Speaker 1: Hackers that use siteeca, GC two and adaptics in an
Speaker 1: espionage style intrusion against an Asian financial institution. FOG ransomware
Speaker 1: hackers known for targeting US educational institutions are now using
Speaker 1: legitimate employee monitoring software siteeca and several open source pen
Speaker 1: testing tools alongside usual encryption. In a May five attack
Speaker 1: on a unnamed financial institution in Asia, Symantec researcher spotted
Speaker 1: hackers using siteteca and several pen testers, including GC two
Speaker 1: in adaptics. The behavioral they found highly unusual in a
Speaker 1: ransomware attack chain. Reflecting on the shift in FOG's attacks,
Speaker 1: bug crowd SISO triy Ford said we should expect the
Speaker 1: use of ordinary and legitimate corporate software as the norm.
Speaker 1: We referred to this as living off the land. Why
Speaker 1: would an attacker introduce new software, create more noise and
Speaker 1: logs and increase the likelihood detection when the liable software
Speaker 1: gets the job done for them well, Simantech identify the
Speaker 1: initial infection vector using the attack. FOG ransomware actors have
Speaker 1: used critical vulnerabilities in the past. Syteca was likely used
Speaker 1: as a stealer. Researchers found attackers using stowaway, the open
Speaker 1: source proxy tool designed for secure communication between internal and
Speaker 1: external networks. It is not known how the attackers use
Speaker 1: the setecha tool during the intrusion, which was distributed as
Speaker 1: files under the names like Syteca client dotxe. Still, they
Speaker 1: have very serial potential of an employee monitoring tool with
Speaker 1: screen recording, a keystroke logging capabilities isn't too hard to guess.
Speaker 1: Several libraries are loaded by this executable, suggesting it was
Speaker 1: possibly used for information stealing or spying. The real danger
Speaker 1: in this case isn't the ransom note, it's how fog
Speaker 1: turns a simple screen record into a hidden camera. Software
Speaker 1: is an essential driver of growth and innovation for every company. However,
Speaker 1: business apps we install an autopilot can suddenly become spy tools.
Speaker 1: Security team, you should keep a live map, but where
Speaker 1: every monitoring app is allowed to run and flag it
Speaker 1: the one moment it pops up somewhere odd. In addition,
Speaker 1: another peculiarly observed in the attack was the use of
Speaker 1: open source penetration testing tools like GCT and adaptics, rarely
Speaker 1: seen with ransomware attacks. Google Command and Controls GC two
Speaker 1: is an open source post exploitation tool that allows attackers
Speaker 1: to control compromise systems using legitimate cloud services like Google
Speaker 1: Sheets and Google Drive. The GC two implant alone potentially
Speaker 1: allowed attackers to run discovery commands, transfer files, and load
Speaker 1: shell code, hitting a deeper intelligence gathering objectives. Unlike typical
Speaker 1: ransomware actors that exit post encryption, the FOG group was
Speaker 1: seen establishing persistence even days after deploying the ransomware and
Speaker 1: move more common and espionage operations. The attackers establishing persistence
Speaker 1: on a victim network having deployed the ransomware is also
Speaker 1: not something they would typically see in a ransom ware attack.
Speaker 1: And that's your update for now in regards to Fogg
Speaker 1: and get the rest of the article if you want
Speaker 1: from c s o O CSO online dot com for
Speaker 1: the whole article. That's it for now