IronNet : April Threat Intelligence Brief 2022

Apr 12, 2022

The Lapsus$ Group is a cybercriminal group that has attracted much attention after a spate of high-profile attacks on technology companies, including Microsoft, Okta, Samsung, NVIDIA, and Ubisoft. Though the group started turning heads in December 2021 as it expanded its targeting to global technology companies, Lapsus$ has activity dating back to June 2021, where it initially focused on organizations in South America. Lapsus$ has been referred to as a ransomware group in some reports, but this is incorrect as there is no evidence of Lapsus$ ever deploying ransomware in victim environments.

At IronNet, we look to behavioral analytics to detect unknown threats on enterprise networks before adversaries succeed at their end-game: exploitation or exfiltration. First, we do the threat detection groundwork needed to spot abnormal network activity across our customers' networks. Second, our IronDefense NDR expert system scores these alerts, prioritizing the most interesting events to help cut down on alert fatigue. Finally, we take a Collective Defenseapproach to crowdsourced threat sharing in real time.

The April IronNet Threat Intelligence Brief

This ability to analyze and correlate seemingly unrelated instances is critical for identifying sophisticated attackers who leverage varying infrastructures to hide their activity from existing cyber defenses. As reported in the April Threat Intelligence Brief, our analysts review alerts from millions of data flows that are ingested and processed with big data analytics. We apply ratings to the alerts (benign/suspicious/malicious) and immediately share them with IronDome Collective Defenseparticipants.

Here is a snapshot of what we discovered across the IronDome communities in March, showing 775 correlated alerts across IronDome participant environments:

Given the unique cross-sector visibility and Collective Defense capabilities of IronDome, we are able to highlight the most frequent behaviors each month, in turn enabling us to track trends over time. For March, the most frequent behavior analytics were External Scanning (1,696), New and Suspicious Domains (482), and Credential Phishing (440).

Analysis of IOCs

In addition to correlated alerts, significant IronDome community findings revealed 1,282 Indicators of Compromise (IoC) that may pose risk to IronDome participant environments. For example, we analyzed the malicious domain uralhukuk[.]com, which was attempting to phish for PII and login credentials.

All the IoCs we analyzed are used to trigger alerts that are mapped to the Cyber Kill Chain to identify the stage and progression of the threat. They can be used to create detection rules for network, endpoint, or other security tools currently deployed to mitigate cyber risk in each IronDome participant's environment.

See the March Threat Intelligence Brief for the full list of recent IoCs.

The bigger picture of Collective Defense

Every month, IronNet's expert threat analysts create threat intelligence rules (TIRs) based on significant community findings from IronDome, malware analysis, threat research, or other methods to ensure timely detection of malicious behavior targeting an enterprise or other IronDome community participants.

In March, we created 3,223 threat intel rules of our 302,420 created to date. Some examples of this month's research related to indicators associated with malware delivery domains for Cobalt Strike, BlackCat, GhostWriter, and Emotet malware.

This combination of behavior-driven and IoC signature-based detection, alert ranking, and sharing ensures IronDome participants have the broadest view of threats facing their enterprise.

Lapsus$ Group

Lapsus$ represents an interesting case study of how cybercriminals adapt their tactics, techniques, and procedures (TTP) to respond to the changing threat landscape. Its Telegram data leak channel and high level of public interaction, lack of ransomware deployment, recruitment of malicious insiders, and composition of members not generally expected to make up a sophisticated cybercriminal group all set Lapsus$ apart and demonstrate how our traditional concepts of cyber crime are being challenged.

You can see the latest industry news in the full brief or check out IronNet's threat intelligence hub.

About Ironnet

Founded in 2014 by GEN (Ret.) Keith Alexander, IronNet, Inc. (NYSE: IRNT) is a global cybersecurity leader that is transforming how organizations secure their networks by delivering the first-ever Collective Defense platform operating at scale. Employing a number of former NSA cybersecurity operators with offensive and defensive cyber experience, IronNet integrates deep tradecraft knowledge into its industry-leading products to solve the most challenging cyber problems facing the world today.

Back to IronNet Blog