Analyzing Incident Response Trends and Threats in Q4 2022

In Q4 2022, the cybersecurity landscape witnessed a notable increase in the use of remote management and monitoring tools by adversaries, with Syncro emerging as a significant tool among them. The Talos Incident Response (Talos IR) team highlighted that ransomware remains a persistent threat, featuring both familiar and new ransomware families, while also observing a surge in post-exploitation activities that complicate threat attribution.

Ransomware Trends

Ransomware was the predominant threat faced by Talos IR in this quarter. The report indicates the notable presence of the BlackCat (ALPHV) ransomware family, which has been consistently involved in incidents throughout the year. Intriguingly, Talos IR also encountered Royal ransomware for the first time, which has been tied to a possible rebranding of the notable Conti group that ceased operations in mid-2022.

Royal ransomware began its extortion campaign around September 2022, targeting a diverse range of organizations globally. One significant incident reported by Talos IR illustrated the use of sophisticated tools like Cobalt Strike and Mimikatz by the Royal actors, showcasing advanced techniques such as the mass uninstallation of security software and leveraging remote access tools like AnyDesk for perpetrating the attack.

The analysis identified persistent techniques employed by the Royal affiliates, including batch scripts for tasks ranging from creating administrative accounts to executing commands for booting systems in Safe Mode. These actions echo a growing trend where ransomware actors are demonstrating resilience and adaptability even after the perceived shutdown of high-profile groups.

Exploitation of Remote Management Tools

A striking highlight of the report is the uptick in Syncro's use, observed in nearly 30% of the engagements. Syncro, a legitimate remote access platform, has been increasingly adopted by threat actors to facilitate their attacks, as evidenced by multiple engagements where it was part of attack chains following the deployment of other malware, notably BatLoader.

BatLoader itself utilizes legitimate tools like Syncro to maintain persistence in infected environments. This echoes the findings from the Talos 2022 Year in Review, which emphasized the trend of adversaries leveraging dual-use tools to operate unnoticed within victim networks. Within this framework, the report noted that BatLoader exploits various methods for initial access, primarily through phishing campaigns and search engine optimization (SEO) strategies that lead unsuspecting users to download the malicious software.

In one engagement, the use of phishing emails disguised as promotions led to the installation of Syncro on compromised systems, showcasing the necessity for enhanced multi-factor authentication (MFA) across organizational environments to counter such tactics effectively.

Initial Access Vectors

Phishing continues to dominate as the leading initial access method, identified in nearly 40% of incidents. The Talos IR report emphasizes that weak passwords and compromised accounts contributed significantly to successful phishing exploits. The analysis pointed to the pressing need for organizations to fortify their training protocols around credential handling and to reset policies post-phishing incidents.

Furthermore, incidents reported detailed how adversaries employed tactics such as Kerberoasting to take over service accounts after initial access, highlighting the critical importance of logging practices and visibility into affected environments for effective incident response management.

Sector Targeting

The telecommunications sector emerged as the most targeted during Q4 2022, followed by education and manufacturing sectors. This trend parallels patterns observed throughout 2022, where telecommunications consistently ranked high in Talos IR engagements.

Mitigating Security Weaknesses

A significant finding from the report is the alarming lack of MFA across enterprise environments, with nearly 30% of engagements suffering from insufficient or absent MFA protections. The report underscores how the absence of MFA increases vulnerability and encourages ransomware tactics that exploit this gap. To address this, the Talos IR team advocates the enhancement of MFA protocols across all critical services and advises disabling unsupported VPN access, especially for accounts lacking two-factor authentication.

Another mitigation strategy suggested by Talos is disabling PsExec and restricting access to administrative shares, as these utilities facilitate lateral movement during ransomware engagements. Organizations are encouraged to explore Microsoft AppLocker to block known malicious or frequently abused files, further protecting against such attacks.

Leveraging MITRE ATT&CK Framework

The report categorizes observed incidents utilizing the MITRE ATT&CK framework, emphasizing the techniques employed during the quarter. For instance, over 35% of engagements involved legitimate remote access and management tools, such as AnyDesk and TeamViewer. Additionally, PsExec was a common tool for lateral movement during ransomware incidents.

Key techniques identified include:

• Utilization of compromised accounts for initial access
• Damage resulting from PowerShell scripts
• Remote access infiltration found in multiple incidents

Looking Ahead

As we progress into 2023, the landscape of cyber threats is likely to evolve with an increasing sophistication of tools and tactics. Organizations should prioritize the implementation of robust authentication practices, improve logging capabilities, and cultivate an awareness of adversaries' evolving strategies to effectively defend against these emerging threats. Familiarity with tools like Syncro and BatLoader is essential for identifying compromises and the need for heightened defense strategies cannot be overstated.