Threat Intelligence and Cyber Threat Management (CTM) Protection Update for the 4th week of February

New Detection Technique - Gamaredon/Pteranodon

Pteranodon is a custom-developed malware by the Gamaredon Group. Pteranodon is capable of downloading and executing payloads of its choice, scanning system drives for specific file types, capturing screenshots, and remotely executing commands on the system in the user’s security context. To distribute this custom-built malware, the Gamaredon Group is known to make use of compromised domains, dynamic DNS providers, Russian and Ukrainian country code top-level domains (ccTLDs), and Russian hosting providers.

We've added IDS signatures and the following correlation rules to detect this activity:

  • System Compromise, Trojan infection, Gamaredon
  • System Compromise, Trojan infection, Pteranodon

New Detection Techniques

We've added the following correlation rules as a result of recent malicious activity:

  • System Compromise, C&C Communication, PSEmpire SSL Activity
  • System Compromise, Trojan infection, Orsam
  • System Compromise, Trojan infection, VMDetector

Updated Detection Technique - Exploit Kits

Exploit kits are used in "drive-by downloads." Undetectable by normal users, these kits are embedded in websites by attackers. When a user browses to a website hosting an exploit kit, the kit attempts all known attack methods to compromise the user and install malware on the user's machine. This approach is a common attack vector and a major source of infections for end users. Cybercriminals constantly change the patterns they use within their code to evade detection.

We've added IDS signatures and updated the following correlation rule to improve exploit kit detection:

  • Delivery & Attack, Malicious website - Exploit Kit, Magnitude EK
  • Delivery & Attack, Malicious website - Exploit Kit, Sundown EK
  • Exploitation & Installation, Malicious website - Exploit Kit, RIG EK

Updated Detection Technique - Malware SSL Certificates

We've added new IDS signatures to include the list of certificates identified by to be associated with malware of botnet activities. The updated correlation rules use this information to detect command and control (C&C) communications related to several malware families, including:

  • System Compromise, C&C Communication, Zeus SSL Certificate

Updated Detection Technique - Ransomware

In the past week, we've seen an increase in ransomware activity in the wild. We've added IDS signatures and updated correlation rules to detect the following ransomware families:

  • System Compromise, Ransomware infection, Cerber
  • System Compromise, Ransomware infection, Filecoder

Updated Detection Technique - Tor Onion Proxy

Tor is an open network that enables anonymity and allows users to surf the Internet anonymously. Tor also provides anonymity for servers that can only be accessed through the Tor network, called hidden services. Some websites allow access to Tor hidden services through the Internet without being inside the Tor network.

We've updated the correlation rule that detects when a system accesses one of these hidden services. Many ransomware schemes use these services to receive payments and to conduct other malicious activities.

  • Environmental Awareness, Anonymous channel, Tor Onion Proxy

Updated Correlation Rules

We've updated the following correlation rules as a result of recent malicious activity:

  • Delivery & Attack, Malicious website, Phishing activity
  • Exploitation & Installation, Client Side Exploit - Known Vulnerability, Malicious Document
  • System Compromise, C&C Communication, Query to a DGA Domain
  • System Compromise, Malware infection, CoinMiner
  • System Compromise, Malware infection, Ursnif
  • System Compromise, Trojan infection, Bancos
  • System Compromise, Trojan infection, Bunitu
  • System Compromise, Trojan infection, Carbanak
  • System Compromise, Trojan infection, FlyStudio
  • System Compromise, Trojan infection, Helminth
  • System Compromise, Trojan infection, Unk
  • System Compromise, Trojan infection, Unknown trojan
  • System Compromise, Trojan infection, Zeus