREVENT integrates with Darktrace's DETECT and RESPOND to ensure that the organization's security posture is hardened, even if the team doesn't have time to eliminate the attack path.
Defensive superiority is key, and Attack Path Modeling is one way to help security teams gain back an advantage. Find out how you can test it in your own environment.
Attack Path Modeling is an objective, however, and there are a few important questions to consider when assessing the different methods of creating these models.
Are we considering all the relevant data when building my attack paths map?
Consider the case where one of your marketing executives has a close friendship with someone in your development team. How do you model that into your attack paths cartography? Attack paths encompass the full digital estate, so the attack path modeling solution should consider information from various parts, internal and external. This may include data from the Email environment, the Network, Endpoints, SaaS & Cloud, Active Directory, Vulnerability Scanners, etc.
Cross-data analysis is the only way to understand holistic attack paths.
Are we looking at the most up to date map of attack paths?
Relationships between users, devices and other sensitive assets can evolve on a daily basis, this implies attack paths evolve on a daily basis. Ensuring that the methods or solutions used update their understanding continuously and in real-time is vital if security teams want the most up to date understanding of their organization's risk posture.
To improve our security posture, how do we know which attack paths to start with?
One thing is to map the sum-total of attack paths, another is to prioritize them. Attack path modeling gives you the map but adding a risk-assessment (explored in more depth below) layer on top is how you prioritize. This is where graph theory can be very useful to identify choke points that you may want to strengthen.
Does this output yield actionable insights?
The prime objective of this solution is not simply to provide an assessment of cyber risk posture, but rather to help drive security efforts in the right direction. To that end, the output needs to be accessible to team members that may not have expert cyber skills. Lowering barriers to entry with usable insights and mitigation advice is key to successfully improve the organization's security posture.
Assessing risk to prioritize attack paths
Darktrace Attack Path Modeling (APM) is a risk-based approach to assessing cyber-attack pathways, thinking like an attacker, and probing the path of least resistance. 'Risk' in this case is defined as the product of two factors: Probability and Impact. By using this information to categorize possible attack paths in the risk matrix below, Darktrace's APM can prioritize attack paths to ensure security team efforts are spent on controlling for the most relevant risks for their organization.
A: Defining Probability
There are two types of probability to consider:
The likelihood of one particular door being chosen by an attacker to infiltrate the organization (among the assets at the attack surface - this could be an internet-facing server, an inbox, a SaaS/Cloud account, etc). And,
The likelihood of one particular node (defined as a device or user account) being compromised next, via lateral movement.
B Defining Impact
Impact refers to the overall impact of an asset being compromised and unusable. In the case of an asset (e.g.: a key server), the bigger the disruption if this asset goes down, the higher the impact score. If considering a particular document, restricted access and sensitivity score of users accessing it are some of the variables used to estimate impact.
Both variables are calculated by the AI autonomously, without requiring human input. Security teams can of course reinforce the AI's understanding of the organization with their business expertise (by tagging additional sensitive devices for example).
A more in-depth description of how impact is propagated to identify key servers or sensitive documents, as well as other components that comprise the Darktrace Attack Path Modeling module can be found in this white paper.
Like this and want more?
.png)
Blog
Inside the SOC
Royal Pains: How Darktrace Refused to Bend the Knee to the MyKings Botnet
Botnets: A persistent cyber threat
Since their appearance in the wild over three decades ago, botnets have consistently been the attack vector of choice for many threat actors. The most prevalent of these attack vectors are distributed denial of service (DDoS) and phishing campaigns. Their persistent nature means that even if a compromised device in identified, attackers can continue to operate by using the additional compromised devices they will likely have on the target network. Similarly, command and control (C2) infrastructure can easily be restructured between infected systems, making it increasingly difficult to remove the infection.
MyKings Botnet
One of the most prevalent and sophisticated examples in recent years is the MyKings botnet, also known as Smominru or DarkCloud. Darktrace has observed numerous cases of MyKings botnet compromises across multiple customer environments in several different industries as far back as August 2022. The diverse tactics, techniques, and procedures (TTPs) and sophisticated kill chains employed by MyKings botnet may prove a challenge to traditional rule and signature-based detections.
However, Darktrace’s anomaly-centric approach enabled it to successfully detect a wide-range of indicators of compromise (IoCs) related to the MyKings botnet and bring immediate awareness to customer security teams, as it demonstrated on the network of multiple customers between March and August 2023.
Background on MyKings Botnet
MyKings has been active and spreading steadily since 2016 resulting in over 520,000 infections worldwide.[1] Although verified attribution of the botnet remains elusive, the variety of targets and prevalence of crypto-mining software on affected devices suggests the threat group behind the malware is financially motivated. The operators behind MyKings appear to be highly opportunistic, with attacks lacking an obvious specific target industry. Across Darktrace’s customer base, the organizations affected were representative of multiple industries such as entertainment, mining, education, information technology, health, and transportation.
Given its longevity, the MyKings botnet has unsurprisingly evolved since its first appearance years ago. Initial analyses of the botnet showed that the primary crypto-related activity on infected devices was the installation of Monero-mining software. However, in 2019 researchers discovered a new module within the MyKings malware that enabled clipboard-jacking, whereby the malware replaces a user's copied cryptowallet address with the operator's own wallet address in order to siphon funds.[2]
Similar to other botnets such as the Outlaw crypto-miner, the MyKings botnet can also kill running processes of unrelated malware on the compromised hosts that may have resulted from prior infection.[3] MyKings has also developed a comprehensive set of persistence techniques, including: the deployment of bootkits, initiating the botnet immediately after a system reboot, configuring Registry run keys, and generating multiple Scheduled Tasks and WMI listeners.[4] MyKings have also been observed rotating tools and payloads over time to propagate the botnet. For example, some operators have been observed utilizing PCShare, an open-source remote access trojan (RAT) customized to conduct C2 services, execute commands, and download mining software[5].
Darktrace Coverage
Across observed customer networks between March and August 2023, Darktrace identified the MyKings botnet primarily targeting Windows-based servers that supports services like MySQL, MS-SQL, Telnet, SSH, IPC, WMI, and Remote Desktop (RDP). In the initial phase of the attack, the botnet would initiate a variety of attacks against a target including brute-forcing and exploitation of unpatched vulnerabilities on exposed servers. The botnet delivers a variety of payloads to the compromised systems including worm downloaders, trojans, executable files and scripts.
This pattern of activity was detected across the network of one particular Darktrace customer in the education sector in early March 2023. Unfortunately, this customer did not have Darktrace RESPOND™ deployed on their network at the time of the attack, meaning the MyKings botnet was able to move through the cyber kill chain ultimately achieving its goal, which in this case was mining cryptocurrency.
Initial Access
On March 6, Darktrace observed an internet-facing SQL server receiving an unusually large number of incoming MySQL connections from the rare external endpoint 171.91.76[.]31 via port 1433. While it is not possible to confirm whether these suspicious connections represented the exact starting point of the infection, such a sudden influx of SQL connection from a rare external endpoint could be indicative of a malicious attempt to exploit vulnerabilities in the server's SQL database or perform password brute-forcing to gain unauthorized access. Given that MyKings typically spreads primarily through such targeting of internet-exposed devices, the pattern of activity is consistent with potential initial access by MyKings.[6]
Initial Command and Control
The device then proceeded to initiate a series of repeated HTTP connections between March 6 and March 10, to the domain www[.]back0314[.]ru (107.148.239[.]111). These connections included HTTP GET requests featuring URIs such as ‘/back.txt', suggesting potential beaconing and C2 communication. The device continued this connectivity to the external host over the course of four days, primarily utilizing destination ports 80, and 6666. While port 80 is commonly utilized for HTTP connections, port 6666 is a non-standard port for the protocol. Such connectivity over non-standard ports can indicate potential detection evasion and obfuscation tactics by the threat actors. During this time, the device also initiated repeated connections to additional malicious external endpoints with seemingly algorithmically generated hostnames such as pc.pc0416[.]xyz.
Tool Transfer
While this beaconing activity was taking place, the affected device also began to receive potential payloads from unusual external endpoints. On April 29, the device made an HTTP GET request for “/power.txt” to the endpoint 192.236.160[.]237, which was later discovered to have multiple open-source intelligence (OSINT) links to malware. Power.txt is a shellcode written in PowerShell which is downloaded and executed with the purpose of disabling Windows Defenders related functions.[7] After the initial script was downloaded (and likely executed), Darktrace went on to detect the device making a series of additional GET requests for several varying compressed and executable files. For example, the device made HTTP requests for '/pld/cmd.txt' to the external endpoint 104.233.224[.]173. In response the external server provided numerous files, including ‘u.exe’, and ‘upsup4.exe’ for download, both of which share file names with previously identified MyKings payloads.
MyKings deploys a diverse array of payloads to expand the botnet and secure a firm position within a compromised system. This multi-faceted approach may render conventional security measures less effective due to the intricacies of and variety of payloads involved in compromises. Darktrace, however, does not rely on static or outdated lists of IoCs in order to detect malicious activity. Instead, DETECT’s Self-Learning AI allows it to identify emerging compromise activity by recognizing the subtle deviations in an affected device’s behavior that could indicate it has fallen into the hands of malicious actors.
Achieving Objectives – Crypto-Mining
Several weeks after the initial payloads were delivered and beaconing commenced, Darktrace finally detected the initiation of crypto-mining operations. On May 27, the originally compromised server connected to the rare domain other.xmrpool[.]ru over port 1081. As seen in the domain name, this endpoint appears to be affiliated with pool mining activity and the domain has various OSINT affiliations with the cryptocurrency Monero coin. During this connection, the host was observed passing Monero credentials, activity which parallels similar mining operations observed on other customer networks that had been compromised by the MyKings botnet.
Although mining activity may not pose an immediate or urgent concern for security unauthorized cryptomining on devices can result in detrimental consequences, such as compromised hardware integrity, elevated energy costs, and reduced productivity, and even potential involvement in money laundering.
Conclusion
Detecting future iterations of the MyKings botnet will likely demand a shift away from an overreliance on traditional rules and signatures and lists of “known bads”, instead requiring organizations to employ AI-driven technology that can identify suspicious activity that represents a deviation from previously established patterns of life.
Despite the diverse range of payloads, malicious endpoints, and intricate activities that constitute a typical MyKing botnet compromise, Darktrace was able successfully detect multiple critical phases within the MyKings kill chain. Given the evolving nature of the MyKings botnet, it is highly probable the botnet will continue to expand and adapt, leveraging new tactics and technologies. By adopting Darktrace’s product of suites, including Darktrace DETECT, organizations are well-positioned to identify these evolving threats as soon as they emerge and, when coupled with the autonomous response technology of Darktrace RESPOND, threats like the MyKings botnet can be stopped in their tracks before they can achieve their ultimate goals.
Credit to: Oluwatosin Aturaka, Analyst Team Lead, Cambridge, Adam Potter, Cyber Analyst
Appendix
IoC Table
IoC - Type - Description + Confidence
162.216.150[.]108- IP - C2 Infrastructure
103.145.106[.]242 - IP - C2 Infrastructure
137.175.56[.]104 - IP - C2 Infrastructure
138.197.152[.]201 - IP - C2 Infrastructure
139.59.74[.]135 - IP - C2 Infrastructure
pc.pc0416[.]xyz - Domain - C2 Infrastructure (DGA)
other.xmrpool[.]ru - Domain - Cryptomining Endpoint
xmrpool[.]ru - Domain - Cryptomining Endpoint
103.145.106[.]55 - IP - Cryptomining Endpoint
ntuser[.]rar - Zipped File - Payload
/xmr1025[.]rar - Zipped File - Payload
/20201117[.]rar - Zipped File - Payload
wmi[.]txt - File - Payload
u[.]exe - Executable File - Payload
back[.]txt - File - Payload
upsupx2[.]exe - Executable File - Payload
cmd[.]txt - File - Payload
power[.]txt - File - Payload
ups[.]html - File - Payload
xmr1025.rar - Zipped File - Payload
171.91.76[.]31- IP - Possible Initial Compromise Endpoint
www[.]back0314[.]ru - Domain - Probable C2 Infrastructure
107.148.239[.]111 - IP - Probable C2 Infrastructure
194.67.71[.]99 - IP- Probable C2 Infrastructure
Darktrace DETECT Model Breaches
- Device / Initial Breach Chain Compromise
- Anomalous File / Masqueraded File Transfer (x37)
- Compromise / Large DNS Volume for Suspicious Domain
- Compromise / Fast Beaconing to DGA
- Device / Large Number of Model Breaches
- Anomalous File / Multiple EXE from Rare External Locations (x30)
- Compromise / Beacon for 4 Days (x2)
- Anomalous Server Activity / New User Agent from Internet Facing System
- Anomalous Connection / New User Agent to IP Without Hostname
- Anomalous Server Activity / New Internet Facing System
- Anomalous File / EXE from Rare External Location (x37)
- Device / Large Number of Connections to New Endpoints
- Anomalous Server Activity / Server Activity on New Non-Standard Port (x3)
- Device / Threat Indicator (x3)
- Unusual Activity / Unusual External Activity
- Compromise / Crypto Currency Mining Activity (x37)
- Compliance / Internet Facing SQL Server
- Device / Anomalous Scripts Download Followed By Additional Packages
- Device / New User Agent
MITRE ATT&CK Mapping
ATT&CK Technique - Technique ID
Reconnaissance – T1595.002 Vulnerability Scanning
Resource Development – T1608 Stage Capabilities
Resource Development – T1588.001 Malware
Initial Access – T1190 Exploit Public-Facing Application
Command and Control – T15568.002 Domain Generated Algorithms
Command and Control – T1571 Non-Standard Port
Execution – T1047 Windows Management Instrumentation
Execution – T1059.001 Command and Scripting Interpreter
Persistence – T1542.003 Pre-OS Boot
Impact – T1496 Resource Hijacking
References
[1] https://www.binarydefense.com/resources/threat-watch/mykings-botnet-is-growing-and-remains-under-the-radar/
[2] https://therecord.media/a-malware-botnet-has-made-more-than-24-7-million-since-2019
[3] https://www.darktrace.com/blog/outlaw-returns-uncovering-returning-features-and-new-tactics
[4] https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophoslabs-uncut-mykings-report.pdf
[5] https://www.antiy.com/response/20190822.html
[6] https://ethicaldebuggers.com/mykings-botnet/
[7] https://ethicaldebuggers.com/mykings-botnet/
Blog
Thought Leadership
The Implications of NIS2 on Cyber Security and AI
The NIS2 Directive requires member states to adopt laws that will improve the cyber resilience of organizations within the EU. It impacts organizations that are “operators of essential services”. Under NIS 1, EU member states could choose what this meant. In an effort to ensure more consistent application, NIS2 has set out its own definition. It eliminates the distinction between operators of essential services and digital service providers from NIS1, instead defining a new list of sectors:
- Energy (electricity, district heating and cooling, gas, oil, hydrogen)
- Transport (air, rail, water, road)
- Banking (credit institutions)
- Financial market infrastructures
- Health (healthcare providers and pharma companies)
- Drinking water (suppliers and distributors)
- Digital infrastructure (DNS, TLD registries, telcos, data center providers, etc.)
- ICT service providers (B2B): MSSPs and managed service providers
- Public administration (central and regional government institutions, as defined per member state)
- Space
- Postal and courier services
- Waste management
- Chemicals
- Food
- Manufacturing of medical devices
- Computers and electronics
- Machinery and equipment
- Motor vehicles, trailers and semi-trailers and other transport equipment
- Digital providers (online market places, online search engines, and social networking service platforms) and research organizations.
With these updates, it becomes harder to try and find industry segments not included within the scope. NIS2 represents legally binding cyber security requirements for a significant region and economy. Standout features that have garnered the most attention include the tight timelines associated with notification requirements. Under NIS 2, in-scope entities must submit an initial report or “early warning” to the competent national authority or computer security incident response team (CSIRT) within 24 hours from when the entity became aware of a significant incident. This is a new development from the first iteration of the Directive, which used more vague language of the need to notify authorities “without undue delay”.
Another aspect gaining attention is oversight and regulation – regulators are going to be empowered with significant investigation and supervision powers including on-site inspections.
The stakes are now higher, with the prospect of fines that are capped at €10 million or 2% of an offending organization’s annual worldwide turnover – whichever is greater. Added to that, the NIS2 Directive includes an explicit obligation to hold members of management bodies personally responsible for breaches of their duties to ensure compliance with NIS2 obligations – and members can be held personally liable.
The risk management measures introduced in the Directive are not altogether surprising – they reflect common best practices. Many organizations (especially those that are newly in scope for NIS2) may have to expand their cyber security capabilities, but there’s nothing controversial or alarming in the required measures. For organizations in this situation, there are various tools, best practices, and frameworks they can leverage. Darktrace in particular provides capabilities in the areas of visibility, incident handling, and reporting that can help.
NIS2 and Cyber AI
The use of AI is not an outright requirement within NIS2 – which may be down to lack of knowledge and expertise in the area, and/or the immaturity of the sector. The clue to this might be in the timing: the provisional agreement on the NIS2 text was reached in May 2022 – six months before ChatGPT and other open-source Generative AI tools propelled broader AI technology into the forefront of public consciousness. If the language were drafted today, it's not far-fetched to imagine AI being mentioned much more prominently and perhaps even becoming a requirement.
NIS2 does, however, very clearly recommend that “member states should encourage the use of any innovative technology, including artificial intelligence”[1]. Another section speaks directly to essential and important entities, saying that they should “evaluate their own cyber security capabilities, and where appropriate, pursue the integration of cyber security enhancing technologies, such as artificial intelligence or machine learning systems…”[2]
One of the recitals states that “member states should adopt policies on the promotion of active cyber protection”. Where active cyber protection is defined as “the prevention, detection, monitoring, analysis and mitigation of network security breaches in an active manner.”[3]
From a Darktrace perspective, our self-learning Cyber AI technology is precisely what enables our technology to deliver active cyber protection – protecting organizations and uplifting security teams at every stage of an incident lifecycle – from proactively hardening defenses before an attack is launched, to real-time threat detection and response, through to recovering quickly back to a state of good health.
The visibility provided by Darktrace is vital to understanding the effectiveness of policies and ensuring policy compliance. NIS2 also covers incident handling and business continuity, which Darktrace HEAL addresses through AI-enabled incident response, readiness reports, simulations, and secure collaborations.
Reporting is integral to NIS2 and organizations can leverage Darktrace’s incident reporting features to present the necessary technical details of an incident and provide a jump start to compiling a full report with business context and impact.
What’s Next for NIS2
We don’t yet know the details for how EU member states will transpose NIS2 into national law – they have until 17th October 2024 to work this out. The Commission also commits to reviewing the functioning of the Directive every three years. Given how much our overall understanding and appreciation for not only the dangers of AI but also its power (perhaps even necessity in the realm of cyber security) is changing, we may see many member states will leverage the recitals’ references to AI in order to make a strong push if not a requirement that essential and important organizations within their jurisdiction leverage AI.
Organizations are starting to prepare now to meet the forthcoming legislation related to NIS2. To see how Darktrace can help, talk to your representative or contact us.
[1] (51) on page 11
[2] (89) on page 17
[3] (57) on page 12
