Brandefense Academy
Your trusted hub for learning, developing, and mastering the skills that shape tomorrow's digital defense.
Discover Now
Your trusted hub for learning, developing, and mastering the skills that shape tomorrow's digital defense.
Discover NowSEPTEMBER 12, 2022
[vc_row pix_particles_check=”” nav_skin=”light” consent_include=”include”][vc_column][vc_column_text]
Integrating technology into the working life of institutions brings with it ‘security’ problems. The effort of the threat actors to gain access to the target network and maintain the provided access is the basis of the existing security problem. Threat actors, acting with various motivations, such as financial returns, commercial/political/military advantages, or political ideologies, are always looking for ways to manipulate the weak points of institutions/organizations.
For institutions/organizations, it is essential to ensure the security of the data in hand in order not to experience financial loss and loss of reputation. For this reason, it is necessary to be aware of the techniques that threat actors use for Initial Access and the detection methods of these techniques.[/vc_column_text][vc_column_text]
Threat actors first try to enter the target organization’s network in attacks such as ransomware. Initial Access; It consists of techniques that use various attack vectors to gain initial access and foothold on the target network.
Threat actors, called Initial Access Brokers (IABs), after accessing the targeted network and maintaining a certain level of persistence on that network, existing accounts belonging to the organization, use of external services, etc. Different additional ports can be obtained. Afterward, the access obtained on the target network is offered for sale in deep and dark web markets.
Recipients of access for sale by IABs commonly include ransomware groups or other threat actors, including their affiliates.
Listed below are the types of access offered for sale by IABs:
[/vc_column_text][vc_column_text]
| Technical ID | Technical Name |
| T1189 | Drive-by Compromise |
| T1190 | Exploit Public-Facing Application |
| T1133 | External Remote Services |
| T1556 | Phishing |
| T1078 | Valid Accounts |
[/vc_column_text][vc_column_text]
This technique relies on the targeted user visiting a compromised website. There are several ways to breach the security of a website through this technique.
After the user visits the website under the control of the threat actor, malicious scripts on the website are automatically run to try to detect the version of the browser and the vulnerable plugins and complements used by the target. When a vulnerable version is detected, code is sent to the browser to exploit the vulnerability.
If the operation is successful and the target user is not protected by similar programs, such as the antivirus program, the threat actor gains remote access to the user’s computer.
As mentioned above, Drive-by Compromise is a technique that targets the security vulnerabilities of the applications and web browsers used. For this reason, the software and systems used should be used in the most up-to-date version available.
The REvil ransomware group was spreading the Sodinokibi software in its campaigns by breaching WordPress sites and injecting malicious JavaScript code into the area.
[/vc_column_text][vc_empty_space height=”15px”][vc_single_image image=”15614″ img_size=”full” add_caption=”yes” alignment=”center”][vc_empty_space height=”15px”][vc_column_text]
Attackers can often exploit programming or design flaws in applications, programs, servers, or services that have access to the Internet and are publicly available, causing such applications to exhibit unwanted or unexpected behavior. It can be said that such applications include websites, databases, services such as SMB or SSH, web servers, and affiliate services.
Successful/unsuccessful attempts to exploit the vulnerability of the applications mentioned above produce output outside the normal program flow. These abnormal behaviors can be noticed by examining the application logs.
Overall network traffic (e.g., SQL Injection attempts, etc.) for attempts to exploit the vulnerability can be detected by in-depth inspection of network packets. Web Application Firewall solutions can detect such unusual attempts.
[/vc_column_text][vc_column_text]
The use of digital technologies and external remote services such as RDP and SMB has increased considerably since the pandemic period. Employees often use external applications such as VPNs and Citrix to connect to internal resources from the outside world. In addition, these services use services such as Windows Remote Management, and Virtual Network Computing (VNC) to manage users’ connections and authentication.
External remote services are used so frequently cause threat actors to update their TTP accordingly. So much so that in a study conducted by ESET, it is stated that the number of attacks that only exploit RDP vulnerabilities increased by 768% between the first and fourth quarters of 2020.
(https://www.welivesecurity.com/2021/02/08/eset-threat-report-q42020/)
The External Remote Service technique exploits security vulnerabilities in external remote services such as Microsoft’s Remote Desktop Protocol (RDP) or Windows Server Message Block (SMB). In addition, threat actors try to hijack an authorized account to use these services through various methods, such as social engineering and brute force attacks.
Thus, when the login credentials of an employee of the institution are captured, they can be included in the internal network through these services. Learn if your sensitive accounts are leaked!
Such an attempt can be detected by examining indicators such as authentication records, unusual access patterns, unexpected activities from the user account, and accesses outside of regular working hours for authentication processes performed over existing services with valid user accounts.
[/vc_column_text][vc_empty_space height=”15px”][vc_single_image image=”15616″ img_size=”full” add_caption=”yes” alignment=”center”][vc_empty_space height=”15px”][vc_column_text]
Valid Accounts mean using valid credentials to bypass access controls placed on various resources in systems within the network. These credentials can be used to gain and maintain permanent access to systems.
Monitoring for unusual activity in user account activity is the focus of the detection of this technique. For example, Accounts logged on to multiple systems simultaneously, accounts logged on to a single system simultaneously, and accounts logged on after working hours can be defined as unusual activities. Institutions also need to configure strong activity controls on account activities.
Financially motivated threat group FIN5 used legitimate VPN, Citrix, or VNC credentials to gain and maintain access to their targeted environment. The information mentioned here describes the account information that current employees use to access the intra-company network remotely.
[/vc_column_text][vc_column_text]
Phishing attacks are a type of social engineering attack that is often used to obtain personal user data such as login credentials. Threat actors can carry out phishing attacks via email, text message (SMS), social media, or phone to gain initial access to target systems. In short, user interaction is required for this technique to be successful.
Usually, e-mails intended for a person, institution, or industry are distributed with a file attachment containing malicious code, and logical reasons are tried to be given as to why this file should be opened. Malicious file attachments can be used in many formats, such as Microsoft Office documents, executable files, PDF files, or archived files (RAR, ZIP, 7z, etc.). The distribution of files with password protection in order not to be detected by the endpoint security solutions and the various instructions for the user to open the file is among the scenarios that may be encountered.
Emails with file attachments can likewise contain a direct link address. In this kind of case, when the user clicks on the relevant link, the username, e-mail, password, etc. encounters pages where vital personal information such as.
Emotet Trojan, which first appeared in 2014 and has the title of the most dangerous banking trojan software until 2021, was distributed as malicious file attachments with the theme of fake phone bills within the e-mail in UK campaigns.
[/vc_column_text][vc_empty_space height=”15px”][vc_single_image image=”15617″ img_size=”full” add_caption=”yes” alignment=”center”][vc_empty_space height=”15px”][vc_column_text]To spread REvil ransomware to target devices, the GOLD SOUTHFIELD threat group used fake emails that looked like warning letters from the fee collection center of public law broadcasters in the German Federal Public Service.
[/vc_column_text][vc_empty_space height=”15px”][vc_single_image image=”15618″ img_size=”full” add_caption=”yes” alignment=”center”][vc_empty_space height=”15px”][vc_column_text]
Threat actors will always try to look for the easiest way to carry out successful attacks on their targets, depending on their motivation. Since the most frequently used methods focus on the “human” factor, which is the weakest link of a system, a conscious user/employee profile should be created first in order to stay safe.
Considering that at least one Initial Access technique is used on the basis of attacks carried out at different scales from the past to the present, being aware of these techniques and knowing how to counter them is the first rule of staying safe.
On a superficial level, you are now familiar with different topics such as techniques, method of application, detection and mitigation commonly used among threat actors. At the end of this report you are also somewhat prepared for attack attempts that may come from personnel errors. You can also request a free demo by contacting Brandefense.
[/vc_column_text][vc_empty_space][/vc_column][/vc_row]
Take control of your digital security with an exclusive demo of our powerful threat management platform.
