WEBVTT 1 00:00:01.639 --> 00:00:09.839 Produced by PI Media. Hi, and welcome to SIPI Radio. I'm your 2 00:00:09.839 --> 00:00:17.640 host, Ran Levy. Once a year, Checkpoint Research releases a media report, 3 00:00:18.000 --> 00:00:22.640 a summary of the first half of the calendar year in cybersecurity, including 4 00:00:22.719 --> 00:00:27.399 all of the major changes, trends, and events that be fined January through 5 00:00:27.600 --> 00:00:32.159 June. Obviously, a lot happens in that time, and so the reports 6 00:00:32.439 --> 00:00:37.399 end up rather along, which is why sometimes we'll do one of these episodes 7 00:00:37.439 --> 00:00:43.320 to summarize not every detail, but the biggest, most important things you should 8 00:00:43.439 --> 00:00:47.439 know. The interviews are hosted by Nate Nelson, the writer of our show, 9 00:00:47.799 --> 00:00:53.079 and feature one of Checkpoint's research lead intelligence analysts. This time a familiar 10 00:00:53.159 --> 00:00:58.280 fakes. You have a rad pinkas so sit back. Over the next twenty 11 00:00:58.280 --> 00:01:00.719 five minutes or so, Nathan you are, We'll give you a brief picture 12 00:01:00.920 --> 00:01:06.439 of the first half of the year twenty twenty three in case you missed any 13 00:01:06.480 --> 00:01:10.599 of it, or maybe you just need a refresher. I'll see you at 14 00:01:10.640 --> 00:01:19.879 the end of it. Enjoy. Heyov, welcome back to the program. 15 00:01:19.079 --> 00:01:23.000 Want to let listeners know what we have in store for them in this episode. 16 00:01:23.480 --> 00:01:27.920 Hi, Nie, good to be here again. The last time we 17 00:01:29.000 --> 00:01:34.120 talked, we discussed Checkpoint Research's twenty twenty three annual Report, and this time 18 00:01:34.159 --> 00:01:38.760 we have the twenty twenty three Media Report, which we published just a few 19 00:01:38.760 --> 00:01:44.519 weeks ago. This edition is more concise but has the same general structure as 20 00:01:44.599 --> 00:01:49.959 before, and it is based on the analysis of anonymized data collected from hundreds 21 00:01:49.959 --> 00:01:57.000 of thousands of gateways of our customers throughout the world. This data, combined 22 00:01:57.040 --> 00:02:01.560 with Ostin's research, gives us a pretty good picture of the current trends in 23 00:02:01.840 --> 00:02:07.960 cyber attack scene. So in this report, we analyze the major trends in 24 00:02:08.039 --> 00:02:15.719 cyber attacks and present the data concerning the major attack industries, infection methods, 25 00:02:16.000 --> 00:02:21.879 tope, malware, and more. Maybe you can be a little more specific 26 00:02:22.000 --> 00:02:28.599 about exactly what's covered in the report. The report itself includes an analysis of 27 00:02:28.719 --> 00:02:34.800 the ransomware ecosystem and its developments, which will go into in a minute, 28 00:02:34.840 --> 00:02:39.319 but also reviews developments in activism, the recent threats in the mobile arena. 29 00:02:40.000 --> 00:02:46.840 We review what is probably going to be the major theme for which twenty twenty 30 00:02:46.840 --> 00:02:52.840 three will be remembered in history is the developments in AI and their implications over 31 00:02:52.879 --> 00:02:58.400 the cyberfield, and much much more. Of course, we don't have nearly 32 00:02:58.479 --> 00:03:01.360 enough time to cover every one of these subjects, so today let's just focus 33 00:03:01.479 --> 00:03:07.000 on a few that we think are extra important. Firstly, what's happening with 34 00:03:07.319 --> 00:03:14.000 ransomware, So ransomer I'm still considered the number one threat for businesses of all 35 00:03:14.080 --> 00:03:20.560 sizes in the sense of the damage that degenerates in both direct and indirect damages. 36 00:03:21.439 --> 00:03:24.759 These are the ransom payments, but also lots of business and exposure to 37 00:03:25.000 --> 00:03:34.520 lawsuits GDPR related for both customers and employees, but not just the damages. 38 00:03:35.000 --> 00:03:39.639 It's also more widespread, I think than you might think. So from analyzing 39 00:03:39.680 --> 00:03:46.759 the cases handled by our incident response team, we find that almost half of 40 00:03:46.800 --> 00:03:52.759 all the cases that they investigate are ransomer related cases. So many of the 41 00:03:52.840 --> 00:03:57.960 smaller incidents we see, if they're not handled properly, could develop into full 42 00:03:58.000 --> 00:04:02.680 blown ransomware attacks. Now, when we say ransomware today, we mean not 43 00:04:03.120 --> 00:04:09.879 that it's an attack where data is encrypted or not just, but rather that 44 00:04:10.000 --> 00:04:16.199 the motivation behind the attack is to generate financial profit through the extortion of the 45 00:04:16.279 --> 00:04:23.720 victims. This is now an entire ecosystem whose main actors are ransomware as a 46 00:04:23.759 --> 00:04:30.040 service RUSS threat actors that operate in a double extortion model. This means that 47 00:04:30.360 --> 00:04:34.519 threat doctors like lock Beat Club and many others that we'll talk about the other 48 00:04:34.560 --> 00:04:41.360 ones that are responsible for the Malwa development, but the actual operation of the 49 00:04:41.399 --> 00:04:47.120 attack is conducted by affiliates. The affiliates pay for the use or show part 50 00:04:47.120 --> 00:04:53.319 of the revenue with the ransomware as a service actors, and in return they 51 00:04:53.319 --> 00:04:59.560 can use the ransomware encryptor and other infrastructure related services, including the reputation of 52 00:04:59.600 --> 00:05:02.839 the of the runs of worth the service actors. Yeah, can you expand 53 00:05:02.839 --> 00:05:08.079 on that idea, because I think it might be strange to those unfamiliar that 54 00:05:08.160 --> 00:05:15.040 ransomware groups would have anything resembling a good reputation. Ironically, reputation is an 55 00:05:15.120 --> 00:05:21.279 important element in this sector of crime industry, since victims who pay large sums 56 00:05:21.279 --> 00:05:28.639 in extortion moneies rely on the reputation of the attacker for receiving decryption keys in 57 00:05:28.720 --> 00:05:33.680 return for their payment. These attacks normally include two strategies of extortion, both 58 00:05:33.720 --> 00:05:40.920 the encryption of data and the victim system and by stealing the data and threatening 59 00:05:40.959 --> 00:05:47.480 to publish it later. This is the double element in double extortion. This 60 00:05:47.600 --> 00:05:53.319 model of operation, which is based on outsourcing the initiative to the affiliates, 61 00:05:53.360 --> 00:05:59.560 has created a competition between ransom as service actors on the attention of affiliates and 62 00:06:00.040 --> 00:06:05.120 how to recruit them, and this competition in turn pushes for continuous development of 63 00:06:05.160 --> 00:06:12.319 additional features in the ransomware malware and services. All of this is relevant today, 64 00:06:12.360 --> 00:06:15.439 of course, but it's not new either. So what's changed in ransomware 65 00:06:15.639 --> 00:06:21.720 in twenty twenty three. One such important ability that was pushed and added to 66 00:06:21.800 --> 00:06:30.600 many ransomware families this year has been ransomware versatility to additional operating systems, mostly 67 00:06:30.680 --> 00:06:36.319 Linox. This ability opens the potential attach surface to many more systems and possible 68 00:06:36.399 --> 00:06:44.399 victims. So Linox dedicated ransomware is now offered by a Lockbit, by Royal, 69 00:06:44.600 --> 00:06:48.680 by Club, Bian, Lion by Society, and it really has become 70 00:06:49.399 --> 00:06:56.600 the standard for ransomware. Another aspect that ransomware has been improving in is the 71 00:06:56.759 --> 00:07:00.519 speed of encryption, which has long been the subject of ransomware advertisements. I 72 00:07:00.560 --> 00:07:06.800 remember two years ago Lockbeat published an advertisement with an operational analysis of all available 73 00:07:06.839 --> 00:07:13.800 ransomware payloads, comparing their encryption speeds and claiming to be the fastest. Why 74 00:07:13.879 --> 00:07:18.519 is this important because the faster the encryption, the less time defenders have to 75 00:07:18.680 --> 00:07:24.959 detect and intercept the attacks, and the more chance criminals have at encrypting valuable 76 00:07:25.079 --> 00:07:30.920 data. This is also why most attacks conduct this critical but noisy encryption phase 77 00:07:30.199 --> 00:07:35.680 at non working hours, so the attacks are mostly during nighttime or weekends or 78 00:07:35.680 --> 00:07:44.120 holidays, and they try to be as quick as possible. CPR has recently 79 00:07:44.120 --> 00:07:49.800 published an analysis of the fastest encryption ransomware we dubbed it woshot, which was 80 00:07:49.920 --> 00:07:57.600 used against an American company. The average time that attackers now spend in breached 81 00:07:57.639 --> 00:08:01.720 networks is also getting shorter, from weeks in the past to less than a 82 00:08:01.839 --> 00:08:07.839 day for actors to stay in a breached network, locate and breach backup servers 83 00:08:09.680 --> 00:08:16.199 or active directories. So to summarize, ransomware, attackers are targeting previously untouched 84 00:08:16.240 --> 00:08:22.399 operating systems and moving faster than ever. What else Another aspect that transfer service 85 00:08:22.480 --> 00:08:28.879 providers are working on improving is their evasion techniques. These are basically all the 86 00:08:28.920 --> 00:08:35.039 features intended to work around security mechanisms. For example, we see that mechanisms 87 00:08:35.120 --> 00:08:43.159 like restarting safe mode. That's when the intruding ransomware restarts the machine in safe 88 00:08:43.159 --> 00:08:48.480 mode to exclude most security mechanisms, so this has become another common feature again 89 00:08:48.519 --> 00:08:54.840 almost as standard. Leading examples are lock Beats, Alpha Black, Busta, 90 00:08:54.320 --> 00:09:00.759 and Avhaslocker and where have we seen all these trends bear out? Tell me 91 00:09:00.840 --> 00:09:05.840 about some of the notable attacks that happen this year. Maybe the trend of 92 00:09:05.919 --> 00:09:11.159 the first half of twenty twenty three is the mega ransomware attacks, where attackers 93 00:09:11.240 --> 00:09:18.240 breach dozens, sometimes hundreds of companies in one go. The three largest examples 94 00:09:18.279 --> 00:09:26.039 of this are the Lockbeat exploitation of the Cloud fifty one service provider that has 95 00:09:26.120 --> 00:09:31.679 led to the breach of sixty other companies, and two attacks by Cloud, 96 00:09:31.279 --> 00:09:37.879 both targeting file transfer tools. The first attack was through a service called go 97 00:09:37.000 --> 00:09:43.039 Anywhere that brought down one hundred and thirty victims, and the second by exploiting 98 00:09:43.039 --> 00:09:48.480 a zero day vulnerability in the movie tool, which is now confirmed to have 99 00:09:48.559 --> 00:09:54.600 taken down one hundred probably more than seven hundred companies, including Shell, Deutsche 100 00:09:54.639 --> 00:10:01.320 Bank, British Airways and many many. This is a major change from what 101 00:10:01.360 --> 00:10:09.320 we've become used to in this ecosystem until now there's been the gradual outsourcing of 102 00:10:09.440 --> 00:10:16.600 various parts of the attack operation to many subcontractors. So affiliates produce the attack, 103 00:10:16.720 --> 00:10:22.200 but they buy infections from initial access brokers, and the initial access brokers 104 00:10:22.559 --> 00:10:28.279 base their activity on information and leads they buy in dark web markets where it 105 00:10:28.360 --> 00:10:35.799 is sold by often less technical actors who operate infostealers. But with mega attacks, 106 00:10:37.000 --> 00:10:43.440 one actor utilizes an expensive zero their vulnerability to penetrate multiple victims. This 107 00:10:43.559 --> 00:10:50.840 creates a substantial management challenge for the threat actor. Just imagine the management of 108 00:10:50.879 --> 00:10:56.240 such an operation. You need to search and networks of hundreds of companies, 109 00:10:56.320 --> 00:11:00.799 you need to identify important information, you need to download and story, you 110 00:11:00.919 --> 00:11:07.000 conduct negotiations, you need to leak it. It's really a considerable logistical challenge, 111 00:11:07.840 --> 00:11:13.480 and this is probably one of the reasons why they now skip the encryption 112 00:11:13.600 --> 00:11:20.879 phase altogether and resort to only data extortion that means they demand money or else 113 00:11:20.960 --> 00:11:26.440 they would publish the story information. Interestingly, this is the main trend we 114 00:11:26.559 --> 00:11:31.480 recognize and outlined in the previous report in December, when we noticed that threat 115 00:11:31.519 --> 00:11:37.279 doctors started to conduct effective DOTA extortion without encryption. And these groups are well 116 00:11:37.320 --> 00:11:43.120 equipped to manage gigantic breaches of so many organizations at once on operation in this 117 00:11:43.279 --> 00:11:46.759 magnitude, there's other challenges. For example, in order to download the gigabyte 118 00:11:46.720 --> 00:11:54.399 of data from a from tour infrastructure, that could take relatively long time and 119 00:11:54.480 --> 00:12:01.399 thus makes the extortion threat less effective. And that's why Globe has experimented with 120 00:12:01.480 --> 00:12:05.440 leaking the data not in its Onion infrastructure but rather on the clear Net, 121 00:12:07.080 --> 00:12:11.600 and in August, just a couple of weeks ago, they transformed their entire 122 00:12:11.679 --> 00:12:16.679 leak infrastructure to torrents. That makes it both much faster, therefore a more 123 00:12:16.720 --> 00:12:24.559 substantial threat for victims and more challenging for law enforcement to take the databasis of 124 00:12:24.679 --> 00:12:30.360 flying anything else. Before we move on from the ran square topic, in 125 00:12:30.399 --> 00:12:35.240 this report, we also publish an analysis of data scrap from ransomware threat acts 126 00:12:35.320 --> 00:12:43.519 shame sight. These are the sites where they publish the identity and lay the 127 00:12:43.639 --> 00:12:48.039 data of non paying victims, so it's a partial view, but it's still 128 00:12:48.759 --> 00:12:54.200 insightful. So what we routinely do is we monitor more than one hundred and 129 00:12:54.240 --> 00:13:00.559 seventy Onion sites which are operated by over one hundred and twenty criminal group and 130 00:13:00.679 --> 00:13:03.759 in the first half of twenty twenty three. These were used to publish the 131 00:13:03.840 --> 00:13:11.399 identity of more than twenty two hundred victims by nearly fifty active groups. Lockbit 132 00:13:11.639 --> 00:13:18.559 was the most prolific actor, accounting for more than a quarter of all victims 133 00:13:18.879 --> 00:13:24.320 before the count of the club's movie Bridge, which occurred in May but was 134 00:13:24.320 --> 00:13:30.080 published and added to the victim count in later months. So Lockbit had the 135 00:13:30.120 --> 00:13:35.919 most victims, and Alpha also known as black Cat and Clob followed. Alphav 136 00:13:37.000 --> 00:13:41.600 is, the actor responsible for the recent breach of MGM Resorts International. In 137 00:13:41.679 --> 00:13:46.559 terms of geographical distribution, we see that almost half of the victims are US 138 00:13:46.639 --> 00:13:54.279 companies. That could explain the intensive activity of American law enforcement dentities against this 139 00:13:54.759 --> 00:14:01.480 criminal industry. They've led operations like the high ransomware group takes down in January 140 00:14:01.840 --> 00:14:07.200 this year and lead much of the international activity. Who I'm curious are the 141 00:14:07.279 --> 00:14:11.399 victims of these stories, whether it be industry, geography, what have you. 142 00:14:13.360 --> 00:14:16.720 Most of the victims are from Western countries like UK, the UK, 143 00:14:16.039 --> 00:14:22.200 Canada, Italy, Germany and France, but interestingly we had some Russian victims 144 00:14:22.200 --> 00:14:28.039 this year. Now, normally most of these groups refrained from attacking exusar countries 145 00:14:28.120 --> 00:14:33.879 or just generally Russian language systems, but we did see now a substantial number 146 00:14:33.879 --> 00:14:41.000 of Russian victim companies. These were almost exclusively victims of the Mala Sloker threat 147 00:14:41.080 --> 00:14:46.559 actor. This group, which emerged earlier this year, is unique not just 148 00:14:46.600 --> 00:14:50.159 for the identity of its victims, but also for their extraordinary ransom demand. 149 00:14:50.840 --> 00:14:56.840 The group asks victims to make a donation to a charity of their choice instead 150 00:14:56.840 --> 00:15:03.679 of paying a ransom payment directly to the group. On something maybe similar, 151 00:15:03.759 --> 00:15:09.600 we've again extraordinarily seen some Iranian victims in August. All of them were breached 152 00:15:09.600 --> 00:15:15.399 by a group called Alvin Club, which is traditionally focused on Iran. Another 153 00:15:15.440 --> 00:15:20.279 interesting finding is the analysis of affected industries by ransomware. So what we see 154 00:15:20.360 --> 00:15:26.919 is that sectors that cannot or systematically would not play ransomware less affected by it. 155 00:15:28.799 --> 00:15:33.840 So government and military, education and research institutes, which we find at 156 00:15:33.879 --> 00:15:39.080 the top of our most sector index when we review general cyber attacks, are 157 00:15:39.120 --> 00:15:46.559 not at the top of the ransomware victim industry index. They're pushed down in 158 00:15:46.639 --> 00:15:52.320 the ranking of most attacks sectors by manufacturing companies and retail entities who are more 159 00:15:52.879 --> 00:16:00.759 income oriented and generally more willing to negotiate and pay ransomware. By use law, 160 00:16:00.799 --> 00:16:06.399 it's forbidden, that is, to negotiate and pay ransomware. And from 161 00:16:06.399 --> 00:16:11.440 this analysis we can see that as an industry this principle is actually effective and 162 00:16:11.480 --> 00:16:18.799 we see less of the public sector at the top of the most attack ransomware 163 00:16:18.279 --> 00:16:22.600 index. Before we finish up here, you have there is another major trend 164 00:16:22.679 --> 00:16:30.159 that you wanted to talk about. On another interesting issue we highlight in this 165 00:16:30.240 --> 00:16:37.399 report the re emergence of an old infection method that's of using USB drives. 166 00:16:37.240 --> 00:16:42.080 This is when thread uctors either distribute or sent by mail USB devices that have 167 00:16:42.159 --> 00:16:48.639 malicious mechanisms either automatic or use IT dependent, or even infections that use occasional 168 00:16:48.759 --> 00:16:55.159 USB drives to transfer infections from one machine to the other. Now, already 169 00:16:55.159 --> 00:17:00.000 in twenty twenty two, the FBI issued a warning about campaign aiming at US 170 00:17:00.279 --> 00:17:07.079 defense firms, with the attackers mailing USB drives loaded with malicious payloads. And 171 00:17:07.680 --> 00:17:11.599 during the past few months, CPR reviewed a couple of malware families with extensive 172 00:17:11.640 --> 00:17:19.880 exploitation of USB devices. The first was the Raspberry robin worm, currently one 173 00:17:19.880 --> 00:17:26.640 of the most widespread multipurpose malware families that has been recorded giving access to infections 174 00:17:26.680 --> 00:17:33.640 such as club and lockwit, So Raspberry Robin can be considered as an access 175 00:17:33.640 --> 00:17:38.960 broker agent in this ecosystem, and one of Raspberry Robin's infection vectors is through 176 00:17:40.079 --> 00:17:45.200 creating malicious lank files on USB storage devices, which infect the next machine they're 177 00:17:45.200 --> 00:17:49.960 inserted too. Now, this is not a primitive malware and it is designed 178 00:17:49.960 --> 00:17:56.920 with an extensive set of anti analysis mechanisms, and it is interesting to see 179 00:17:56.359 --> 00:18:03.759 that it still bases much of its initial infections on USB tribes, which suggest 180 00:18:03.240 --> 00:18:10.759 that this is still an effective attach vector. We've also seen reports of nation 181 00:18:10.920 --> 00:18:18.480 state apts like China related Camaro Dragon that we published a research about and the 182 00:18:18.559 --> 00:18:23.920 Russian affiliated Shockworm, which were also reported to utilize the USB drives for infections, 183 00:18:23.960 --> 00:18:30.200 so again, take care beware. At the beginning of the episode, 184 00:18:30.400 --> 00:18:34.240 you mentioned that the report covers shifting infection vectors, So what's going on in 185 00:18:34.279 --> 00:18:41.359 that realm? We've measured a significant decline in the use of office files for 186 00:18:41.480 --> 00:18:45.920 infection. This is due to Microsoft's restriction on Office macros, and we have 187 00:18:45.960 --> 00:18:52.359 a separate podcast chapter with Sam Handelman discussing this. But it's very clear from 188 00:18:52.400 --> 00:18:57.559 our current gateway data that this has changed the way threat actors act. We 189 00:18:57.599 --> 00:19:04.559 see rustick drop of eighty to ninety five percent in the malicious use of Excel 190 00:19:04.640 --> 00:19:11.079 files of different types, and instead we see previously seldom used attack factors like 191 00:19:11.160 --> 00:19:18.640 one note files which despite being click intensive meaning that they require multiple activation by 192 00:19:18.640 --> 00:19:23.519 the user, they have been used to distribute malwer like cuboat Agent, Tesla, 193 00:19:23.640 --> 00:19:33.119 redline and others. Anything else before we head off what else? We 194 00:19:33.200 --> 00:19:40.079 also see further use of various archives and container files, both password protected and 195 00:19:40.279 --> 00:19:47.279 not most popular Z files, which make up almost thirty percent of email attached 196 00:19:47.400 --> 00:19:52.119 archives and allow files, but also image and EASO files. We've also seen 197 00:19:52.160 --> 00:19:57.039 an increase of forty five percent of attached L and K files, and PDF 198 00:19:57.119 --> 00:20:02.839 files are on the rise, so threat actors like qboard and many others are 199 00:20:02.880 --> 00:20:10.200 still exploring alternative infection chains to replace the block ones. I think that is 200 00:20:10.240 --> 00:20:14.119 it for this review. There's much more in the full edition, and you're 201 00:20:14.480 --> 00:20:18.920 very invited to our web page. And that's it. Thank you, and 202 00:20:18.960 --> 00:20:25.480 I hope to see you next time. That's it for this episode. Thank 203 00:20:25.519 --> 00:20:30.640 you for listening to find this year's full media report. Visit Research dot checkpoint 204 00:20:30.759 --> 00:20:36.240 dot com, and if you click the CPR podcast channel in the top menu, 205 00:20:36.599 --> 00:20:41.039 you'll find all of our past episodes. Seepy Radio is produced by PI 206 00:20:41.200 --> 00:20:52.279 Media. Hilas Emish is our producer. See you next episode. Bye bye.