Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports & papers.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
Episodes on cybersecurity strategy and threat intel.
Join eSentire’s half-day Cybersecurity Insights Summit to hear from a…
eSentire will be speaking and exhibiting at CIO Arena.
eSentire will be speaking at Advocate's Insider Summit.
THE THREAT
Ransomware threat groups are actively abusing known exploits and compromised accounts to obtain access to environments via remote access services such as VPN and RDP. eSentire has observed this activity in recent incidents involving Revil (Sodinokibi), SunCrypt, and Netwalker ransomware. Reports from CISA and the FBI confirm that remote access services, especially VPN, are being actively targeted by multiple threat groups, including Nation States [1][2].
eSentire recommends organizations protect accounts with Multi-Factor Authentication (MFA) and ensure externally facing services are prioritized for patching.
What we’re doing about it
What you should do about it
Additional information
Analysis of incidents detected by eSentire’s Security Operations Center shows use of compromised accounts and exploitation of externally facing systems as initial access methods for multiple ransomware threats. Known vulnerabilities and absence of MFA on remote access services played a significant part in these attacks.
Private and government entities such as Microsoft and Cybersecurity and Infrastructure Security Agency (CISA) have all made similar observations across several ransomware and APT groups [3].
Accessing VPN Using Compromised Accounts:
Vulnerabilities Actively Exploited by Ransomware Threats:
Additional Observations
Relationships with Commodity Malware
Multiple malware families are linked to ransomware groups. Malware such as Quakbot, Trickbot, Dridex and Emotet are known to install ransomware as part of post-compromise operations. In a recent incident, eSentire observed interactive operators arrive on the compromised asset within one hour of initial infection. Positive identification of these malware types should be treated as precursor activity to ransomware and prioritized accordingly.
Zerologon Vulnerability
The risk of ransomware deployment has increased due to the release of CVE-2020-1472, its associated technical details, and Proof of Concept (PoC) exploit code. This vulnerability affects Windows servers and could be used to escalate attacker privileges and rapidly deploy ransomware. eSentire released an advisory on CVE-2020-1472 on September 14, 2020 [4].
Password attacks and eSentire’s detection methods are discussed at length in the September Customer Connect Webinar [5].
References:
[2] https://us-cert.cisa.gov/ncas/alerts/aa20-259a
[4] https://www.esentire.com/security-advisories/cve-2020-1472-technical-details-released
[5] https://www.esentire.com/resources/library/september-2020-threat-intelligence-observations-on-demand