Malware-as-a-Service When Your Cloud Begins to Rain Malwares! · Malware-as-a-Service – When Your...

transcript

SESSION ID:SESSION ID:

Abhinav Singh

Malware-as-a-Service – When Your Cloud Begins to Rain Malwares!

TTA – R03

Cloud Security ResearchNetskope Inc.

About Netskope

‣ 350+ employees globally, including North America, Europe, and Asia-Pacific

‣ Early distinguished architects from large traditional security companies

‣ First comprehensive CASB patent. 45+ patent claims across four categories, with 100s of patents pending

‣ The world’s largest bank, automaker, pharmaceutical, payment processor, consulting firm, insurance, energy, oil and gas, retail and healthcare companies trust Netskope.

Agenda

Malware in the cloud – myth or reality?

Brief History of Malware campaigns utilizing cloud services

Generic Cloud threats like Malware “Fan-out” effect and

“Man-in-the-cloud”.

Detailed analysis of cloud based malware campaigns

Adoption of service based models by cyber criminals

Recommended Actions

What is malware doing in the Cloud?

File Infrastructure

SaaS + IaaS

cute-Ransomware

(7/12/16)

Zepto(Locky variant)

(7/16/16)

URSNIFData Theft

(8/2/16)

VirlockRansomware

(9/27/16)

CloudSquirrel(7/15/16)

Zepto Deliveredvia DLL

(9/9/16)

CloudFanta(10/18/16)

NitolBotnet

(10/14/16)

CerberRansomware

(6/30/16)

Cloud Based Malware Timeline

Virlock’sResurgence(1/30/17)

Ransomware +Click Fraud(1/30/17)

New Variantsof Locky

(12/15/16)

Cloud Phishing(1/18/17)

Cloud CRM Attack Vector(2/09/2017)

Targeted Attack Campaign

with Multivariatemalwares

(3/08/2017)

Godzilla BotnetAnalysis

(4/07/2017)

Google DocCloudPhishing(5/04/2017)

Generic Cloud threat Concepts

Malware “fan-out” effect.

Man-in-the-cloud (MITC)

Malware “fan-out” Effect in an Enterprise Cloud

Man-in-the-cloud Affecting cloud Applications

Token A Token B

CloudSquirrel Malware Campaign CloudFanta Malware Campaign

Malware Campaigns utilizing the Cloud

Brief Technical Analysis

CloudSquirrel CloudFanta

Phishing In the Cloud

File decoys hosted in the cloud

Documents used for phishing attacks

against popular cloud applications.

CloudPhishing

Ransomware with Benefits!

Ransomware attacks with blended threats.

Cloud Sharing & Collaboration turn it into an

elevated threat.

Encrypts files and also infects same files

Polymorphic Code

Malware Code

Clean Code

Polymorphic Code

Ransomware Blended Threats

Wormed Ransomwares

• Rapidly the entire peer network is infected

• Many collaborative files are infected and encrypted many times.

• Many ransoms to be paid, perhaps a bulk discount can be negotiated?

Advance Malware Families utilizing the Cloud

Carbanak Banking Trojan

Inception Framework

Carbanak Banking Trojan APT

Group of financially motivated cyber criminals, first seen in 2015.

Hides in plain sight.

Uses Google App script, Google sheet and Google forms service to build a command and control service.

Request for UUID11Check for the existence of

Google Sheet for the unique ID

Create

Read the Google Sheet content for

Commands to Execute

Read the Google Sheet content for

Commands to Execute

Carbanak Banking Trojan APT

Inception Framework (Cloud Hosted APT)

Initially targeted at Russia, but expanding globally

Clean and elegant code suggesting strong backing and top-tier talent.

Includes malware targeting mobile devices: Android, Blackberry and iOS.

Using a free cloud hosting service based in Sweden for command and control.

Service Based Models adopted by Cyber Criminals

• Has been around since early 2012.

• Major dealers include exploit kit sellers, botnet controllers and click fraud operators.

• Current portfolio includes:• Ransomware-as-a-Service(RaaS)• Phishing-as-a-Service(PhaaS) • Crimeware-as-a-Service

MaaS PaaS

How to detect Malwares propagating through Cloud

Recommended Actions (“Apply”)

Detect and remediate all threats at rest in sanctioned cloud services.

Detect and remediate all threats being downloaded from unsanctioned cloud services.

enforce policy on usage of unsanctioned applications as well as unsanctioned instances of sanctioned cloud applications.

Enforce DLP policies to control files and data en route to or from your corporate environment.

Regularly back up and turn on versioning for critical content in cloud services.

Need to track both managed as well as unmanaged devices accessing the cloud services.

Thank You!

M.Tech Booth #D02