Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Visibility and response across your entire Microsoft security ecosystem.
XDR with Machine Learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert threat hunting, original research, and proactive threat intelligence.
TRU is foundational to our MDR service. No add-ons or additional costs required.
Stop ransomware attacks before they disrupt your business.
Detect and respond to zero-day exploits.
Protect against third-party and supply chain risk.
Adopt a risk-based approach to cybersecurity.
Protect your most sensitive data.
Meet cybersecurity regulatory compliance mandates.
Eliminate misconfigurations and policy violations.
Prevent business disruption by outsourcing MDR.
Meet insurability requirements with MDR.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and mediating threats to prevent lateral spread.
Enhance investigation and threat detection across multi-cloud or hybrid environments.
Remediate critical misconfigurations, security vulnerabilities and policy violations across cloud and containerized environments.
Detect malicious insider and identity-based behavior leveraging machine learning models.
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company's mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
A Russian-speaking hacker exposed their toolbox while attempting a ransomware intrusion at a U.S. Community College. The attacker unloaded an arsenal of hacker tools including:
Since the Phobos ransomware is bought, not borrowed, this threat actor was likely acting in isolation or as part of a small independent group. Some of the custom tools and the observation of Russian language in the code observed in the incident mirrored a previous report on an unknown ransomware operation.
The threat actor used two distinct systems: a Transfer Box and a C2 Box full of intrusion tools and, presumably, exfiltrated data. The attacker’s systems were open to the internet and were scanned by various open-source tools that reported open services and exposed directories. TRU leveraged these sources to understand attacker motivation and techniques.
The threat actor used a box containing several services for lateral movement via GUI-based applications such as Remote Desktop, VNC, and AnyDesk (Figure 1). They also had the 445 and 1139 exposed, likely for SMB-based ingress of tools and exfiltration of data.
The transfer box also had a directory structure with an exposed folder containing a long list of intrusion tools and exfiltrated network data (Figure 2, exfiltrated data removed). The presumed exfiltrated data was titled with IP addresses which pointed to a university in Argentina.
Port | Service |
22 | SSH |
1139 | NetBios |
445 | SMB |
3389 | RDP |
5901 | VNC |
7070 | AnyDesk |
Figure 1: Transfer box services
* [AirVPN_Belgium_UDP-443.ovpn](AirVPN_Belgium_UDP-443.ovpn)
* [AirVPN_Canada_UDP-443.ovpn](AirVPN_Canada_UDP-443.ovpn)
* [AirVPN_Latvia_UDP-443.ovpn](AirVPN_Latvia_UDP-443.ovpn)
* [AirVPN_Norway_UDP-443.ovpn](AirVPN_Norway_UDP-443.ovpn)
* [any.exe](any.exe)
* [APS.exe](APS.exe)
* [CobaltStrike MANUAL_V2 .rar](CobaltStrike%20MANUAL_V2%20.rar)
* [CS Inst.txt](CS%20Inst.txt)
* [DefenderControl 2.exe](DefenderControl%202.exe)
* [disable-defender.exe](disable-defender.exe)
* [Everything.exe](Everything.exe)
* [Fast.ex_](Fast.ex_)
* [Fast.ex__](Fast.ex__)
* [gost-windows-amd64-2.11.2.zip](gost-windows-amd64-2.11.2.zip)
* [Handover.xlsx](Handover.xlsx)
[Instant_Netcat_Starter_@C2Book_News_@Library_Sec_220704_085638.pdf](Instant_Netcat_Starter_%40C2Book_News_%40Library_Sec_220704_085638.pdf)
* [johnsuppttt987_2022-06-22_03-10.zip](johnsuppttt987_2022-06-22_03-10.zip)
* [mi.7z](mi.7z)
* [MindCert-Netcat-MindMap @Library_Sec_220704_085750.pdf](MindCert-Netcat-MindMap%20%40Library_Sec_220704_085750.pdf)
* [nc.exe](nc.exe)
* [nc.exe-master.zip](nc.exe-master.zip)
* [nc64.exe](nc64.exe)
* [netscan.exe](netscan.exe)
* [NTLM.txt](NTLM.txt)
* [OpenSSH_8.6x64 (2).exe](OpenSSH_8.6x64%20%282%29.exe)
* [OpenSSH_8.6x64.exe](OpenSSH_8.6x64.exe)
* [OpenSSH_8.6x86 (2).exe](OpenSSH_8.6x86%20%282%29.exe)
* [OpenSSH_8.6x86.exe](OpenSSH_8.6x86.exe)
* [plink.exe](plink.exe)
* [PowerTool_64.exe](PowerTool_64.exe)
* [Process Hacker 3.0.exe](Process%20Hacker%203.0.exe)
* [prochack.exe](prochack.exe)
* [prochack3/](prochack3/)
* [PROXI new (2).txt](PROXI%20new%20%282%29.txt)
* [PROXI new.txt](PROXI%20new.txt)
* [Result.xml](Result.xml)
* [RTCleaner+.bat](RTCleaner%2B.bat)
* [scan арабы.xml](scan%20%D0%B0%D1%80%D0%B0%D0%B1%D1%8B.xml)
* [scan2.xml](scan2.xml)
* [Servers_IP_summary_with passwords.xlsx](Servers_IP_summary_with%20passwords.xlsx)
* [setup_undefined.msi](setup_undefined.msi)
* [Shadow.bat](Shadow.bat)
* [skr 1.png](skr%201.png)
* [skr 2.png](skr%202.png)
* [ssh_tunnel.bat](ssh_tunnel.bat)
* [tai mis.xml](tai%20mis.xml)
* [tai.xml](tai.xml)
* [uninstallSophos.bat](uninstallSophos.bat)
* [unlocker-setup.exe](unlocker-setup.exe)
Figure 2: Transfer box used by the attacker had a library of intrusion tools and exfiltrated data (removed).
The threat actor used a C2 Box for maintaining a web shell to the community college´s network. The C2 Box was also a Cobalt Strike server. However, the attacker didn’t leverage Cobalt Strike’s Beacon in the attack against the community college. Interestingly, the infrastructure existed on a range known to be managed by bulletproof hosting provider that appears to still be active on hacker forums. (Figure 3).
Some tools in the exposed toolbox and the code (Figure 4) in some of the deployed tools are in Cyrillic, which Slavic-speaking members of TRU identify as the Russian language and validated through Google Translate. A few tools overlap with tools observed in an incident reported by Security Joes.
Information stealers deployed by the threat actor had some interesting targets including crypto-wallets, PokerStars, Ebay, Neteller, and Skrill. In addition to the deployment of ransomware, these targets point to financially motivated cybercrime.
Our Threat Response Unit (TRU) combines threat intelligence obtained from research and security incidents to create practical outcomes for our customers:
Our detection content is supported by investigation runbooks, ensuring our SOC (Security Operations Center) analysts respond rapidly to any intrusion attempts related to known malware Tactics, Techniques, and Procedures. In addition, TRU closely monitors the threat landscape and constantly addresses capability gaps and conducts retroactive threat hunts to assess customer impact.
As the adversarial TTPs grow in sophistication, they lead to a certain level of difficulties at which critical business decisions must be made. Preventing the various attack paths utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.
Initial Access for ransomware operations is typically achieved using valid VPN and Active Directory (AD) user credentials, which are stolen using phishing emails, infostealer malware, social engineering tactics, and remote exploitation. Social engineering may occur through phishing and business email compromise (BEC) attempts and SEO poisoning. Remote exploitation occurs on the organizations’ Internet-facing systems when those systems are vulnerable. To increase your cyber resilience against Initial Access attempts, we recommend:
It’s important to understand that you can’t assume that every Initial Access vector can be stopped. Given sufficient time and size of organization, some fraction of employees will inevitably download and execute malware and give their credentials to phishing campaigns, resulting in threat actors gaining access and moving laterally across your environment. Some administrators will miss a patch or misconfiguration because there can be many patches to prioritize at different times in the year as the cybercrime seasons change. Therefore, we recommend:
Impact happens when the ransomware operation is successful. There are various levels and markers of success, from exfiltration to disrupting business directly through ransomware. Therefore, we recommend:
eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.
If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.
Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.