Threat Hunting Cyber Risks and Safeguarding Intellectual Property in High-Risk Locations

This blog was originally published on CyFIR.com and has been reposted as-is here following eSentire’s acquisition of CyFIR Inc. in June 2021. As of the date of the acquisition, no changes have been made to the content below.

WWT and CyFIR partner to conduct a Threat Hunting Assessment and remediation effort for a global company operating in China.

CASE STUDY IN PARTNERSHIP WITH

Recently, a global company operating in China enlisted WWT and CyFIR to perform a Threat Hunting Assessment of their network. Multiple reports suggested widespread theft of intellectual property (IP) among similar companies in the region. As a result, the company sought a trusted advisor who could evaluate activity on their network endpoints to assess their exposure to any threats or vulnerabilities. The company selected WWT and CyFIR because of their experience in conducting similar reviews of equivalent size and complexity.

WWT and CyFIR conducted a Threat Hunting Assessment across just under 100,000 endpoints located in China to evaluate potential risks for intellectual property loss.

Challenge

Theft of IP is a significant problem for many companies in China. IP theft often leads to the manufacturing and production of counterfeit products that are then sold at deep discounts compared to the original, legitimate products. Consequently, companies targeted for IP theft can experience a significant decline in revenue and profitability.

In this example, the company needed to quickly determine if their network contained any dormant threats or if their data had already been compromised and exfiltrated.

Solution

Globally, the company operated a network of just under 100,000 endpoints. WWT and CyFIR designed a Threat Hunting Assessment to focus on an agreed-upon sample of endpoints located within China.

Forensic investigators deployed agents to each endpoint and analyzed 100 percent of the processes running in the network to identify:

1. Any known malware.
2. Any unknown processes.
3. Any new processes that had never been seen before.

All unknown or new processes were subjected to additional scrutiny to determine if any malware or threat existed. WWT and CyFIR investigators performed a continuous monitoring function over a 30-day period to capture any dormant processes or processes running periodically that might pose a potential threat.

Outcome

In conducting the assessment, WWT and CyFIR identified multiple threats within the company’s network. Once identified, these threats were remediated. Investigators also discovered that data was actively being exfiltrated and subsequently determined where that data was sent. Investigators also went beyond the Threat Hunting Assessment and provided the customer with evidence of the deficiencies in their network that were the source of vulnerabilities to attack.

As a result of the engagement, all identified threats were remediated, and WWT and CyFIR continue to advise the company on additional measures to remediate the root cause that allowed the threats to enter the network in the first place. The company is now considering an expansion of the Threat Hunting Assessment to include endpoints in other regions as part of a global approach to risk management.