CYPHERLOCK, INC.

In the fast-paced realm of cybersecurity, organizations face escalating challenges from new and sophisticated threats. These threats, defined by their innovative and complex nature, frequently exploit emerging vulnerabilities and advanced technologies, complicating efforts to anticipate and counteract them.

As cybercriminals continuously refine their tactics, it’s crucial for businesses to remain vigilant and proactive in safeguarding their resources. One crucial asset in this defense is the Threat Intelligence (TI) Lookup service offered by ANY.RUN, which delivers essential insights into these evolving threats.

The Distinctiveness of Emerging Threats

Emerging threats are distinct from ongoing threats in several notable ways:

• Innovative Approaches: These threats utilize previously unseen methods and tools.
• Ongoing Adaptation: Attackers perpetually enhance their techniques to avoid detection.
• Inherent Unpredictability: The unpredictable nature of these threats makes them particularly hard to defend against.
• Severe Consequences: They can result in significant financial and reputational damage.

The Necessity of Monitoring Emerging Threats

Organizations often struggle with emerging threats due to limited awareness, resources, or expertise. Such threats can disrupt operations, lead to data breaches, and damage customer trust. Keeping up-to-date with these threats and taking proactive steps is crucial for protecting organizational assets.

How Threat Intelligence Lookup Can Help

ANY.RUN’s Threat Intelligence Lookup is an invaluable resource for organizations aiming to stay ahead of emerging threats. Supported by a global network of 400,000 security professionals, the service offers access to an extensive database of indicators of compromise (IOCs) and other critical threat data. Users can explore this data through various search parameters to uncover information about malware and phishing threats.

Features of TI Lookup:

• Extensive Search Capability: Users can sift through 2TB of up-to-date threat data using over 40 different search parameters.
• Rapid Results: Each query returns swift results accompanied by relevant sandbox sessions.
• YARA Search Integration: A built-in rule editor allows for precise searches using custom YARA rules.
• API Integration: TI Lookup integrates smoothly with existing security systems for streamlined operation.

Examples of Emerging Threats and Investigative Approaches

1. New Phishing Schemes

Cybercriminals constantly innovate phishing strategies, sometimes leveraging legitimate services for deception. For instance, a recent attack used Amazon Simple Email Service (SES) accounts to spread phishing emails.

Example: SES Accounts Exploited by Tycoon 2FA Phish-kit

ANY.RUN researchers detected a phishing scheme that used compromised Amazon SES accounts to distribute phishing emails. TI Lookup enables security teams to analyze such schemes by providing data on associated domains, IPs, and files.

2. New Malware Variants

Newly discovered malware strains, such as DeerStealer, pose substantial risks. These variants often employ sophisticated evasion techniques. TI Lookup assists in gathering detailed information on these threats using YARA Search, which provides in-depth sandbox reports for further analysis.

Example: DeerStealer Malware

In July 2024, ANY.RUN identified a new malware family named DeerStealer, which was distributed via a phishing campaign imitating the Google Authenticator website. TI Lookup facilitates the investigation of DeerStealer samples through YARA Search, enabling precise identification based on content.

3. Updated Tactics, Techniques, and Procedures (TTPs)

Attackers frequently adjust their tactics to exploit vulnerabilities and evade detection. For example, the updated version of HijackLoader includes a User Account Control (UAC) bypass. TI Lookup can track such updates using queries based on the MITRE ATT&CK framework.

Example: New HijackLoader Version

Earlier in 2024, HijackLoader was updated to include a UAC bypass (TT1548.002), allowing it to circumvent Windows security controls. To find samples of this updated version, you can use the following TI Lookup query: MITRE:”T1548.002″ AND threatName:”hijackloader”.

4. Exploitation of Global Events

Cybercriminals often take advantage of major global events to launch attacks. During the CrowdStrike outage, attackers launched phishing campaigns to exploit the confusion. TI Lookup was instrumental in identifying malicious domains mimicking official sites, aiding in the investigation.

Example: CrowdStrike Incident

ANY.RUN analysts quickly identified threats exploiting a recent CrowdStrike incident, with TI Lookup playing a crucial role. A search query (domainName:”crowdstrike” AND threatLevel:”malicious”) detected domains that mimicked the official CrowdStrike domain.

Additional Investigation Techniques with TI Lookup

• Assess Suspicious Connections: Quickly evaluate the threat level of suspicious IP addresses.
• Enhance C2 Infrastructure Intelligence: Stay updated on changes in command and control infrastructure used by attackers.
• Identify Malicious Network Activity: Utilize Suricata IDS rules to detect and analyze network threats.
• Explore Regional Threats: Investigate threats specific to certain regions based on local submissions.

Effective threat investigation relies on comprehensive intelligence. ANY.RUN’s TI Lookup offers a wealth of data, enabling organizations to better understand and mitigate emerging threats. Leveraging this tool enhances cybersecurity measures and ensures the protection of systems and data.

About ANY.RUN

ANY.RUN supports a global community of over 400,000 cybersecurity experts with its interactive sandbox and threat intelligence solutions, including TI Lookup, YARA Search, and Feeds. These tools empower organizations to respond swiftly to incidents and stay informed about emerging threats.