{"id":2720,"date":"2024-09-25T19:34:06","date_gmt":"2024-09-25T19:34:06","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=2720"},"modified":"2024-10-15T08:04:51","modified_gmt":"2024-10-15T08:04:51","slug":"powershell-critical-infrastructure-and-emotet-trojans-to-take-centre-stage-in-2019","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/powershell-critical-infrastructure-and-emotet-trojans-to-take-centre-stage-in-2019\/","title":{"rendered":"PowerShell, Critical Infrastructure and Emotet trojans to take centre stage in 2019"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

During the course of monitoring and defending client environments throughout 2018, LMNTRIX analysts have noticed a number of trends that show no sign of abating. 

This year we saw attackers become much smarter and harder to detect. They\u2019ve thrown away a lot of the tools they used to rely on, in favour of tactics that slip by traditional defences completely undetected. While this used to be the calling card of more advanced attackers, methods like PowerShell attacks are becoming more popular every day. 

By looking at the trends that took shape this year, there are a number of tools and tactics we expect to see attackers embrace in 2019.  

PowerShell and fileless attacks the new norm <\/strong>

As a Windows scripting language, PowerShell provides unprecedented access to a machine\u2019s inner core, including unfettered access to APIs. It is inherently trusted by Windows, so any commands it executes are typically overlooked by security software.

Once an attacker hijacks PowerShell (or another trusted Windows tool), complete compromise of the victim\u2019s environment is almost inevitable.

Because no actual malware is used in these \u2018fileless\u2019 attacks, there isn\u2019t anything for antivirus programs to scan which means they bypass these controls without even trying. 

This makes PowerShell attacks a favoured tactic of APTs.

So far, this type of attack has been favoured by Chinese and Russian nation-state actors. The list of those who have deployed PowerShell in campaigns reads like a who\u2019s who of bad guys; APT groups 3, 19, 28, 29, and 32, the financially focussed FINs 6, 7, 8, and 10, and, of course, who can forget Deep Panda, the corporate espionage group linked to China that was implicated in attacks against Australian organisations<\/a> in the lead up to the G20.

So, while 2017 was the year of Ransomware, 2018 was the year that sophisticated fileless and PowerShell attacks reigned supreme.

Given the ease with which these attacks bypass defences, coupled with the complete pwnage once successful, this is a trend we expect to see continue well into 2019.  

Critical infrastructure in the crosshairs <\/strong>

Before 2018, successful attacks against critical infrastructure were relatively rare \u2013 they were always feared, but highly uncommon. Not anymore. 

This year, we saw the hacking group GreyEnergy<\/a>, which took down Ukranian power grids in 2015, systematically target other critical infrastructure across the Eastern European nation and its neighbours.

Industrial control systems running SCADA software in Ukraine and Poland were GreyEnergy\u2019s primary targets this year. Rather than shut down the grids after compromise, the attackers preferred to remain undetected and cover their tracks after collecting the intelligence they were seeking. According to researchers, this new degree of stealth is because the attackers are either preparing to sabotage the networks at the most damaging time possible, or are setting the stage for another APT. Interestingly, fileless attacks were part of GreyEnergy\u2019s arsenal. 

This year also saw the emergence of perhaps the most damaging critical infrastructure-specific malware since Stuxnet: Triton<\/a>.

Widely believed to have been developed by Russia, Triton was used in an attack against a Saudi Arabian petro-chemical plant, shutting it down (although the shut down seemed to be inadvertent). 

Triton targets Industrial Control Systems<\/a>, with the aim of handing over full control to the attackers. 

Next year, given the ongoing geopolitical uncertainty, we expect to see more critical infrastructure-specific payloads targeting SCADA and ICS systems across the globe. 

\u201cEmotet\u201d \u2013 A constant threat<\/strong>

When it comes to banking trojans, Emotet is the star atop the Christmas tree. 

This year, it was distributed to such an extent that US-CERT issued a cyber alert in July warning users and organisations to be vigilant against the rising number of malspam campaigns spreading the trojan. It was described as \u201camong the most costly and destructive malware affecting state, local, tribal, and territorial governments, and the private and public sectors\u201d.

Despite the spotlight on Emotet, it was still used to target Christmas and Thanksgiving shoppers in a campaign designed to exploit the shopping frenzy around Black Friday and Cyber Monday<\/a>.  

Primarily distributed in malspam campaigns, Emotet is typically hidden in attachments that claim to be receipts from financial institutions or holiday-themed greeting cards<\/a>. Once opened, Emotet downloads a secondary payload, most often a banking malware like Ursnif or IcedId, which then steals the victim\u2019s credit card details, passwords, or crypto wallets. 

Given Emotet\u2019s massive proliferation in the past few weeks, despite an advisory from USCERT in July, we expect to see it deployed again in the New Year \u2013 possibly to exploit New Year\u2019s, Valentine\u2019s Day and End of Financial Year retail sales.

While cyber attackers by their very nature are difficult to predict, it does help to review the past year\u2019s trends to see what methods are gaining popularity. With 2018 seeing an increase in PowerShell attacks, campaigns against critical infrastructure and the emergence of Emotet, it\u2019s safe to say we\u2019ll be seeing these again long after we\u2019ve given up on our New Year\u2019s resolutions. <\/p>\n\n\n\n

On 2018-12-06<\/p>\n","protected":false},"excerpt":{"rendered":"

During the course of monitoring and defending client environments throughout 2018, LMNTRIX analysts have noticed a number of trends that show no sign of abating.  This year we saw attackers become much smarter and harder to detect. They’ve thrown away a lot of the tools they used to rely on, in favour of tactics that […]<\/p>\n","protected":false},"author":1,"featured_media":2721,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-2720","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2720","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=2720"}],"version-history":[{"count":3,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2720\/revisions"}],"predecessor-version":[{"id":4282,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2720\/revisions\/4282"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/2721"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=2720"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=2720"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=2720"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}