IronNet’s October Threat Intelligence Brief

As we look back on September, we have much to report on: from a widespread credential phishing campaign leveraging open redirects in conjunction with reCAPTCHA to the cloud security firm Wiz‘s recent discovery of four new vulnerabilities in the Open Management Interface (OMI) of Linux-based Azure virtual machines (VM). The vulnerabilities are referred to as OMIGOD. Exploiting these vulnerabilities, attackers can remotely execute malicious code.

At IronNet, we look to behavioral analytics to detect such unknown threats on enterprise networks before adversaries succeed at their end-game: exploitation or exfiltration. When it comes to ransomware attacks and other types of attack campaigns, early detection is critical. First, we do the threat detection groundwork needed to spot abnormal network activity across our customers’ networks. Second, our expert system scores these alerts, prioritizing the most interesting events to help cut down on alert fatigue. Finally, we take a Collective Defense approach to crowdsourced threat sharing in real time.

The October IronNet Threat Intelligence Brief 

This ability to analyze and correlate seemingly unrelated instances is critical for identifying sophisticated attackers who leverage varying infrastructures to hide their activity from existing cyber defenses. As reported in the October Threat Intelligence Brief, our analysts review alerts from millions of data flows that are ingested and processed with big data analytics. We apply ratings to the alerts (benign/suspicious/malicious) and immediately share them with IronDome Collective Defense participants.

Sponsorships Available

Sponsorships Available

Sponsorships Available

Here is a snapshot of what we discovered across the IronDome communities in September, showing 866 correlated alerts across IronDome participant environments:

Given the unique cross-sector visibility and collective defense capabilities of IronDome, we are able to highlight the most frequent behaviors each month enabling us to track trends over time. For September, the most frequent behavior analytics were C2 Rendezvous (DGA) (585), Credential Phishing (151), and New and Suspicious Domains (132).

Analysis of IOCs 

In addition to correlated alerts, significant IronDome community findings revealed 773 Indicators of Compromise (IoC) that may pose risk to IronDome participant environments. For example, we analyzed the malicious kerrytj[.]com domain, which hosts two malicious macro-enabled Word documents (invoice.doc/use.doc).

All the IoCs we analyzed are used to trigger alerts that are mapped to the Cyber Kill Chain to identify the stage and progression of the threat. They can be used to create detection rules for network, endpoint, or other security tools currently deployed to mitigate cyber risk in each IronDome participant’s environment.

See the October Threat Intelligence Brief for the full list of recent IoCs.

The bigger picture of Collective Defense 

Every month, IronNet’s expert threat analysts create threat intelligence rules (TIRs) based on significant community findings from IronDome, malware analysis, threat research, or other methods to ensure timely detection of malicious behavior targeting an enterprise or other IronDome community participants. 

In September, we created 5,871 threat intel rules of our 269,067 created to date. Some examples of this month’s research related to indicators associated with malware delivery domains for Gafgyt, AgentTesla, Sabsik, Socelars, and Bian malware, as well as IoCs surrounding FerociousKitten APT Group.

This combination of behavior-driven and IoC signature-based detection, alert ranking, and sharing ensures IronDome participants have the broadest view of threats facing their enterprise.

OMIGOD vulnerabilities discovered

As I mentioned, four new vulnerabilities called OMIGOD were found in the Open Management Interface (OMI) of Linux-based Azure virtual machines (VM). When customers set up a Linux VM in their cloud, the OMI is automatically deployed without their knowledge when they enable certain Azure services. The OMI agent runs as root with the highest privileges and is basically the Linux equivalent of Microsoft Windows Management Infrastructure (WMI) service, which enables the collection of logs and metrics and some remote management.

You can see the latest industry news in the full report or check out IronNet’s threat intelligence web page.