Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
MITRE ATT&CK Framework, Cybersecurity Assessment, SOC Calculator & more
eSentire will be a sponsor at the Seattle CyberSecurity Conference.
eSentire will be a Sponsor at the NetDiligence Cyber Risk Summit in…
eSentire will be presenting and is a Gold Sponsor at the CyberRisk…
A Russian-speaking hacker exposed their toolbox while attempting a ransomware intrusion at a U.S. Community College. The attacker unloaded an arsenal of hacker tools including:
Since the Phobos ransomware is bought, not borrowed, this threat actor was likely acting in isolation or as part of a small independent group. Some of the custom tools and the observation of Russian language in the code observed in the incident mirrored a previous report on an unknown ransomware operation.
The threat actor used two distinct systems: a Transfer Box and a C2 Box full of intrusion tools and, presumably, exfiltrated data. The attacker’s systems were open to the internet and were scanned by various open-source tools that reported open services and exposed directories. TRU leveraged these sources to understand attacker motivation and techniques.
The threat actor used a box containing several services for lateral movement via GUI-based applications such as Remote Desktop, VNC, and AnyDesk (Figure 1). They also had the 445 and 1139 exposed, likely for SMB-based ingress of tools and exfiltration of data.
The transfer box also had a directory structure with an exposed folder containing a long list of intrusion tools and exfiltrated network data (Figure 2, exfiltrated data removed). The presumed exfiltrated data was titled with IP addresses which pointed to a university in Argentina.
Port | Service |
22 | SSH |
1139 | NetBios |
445 | SMB |
3389 | RDP |
5901 | VNC |
7070 | AnyDesk |
Figure 1: Transfer box services
* [AirVPN_Belgium_UDP-443.ovpn](AirVPN_Belgium_UDP-443.ovpn)
* [AirVPN_Canada_UDP-443.ovpn](AirVPN_Canada_UDP-443.ovpn)
* [AirVPN_Latvia_UDP-443.ovpn](AirVPN_Latvia_UDP-443.ovpn)
* [AirVPN_Norway_UDP-443.ovpn](AirVPN_Norway_UDP-443.ovpn)
* [any.exe](any.exe)
* [APS.exe](APS.exe)
* [CobaltStrike MANUAL_V2 .rar](CobaltStrike%20MANUAL_V2%20.rar)
* [CS Inst.txt](CS%20Inst.txt)
* [DefenderControl 2.exe](DefenderControl%202.exe)
* [disable-defender.exe](disable-defender.exe)
* [Everything.exe](Everything.exe)
* [Fast.ex_](Fast.ex_)
* [Fast.ex__](Fast.ex__)
* [gost-windows-amd64-2.11.2.zip](gost-windows-amd64-2.11.2.zip)
* [Handover.xlsx](Handover.xlsx)
[[email protected][email protected]_Sec_220704_085638.pdf](Instant_Netcat_Starter_%40C2Book_News_%40Library_Sec_220704_085638.pdf)
* [johnsuppttt987_2022-06-22_03-10.zip](johnsuppttt987_2022-06-22_03-10.zip)
* [mi.7z](mi.7z)
* [MindCert-Netcat-MindMap @Library_Sec_220704_085750.pdf](MindCert-Netcat-MindMap%20%40Library_Sec_220704_085750.pdf)
* [nc.exe](nc.exe)
* [nc.exe-master.zip](nc.exe-master.zip)
* [nc64.exe](nc64.exe)
* [netscan.exe](netscan.exe)
* [NTLM.txt](NTLM.txt)
* [OpenSSH_8.6x64 (2).exe](OpenSSH_8.6x64%20%282%29.exe)
* [OpenSSH_8.6x64.exe](OpenSSH_8.6x64.exe)
* [OpenSSH_8.6x86 (2).exe](OpenSSH_8.6x86%20%282%29.exe)
* [OpenSSH_8.6x86.exe](OpenSSH_8.6x86.exe)
* [plink.exe](plink.exe)
* [PowerTool_64.exe](PowerTool_64.exe)
* [Process Hacker 3.0.exe](Process%20Hacker%203.0.exe)
* [prochack.exe](prochack.exe)
* [prochack3/](prochack3/)
* [PROXI new (2).txt](PROXI%20new%20%282%29.txt)
* [PROXI new.txt](PROXI%20new.txt)
* [Result.xml](Result.xml)
* [RTCleaner+.bat](RTCleaner%2B.bat)
* [scan арабы.xml](scan%20%D0%B0%D1%80%D0%B0%D0%B1%D1%8B.xml)
* [scan2.xml](scan2.xml)
* [Servers_IP_summary_with passwords.xlsx](Servers_IP_summary_with%20passwords.xlsx)
* [setup_undefined.msi](setup_undefined.msi)
* [Shadow.bat](Shadow.bat)
* [skr 1.png](skr%201.png)
* [skr 2.png](skr%202.png)
* [ssh_tunnel.bat](ssh_tunnel.bat)
* [tai mis.xml](tai%20mis.xml)
* [tai.xml](tai.xml)
* [uninstallSophos.bat](uninstallSophos.bat)
* [unlocker-setup.exe](unlocker-setup.exe)
Figure 2: Transfer box used by the attacker had a library of intrusion tools and exfiltrated data (removed).
The threat actor used a C2 Box for maintaining a web shell to the community college´s network. The C2 Box was also a Cobalt Strike server. However, the attacker didn’t leverage Cobalt Strike’s Beacon in the attack against the community college. Interestingly, the infrastructure existed on a range known to be managed by bulletproof hosting provider that appears to still be active on hacker forums. (Figure 3).
Some tools in the exposed toolbox and the code (Figure 4) in some of the deployed tools are in Cyrillic, which Slavic-speaking members of TRU identify as the Russian language and validated through Google Translate. A few tools overlap with tools observed in an incident reported by Security Joes.
Information stealers deployed by the threat actor had some interesting targets including crypto-wallets, PokerStars, Ebay, Neteller, and Skrill. In addition to the deployment of ransomware, these targets point to financially motivated cybercrime.
Our Threat Response Unit (TRU) combines threat intelligence obtained from research and security incidents to create practical outcomes for our customers:
Our detection content is supported by investigation runbooks, ensuring our SOC (Security Operations Center) analysts respond rapidly to any intrusion attempts related to known malware Tactics, Techniques, and Procedures. In addition, TRU closely monitors the threat landscape and constantly addresses capability gaps and conducts retroactive threat hunts to assess customer impact.
As the adversarial TTPs grow in sophistication, they lead to a certain level of difficulties at which critical business decisions must be made. Preventing the various attack paths utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.
Initial Access for ransomware operations is typically achieved using valid VPN and Active Directory (AD) user credentials, which are stolen using phishing emails, infostealer malware, social engineering tactics, and remote exploitation. Social engineering may occur through phishing and business email compromise (BEC) attempts and SEO poisoning. Remote exploitation occurs on the organizations’ Internet-facing systems when those systems are vulnerable. To increase your cyber resilience against Initial Access attempts, we recommend:
It’s important to understand that you can’t assume that every Initial Access vector can be stopped. Given sufficient time and size of organization, some fraction of employees will inevitably download and execute malware and give their credentials to phishing campaigns, resulting in threat actors gaining access and moving laterally across your environment. Some administrators will miss a patch or misconfiguration because there can be many patches to prioritize at different times in the year as the cybercrime seasons change. Therefore, we recommend:
Impact happens when the ransomware operation is successful. There are various levels and markers of success, from exfiltration to disrupting business directly through ransomware. Therefore, we recommend:
eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.
If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.
Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.
Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our Atlas XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen.