Top 10 cyber-weapons; weaponised IT the preferred attack vehicle once inside

The Cyber Weapons Report 2016 from LightCyber Inc issued today catalogues the top ten weapons used in various categories of cyber-attack, however its main thrust is that once an attacker is on your system, they rarely use malware and what you need to monitor is anomalous behaviour using legitimate tools.

In fact the report says that 99 percent of internal, east-west reconnaissance and lateral movement in the sample covered did not originate from malware, but from legitimate applications or from riskware such as scanners.

“No one is saying unplug the firewall or ditch anti-virus – it works, but not 100 percent,” David Thompson, LightCyber's senior director of product management, told SCMagazineUK.com. He added: “90 percent of [monitoring] reports suggested that once people get into the network these [malware] tools stop – it's weaponised IT.”

As well as seeing a lot of attack activity using legitimate tools, the research showed that half is reconnaissance activity, when the attackers need to be very active to get to their target. Command and control activity and lateral movement were both just under 20 percent, with exfiltration just under five percent of activity. In contrast, malware activity, the focus of industry attention, accounted for just 7.5 percent of activity once the intruder was inside. Of course it is true that by stopping malware from facilitating entry, the level of intruder activity is greatly diminished.

As a result, Thompson says, “Organisations need to build their ‘detect and response' capability - how to investigate previously undetected anomalies, and what to do when they find them. It needs both network traffic analysis and user behaviour analysis – combining [activity seen] with people and processes.”

It's not enough to detect the tools used, but users must spot the anomalous behaviours they are used to create, allowing organisations to block each stage of an attack and make sure that if one safeguard fails, another one can prevent a costly breach.

Thompson notes that the sort of activity to look for includes “large port scans, high failure rates in connections, and large numbers of folders in file sharing”.

But he adds that reconnaissance activity can be hard to look for without being overwhelmed with alarms as many apps allow a lot of automatic searching for peers and are “very chatty – so you need to see what's installed where”.

Of 1,109 unique tools used during attacks monitored, the majority were not malicious.

The ten most popular networking and hacking tools were:

While primarily used for lateral movement, admin tools are also associated with data exfiltration. The ten most popular admin tools used were:

Attackers also use remote desktop programs to gain access to new hosts, to move laterally, or to remotely control compromised devices. TeamViewer topped the list of the most common remote desktop tools in the study, along with Ammyy Adminn and LogMeIn, to control computers from outside the network because they broker connections through their service — basically command and control. Others, like VNC and Remote Desktop Connection, are used within the LAN for lateral movement.  The ten most popular desktop programs used were:

Organisations are advised to monitor all remote desktop connections and enforce strong authentication to prevent unauthorised computer access. Correlating remote desktop access with other anomalies, such as data exfiltration and command and control activity, can help zero in on advanced attacks.

Attackers can use malware at any stage of the attack process - to exploit the initial host, or turned on after they are entrenched in the network and have established control. The report shows that most malware activity was detected in early phases of the attack lifecycle, such as command and control communications between clients and destinations on the Internet. Some 28 percent of suspicious processes associated with alerts were either malware or riskware.

An interesting finding was that more than 70 percent of active malware detected was detected ONLY on a single site, indicating the increased prevalence of targeted malware as well as polymorphic malware to completely bypass signature-based prevention. “Even though it was only a small sample (60 installations) it did indicate the ease with which attackers can re-configure and create new malware,” comments Thompson. The top ten malware programs found were:

Methodology

Meta data for this report was gathered from LightCyber's global customer base using the LightCyber Magna Behavioral Attack Detection platform. The Report concentrates on the malware that bypassed preventative controls and successfully compromised clients, and the tools attackers use once inside the network. It encompasses attack activity detected across hundreds of thousands of endpoints from more than 60 sites during a six-month period ending in June 2016. Sample organisations ranged in size from 1,000 to 50,000.  The threats described in the report were identified by deep packet inspection (DPI) of network traffic for behavioural anomalies.