The attackers behind Maikspy have changed domains and IP addresses over the years, but all were found hosted in a publicly traded internet domain registrar and web hosting company in the U.S.


The following figures show how Maikspy variants from 2016 to 2018 are connected to C&C servers (found in this appendix, along with the Android and Windows hashes) used by the attackers:  Figure 20.


The connection of Maikspy variants to 198[.]12[.]155[.]84, hxxp://roundyearfun[.]org/, and 192[.]169[.]217[.]55.


Note: The green nodes represent Android samples, while the blue nodes represent Windows samples.


Figure 21. Connection of Maikspy variants to 107[.]180[.]46[.]243 and hxxp://fakeomegle[.]com  Figure 22. Connection of Maikspy variants to 198[.]12[.]149[.]13and hxxp://miakhalifagame[.]com/


Countermeasures


Downloading only from legitimate app stores like Google Play can prevent Maikspy from compromising computers and mobile devices.


It is also important to be aware of what apps are allowed to access, and to understand the risks before accepting any terms or granting certain permissions to apps.


Trend Micro’s Mobile App Reputation Service (MARS) already covers Android and iOS threats using leading sandbox and machine learning technology.


It can protect users against malware, zero-day and known exploits, privacy leaks, and application vulnerability.


End users and enterprises can also benefit from multilayered mobile security solutions such as Trend Micro™ Mobile Security for Android™ which is also available on Google Play.


For organizations, Trend Micro™ Mobile Security for Enterprise provides device, compliance and application management, data protection, and configuration provisioning, as well as protects devices from attacks that leverage vulnerabilities, preventing unauthorized access to apps, as well as detecting and blocking malware and fraudulent websites.


The Trend Micro™ Deep Discovery™ threat protection platform enables companies to detect, analyze, and respond to modern threats such as sophisticated malware, targeted attacks, and APTs.


Trend Micro™ Smart Protection for Endpoints with Maximum XGen™ security infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across user activity and any endpoint—the broadest possible protection against advanced attacks.        Tags  APT & Targeted Attacks | Endpoints | Research | Mobile | Articles, News, Reports | Network


Real enterprises are messy places.


One messy reality is that enterprises don’t manage all their endpoints.


A smart colleague turned me onto using the % of endpoints and servers managed as a prime security metric.


On one end of the spectrum are places like universities that maybe manage 10% of the endpoints on their network.


On the other end are places like some large banking and R&D companies that can manage about 98 or 99%.


A financial services company that was spending millions of dollars on getting from 96% to achieving 98%, using the very good reasoning that they were “cutting their biggest security problem in half” rather than “2%, meh.” So even the very best enterprises can have unmanaged endpoints that can be more easily exploited than ones with a security agent deployed on them.


A lot of the advanced security we’ve been delivering on the last few years has been focused on this problem.


EDR is an example of how stealthy or evasive attackers can be better uncovered than with traditional endpoint protection.


EDR is great for endpoints they are on.


Ian Loe of NTUC gives a killer example of uncovering stealthy attacks using EDR and MDR here.


But most of EDR’s capabilities are for endpoints they are on: ones they manage.


Sure there’s some herd-immunity with EDR that the greater number of managed endpoints the harder it is for an attacker to move laterally or deeper.


But more capable, patient, and stealthy attackers are getting better at being evasive, knowing that EDR may be or is deployed.


Mark Nunnikhoven does a great job in this post talking about lateral movement.


EDR can only go so far on its own to help spot attacks that are exceptionally low and slow, and/or using unmanaged endpoints.


Endpoint security needs to step outside the endpoint silo to keep step with advanced attackers.


An attack using many hops could see movement between managed endpoints, IoT, email, network components, containers and cloud-based servers over the course of many months.


The delivery and reconnaissance could involve multiple protocols, emails, payloads, files, and credentials.


Pulling together the tenuous and ephemeral threads of such an intentional attack needs more modern tools, rather than hoping we stumble on a supply of highly advanced threat hunters.


Pulling together deep security information from across your enterprise is what is needed to face off against such advanced and intentionally evasive attacks.


XDR is intended to be that security data lake of deeper enterprise infrastructure and security information than we’ve previously gathered in a single addressable pool and designed to be useful for threat hunters and analysts.


In these posts here and here we talk about what XDR is and how it brings in more sources, such as network data.


In the game of measure-countermeasure that is cybersecurity today and tomorrow, XDR is the next evolutionary step in dealing with more evasive threats.


Malicious actors, once in an organization’s network, will need to move beyond their initial infection location to other parts of the network, seeking out areas that hold the data or critical systems they wish to utilize.


Whether that is the data center, an OT network, or finding critical business systems to support their criminal or destructive intent.


There are a number of ways lateral movement is performed, but the key is to hide and remove evidence of their presence.


Initially they will look to scan the internal network using similar scanning tools used by admins to identify what systems are available to them.


Hacking tools and keyloggers will be used to steal user accounts and passwords to obtain legitimate user credentials within systems.


More tools will typically be downloaded using the command & control infrastructure to help with their attack.


After obtaining more powerful user accounts, the attacker can laterally move to other systems and use “normal” tools to perform other activities.


These activities may be difficult to identify for defenders due to the use of these things like:     PSEXEC to execute a program from remote system Schedule a remote task to execute back door or malicious code RDP or net use to connect to other hosts


Leverage WMI for fileless intrusion Execute Powershell script for fileless intrusion


Utilize exploits targeting unpatched systems for known vulnerabilities Execute normal tool like Bitlocker, to encrypt customer data like ransomware did.


But normal tools will not detect by antivirus system.


This is where adding network intelligence to an XDR and correlating with other intelligence from different areas of the network can be most beneficial.


An XDR that supports advanced detection capabilities can identify correlate data across areas to identify events that would otherwise go unnoticed.


Additionally, in many attacks the malicious actors are removing their tracks once finished with that area, so having the ability to capture and keep intelligence can help with root cause analysis and correlate the different disparate components of an attack.


This correlation allows an organization to put the pieces of the attack puzzle together to see the full picture.


Some recent RYUK ransomware attacks are a good example.


In these attacks, attackers utilized the Eternal Blue exploit and harvested credentials as they moved across the environment, and then used existing system tools to kill security services within machines to hide their presence.


In both cases the intelligence coming from endpoints, servers, and the network allowed researchers to identify the attack chain and all the components used within the attack.


Most attacks today, including ransomware, are utilizing lateral movement.


Including detection of this as part of an overall XDR platform will improve the prevention, detection, and remediation of sophisticated attacks on an organization.


Stay tuned for more upcoming blogs on how XDR will help improve our overall security strategy moving forward.


Tags  Cloud | APT & Targeted Attacks | Cyber Crime | Expert Perspective | Cyber Threats