Learn about the transformative approach to cybersecurity risk reduction with NIST 2.0 Cybersecurity Framework. Discover how it addresses the constantly evolving cyber threat landscape.
Learn how to safeguard your Microsoft 365 environment against rising cyber threats like BEC scams with Adlumin’s Dynamic M365 Prevention feature. Enhance your security posture and test your defenses with their complimentary M365 BEC Simulator tool today.
Learn why GLBA compliance is crucial for safeguarding student data in higher education. Discover key checklist elements, consequences of non-compliance, and how adherence enhances cybersecurity posture and fosters trust.
In our quarterly industry spotlight series, we highlight the evolving threats faced by various industries and provide recommendations to enhance their security posture. Today, we shift our focus to the healthcare sector, a critical industry that faces unique challenges in safeguarding sensitive patient data and maintaining crucial healthcare operations.
Mitigating cybersecurity risks is critical in the healthcare industry due to the highly sensitive nature of patient information stored within Electronic Health Records (EHRs) and the important role these systems play in patient care. Healthcare organizations are prime targets for cybercriminals seeking to exploit vulnerabilities for financial gain or disrupt essential services.
Recent cyberattacks on healthcare organizations, like the Change Healthcare cyberattack, have demonstrated the growing sophistication and persistence of threat actors targeting this sector. Ransomware attacks, such as those leveraging Ransomware-as-a-Service (RaaS) and employing double extortion techniques, have caused significant disruptions and financial losses for healthcare providers. In response to these threats, organizations recognize the need to strengthen their cybersecurity defenses.
Adlumin previously detailed significant trends and developments in the threats, vulnerabilities, and cyberattacks faced by the healthcare industry in the U.S observed from January to March 2024 by Adlumin’s Threat Research Team, in Cybersecurity for Healthcare: 2024 Threat Insights.
Healthcare Threat Highlights:
Shifting from the identification of ransomware as the top threat in the healthcare industry, Adlumin’s Threat Research Team has developed crucial mitigation strategies and recommendations to help healthcare organizations better defend against these malicious attacks. Let’s explore key strategies recommended by Adlumin’s experts to enhance cybersecurity resilience in the healthcare sector.
Cybercriminals are continuously evolving their strategies, highlighting the importance for entities within the healthcare sector to remain alert and proactive. Key developments in their methodologies include:
For healthcare organizations looking to amplify their cybersecurity resilience against the pervasive threat of ransomware and other evolving cyber threats, the implementation of a comprehensive and integrated security strategy is paramount. By leveraging a centralized Security Operations Platform that incorporates all the recommended mitigation strategies and practices, organizations can streamline their cybersecurity efforts and enhance their ability to detect, respond to, and mitigate potential threats effectively.
Additionally, partnering with Managed Detection and Response (MDR) services can provide organizations with the expertise, tools, and continuous monitoring needed to mitigate risks, optimize threat response, and ensure a proactive defense against cyber threats. By adopting this holistic approach, healthcare organizations can strengthen their cybersecurity posture, safeguard patient data, and protect critical infrastructure in the face of threats.
Adlumin ensures swift setup, unrivaled visibility spanning endpoints, users, and the perimeter, and provides contextual insights for rapid, informed decision-making.
Adlumin’s Threat Research Team is the innovator behind Adlumin’s comprehensive threat hunting to improve visibility, reduce complexity, and manage risk. The team proactively searches for cyber threats lurking undetected in your network environment. They dig deep to identify non-remediated threats and other malicious activities to reinforce security defenses.
Ransomware attacks have become an omnipresent threat to organizations worldwide, posing significant risks to data integrity, financial stability, and organization continuity. As cybercriminals continue to evolve their tactics and target organizations of all sizes and industries, it’s imperative for organizations to strengthen their defenses and protect themselves against ransomware incidents.
Organizations must also be equipped with a detailed recovery plan to mitigate the impact of such incidents effectively. In this blog, we delve into the essential steps and solutions for recovering from ransomware attacks and restoring organization operations quickly and securely.
While recovering from a ransomware attack requires a strategic and methodical approach, having the right tools and solutions in place can significantly expedite the process and enhance overall resilience. Here are some key solutions to consider integrating into your recovery plan:
By incorporating these solutions into your ransomware recovery plan, you can enhance your organization’s resilience and expedite the recovery process in the event of a ransomware attack. Remember to regularly review and update your recovery plan to adapt to evolving ransomware threats and ensure continued effectiveness.
In effort to strengthen resilience and recovery strategies against ransomware attacks, organizations must adopt a proactive approach by implementing the right solutions and technologies. By establishing clear roles, responsibilities, and communication protocols, organizations can effectively respond to attacks and minimize their impact on operations.
Additionally, using simulator tools can help organizations assess their readiness and identify gaps in defense mechanisms, allowing for the implementation of stronger security measures and better protection of data. Through testing defenses, organizations can stay ahead of cyberthreats and safeguard their valuable information effectively.
By: Bronwen Cohn-Cort, Data Scientist, and Shaul Saitowitz, Data Scientist
Welcome to the Unraveling Cyber Defense Model Secrets series, where we shine a light on Adlumin’s Data Science team, explore the team’s latest detections, and learn how to navigate the cyberattack landscape.
Threat detection is a critical component of an organization’s cybersecurity strategy. Requiring the combination of human expertise and machine learning, risk can be significantly reduced by identifying threats before a potential attack.
Many threats can go unnoticed for months or even years. In IBM’s latest report, it takes an average of 277 days for security teams to identify and contain a data breach, and the cost of a breach skyrocketed, reaching an average of $4.45 million. Given the extended timeframe it often takes to detect and contain a data breach, organizations must proactively implement measures to quickly respond to potential threats and reduce the risk of costly damages.
To effectively combat malicious activity in your environment, it can be challenging to stay on top of all the potential threats, particularly as it demands skilled professionals who can develop models to apply artificial intelligence. Setting up alerts for when suspicious activity is detected can help organizations quickly respond to potential breaches and mitigate the risk of further damage to their systems and data.
While there are many types of security threats and detections to consider today, we highlight credential harvesting and insider threats as two crucial ones to add to your queue.
Adlumin Data Science is rolling out alerts for credential harvesting and insider threats, each capable of warning against prevalent attack tactics within their domains by utilizing user and entity behavior analytics. These detections are crucial as they are often difficult for organizations to identify.
A credential harvesting alert addresses a post-exploitation technique to broaden network access. After gaining a foothold, this alert will notify an organization about suspicious activities related to stealing login credentials from a computer system. This information can then be used to access other systems, steal data, or even compromise an entire network.
Sources of stored credentials include files, databases, registry entries, and memory structures where login credentials are stored, whether in plaintext or encrypted form. Some of these locations include LSASS (Local Security Authority Subsystem Service), GPP (Group Policy Preferences), and web browsers that store passwords. Cybercriminals can use one of many tools or techniques to capture the stored credentials.
These include utilities like Mimikatz, Hashcat, and SharpChromium. Once the credentials have been extracted, the attacker harvests them for future use. Encrypted passwords can be cracked offline and then used to access other systems within the network, furthering the attack.
The detection exposes several credential dumping techniques and delivers background on the tool discovered. This allows prompt stoppage of the unfolding attack and helps protect business assets. The detection model should be updated regularly to keep up with new tactics and methods.
Credential harvesting poses a significant threat to organizations, leading to unauthorized access, data breaches, and financial loss. Setting up alerts for credential dumping processes is crucial as it enables early detection and swift response to mitigate potential damage. Organizations can protect their sensitive information, maintain operational continuity, and uphold trust with customers and stakeholders by efficiently enriching, containing, and recovering from such incidents.
Some ransomware variants, like REvil, involve mass file deletion; in some instances, an unauthorized insider may gain permissions sufficient to mass-delete files. The Insider Threat model detects and alerts on cases of a user or attacker deleting an abnormally high number of files across many different subdirectories. Further analysis is conducted to filter out file extensions and locations that likely correspond to benign deletion activity. For example, a user emptying the Recycle Bin would not trigger an alert.
Setting up an Insider Threat alert uses a machine learning model to determine anomalies in the number of Windows Event ID 4663 (“An attempt was made to access an object”) events with Delete access permissions. A high quantity of these 4663 events in a half-hour period significantly deviating from the customer baseline is considered anomalous.
The table below displays partially redacted information from 4663 events associated with an alert. For each, it shows the time of the log message, the computer name on which it occurred, and which Object Name and Process Name were associated with the event. This table can be used to further investigate the deletion activity by reviewing the details of what computers, locations, and types of files were involved.
Following an alert, activity from the username(s) in question should be examined if a threat actor compromised a user account. Suspicious behavior may warrant disabling the account and quarantining affected computers from the network. Review user actions and run an anti-malware scan and vulnerability assessment to check if the threat actor has performed any other actions, such as creating a logic bomb or backdoor.
Insider threats pose a significant risk to organizations as they can result in data breaches, financial loss, reputational damage, and operational disruptions. Malicious insiders or compromised accounts can intentionally or unintentionally cause harm by deleting critical files, installing malware, or stealing sensitive information.
Setting up Insider Threat alerts, like the one described here, is crucial for detecting suspicious activities, such as widespread file deletion, in a timely manner. By observing user behavior, organizations can proactively identify and respond to potential insider threats, mitigating the impact of security incidents and safeguarding their assets and operations.
Here at Adlumin, we know how important it is to see everything in cybersecurity. That’s why we offer a customized Security Operations Platform and Managed Detection and Response services to give organizations a complete view of their IT environment. But we go further than that. We believe in the value of firsthand experience, so we invite you to explore our platform yourself with a guided tour.
See how our platform helps your team find and address threats by arranging a demo or trying out our platform for free. Join the tour and boost your organization’s visibility to a whole new level.
The recent ransomware attack on UnitedHealth’s Change Healthcare subsidiary highlighted the attractiveness of the data-rich U.S. healthcare industry to cybercriminals and the severe impact on patients and doctors. Total expenses from the attack are expected to surpass $1 billion, including a $22 million ransomware payment. With cybercriminals leveraging sophisticated techniques to infiltrate systems, encrypt data, and extract sensitive information, the healthcare sector faces significant challenges in safeguarding patient records and maintaining operational efficiency.
This industry spotlight highlights significant trends and developments in the threats, vulnerabilities, and cyberattacks faced by the healthcare industry in the U.S observed from January to March 2024 by Adlumin’s Threat Research Team.
Last year, the FBI’s Internet Crime Complaint Center released its latest report on Internet crimes and identified the healthcare and public health sectors as the most victimized by ransomware[1]. In fact, the healthcare sector had over 33% more reported victims than the second leading sector, critical manufacturing; 82% more than government facilities, and well more than double the number reported by the financial service sector. While waiting for the latest data reflecting 2023 cases, it’s almost certain that the healthcare sector will continue to see more ransomware attacks.
Ransomware gangs which operate under affiliate models often capture vital data, impose hefty ransoms for data retrieval, and significantly hinder patient care operations. The ransomware affiliate model resembles legitimate affiliate programs – hackers code the malware, while affiliates distribute it through Ransomware-as-a-Service (RaaS), then share the ransom profits. There may also be shared infrastructure for payout and money laundering operations. Combined, this lowers the barrier to entry for attackers and increases attack volume, fueling the overall threat.
Adlumin has observed wide adoption of a tactic known as double extortion in healthcare sector attacks. In double extortion operations, attackers encrypt sensitive and critical data as part of traditional ransomware operations, and exfiltrate or steal sensitive data. Ransomware actors then threaten public release of the data, meant to force payment of hefty ransoms even if defenders can recover encrypted data and systems from backups or other sources.
Adlumin has also observed ransomware operators increasingly threaten to report victims to regulatory authorities such as the SEC, resulting in almost certain fines if applicable under a host of old and new laws and regulations. Additionally, in uncovering Play ransomware. operations, Adlumin uncovered that ransomware attackers threaten to notify organization’s partners and customers as part ransom messages, a tactic meant to coerce payment. These factors can be especially important for those in the healthcare sector as HIPAA (Health Insurance Portability and Accountability Act) can impose fines for data breaches involving protected health information (PHI). The four categories used for the penalty structure are:[2]
| Tier | Description | Fines per Violation* |
|---|---|---|
| Tier 1 | A violation that the covered entity was unaware of and could not have realistically avoided, had a reasonable amount of care been taken to abide by HIPAA Rules. | $137 to $68,928 |
| Tier 2 | A violation that the covered entity should have been aware of but could not have avoided even with a reasonable amount of care (but falling short of willful neglect of HIPAA Rules). | $1,379 to $68,928 |
| Tier 3 | A violation suffered as a direct result of “willful neglect” of HIPAA Rules, in cases where an attempt has been made to correct the violation. | $13,785 to $68,928 |
| Tier 4 | A violation of HIPAA Rules constituting willful neglect, where no attempt has been made to correct the violation within 30 days. | $68,928 to $2,067,813 |
*Yearly cap of $2,067,813
Ransomware operators are also beginning to forgo encryption entirely, favoring data exfiltration and extortion operations. Both types have seen usage of Living-Off-the-Land (LOTL) techniques.
LOTL attacks are a stealthy tactic where attackers exploit legitimate tools already present on a system, like PowerShell, the command prompt, or native binaries like certutil, to carry out malicious activities. These “Living Off the Land Binaries” (LOLBins) blend in with normal system operations, making them more difficult to detect and allows attackers to steal data, move laterally within a network, or gain persistence without relying on easily identifiable malware.
On December 19, 2023, the FBI announced disruption of RaaS operations carried out by AlphV (also known as “BlackCat”). The FBI seized several websites created by the group and gained visibility into the BlackCat ransomware group’s computer network as part of the investigation[3]. Additionally, authorities offered victims access to an FBI-developed decryption tool allowing for recovery of encrypted data.
In response BlackCat called for open season against the healthcare sector stating, “Because of their actions, we are introducing new rules, or rather, we are removing ALL rules except one, you cannot touch the CIS. You can now block hospitals, nuclear power plants, anything, anywhere.”[4]
On February 27, 2024, CISA, the FBI, and the Department of Health and Human Services (HHS), released a joint advisory which addressed BlackCat’s operations and attacks against the healthcare sector. They noted that, “Since mid-December 2023, of the nearly 70 leaked victims, the healthcare sector has been the most victimized. This is likely in response to the AlphV / Blackcat administrator’s post encouraging its affiliates to target hospitals after operational action against the group and its infrastructure in early December 2023.”[5]
In late February 2024, as part of attacks against the healthcare sector, insurance provider UnitedHealth found itself in the crosshairs of BlackCat operations, it was reported the attack “had a knock-on effect on players across the U.S. healthcare system, as disruptions triggered by the attack have impacted electronic pharmacy refills and insurance transactions.”[6] In a quickly deleted post to its darknet hosted website, BlackCat stated that it stole millions of sensitive records.
In November 2023, the Health Sector Cybersecurity Coordination Center (HC3) at the U.S. Department of Health and Human Services (HHS), released a detailed analysis on BlackSuit, a new ransomware strain that poses a credible threat to the healthcare and public health (HPH) sector.
BlackSuit emerged in May 2023 and exhibits significant parallels to the Royal ransomware family, which succeeded the infamous Conti group linked to Russia. BlackSuit’s ties to these active threat actors suggest ongoing, aggressive targeting of the healthcare industry. HC3 outlined BlackSuit’s operations, including its use of double extortion tactics, specific technical details, and potential impact on healthcare services, alongside recommended defenses, and mitigation strategies.
As outlined in the HC3 report, BlackSuit’s impact could be significant, particularly if the group’s ties to the Royal and Conti ransomware families are confirmed. With its use of double extortion tactics, BlackSuit not only encrypts sensitive data on compromised healthcare networks but also threatens to leak stolen data unless a ransom is paid. This approach poses a dual threat: the immediate disruption of healthcare services due to inaccessible patient records and systems, and the long-term damage from the potential exposure of confidential patient data.
BlackSuit operates by encrypting sensitive data on compromised networks, employing a double extortion scheme that has so far targeted a limited number of victims across various sectors, including healthcare, in countries such as the U.S., Canada, Brazil, and the U.K. The analysis reveals BlackSuit’s operational techniques, encrypted file extensions, ransom demand methods, and its distribution via infected email attachments, torrent websites, malicious ads, and trojans.
Despite its limited use, the connections to Royal and Conti hint at a potentially significant threat landscape for the healthcare sector. Technical similarities with the Royal ransomware family, based on binary comparison tools, suggest BlackSuit could be a variant or affiliate of these larger, well-organized ransomware operations.
HHS emphasizes the importance of heightened security measures and preparedness within the healthcare industry to mitigate risks associated with ransomware attacks.
To protect against evolving cyber threats in the healthcare sector, Adlumin recommends practicing good cyber hygiene by staying informed of the threat landscape, updating software regularly, implementing a Security Awareness Program, and deploying endpoint protection solutions.
Adlumin’s threat research team advises healthcare organizations to regularly update software, segment their networks, and plan for incident response. They also recommend implementing security monitoring, and anomaly detection tools. In addition, secure backups, encryption of sensitive data, and HIPAA compliance are crucial elements of a strong cybersecurity strategy.
With a deep understanding of the healthcare sector’s unique challenges and vulnerabilities, Adlumin stands as a reliable partner in strengthening cybersecurity posture and ensuring regulatory compliance. Partnering with Adlumin equips healthcare organizations with the necessary tools and expertise to combat ransomware and protect critical infrastructure effectively.
Stay tuned, Adlumin’s Threat Research team is releasing in-depth mitigation strategies for the healthcare sector.
References:
[1] https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf
[2] https://www.hipaajournal.com/what-are-the-penalties-for-hipaa-violations-7096/
[3] https://www.justice.gov/opa/pr/justice-department-disrupts-prolific-alphvblackcat-ransomware-variant
[4] https://krebsonsecurity.com/2023/12/blackcat-ransomware-raises-ante-after-fbi-disruption/
[5] https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a
[6] https://www.reuters.com/technology/unitedhealth-confirms-blackcat-group-behind-recent-cyber-security-attack-2024-02-29/
By: Brittany Holmes, Corporate Communications Manager
The rise of ransomware attacks can be traced back to the infamous WannaCry outbreak in 2017, a watershed moment for cybercriminals. This high-profile incident revealed the potential profitability of ransomware attacks and spurred the development of numerous variants since then.
Additionally, the COVID-19 pandemic played a significant role in the recent surge of ransomware attacks. With organizations hurriedly transitioning to remote work, vulnerabilities in their cybersecurity defenses became more apparent and exploitable. Cybercriminals took advantage of these weaknesses to launch ransomware attacks, sharply increasing such incidents.
As history has shown, ransomware attacks continue to evolve and become more sophisticated in their tactics. This makes it crucial for small and medium-sized businesses (SMBs) to understand the growing threat landscape and take proactive steps to protect their data and systems.
This blog explores the mechanisms through which ransomware is delivered, the reasons behind its alarming success rate, and effective mitigation strategies for SMBs.
From a cybercriminal’s point of view, there are numerous ways to break into a network and encrypt its data for ransom. Stealing and holding data hostage has proven to be an effective way to extort money from organizations, so cybercriminals are increasingly utilizing this tactic.
To successfully breach a network, cybercriminals target the most vulnerable link in the security chain—the people. It is crucial for companies to prioritize employee training on cybersecurity awareness and to update and strengthen their security measures constantly.
Ransomware is often delivered through phishing emails and malicious websites. Phishing emails typically contain deceptive links or attachments that, when clicked, can install ransomware onto a victim’s device. These emails are made to appear sincere and may even impersonate trusted sources, tricking users into taking actions that compromise their security. On the other hand, malicious websites can also distribute ransomware through drive-by downloads or exploit kits. These websites can quickly infect a user’s system with ransomware by luring unsuspecting visitors to click on malicious links or download files.
One of the main reasons why ransomware is so effective is because it preys on peoples’ fear and urgency to regain access to their data. Many individuals and organizations rely heavily on their data for everyday operations, and the idea of losing that data can be terrifying. This fear often leads victims to pay the ransom, even though there is no guarantee that the cybercriminals will provide the decryption key once the ransom is paid.
Additionally, the speed at which ransomware operates also contributes to its effectiveness. By the time detection occurs, most files are encrypted, making it difficult to stop the attack in its tracks. Even with detection, analysts still need to look at the alerts and take the appropriate action, which can be time-consuming and may result in further data loss. This rapid encryption process adds to the sense of urgency that victims feel, pushing them to consider paying the ransom as a quick solution to regain access to their data.
Ransomware is particularly effective against SMBs because they often lack the proper resources and expertise to defend against such attacks. SMBs are also more likely to pay the ransom, as they may not have proper backups in place or the means to recover their data through other methods.
According to Adlumin’s most recent Threat Insights 2024 Volume I, the top two tactics/methods used by ransomware gangs include:
Ransomware attacks continue to be successful due to the evolving tactics employed by cybercriminals, who are now packaging their methods into more streamlined and sophisticated approaches. The two primary tactics driving the success of ransomware include double extortion and the rise of Ransomware-as-a-Service (RaaS), enabling easier access and increased efficiency for cybercriminals looking to exploit organizations for financial gain.
Double Extortion: In addition to encrypting an organization’s data, cybercriminals are increasingly stealing sensitive information and threatening to release it publicly unless the ransom is paid. This additional pressure increases the likelihood that victims will pay the ransom.
Ransomware-as-a-Service (RaaS): Some ransomware groups now offer their ransomware as a service to other cybercriminals, allowing them to distribute and deploy ransomware attacks without technical expertise efficiently. This has led to increased ransomware attacks, as more criminals can launch their own campaigns with minimal effort.
By understanding how ransomware works and the tactics used by cybercriminals, organizations can better protect themselves against these attacks and prevent falling victim to ransomware.
To effectively mitigate ransomware risks, SMBs must educate and train employees to identify and report the signs of a potential attack. By raising awareness about suspicious emails, links, and attachments, employees become the frontline defense against ransomware infiltrations. Encouraging the use of strong, unique passwords and multi-factor authentication further bolsters security measures.
In addition to employee training, implementing a robust data backup and recovery plan is essential. Regularly backing up data to offline or secure cloud storage ensures that systems can be restored without succumbing to ransom demands.
Maintaining up-to-date patch updates, particularly through Continuous Vulnerability Management, adds another layer of security. Staying vigilant and updating systems regularly makes it more challenging for threat actors to gain unauthorized access to sensitive data.
By combining these strategies, SMBs can significantly reduce their vulnerability to ransomware and protect their valuable data.
Last year, there was an increase of ransomware attacks at a rate of 73% totaling 4,611 cases reported. The staggering statistics on ransomware attacks highlight the critical need for heightened awareness and preparedness across all industries.
Implementing a multi-layer defense strategy and prioritizing early detection are pivotal steps in safeguarding organizations against the damaging impact of ransomware. It is imperative that organizations invest in cybersecurity measures, conduct regular training for employees, and stay vigilant against evolving threats.
By staying informed and proactive, organizations can significantly reduce the potential damage inflicted by ransomware attacks and ensure the security of their valuable data and systems.
By: Brittany Holmes, Corporate Communications Manager
Ransomware attacks continue to pose a serious and persistent threat, causing widespread disruption to organizations of all sizes. This underscores the critical need for proactive cybersecurity measures to stay ahead of cybercriminals.
A recent high-profile incident involving approximately 60 Credit Unions highlighted the ongoing impact of these attacks. Many of the credit unions affected lacked adequate backup coverage and dedicated security, which serves as an example of the importance of early detection and a multi-layered defense strategy to protect valuable data from ransomware threats.
This blog explores top methods for detecting ransomware, response strategies, and the importance of a multi-layer protection approach.
Ransomware protection strategies commonly focus on various stages of attack detection, as outlined by MITRE. From blocking known variants to detecting signs of compromise before execution and identifying malicious activities during the execution phase, each step plays a crucial role in preventing file encryption and data loss. Here are some top ways ransomware is detected:
Additionally, leveraging frameworks such as MITRE ATT&CK can provide organizations with a standardized approach to understanding ransomware tactics, techniques, and procedures (TTPs). By mapping ransomware behaviors to the MITRE ATT&CK framework from left to right, organizations can identify gaps in their detection and response capabilities and implement targeted security measures to enhance their ransomware defense strategy.
However, cybercriminals continually evolve their tactics, and ransomware strains emerge, hindering some security approaches. To address the shortcomings of each detection method, organizations can adopt a strategy that combines multiple layers of defense. Ransomware detection capabilities can be enhanced by integrating threat intelligence feeds with advanced behavioral analytics and proactive threat hunting, improving their overall cybersecurity posture.
Adlumin’s Managed Detection and Response (MDR) now includes a ransomware prevention feature focused on file system preservation to combat the evolving ransomware landscape. This new capability safeguards and preserves most files by killing the process at the earliest detection sign.
One crucial aspect of ransomware protection is proactive testing and preparedness. It is important to understand how secure your organization’s security tools are against ransomware by prioritizing testing defenses and response protocols to ensure readiness in the face of potential threats.
Ransomware protection is a complex and challenging threat that demands a multi-layered defense approach. Early detection, proactive response strategies, secure backups, and innovative technologies like Adlumin’s Ransomware Prevention are essential to a comprehensive defense posture against attacks. By understanding the importance of early detection and implementing a multi-layered defense strategy, organizations can significantly enhance their resilience to evolving cyber threats.
The threat of ransomware is large, but by staying informed and leveraging advanced security solutions, the risks can be mitigated, and data assets can be safeguarded. Remember, there is no single answer to ransomware protection – it requires a holistic and dynamic approach to stay ahead of cyber adversaries. With 24×7 coverage and innovative technologies, you can protect your organization against the threat of ransomware and ensure organization continuity in the face of evolving cyber risks.
The Adlumin team recently investigated a security incident in which a malicious actor(s) successfully managed to gain unauthorized access to a company’s networks by completely bypassing Duo, a popular zero-trust security solution used by hundreds of organizations worldwide.
The incident occurred in early February 2024 when threat actor(s) used two compromised sets of email credentials to log in remotely to the targeted company’s network from servers with IP addresses registered to Russia and Brazil. Subsequently, the company’s security tools, including Adlumin, generated several alerts for malicious activity detected within the network. This activity included credential brute forcing attempts, attacks against Microsoft Active Directory and Kerberos, and the use of Netscan to enumerate endpoints and servers.
Security teams responded to the alerts and successfully halted and locked out the threat actors before they could inflict more harm on the network, but questions remained as to why Duo’s two-factor authentication (2FA) was not prompted to verify the legitimacy of the login sessions which would have protected against compromised credential-based attacks.
The Adlumin investigation revealed that the two compromised email accounts used by the threat actor(s) were stale accounts which had been mistakenly configured with a policy that allows for unenrolled or partially enrolled users to authenticate into their network without 2FA.
According to Duo’s online documentation (last updated on Jan. 29, 2024), a “New User Policy” to allow access without 2FA, does not prompt users to complete enrollment and they are granted access without two-factor authentication.1
This type of user policy is made available to organizations for several reasons, including facilitating a gradual rollout of 2FA within the organization or a slow adoption of new zero-trust practices. However, it remains important to monitor events generated by users that bypass 2FA. Duo does offer such a monitoring feature to companies using Duo Premier, Duo Advantage, and Duo Essentials Plan.
With any 2FA solution, it’s important to consider the risks of enabling or using user policies that bypass it in any scope. Bypassing 2FA for certain users or scenarios reduces the overall security posture of the system and network. It can create fringe but exploitable instances where authentication relies solely on a single factor (e.g., username and password) that may be more susceptible to compromise – which was the case in the security incident investigated by Adlumin.
When users are not required to use 2FA, there is an increased vulnerability window. Attackers may exploit this period, especially if users with reduced authentication factors can enable access to sensitive information or critical systems.
In its online documentation, Duo does warn account owners and administrators who configure login access to remember that users with bypass status are not subject to restrictions and can bypass Duo authentication entirely.2
To protect against similar attacks at organizations that use Duo or other zero-trust solutions, Adlumin recommends that companies and organizations ensure user access policies are correctly configured and consider the security risks that come with allowing some users to bypass 2FA.
Organizations can avoid or reduce their exposure to an attack by practicing good account hygiene. This includes routinely conducting account reviews to identify and deactivate accounts that are no longer needed, establishing efficient communication between IT departments and human resources when employees leave an organization, and automating account provisioning and deprovisioning processes.
References:
[1] https://duo.com/docs/policy#new-user-policy
[2] https://duo.com/docs/policy#overview
1140 3rd St. NE, Suite 340
Washington, DC 20002
(202) 570-7907
Copyright 2024 Adlumin, Inc. All Rights Reserved