Moving Target Defense Blog

Cybercrime is on the rise across all levels of industry and government. Nowhere is that more apparent than in financial services, where firms like banks and credit unions experience attacks nearly 300x more often than other industries. This is even accounting for the increased risk of cyberattack that schools and healthcare organizations faced as targets of opportunity in the COVID-19 pandemic. 

This week on Security News in Review, we have coverage on the Facebook data leak, some movement from the federal government on closing a weak spot, and theories on whether IcedID could take on the role Emotet used to have. 

With attacks increasing by 140 percent between 2018 and 2019, the threat from ransomware was growing long before the COVID-19 pandemic began. Last year, however, thanks to a perfect storm of unfortunate circumstances, the trend line for ransomware growth has gone vertical.

This weekend on security news in review, we have some new data on firmware attacks against global enterprises, insights into how much damage ransomware has caused the healthcare industry, and the Department of Homeland Security laying out a new cybersecurity strategy. 

Introduction

The developers of the Phobos ransomware have added new fileless and evasive techniques to their arsenal. Constantly keeping their attack up to date helps them bypass detection technologies through several distinct approaches, the latest of which we detail in this blog. 

Cybersecurity spending is something of a corporate paradox. Ultimately, the discipline of cybersecurity is about risk reduction. You purchase an endpoint protection platform and other security tools--network firewalls, data loss prevention, etc.--to reduce the risk of an attack compromising your systems.

In this week’s edition of Security News in Review, there’s new stories about the ransomware attack that locked up Acer’s computer systems, insight into how many Microsoft Exchange servers remain unpatched, and some theorizing on whether takedowns of cybercrime networks are valuable. 

Over 30 years ago, a disgruntled researcher unleashed the first noted ransomware virus, the “Aids Trojan.” Distributed on 20,000 floppy disks marked “AIDS Information — Introductory Diskettes'' using hijacked mail subscriber lists to the World Health Organization AIDS conference, the Aids Trojan encrypted hard drives and directed victims to post ransom money to a P.O. box located in Panama. However, the Aids Trojan had a design failure — it used simple symmetric cryptography, which meant that it was possible to extract the decryption key from the code of the Trojan. 

Ever since the Morris Worm infected 10 percent of internet-connected computers in 1988, endpoint security has become a critical asset for organizations and endpoints themselves a top target for threat actors. However, in recent years, the arms race between cybercriminals and businesses has reached a fever pitch. Even though spending on cybersecurity solutions has increased exponentially, the damage done by cybercrime has not diminished. Estimates now show that by 2025 global cybercrime will cost over $10 trillion per year — equivalent to half the United States' current GDP. 

Introduction

During 2021 Morphisec identified an increased usage of the “HCrypt” crypter. In this post, we will lockpick “HCrypt” – a crypter as a service that is marketed as a FUD (fully undetectable) loader for the client`s RAT of choice. We chose to dissect the crypter’s operations along with tracking several actors that utilize it.