This blog summarizes key themes that emerged from Black Hat USA 2023, including AI developments, integrations, and the human side of cyber security.
Black Hat is an annual cyber security event that highlights the latest innovation and technology in the field of information security. This internationally recognized, multi-day conference is a hub for the security community to meet, learn, and share.
This year’s event took place on August 5-10. Darktrace’s Hanah Darley, the Head of Threat Research and Cambridge analyst team lead, shares her main takeaways.
1. New technologies, especially AI, will increase cyber security market cap and the possible breadth of technical and security challenges
Security technologies will increase the market size, and the breadth and depth of technical security challenges will continue to grow in tandem as the scope of technologies and their providers increase. This increase can be seen in how much of the digital estate is serviced, areas that are becoming third-party services, and the sheer volume of providers hoping to cater to these new market shares. Especially as more and more of these technologies overlap, share permissions, connect via APIs, and change the technological pathways within organizations, the possibilities for security challenges and cascading supply chain impacts will become critical risks and likely continue to grow as the technological landscape becomes more complex.
2. Autonomous agents require organizations to rethink identity and access management
Identity and access management is still a huge challenge for organizations, despite the numerous pushes toward cloud infrastructure and third-party tools to help manage this process. As more organizations implement either first- or third-party AI technologies, which include autonomous agents, the difficulty of identity and access management will only increase given the complexity of classifying these agents and determining their permissions, especially if these agents then grant permissions to other entities within the organization.
3. The ‘Age of AI’ requires methods to explain machine outputs and decision making
With the popularization of AI, specifically generative AI and large language model (LLM) tools, explainable AI will become more critical than ever to clarify the decision-making roadmaps and outputs of AI agents. It is essential not only to understand how valid AI models’ outputs are, but also how the AI arrived at its conclusions. Explainable AI will fill a critical gap here, enhancing what would take humans much longer to do manually.
4. Integrations are one of the biggest gaps in security programs and vendor offerings
Technologies are growing more dependent on contextual information because of increased complexity in digital estates, identity roles, and other programs and systems also used by the organization.
Siloed technologies not only inconvenience security teams but can also increase risk by causing gaps in visibility and action potential. For example, an alerting system that does not tie into the location where an action is needed like resetting a password or disrupting a connection. Moreover, isolated data also hampers investigations and decision-making timelines.
5. Vendors attempt to address the human element of cyber security with security awareness training
While AI and automation can identify and respond to attacks at machine-speed, they cannot be the only approach to establishing a layered cyber security posture. Security awareness training is crucial, though current policies often neglect the reality of human nature.
While humans may have good intentions, that alone does not improve behavior. Teaching habitual actions, especially when it comes to questioning a trusted relationship that employees depend on daily (e.g., their email service), is complicated and will likely never fully bridge the gap between understanding and action. Trainings are often aimed at having humans recognize red flags for specific scenarios, but assessments of danger are rarely so cut and dry when it comes to human psychology. Similarly, trainings tend to be quarterly or yearly, when psychologically, it takes continuous input, on a weekly if not daily basis, to form habits.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Appleby law firm uses Darktrace and Microsoft for proactive cyber resilience and compliance
02
May 2024
Security Challenges for Appleby law firm
Appleby is an international law firm that provides offshore legal advice to clients. As such, assuring confidentiality is one of our priorities. I regularly discuss cybersecurity with our clients and prospects who want to know that their data will be protected.
Like all security teams, we are working to keep ahead of the evolving cyber threat landscape while also managing our internal tools and infrastructure.
Although we already applied security philosophies like defense-in-depth and multi-tiered protection, we wanted to expand our coverage especially given the increase in working from home. These improvements would be especially impactful given our lean security team, which must provide 24/7 coverage for our 10 offices around the globe that span several jurisdictions and time zones.
Given these challenges and goals, we turned to Darktrace.
We wanted to move away from point solutions, and after doing extensive research, we chose to consolidate around Darktrace and Microsoft. This helped us achieve increased coverage, seamless security operations, and even reduced costs.
While considering our upgrade from E3 to E5, we went through an extensive TCO exercise. After reviewing our stack, we were able to sunset legacy tools and consolidate our vendors into an integrated and cost-efficient modern platform built around Darktrace and Microsoft. We now have a single portal to manage security for all our coverage areas, improving upon what we had with our legacy eXtended Detection and Response (XDR) tool.
Darktrace’s AI-led understanding of our business operations, people, processes, and technology has helped us automate so our small team can easily achieve continuous detection, investigation, and response across our systems. This has helped us save time and overcome resource limitations, giving us comprehensive cyber resilience and new opportunities to move past firefighting to take proactive measures that harden our environment.
Darktrace and Microsoft have allowed us to simplify workflows and reduce costs without compromising security. In fact, it’s now stronger than ever.
I come from a physical security background, so I’ve always been keen on the prevention side. You would always rather prevent somebody from entering in the first place than deal with them once they are inside. With that mindset, we’re pushing our strongest controls to the boundary to stop threat actors before they gain access to our systems.
To help us with that, we use Darktrace PREVENT/Attack Surface Management™ (ASM). With just our brand name, it was able to reveal our entire attack surface, including shadow IT we didn’t know was there. PREVENT/ASM continuously monitors our exposures with AI and reports its findings to my team with actionable insights that contain key metrics and prioritizations based on critical risk. This enables us to maximize our impact with limited time and resources.
PREVENT/ASM has already identified typo squatting domains that threat actors set up to impersonate our brand in phishing attacks. Finding this type of brand abuse not only defends our company from attackers who could damage our reputation, but also protects our clients and vendors who could be targeted with these imitations. PREVENT/ASM even collects the necessary data needed for my team to file a Notice and Takedown order.
In addition to finding vulnerabilities such as brand abuse, PREVENT/ASM integrates with our other Darktrace products to give us platform-wide coverage. This is key because an attacker will never hit only one point, they’re going to hit a sequence of targets to try to get in.
Now, we can easily understand vulnerabilities and attacks because of the AI outputs flowing across the Darktrace platform as part of the comprehensive, interconnected system. I have already made a practice of seeing an alert in Darktrace DETECT/Network and clicking through to the PREVENT/ASM interface to get more context.
Achieving compliance standards for our clients
We work hard to ensure confidentiality for our clients and prospects and we also frequently work with regulated entities, so we must demonstrate that we have controls in place.
With Darktrace in our security stack, we have 24/7 coverage and can provide evidence of how autonomous responses have successfully blocked malicious activity in the past. When I have demonstrated how Darktrace works to regulators, it ticks several of their boxes. Our Darktrace coverage has been critical in helping us achieve ISO27001 compliance, the world’s best-known standard for information security management systems.
Darktrace continues to prove its value. Last year, we brought a red team into our office for penetration testing. As soon as the first tester plugged into our network, Darktrace shut him out. We spent hours clearing the alerts and blocks to let the red team continue working, which validated that Darktrace stopped them at every step.
The red team reported that our controls are effective and even in the top 10% of all companies they had ever tested. That feedback, when presented to ISO auditors, regulators, and clients, immediately answers a lot of their more arduous questions and concerns.
Darktrace helps us meet compliance frameworks while reassuring both my team and our clients that our digital infrastructure is safe.
Detecting Attacks Across Email, SaaS, and Network Environments with Darktrace’s AI Platform Approach
30
Apr 2024
The State of AI in Cybersecurity
In a recent survey outlined in Darktrace’s State of AI Cyber Security whitepaper, 95% of cyber security professionals agree that AI-powered security solutions will improve their organization’s detection of cyber-threats [1]. Crucially, a combination of multiple AI methods is the most effective to improve cybersecurity; improving threat detection, accelerating threat investigation and response, and providing visibility across an organization’s digital environment.
In March 2024, Darktrace’s AI-led security platform was able to detect suspicious activity affecting a customer’s email, Software-as-a-Service (SaaS), and network environments, whilst its applied supervised learning capability, Cyber AI Analyst, autonomously correlated and connected all of these events together in one single incident, explained concisely using natural language processing.
Attack Overview
Following an initial email attack vector, an attacker logged into a compromised SaaS user account from the Netherlands, changed inbox rules, and leveraged the account to send thousands of phishing emails to internal and external users. Internal users fell victim to the emails by clicking on contained suspicious links that redirected them to newly registered suspicious domains hosted on same IP address as the hijacked SaaS account login. This activity triggered multiple alerts in Darktrace DETECT™ on both the network and SaaS side, all of which were correlated into one Cyber AI Analyst incident.
In this instance, Darktrace RESPOND™ was not active on any of the customer’s environments, meaning the compromise was able to escalate until their security team acted on the alerts raised by DETECT. Had RESPOND been enabled at the time of the attack, it would have been able to apply swift actions to contain the attack by blocking connections to suspicious endpoints on the network side and disabling users deviating from their normal behavior on the customer’s SaaS environment.
Nevertheless, thanks to DETECT and Cyber AI Analyst, Darktrace was able to provide comprehensive visibility across the customer’s three digital estate environments, decreasing both investigation and response time which enabled them to quickly enact remediation during the attack. This highlights the crucial role that Darktrace’s combined AI approach can play in anomaly detection cyber defense
Attack Details & Darktrace Coverage
1. Email: the initial attack vector
The initial attack vector was likely email, as on March 18, 2024, Darktrace observed a user device making several connections to the email provider “zixmail[.]net”, shortly before it connected to the first suspicious domain. Darktrace/Email identified multiple unusual inbound emails from an unknown sender that contained a suspicious link. Darktrace recognized these emails as potentially malicious and locked the link, ensuring that recipients could not directly click it.
Figure 1: Suspected initial compromise email from an unknown sender, containing a suspicious link, which was locked by Darktrace/Email.
2. Escalation to Network
Later that day, despite Darktrace/Email having locked the link in the suspicious email, the user proceeded to click on it and was directed to a suspicious external location, namely “rz8js7sjbef[.]latovafineart[.]life”, which triggered the Darktrace/Network DETECT model “Suspicious Domain”. Darktrace/Email was able to identify that this domain had only been registered 4 days before this activity and was hosted on an IP address based in the Netherlands, 193.222.96[.]9.
3. SaaS Account Hijack
Just one minute later, Darktrace/Apps observed the user’s Microsoft 365 account logging into the network from the same IP address. Darktrace understood that this represented unusual SaaS activity for this user, who had only previously logged into the customer’s SaaS environment from the US, triggering the “Unusual External Source for SaaS Credential Use” model.
4. SaaS Account Updates
A day later, Darktrace identified an unusual administrative change on the user’s Microsoft 365 account. After logging into the account, the threat actor was observed setting up a new multi-factor authentication (MFA) method on Microsoft Authenticator, namely requiring a 6-digit code to authenticate. Darktrace understood that this authentication method was different to the methods previously used on this account; this, coupled with the unusual login location, triggered the “Unusual Login and Account Update” DETECT model.
5. Obfuscation Email Rule
On March 20, Darktrace detected the threat actor creating a new email rule, named “…”, on the affected account. Attackers are typically known to use ambiguous or obscure names when creating new email rules in order to evade the detection of security teams and endpoints users.
This rule was seemingly created with the intention of obfuscating the sending of malicious emails, as the rule would move sent emails to the "RSS Feeds” folder, a commonly used tactic by attackers as the folder is often left unchecked by endpoint users. Interestingly, Darktrace identified that, despite the initial unusual login coming from the Netherlands, the email rule was created from a different destination IP, indicating that the attacker was using a Virtual Private Network (VPN) after gaining a foothold in the network.
Figure 2: Hijacked SaaS account making an anomalous login from the unusual Netherlands-based IP, before creating a new email rule.
6. Outbound Phishing Emails Sent
Later that day, the attacker was observed using the compromised customer account to send out numerous phishing emails to both internal and external recipients. Darktrace/Email detected a significant spike in inbound emails on the compromised account, with the account receiving bounce back emails or replies in response to the phishing emails. Darktrace further identified that the phishing emails contained a malicious DocSend link hidden behind the text “Click Here”, falsely claiming to be a link to the presentation platform Prezi.
Figure 3: Darktrace/Email detected that the DocSend link displayed via text “Click Here”, was embedded in a Prezi link.
7. Suspicious Domains and Redirects
After the phishing emails were sent, multiple other internal users accessed the DocSend link, which directed them to another suspicious domain, “thecalebgroup[.]top”, which had been registered on the same day and was hosted on the aforementioned Netherlands-based IP, 193.222.96[.]91. At the time of the attack, this domain had not been reported by any open-source intelligence (OSINT), but it has since been flagged as malicious by multiple vendors [2].
Figure 4: External Sites Summary showing the suspicious domain that had never previously been seen on the network. A total of 11 “Suspicious Domain” models were triggered in response to this activity.
8. Cyber AI Analyst’s Investigation
As this attack was unfolding, Darktrace’s Cyber AI Analyst was able to autonomously investigate the events, correlating them into one wider incident and continually adding a total of 14 new events to the incident as more users fell victim to the phishing links.
Cyber AI Analyst successfully weaved together the initial suspicious domain accessed in the initial email attack vector (Figure 5), the hijack of the SaaS account from the Netherlands IP (Figure 6), and the connection to the suspicious redirect link (Figure 7). Cyber AI Analyst was also able to uncover other related activity that took place at the time, including a potential attempt to exfiltrate data out of the customer’s network.
By autonomously analyzing the thousands of connections taking place on a network at any given time, Darktrace’s Cyber AI Analyst is able to detect seemingly separate anomalous events and link them together in one incident. This not only provides organizations with full visibility over potential compromises on their networks, but also saves their security teams precious time ensuring they can quickly scope out the ongoing incident and begin remediation.
Figure 5: Cyber AI Analyst correlated the attack’s sequence, starting with the initial suspicious domain accessed in the initial email attack vector.
Figure 6: As the attack progressed, Cyber AI Analyst correlated and appended additional events to the same incident, including the SaaS account hijack from the Netherlands-based IP.
Figure 7: Cyber AI Analyst correlated and appended additional events to the same incident, including additional users connecting to the suspicious redirect link following the outbound phishing emails being sent.
Conclusion
In this scenario, Darktrace demonstrated its ability to detect and correlate suspicious activities across three critical areas of a customer’s digital environment: email, SaaS, and network.
It is essential that cyber defenders not only adopt AI but use a combination of AI technology capable of learning and understanding the context of an organization’s entire digital infrastructure. Darktrace’s anomaly-based approach to threat detection allows it to identify subtle deviations from the expected behavior in network devices and SaaS users, indicating potential compromise. Meanwhile, Cyber AI Analyst dynamically correlates related events during an ongoing attack, providing organizations and their security teams with the information needed to respond and remediate effectively.
Credit to Zoe Tilsiter, Analyst Consulting Lead (EMEA), Brianna Leddy, Director of Analysis
