Cybercriminals Battle Against Banks' Incident Response
'Filess' attacks account for more than half of successful breaches of bank networks, new data shows.
Financial institutions traditionally have established some of the most secure perimeters and defenses against cybercriminals and nation-state actors, but new studies show how they often struggle to detect or quell ongoing attacks that have infiltrated their internal networks.
CISOs from major financial firms surveyed and interviewed recently by Carbon Black say they're seeing attackers moving across their networks under the cover of legitimate applications and tools such as Windows PowerShell (89%), Windows Management Interface (59%), and SSH (28%). Those camouflaged, memory-based attacks – aka file less attacks – were used in more than half of successful breaches of the bank networks, according to Carbon Black.
In addition to the usual Windows utility suspects, Google Drive, unsigned digital certificates, and legit processes hiding malicious code (aka process hollowing), each were found in about 10% of cases at banks.
Leigh-Anne Galloway, cybersecurity resilience lead at Positive Technologies, says these methods work for the bad guys because banks often don't pay close attention to the security of their internal networks. Her firm, which provides penetration testing to banks in Europe and elsewhere, uses legitimate tools in those engagements. "When doing pen tests, we try to act as close as possible to the actions of the attacker - including 'living off the land' - so that the organization can understand how well its internal monitoring tools for attacks like SIEM or SOC work," she says.
The pen testers run Mimikatz PowerShell version as well as the "procdump" utility, where they copy operating system memory. "You can extract passwords from this dump on your laptop, which naturally will go unnoticed by the protection systems. Such methods show high efficiency," she days, with the pen testers able to steal passwords from the operating system memory using Mimikatz in 100% of banks they tested.
Persistent attackers aren't backing down when banks detect them and launch their incident response processes, either. One in four bank CISOs in the Carbon Black study say their institution faced attackers fighting back when they got spotted, trying to deter defenses and the investigation into the attack.
"They are leaving wipers or destructive malware to inhibit [IR], deleting logs, and inhibiting the capacity of forensics tools," for example, says Tom Kellermann, chief cybersecurity officer at Carbon Black. "Sometimes they are using DDoS to create smokescreens during events."
These counter-IR activities are forcing banks to be be more proactive and aggressive as well, he says. "They need to have threat hunting teams. You can't just rely on telemetry and alerts."
While banks are often relying on their IR playbooks, attackers have the freedom to freelance and counter IR activities. They're changing their malware code on the fly when it gets detected, deleting activity logs to hide their tracks, and even targeting bank security analysts and engineers to help their cause. Carbon Black found in its study