Elastic Security Labs has released the 2024 Elastic Global Threat Report, surfacing the most pressing threats, trends, and recommendations to help keep organizations safe for the upcoming year.

Elastic publishes 2024 Global Threat Report

This article highlights the essential contributions to the Global Threat Report from the Security Intelligence team, and describes three major phenomena impacting the threat landscape.

Defense Evasion 

Endpoint tampering

Credential Access

Fall 2023 Global Threat Report Outro

Check out the newest report from Elastic Security Labs, which explores how you can protect your organization from LLM threats.

Now available: The LLM safety assessment

Elastic Security Labs is releasing a triage analysis to assist 3CX customers in the initial detection of SUDDENICON, a potential supply-chain compromise affecting 3CX VOIP softphone users.

Prevention

Hunting queries

KQL queries

EQL queries

YARA

Defensive recommendations

Potentially malicious domains

Elastic alert telemetry has observed protection events related to the supply chain attacks targeting the 3CXDesktopApp update process.

Elastic users protected from SUDDENICON’s supply chain attack

This week, we’re publishing a new version of this report that’s online and interactive, which includes additional data covering the remainder of 2022, written using Elastic technologies.

Elastic publishes 2023 Global Threat Report Spring Edition

Each month, the Elastic Security Labs team dissects a different trend or correlation from the Elastic Global Threat Report. This post provides an overview of those individual publications.

Elastic Global Threat Report Multipart Series Overview

Elastic Security Labs is providing an update to the REF2924 research published in December of 2022. This update includes malware analysis of the implants, additional findings, and associations with other intrusions.

Key takeaways

Preamble

DOORME code analysis

Introduction to backdoored IIS modules

Introduction to the DOORME IIS module

Obfuscation

String obfuscation

Anti-disassembly technique

Control flow obfuscation

Dynamic import table resolution obfuscation

Execution flow

Authentication

GET request handling

POST requests handling

Base64 implementation

AES algorithm implementation

Command handling table

Command ID 0x42

Command ID 0x43

Command ID 0x63

Command ID 0x44

DOORME Summary

SIESTAGRAPH code analysis

Introduction to the SIESTAGRAPH implant

Command and control

C - run command

N - Sleep timer update

D - Upload to OneDrive

U - Download from OneDrive

NET - Gather network information

SS - Take screenshot

SIESTAGRAPH Summary

SHADOWPAD loader code analysis

Introduction to log.dll

Capabilities

API loading

Persistence

Shellcode

Other SHADOWPAD research

SHADOWPAD Summary

Campaign and adversary modeling

Winnti

Undisclosed REF, Winnti

REF2924, ChamelGang, Winnti

Undisclosed REF, ChamelGang

Campaign associations

Campaigns 1 and 3

Campaigns 3 and 4

Summary

Detections

Signatures

YARA rules

The DOORME IIS module

The SIESTAGRAPH implant

The SHADOWPAD malware family

References

Indicators

Elastic Security Labs is providing an update to the active intrusions using SIESTAGRAPH, DOORME, and SHADOWPAD, including malware analysis and associations with additional campaigns.

Update to the REF2924 intrusion set and related campaigns

Elastic is deploying a new malware signature to identify the use of the Follina vulnerability. Learn more in this post.

Vulnerability summary: Follina, CVE-2022-30190

Elastic Security Labs is tracking likely multiple on-net threat actors leveraging Exchange exploits, web shells, and the newly discovered SiestaGraph implant to achieve and maintain access, escalate privilege, and exfiltrate targeted data.

Analysis

November 26–30, 2022

Malware execution

Internal reconnaissance

Exporting Exchange mailboxes

IIS backdoor module

kk2.exe

Web shells

December 1–4, 2022

DLL side-loading

Victimology and targeting motivations

Diamond model

Victimology

Targeting motivation

Detection logic

Prevention rules

Detection rules

KQL query

Observed adversary tactics and techniques

Tactics

Techniques / Sub techniques

Observables

Elastic Security Labs is tracking an active intrusion, by likely multiple threat actors, into the Foreign Affairs office of an ASEAN member.

SiestaGraph: New implant uncovered in ASEAN member foreign ministry

Discover our latest findings & strategic recommendations to better stay informed of potential directions threat actors may focus on.

2022 Elastic Global Threat Report Announcement

Provide executive-level details about CVE-2022-22965, a recently-disclosed remote code execution (RCE) vulnerability also known as “Spring4Shell”.

What is the threat?

What is the impact?

Leveraging Elastic for exploit detection

Artifacts

Elastic's response to the Spring4Shell vulnerability (CVE-2022-22965)

作者

德文·克尔

文章

Elastic 发布 2024 年全球威胁报告

2023 年秋季全球威胁报告尾声

现已发布：LLM 安全评估

Elastic 用户免受 SUDDENICON 的供应链攻击的侵害

Elastic 发布 2023 年全球威胁报告春季版

Elastic 全球威胁报告多部分系列概述

REF2924 入侵集和相关活动的更新

漏洞摘要：Follina，CVE-2022-30190

SiestaGraph：在东盟成员国外交部发现的新植入程序

2022 年 Elastic 全球威胁报告发布

Elastic 对 Spring4Shell 漏洞 (CVE-2022-22965) 的响应