Shifting Cyber Defense Toward a Comprehensive Approach Based on Endpoint Protection and Prevention Strategies, According to CISA
Ransomware and advanced cyberattacks continue to pose a significant threat to national security, with attackers employing a range of sophisticated techniques to evade detection and response systems. In this article, we delve into the most common evasion techniques used by these threat actors, and how Endpoint Privilege Management (EPM) can bolster defenses against these threats.
Evasion Techniques Used by Ransomware and Advanced Cyberattack Threat Actors
The tactics employed by these threat actors are diverse and constantly evolving. Some of the common evasion techniques include:
- Exfiltration of data: Threat actors often opt for data exfiltration as a primary extortion method, using stolen data as leverage for ransom demands.
- Lateral movement: Attackers move laterally within networks using native protocols (RDP, SSH) and tools like PSExec to escalate privileges and evade detection.
- Use of EDR killers: Malware designed to terminate or disable antivirus and Endpoint Detection and Response (EDR) software is a common tactic. These EDR killers often operate at the kernel level, using compromised certificates to bypass security controls.
- Masquerading and invalid code signing: Threat actors often appear as legitimate software, subverting trust controls and avoiding detection.
- Sandbox and virtualization evasion: Techniques to detect and avoid analysis environments make malware harder to analyze and detect.
- Hiding artifacts: Malicious components are concealed by hiding files and directories.
- Customized command-and-control implants: These implants blend in with legitimate traffic, supporting stealthy persistence, remote access, and control.
- Deleting backups or shadow copies: This prevents recovery and increases pressure on victims.
- Deployment of additional malware payloads: Multiple endpoints are targeted to expand control and impact.
- Targeted social engineering and personalized phishing: AI-driven campaigns are used to trick users and bypass detection.
The Role of Endpoint Privilege Management (EPM)
Endpoint Privilege Management (EPM) is a critical layer in defense-in-depth strategies to mitigate ransomware threats. EPM helps boost endpoint resiliency against these threats by:
- Minimizing the attack surface through strict enforcement of least privilege, ensuring users and processes operate with only the permissions necessary to perform their tasks.
- Preventing unauthorized installation or execution of malicious code by blocking elevated privileges unless explicitly approved.
- Controlling application behavior and access to critical system resources, making masquerading and code signing bypass more difficult.
- Enabling rapid containment by restricting privilege escalation and limiting attacker movement within endpoints and networks.
- Supporting better visibility and auditing around privilege use, which helps detect suspicious privilege abuse attempts early and aids incident response.
By implementing EPM, organizations can significantly reduce the opportunities for threat actors to escalate privileges, evade detection, and cause widespread damage on endpoints.
Recent Developments
In 2024, the Dark Angels ransomware group received the largest ransomware payment ever, approximately $75 million. The use of EDR killers, a type of advanced malware, continues to be a concerning trend, with threat actors employing these tools to evade, disable, and manipulate EDR systems.
In conclusion, the landscape of ransomware and advanced cyberattacks is complex and dynamic. However, by understanding the common evasion techniques and implementing robust defense strategies like EPM, organizations can better protect themselves against these threats and ensure the security of their critical infrastructure.
- The federal workforce, in an effort to combat growing cybersecurity threats, has been urged to reimagine itself, embracing the integration of technology and adopting practices such as Endpoint Privilege Management (EPM), which has shown potential in bolstering defenses against ransomware and advanced cyberattacks.
- Given the increasing reliance on data-and-cloud-computing, ensuring the workforce is well-equipped to address cybersecurity challenges through the use of EPM becomes crucial, as it minimizes the attack surface, prevents unauthorized code execution, controls application behavior, and enhances visibility for rapid containment of threats.
