This vacation season our SOC analysts have noticed a pointy uptick in cyber menace exercise. Specifically, they’ve seen an increase in tried ransomware assaults, which began throughout the American Thanksgiving vacation interval (November 25–31, 2024) and are anticipated to proceed all through the vacation season. We’re sharing particulars on the menace actors concerned, their techniques, in addition to suggestions to provide you data and instruments to proactively strengthen your safety in opposition to evolving threats.
Key Threat Groups
BlackGo well with (previously “Royal”)
Known for focusing on essential infrastructure sectors, together with healthcare, authorities, and manufacturing, BlackGo well with employs information exfiltration, extortion, and encryption methods, in response to a Cybersecurity and Infrastructure Security Agency (CISA) advisory.
Common assault vectors embody:
- Phishing emails and malicious web sites
- Exploitation of unsecured digital non-public networks (VPNs) missing multi-factor authentication (MFA)
- Disabling antivirus software program to exfiltrate information earlier than encrypting methods
Black Basta
Operating as a ransomware-as-a-service (RaaS), Black Basta associates have focused over 500 entities in 2024 alone in North America, Europe, and Australia, in response to CISA. Key techniques:
- Vishing: Impersonating assist desk technicians through cellphone to entry networks
- Using malicious distant administration instruments to realize entry and escalate assaults
LevelBlue Observations of Threat Actor TTPs and How to Fortify Security
In latest weeks, our SOC crew has noticed menace actors utilizing the next techniques to launch assaults:
| Tactic | Recommendations |
|---|---|
| Exploitation of a VPN portal that isn’t implementing MFA to realize preliminary entry |
|
|
The use of vishing (impersonating a “help desk” crew member) to realize preliminary entry to end-user workstations, which then offers the attacker entry to the bigger community (emails and textual content messages are additionally being leveraged for credential assortment and malware deployment) Two numbers LevelBlue has recognized to be concerned in incidents are 1-844-201-3441 and 304-718-2459 |
|
| The use of Rclone, WinSCP, and different file switch instruments to exfiltrate information from environments |
|
|
Exploitation of vulnerabilities throughout frequent software program/functions to escalate privileges Vulnerabilities for VMware, Microsoft Exchange, Microsoft SharePoint, and different self-hosted functions are being notably focused to realize administrator and even root entry inside environments |
|
| The use of Remote Desktop Protocol (RDP), Window Remote Management (WinRM), and Remote Monitoring Management (RMM) instruments for lateral motion |
|
Other Proactive Cybersecurity Measures
Enhance Employee Awareness
While staff is perhaps having fun with extra festivities this time of yr, it’s necessary to speak the urgency of heightened vigilance throughout the vacation season. Educate staff on recognizing and reporting suspicious communications. And present clear steerage on verifying IT help contacts.
Validate Security Controls and Address Potential Exposures
Stay on prime of patching and guarantee public-facing property are secured via MFA. We’re right here to assist determine potential safety gaps and exposures. Take benefit of a 30-day free trial with LevelBlue’s Vulnerability Management service.
Protect Against Malicious Sites and Emails
If you don’t have already got e mail safety, safe distant entry, or safe net gateway protections in place, contemplate including them. LevelBlue supplies versatile, managed service supply choices with a selection of main applied sciences. These providers may help shield staff from phishing makes an attempt and malicious websites in addition to assist management and handle entry to functions.
Fortify Endpoint Security
More than 75% of organizations say they’ve skilled not less than one cyberattack attributable to unknown, unmanaged, or poorly managed units.2 LevelBlue Managed Endpoint Security with SentinelOne protects various endpoints, together with laptops, servers, desktops, and cloud workloads, from evolving threats. Pair this service with LevelBlue Managed Threat Detection and Response to cowl your complete assault floor. We additionally provide a number of tiers for an incident response retainer, giving prospects entry to extra response, forensics, and restoration help.
Finally, it might be tempting to let duties linger this time of yr, however as everyone knows, cybercriminals will use that to their benefit. Address safety considerations instantly, so they don’t compound and develop extra extreme. The holidays are a busy time for everybody, together with menace actors. Use our help providers throughout this season and past to fortify your cyber operations and guarantee your group stays secure.
Contact LevelBlue
info@levelblue.com
1CISA Alert: Royal Ransomware Actors Rebrand as “BlackSuit,” FBI and CISA Release Update to Advisory. Retrieved Dec. 5, 2024.
2CISA Alert: CISA and Partners Release Advisory on Black Basta Ransomware. Retrieved Dec. 5, 2024.