Cyber Kill Chain by al chua https://padlet.com/cdocsafcds/cyber1212 Find a case study and apply the cyber kill chain by explaining the steps taken. en-us 2022-05-11 01:41:28 UTC 2022-08-22 03:04:39 UTC hello@padlet.com Group 1 cdocsafcds https://padlet.com/cdocsafcds/cyber1212/wish/2178573069 2022-05-11 01:43:02 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2178573069 Group 2 cdocsafcds https://padlet.com/cdocsafcds/cyber1212/wish/2178573169 2022-05-11 01:43:07 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2178573169 Group 3 cdocsafcds https://padlet.com/cdocsafcds/cyber1212/wish/2178573297 2022-05-11 01:43:13 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2178573297 Group 4 cdocsafcds https://padlet.com/cdocsafcds/cyber1212/wish/2178573395 2022-05-11 01:43:18 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2178573395 Group 5 cdocsafcds https://padlet.com/cdocsafcds/cyber1212/wish/2178573516 2022-05-11 01:43:24 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2178573516 colonial pipeline ransomware attack https://padlet.com/cdocsafcds/cyber1212/wish/2178592048 step 1: reconnaissance 
Hackers went on the dark web to acquire passwords  
step 2: weaponisation 
hackers logged into the VPN account using acquired passwords
step 3 : delivery
hackers found where to login using their new found credentials

step 4 : exploitation
the website did not have 2FA and the employees did not disable the accounts properly 
step 5 : installation
hackers installed ransomware 
step 6 :command and control 
hackers controlled the supply of oil, causing many drivers to be stranded and effectively resulting in the standstill of society.
step 7 actions and objectives
 they received 4 million usd in ransom ]]> 2022-05-11 01:58:54 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2178592048 Context: Singhealth data breach https://padlet.com/cdocsafcds/cyber1212/wish/2178597608 Personal particulars of 1.5M singhealth patients, including PM Lee's, as well as 160k records of outpatient dispensed medicines were obtained by the perpetrators. Details included names, NRIC, addresses and other personal information. The data stolen spanned entries from 1 May 2015 to 4 July 2018. PM Lee's information was specifically targeted. 

CYBER KILL CHAIN
Reconaissance: obtained login credentials
Weaponization: customized malware used
Delivery: through front end workstation
Exploitation: malware modified to target singhealth cybersecurity weaknesses
Installation: on front end workstation i guess, into IT network
Command and Control: database accessed
Actions on objectives: personal particulars obtained]]> 2022-05-11 02:03:34 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2178597608 Aftermath https://padlet.com/cdocsafcds/cyber1212/wish/2178611951 Singhealth disconnected factor systems and others permenantly. It also made use of more secure information exchange gateways and hired independent operatives tk review the health records before submission. 

The IHS has since strengthened public health systems against data breaches. All suspicious occurences are to be reported within 24 hours. Other measures include 2 factor authentication, proactive threat hunting and ensuring all machines have the most updated security updates. 

Two employees were dismissed for negligence and misinterpretation of the threat respectively and financial penalties were imposed on the related supervisors and managers. 

Cybersecurity company Symantec identified a state-sponsored group called Whitefly but its benefactor has yet to be found. ]]> 2022-05-11 02:14:34 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2178611951 wannacry ransomware attack https://padlet.com/cdocsafcds/cyber1212/wish/2266882216 2022-08-22 02:25:25 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266882216 Cisco YanLuoWang attack https://padlet.com/cdocsafcds/cyber1212/wish/2266885134 2022-08-22 02:28:27 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266885134 How it started https://padlet.com/cdocsafcds/cyber1212/wish/2266885490 The attacker convinced the Cisco employee to accept multi-factor authentication (MFA) push notifications through MFA fatigue and a series of sophisticated voice phishing attacks initiated by the Yanluowang gang that impersonated trusted support organizations.

Under cyber kill chain, it can be classified as credential access]]> 2022-08-22 02:28:51 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266885490 https://padlet.com/cdocsafcds/cyber1212/wish/2266886042 Once they gained a foothold on the company's corporate network, Yanluowang operators spread laterally to Citrix servers and domain controllers.]]> 2022-08-22 02:29:28 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266886042 Reconnaissance https://padlet.com/cdocsafcds/cyber1212/wish/2266886833 Organizations with open port 445 endpoints were searched for, exploitable with EternalBlue.]]> 2022-08-22 02:30:19 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266886833 Exploitation https://padlet.com/cdocsafcds/cyber1212/wish/2266888934 Exploits the vulnerability with EternalBlue. It injects code into the SMB system process and becomes persistent by creating an entry in the windows registry.]]> 2022-08-22 02:32:24 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266888934 Installation https://padlet.com/cdocsafcds/cyber1212/wish/2266889393 It copies itself to those vulnerable endpoints by exploiting a variant of the DoublePulsar payload. The process starts again on every infected computer. The capacity of the propagation within the network is enormous.]]> 2022-08-22 02:32:56 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266889393 Weaponization https://padlet.com/cdocsafcds/cyber1212/wish/2266889480 Artifacts such as injection code for SMB process & kill-switch mechanism were created]]> 2022-08-22 02:33:03 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266889480 Weaponisation https://padlet.com/cdocsafcds/cyber1212/wish/2266890311 After gaining domain admin, they used enumeration tools like ntdsutil, adfind, and secretsdump to collect more information and installed a series of payloads onto compromised systems, including a backdoor malware. 

"After obtaining initial access, the threat actor conducted a variety of activities to maintain access, minimize forensic artifacts, and increase their level of access to systems within the environment," Cisco Talos added.





Weaponisation
]]> 2022-08-22 02:33:44 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266890311 command and control (C2) & actions on objectives https://padlet.com/cdocsafcds/cyber1212/wish/2266890383 -Got access to system files and deleted existing shadow copy folders to prevent the user from retrieving information.
-It do not allow booting in system recovery mode, and hides the recycle bin.
-It kills processes that have open databases to guarantee access to the encryption of such databases (mysql, sqlserver, and exchange)
-Proceeds to encrypt the files and directories of the system using an AES algorithm, which can only be decrypted if the private RSA key is available.
-when the file encryption finishes, it shows a dialog to the user requesting the ransom.]]> 2022-08-22 02:33:48 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266890383 Ryuk ransomware https://padlet.com/cdocsafcds/cyber1212/wish/2266891056 2022-08-22 02:34:41 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266891056 Delivery https://padlet.com/cdocsafcds/cyber1212/wish/2266894484 Payload of malicious code is injected into vulnerable systems through port 445, using SMB file-sharing through EternalBlue]]> 2022-08-22 02:38:54 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266894484 Outline https://padlet.com/cdocsafcds/cyber1212/wish/2266896600 WannaCry - Self-spreading ransomware
Exploitation of one of Microsoft's protocols led to creation of EternalBlue, one of the tools used to gain access to remote computers.
DoublePulsar, a backdoor tool used for installation and execution of programs.
This exploit was patched within a month of discovery, but many users across the globe did not install the patch.
A combination of these tools allowed the creation of WannaCry, which spread across the world.
User's computers data was encrypted by WannaCry, spreading with the use of EternalBlue, and installation using DoublePulsar.

When WannaCry is executed, it checks for a fixed domain name, if this domain name is not found, it will encrypt the computer data.

A computer researcher reverse-engineered the malware code and found this vulnerability, and registered the domain name. This caused WannaCry to stop any further executions, effectively acting as a kill switch.

 ]]> 2022-08-22 02:41:19 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266896600 https://padlet.com/cdocsafcds/cyber1212/wish/2266900385 Step 1: Reconnaissance
Look for organizations with critical assets that are more likely to pay, a technique the security industry calls "big game hunting".

Step 2: Weaponisation
Ryuk uses Trickbot computer malware to install itself, once access is gained to a network's servers. It has the capability to defeat many anti-malware countermeasures that may be present and can completely disable a computer network. It can even seek out and disable backup files if kept on shared servers.

Step 3: Delivery
Created phishing campaigns that contain either links to malicious websites that host the malware or attachments with the malware. 

Step 4: Exploitation
The phishing email would have contained Emotet, a piece of trojan. Emotet would have installed Trickbot, which then enabled the hacker group, WIZARD SPIDER, to manually install Ryuk through a reverse shell.

Step 5: Installation
Loaders start the infection chain by distributing the payload; they deploy and execute the backdoor from the command and control server and install it on the victim’s machine.

Step 6: C2
At that point, the encryption can occur. Ryuk encrypts files such as photos, videos, databases, and documents – all the data you care about – using AES-256 encryption. The symmetric encryption keys are then encrypted using asymmetric RSA-4096.

Step 7: Action on Objectives
The hackers leave ransom notes in the system as RyukReadMe.txt, demanding a ransom]]> 2022-08-22 02:45:38 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266900385 Reconnaissance https://padlet.com/cdocsafcds/cyber1212/wish/2266905292 Got hold of an employee's personal Google account that contained passwords synced from their web browser]]> 2022-08-22 02:50:49 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266905292 Action on Objectives https://padlet.com/cdocsafcds/cyber1212/wish/2266907137 After the attackers were booted off, the attackers tried to manipulate the company executives by trying to establish email communications at least three times to urge them to pay so that no one will know about the incident and information leakage. The email also included a screenshot of the directory listing of the exfiltrated Box folder]]> 2022-08-22 02:52:41 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266907137 Exploitation https://padlet.com/cdocsafcds/cyber1212/wish/2266909734 The attacker ultimately succeeded in achieving an MFA push acceptance, granting them access to VPN in the context of the targeted user.”

The report adds that once the attacker obtained initial access, they enrolled a series of new devices for MFA and authenticated successfully to the Cisco VPN.

]]> 2022-08-22 02:55:08 UTC https://padlet.com/cdocsafcds/cyber1212/wish/2266909734