| Listen on Google Podcasts | Listen on Mave | Listen on Yandex Music |
Ruslan Rakhmetov, Security Vision
In our previously published article on Indicators of Compromise (IoC), we discussed the types and types of Indicators of Compromise (IoC) that are used in cyber security, such as CyberThreat Intelligence, often abbreviated as CTI or simply TI, from Threat Intelligence. In this article, we will discuss what TI is, how and why to apply cyber intelligence techniques, and how businesses will benefit from using threat intelligence technology. Let's get started!
Cyber Intelligence
So, the term cyber intelligence itself appeared by translating the English word combination cyberthreat intelligence, which became popular about 10-12 years ago. It was then that Western IS vendors began to actively publish their reports on some hacker cybercriminal APT groups (Advanced Persistent Threat) and the cyber operations they carried out. At the time, the total number of registered APT groups did not exceed 2-3 dozen (according to some reports, today there are already several hundred), and expert analysts assigned them sequential numbers, such as APT-1 or APT-12 (for a list of groups, which is not intended to be exhaustive, see the MITRE ATT&CK project website). As experts have studied various complex cyberattacks, they have come to believe that APT groups must have not only the resources, but also the experience and expertise to carry out a successful attack. For example, they must have information about the attacked company's IT infrastructure and the software and defences used, as well as develop or acquire ‘working’ exploits for the vulnerabilities they plan to exploit during the attack. In addition, hacker Command&Control servers (C&C or C2) that receive information from infected computers and control them with the help of commands sent by the attackers must be preconfigured, and phishing email templates must be developed, which are usually the starting point for such attacks, and to increase the probability of ‘penetration’, i.e. successful opening of a phishing email by an inattentive user, attackers must study the peculiarities of document management in a particular company and possess a list of valid emails.
Having analysed all these facts, the experts concluded that cybercriminals try to reuse their hacking techniques and methods, C2 servers and vulnerabilities to save money and increase their ‘profit’ from illegal activities. In-depth, long-term analysis of the cybercriminal activities of various groups has allowed us to form sets of attributes, i.e. attack traits characteristic of APT groups, which form the peculiar handwriting of specific cybercriminals. For example, different APT groups use different frameworks they have mastered to manage attacks (the most popular are the Metasploit Framework and Cobalt Strike - platforms for conducting penetration tests), certain favourite and proven methods of initial penetration (usually phishing, attacks on web services, exploitation of vulnerabilities on the network perimeter and bribing insiders), various methods of interaction between co-conspirators, as well as different profiles of target companies. Let us elaborate on the last point: it would be frivolous to assume that large APT teams with substantial resources will waste them on targets that will not bring them any results. For the vast majority of attackers, the result is valuable commercial information (which can be sold to competitors or blackmailed into disclosure), personal data of employees and customers (which can be easily monetised through black market sales or used for further phishing), and funds obtained through direct theft (from connected e-banking systems) or through blackmail (encryption virus attacks are a prime example).
Materially motivated attackers will approach the issue of attacking from the perspective of economic expediency, i.e. obtaining maximum benefit at minimum cost: if a cybercriminal group has considerable experience of successful attacks on industrial organisations, they will continue to attack this sector; if the attackers have access to insiders from telecom companies, they will be the victims of new attacks; if an APT group has an understanding of the workings of a modern financial institution, it will attack it as well.
Threat intelligence (TI)
So, as a result of the study of cyberattacks and the techniques and methods used in them, analysts concluded that in order to successfully counteract hacks, it is necessary to carry out attribution of attackers by studying the behaviour of APT-groups and analyzing indicators of compromise. Various methods of such attribution have emerged and have been used: analysing malware samples (looking for characteristic patterns in the code of viruses or the use of typical exploits), analysing the infrastructures and interconnections of C2 servers (IP addressing, data from SSL certificates, hosting and cloud providers used), assessment of the profiles of the attacked companies (economic sector, software and systems used, common owners/shareholders) and methods of withdrawing stolen funds (ransom in cryptocurrency, withdrawal to the accounts of shell companies, transfer of stolen money to the bank cards of individuals - ‘drops’). In addition, IS analysts have started to monitor large shadow forums and online platforms, as some cybercriminals actively communicate on closed Darknet resources, where they look for accomplices and partners in illegal business, buy and sell stolen data, malware and exploits, hire virus-writing programmers, offer insiders illegal income, and, finally, simply communicate on specific topics. Numerous aspects of such monitoring and analysis, including technical, infrastructural, economic, and even psychological aspects of surveillance of APT groups, have become components of a new trend in cyber security - cyber threat intelligence.
From a technical perspective, an IS professional who is new to the topic of cyber intelligence is likely to initially look at cyber intelligence data sources - Threat Intelligence Feeds, or TI-feeds for short. These datasets can include details such as malicious file hashes, phishing URLs, IP addresses and C2 domain names, even specific registry branch names or file names. It is also important to understand and take into account the relevance and lifespan of the received indicators: often an IP address that was used in 1-2 attacks several years ago will still be labelled as ‘potentially malicious’ despite the fact that the web resource hosted at this address has already changed several times. It is also important to understand the context of the indicators received, e.g: which APT group is currently using the malicious file with the TI feed hash, whether our company is a target for this APT group, and if so, what tactics, techniques and procedures (Tactics, Techniques and Procedures, TTPs) this APT group typically uses to attack its victims, what attack method this group has chosen to carry out its new malware campaign (e.g. targeted phishing, exploiting a new vulnerability in our installed web server, attacking by brute-forcing passwords from a recent leak) - all of this data will help us prepare for a possible attack and correctly implement a cyber incident response procedure.
A useful option would also be the ability to perform a retrospective analysis, when new TI data is compared with previously accumulated artefacts from our IT infrastructure and then a conclusion is made about a possible undetected attack that may have already occurred and whose characteristic indicators of compromise were previously unknown. In addition, if a company uses an IRP/SOAR solution in its cybersecurity management system, it will be necessary to integrate a mechanism for receiving and processing TI feeds, for example, using a TIP - Threat Intelligence Platform solution, such as the TIP module of Securtiy Vision, in order to carry out a correct cyber incident response procedure. Such solutions allow aggregating disparate cyber intelligence data, bringing it into a single format for ease of use, enriching it with relevant context, as well as directly identifying signs of a breach of a company's infrastructure by comparing the data received from the protection system with indicators of compromise.
In terms of the business benefits provided by cyber intelligence systems, several levels of Threat Intelligence can be conventionally distinguished. At the first level, the operational level, technical processing of compromise indicators is performed: enrichment, aggregation, normalisation and loading into systems and defences. This enables SOC analysts to optimise cyber incident response processes, thus improving MTTD (mean time to detect) and MTTR (mean time to respond) indicators, which in turn leads directly to a reduction in the damage caused by a cyber attack. At the second level - tactical - the tactics, techniques and procedures of attackers are analysed, which helps the head of the IS department to build an economically justified modern cyber security management system taking into account the current threats and capabilities of advanced attackers.
At the top level - the strategic level - the company's management is able to make risk-oriented management decisions based on information about modern cyberattacks and the capabilities of APT groups, thus demonstrating situational awareness in forecasting the company's activities and development, taking into account the results of analyses of current cyber risks, the company's attractiveness to specific groups of attackers, and economically justified cybersecurity costs.
Cyberattacks
Of course, cyber intelligence tools are not a ‘silver bullet’ against all threats, and one should not overestimate the capabilities of only one aspect of building an IS management system. For example, consideration should be given to the potential for false attribution errors, where APT groups deliberately change their attack elements and hacking methods to mislead IS systems and analysts who may incorrectly attribute a cyber attack that has occurred to another group. You should also consider the possibility of reselling access to compromised infrastructure when an APT group that has never ‘worked’ in your economy is successful in an attack and decides to resell stolen credentials from your infrastructure to a cyber group that is more interested in your business. Attackers can also deliberately mislead cyberintelligence by attempting a hack using easily detected tools, while conducting a stealthy second attack that may go unnoticed in the face of a ‘quick win’ over the first, distracting attack.
