<h2 id="summary">Summary</h2>
<p>In August 2021, a group of malicious code detectors <a href="https://analyze.intezer.com/files/294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc">identified malware</a> roaming the wild that carried out a robustly stealth executable and linkable format (ELF) of Cobalt Strike&#39;s beacon. The group named this malware Vermillion Strike. By hijacking Cobalt&#39;s Strike Command as well as the C2 (Control) protocol to contact the Control server, Vermillion Strike gained remote access proficiency to write to files, run shell commands and even upload media and text files. According to the code detectors, they believe an entity (or entities) uploaded Vermillion Strike malware from Malaysia.</p>
<h2 id="implementation-of-cobalt-strike-by-threat-actors">Implementation of Cobalt Strike by Threat Actors</h2>
<p>An incognito threat emulation software, the Cobalt Strike Beacon is an unofficial threat emulator intended for use on Linux and Windows systems to detect a Cobalt Strike.</p>
<p>Developed as a rigorous penetration testing tool, the Cobalt Strike Beacon proved to be an outstanding asset for effectively compromising systems during a penetration testing event. Unfortunately, the same elements that made the Cobalt Strike Beacon so successful also facilitated the ability of threat actors to utilize the port of Cobalt Strike beacon as a way to covertly infiltrate and attack systems.</p>
<p>Vermillion Strike is considered one of the most widespread, brutally stealth threats employing a code that was previously unknown. Threat actors quickly discovered the Cobalt Strike Beacon is highly attractive for hacking purposes because it merges assorted exploitation executions. The more exploitation techniques incorporated into a specific malware, the more opportunities there are available for hackers to manipulate it.</p>
<p>The resulting malware produced by this sophisticated feat of reverse engineering is Vermillion Strike.</p>
<h2 id="yara-rules-and-vermillion-strike">YARA Rules and Vermillion Strike</h2>
<p>Utilized by red teams with the <a href="https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/">intent to conduct espionage,</a> Vermillion Strike is a completely original malware code that allows threat actors to remotely extract, manipulate and manage system data without being detected. The group initially discovering Vermillion Strike states that this malware shares code strings with Cobalt Strike that instigates several YARA rules. Similar to a snippet of programming language, YARA rules work exceptionally well to identify samples of malware code by composing summaries of malware lineages according to their binary or textual patterns.</p>
<p>YARA rules cannot be relied on to detect Vermillion Strike. Instead, YARA rules identify Cobalt Strike Beacon samples as Cobalt Strike or other malware, which allows Vermillion Strike to continue running undetected in the background. Vermillion Strike essentially opens backdoors on systems and on Linux, Mac, and Windows machines.</p>
<h2 id="what-happens-to-systems-infected-with-vermillion-strike">What Happens to Systems Infected with Vermillion Strike?</h2>
<p>Performed over both HTTP and DNS, command and control instructions are mostly executed over the DNS to avoid standard defenses scanning HTTP traffic. Reception of commands involves recognition by TXT records and the DNS address. Initially, the beacon receives an IP address after making DNS inquiries of hard-coded subdomains. Without Vermillion strike interfering with the translation requests for IP addresses, the IP address sent in response to a command does not trigger modifications of beacon engagement.</p>
<p>Vermillion Strike not only exploits the use of separate threads to perform remotely controlled tasks but also allows threat actors to avoid suspicion by applying a <a href="https://www.techopedia.com/definition/3875/semaphore">semaphore</a> to scheduling tasks. In addition, Vermillion Strike interacts with command and control servers via Internet Control Message Protocol (ICMP) ping messages. Functions of ICMP include announcing network errors, timeouts, congestion, and troubleshooting.</p>
<p>Once Vermillion Strike has comprised a network, remote threat actors can do all of the following:</p>
<ul>
<li>Upload files to command and control</li>
<li>Write to files</li>
<li>Run shell commands</li>
<li>List files</li>
<li>Modify working directory</li>
<li>Access the current working directory</li>
<li>Initiate commands with the popen function. Threat actors using ()--which is code for popen--can start another process or program</li>
</ul>
<p>To reduce the <a href="cyberthreatsensor.io">risk of Vermillion Strike</a> infecting systems, security researchers have been recommending organizations:</p>
<ul>
<li>Keep systems updated and patched across all devices and servers</li>
<li>Implement/update signature detection software</li>
<li>For Linux systems, disable root accounts that offer hackers an easy way to read/write and execute unauthorized files.</li>
<li>Enhance connections and security of SSH logins with an encrypted SSH key</li>
</ul>
<p>However, these actions do not provide the kind of resolute defense mitigation found in the superior cybersecurity SaaS product provided only by Cyber Threat Sensor AI.</p>
<h2 id="protecting-your-company-with-cyber-threat-sensor-10-benefits-of-cts-ai">Protecting Your Company with Cyber Threat Sensor: 10 Benefits of CTS-AI</h2>
<p>Global organizations know they can depend on our proprietary <a href="https://www.dropbox.com/s/hczu2gswphewxgn/Vermilion%2BStrike%2BReport_REV4.pdf?dl=0">Cyber Threat Sensor-AI (CTS-AI)</a> to provide the following benefits essential for protection against Vermillion Strike:</p>
<ul>
<li>Enforcement of secure account password policy</li>
<li>Isolation of crucial resources, functions, and systems within network architecture</li>
<li>Multi-factor authentication (MFA) significantly increases security if one credential is infiltrated. MFA requires threat actors to overcome a second authentication demand before they can hack into a system.</li>
<li>Detection and prevention of unauthorized behavior emerging on endpoint systems</li>
<li>Meticulous scanning and auditing of systems, insecure configurations/software, and permissions to identify weaknesses</li>
</ul>
<p>CTS-AI is powered by artificial intelligence to detect and respond to malware attempting to compromise cloud-based data and AWS applications. Our GTIC implements automated indicator sharing to robustly support our threat detection service administration. In addition, Cyber Threat Sensor&#39;s GTIC provides proactive clarity to greatly enhance threat detection, fully supporting our Managed Security Services protecting our customers&#39; sensitive data and systems.</p>
<p>We also strongly recommend MITRE ATT&amp;CK mitigations to substantially reduce the risk of a Cobalt Strike compromise event. For example, vulnerability scanning rapidly detects possible vulnerabilities within software coding that can be easily exploited by threat actors. Employee training classes should be scheduled to help users recognize signs of hackers attempting to manipulate, access, or otherwise infiltrate systems by employing red hat tactics such as spear phishing and phishing, pretexting, baiting, social engineering, voice phishing (vishing), quid pro quo, and tailgating. When employees remain aware and up-to-date on the latest techniques used by threat actors to install malware in company systems, that company can nearly eliminate the financial and reputational consequences of an unauthorized intrusion event.</p>


CTS-AI Offers Immediate Access to Robust Protection Against Vermillion Strike Domain Activity

<h2 id="report-summary">Report summary</h2>
<p>Our Global Threat Intelligence Center (GTIC) has been tracking Vermillion Strike actors since mid-2021. You can read our previous research <a href="https://hello.global.ntt/-/media/ntt/global/insights/white-papers/vermilion-strike-report.pdf?rev=9440a2afb3bc4916815358c02e1b89de">here</a>.</p>
<p>Over the past two weeks, the same actors have been ramping up a new campaign. The actors have updated domains (microsoftkernel[.]com and microsofthk[.]com) previously used for Vermillion Strike campaigns to a new IP address. The domains have been active for the first time in several months. Additionally, we established a relationship between the Vermillion Strike infrastructure and a tracked Cobalt Strike jumphost, linking the activity of the two infrastructures.</p>
<p>Increased traffic and the reactivation of high-value command-and-control (C2) domains strongly indicate a new campaign led by the actors behind Vermillion Strike.</p>
<h2 id="technical-details">Technical details</h2>
<p>A new SoftEther VPN node utilizing a self-signed certificate used in a previous campaign appeared online on 29 January 2022. On 21 January, microsoftkernel[.]com was updated to resolve to 202[.]58[.]104[.]136; due to NTT’s unique visibility and telemetry from our global internet footprint, we were able to observe an Indonesian government organization start to communicate with it before pDNS services pointed to the update on 22 January. On 29 January, the microsofthk[.]com DNS record was updated to 202[.]58[.]104[.]136. Shortly afterwards, the Cobalt Strike jumphost (185[.]191[.]34[.]209) established communication and has maintained a high amount of traffic to date.</p>
<p>Microsoftkh[.]com appears to be only associated with high-level targets. In the previous campaign, only government entities were seen accessing it over port 443, which was the port the SoftEther VPN service was using, likely for exfiltration and remote access. Over the last two weeks, other than the Cobalt Strike jumphost connection, all 443 communication to the SoftEther VPN node have been suspected high-level targets as well.</p>
<p><img src="/img/blog/vermillion-strike-original-vpn.png" alt="Original Vermillion Strike VPN" title="Original Vermillion Strike VPN"></p>
<h2 id="threat-actors">Threat actors</h2>
<p>At this time, we have not yet attributed this campaign to a specific named threat actor group. As we continue to investigate this campaign and discovers more details, we will update this research with further relevant details as possible.</p>
<h2 id="target">Target</h2>
<p>We previously observed Vermillion Strike only targeting government entities. Recently, we’ve observed the campaign also impacting organizations in the education and telecommunications industries. IPs from Thailand and Taiwan accessed the new host via port 443, with the earliest connections beginning 19 January 2022.</p>
<h2 id="tactics-techniques-procedures">Tactics, techniques, procedures</h2>
<p><a href="https://attack.mitre.org/software/S0154/">Cobalt Strike </a>– a legitimate and commercially available advanced penetration tool first released in 2012; covers the full MITRE ATT&amp;CK tactics. Marketed for adversary simulations, Red Team operations and penetration testers and aimed against the Windows platform, Cobalt Strike allows for the emulation of advanced threat actor post-exploitation activities.</p>
<p>However, threat actors use stolen versions of the tool in their attacks to achieve advanced capabilities they may not otherwise be capable of.</p>
<p>Notably, Cobalt Strike’s Beacon component allows operators to model advanced attack behavior including execution of various scripts, downloading of files, privilege escalation and recording keystrokes and screenshots, as well as spawning additional payloads. Additionally, Cobalt Strike can leverage other tools’ capabilities, such as <a href="https://attack.mitre.org/software/S0002">Mimikatz</a>.</p>
<p>In 2021, threat actors recreated and released a version of Cobalt Strike for Linux dubbed Vermillion Strike.</p>
<h2 id="campaign-and-event-timeline">Campaign and event timeline</h2>
<h3 id="19-january-2022">19 January 2022</h3>
<p>An organization in Thailand started connecting to the Vermillion Strike host over port 443</p>
<h3 id="29-january-2022">29 January 2022</h3>
<p>microsofthk.com DNS record updated to 202.58.104.136. The Cobalt Strike jumphost established communication shortly after</p>
<h3 id="21-january-2022">21 January 2022</h3>
<p>microsoftkernel.com updated to resolve to 202.58.104.136</p>
<h2 id="recommendation">Recommendation</h2>
<p>We help clients detect, prevent and remediate Cobalt Strike infections via our Threat Detection services delivered from multiple 24/7 SOCs around the world.</p>
<p>Customers using our <a href="https://cyberthreatsensor.io/">Cyber Threat Sensor-AI (CTS-AI)</a>, our AI-powered network detection and response tool for AWS applications and data in the cloud will already have received early access to enhanced protection from our threat intelligence and monitoring in advance of this publication.</p>
<p>Our GTIC provides automated indicator sharing to enhance our Threat Detection service coverage. This provides early visibility and improves threat detection to support our Managed Security Services (MSS) customers. Should you require further assistance or investigation, please reach out to our <a href="https://services.global.ntt/en-us/services-and-products/security/security-consulting-and-professional-services">Security Consulting Services </a>to engage our <a href="https://services.global.ntt/en-us/services-and-products/security/security-consulting-and-professional-services/security-operations-and-incident-response">Digital Forensics &amp; Incident Response </a>team.</p>
<h2 id="mitigation-and-remediation">Mitigation and remediation</h2>
<p>We also recommend adopting the following MITRE ATT&amp;CK Mitigations to reduce the risk of compromise by Cobalt Strike. We recommend utilizing the following defense mitigations:</p>
<table>
<thead>
<tr>
<th><strong>Mitigation ID</strong></th>
<th><strong>Mitigation name</strong></th>
<th><strong>ATT&amp;CK description</strong></th>
</tr>
</thead>
<tbody><tr>
<td><a href="https://attack.mitre.org/mitigations/M1016/">M1016</a></td>
<td>Vulnerability Scanning</td>
<td>Vulnerability scanning is used to find potentially<br>exploitable software vulnerabilities to remediate them.</td>
</tr>
<tr>
<td><a href="https://attack.mitre.org/mitigations/M1017/">M1017</a></td>
<td>User Training</td>
<td>Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.</td>
</tr>
<tr>
<td><a href="https://attack.mitre.org/mitigations/M1027/">M1027</a></td>
<td>Password Policies</td>
<td>Set and enforce secure password policies for accounts.</td>
</tr>
<tr>
<td><a href="https://attack.mitre.org/mitigations/M1030/">M1030</a></td>
<td>Network Segmentation</td>
<td>Architect sections of the network to isolate critical systems, functions, or resources.</td>
</tr>
<tr>
<td><a href="https://attack.mitre.org/mitigations/M1031/">M1031</a></td>
<td>Network Intru- sion Prevention</td>
<td>Use intrusion detection signatures to block traffic at<br>network boundaries.</td>
</tr>
<tr>
<td><a href="https://attack.mitre.org/mitigations/M1032/">M1032</a></td>
<td>Multi-Factor Authentication</td>
<td>Use two or more pieces of evidence to authenticate to a system.</td>
</tr>
<tr>
<td><a href="https://attack.mitre.org/mitigations/M1037/">M1037</a></td>
<td>Filter Network<br>Traffic</td>
<td>Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.</td>
</tr>
<tr>
<td><a href="https://attack.mitre.org/mitigations/M1040/">M1040</a></td>
<td>Behavior Prevention on Endpoint</td>
<td>Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems.</td>
</tr>
<tr>
<td><a href="https://attack.mitre.org/mitigations/M1047/">M1047</a></td>
<td>Audit</td>
<td>Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.</td>
</tr>
<tr>
<td><a href="https://attack.mitre.org/mitigations/M1049/">M1049</a></td>
<td>Antivirus/ Antimalware</td>
<td>Use signatures or heuristics to detect malicious software</td>
</tr>
<tr>
<td><a href="https://attack.mitre.org/mitigations/M1051/">M1051</a></td>
<td>Update Software</td>
<td>Perform regular software updates to mitigate exploitation risk.</td>
</tr>
<tr>
<td><a href="https://attack.mitre.org/mitigations/M1053/">M1053</a></td>
<td>Data Backup</td>
<td>Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.</td>
</tr>
</tbody></table>
<p><strong>References</strong>
<a href="https://hello.global.ntt/-/media/ntt/global/insights/white-papers/vermilion-strike-report.pdf">https://hello.global.ntt/-/media/ntt/global/insights/white-papers/vermilion-strike-report.pdf</a>
<a href="https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-">https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-</a> campaign-exploits-microsofts-signature-verification-putting-users-at-risk/
<a href="http://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/">https://www</a>.intezer<a href="http://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/">.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/</a></p>
<h2 id="technical-indicators">Technical indicators</h2>
<h3 id="c2-domains">C2 Domains</h3>
<ul>
<li>microsoftkernel.com</li>
<li>microsofthk.com</li>
</ul>
<h3 id="cobaltstrike">CobaltStrike</h3>
<p>104[.]168.165.125
• 118[.]107.43.207 - https://
ejv8xluugf.execute-api.ap-east-1.
amazonaws[.]com/api/fetch</p>
<ul>
<li>128[.]199.223.60</li>
<li>128[.]199.228.141</li>
<li>137[.]220.184.148</li>
<li>139[.]162.116.109</li>
<li>139[.]180.175.197</li>
<li>139[.]59.103.164</li>
<li>141[.]164.57.17</li>
<li>143[.]198.214.125</li>
<li>154[.]202.59.41</li>
<li>156[.]232.248.34</li>
<li>156[.]232.248.38</li>
<li>158[.]247.204.133</li>
<li>172[.]104.90.254</li>
<li>172[.]105.192.139</li>
<li>172[.]245.79.146 - <a href="http://172%5B.%5D245.79.146:8443/cx">http://172[.]245.79.146:8443/cx</a></li>
<li>182[.]16.54.178</li>
<li>182[.]16.54.179</li>
<li>182[.]16.54.180</li>
<li>182[.]16.54.181</li>
<li>182[.]16.54.182</li>
<li>192[.]252.180.68</li>
<li>192[.]3.128.243</li>
<li>193[.]203.12.193</li>
<li>210[.]1.226.241</li>
<li>216[.]118.246.118</li>
<li>47[.]242.26.146</li>
<li>47[.]243.179.37</li>
<li>47[.]243.230.91</li>
<li>47[.]243.24.118</li>
<li>52[.]128.229.4</li>
<li>52[.]128.229.6</li>
<li>8[.]217.74.99</li>
<li>8[.]218.134.36</li>
</ul>
<h3 id="softethervpn-ssl-fingerprint">SoftEtherVPN SSL Fingerprint</h3>
<p>e2a2a59380dbb0a545fb253cd 334c7f216c20cc6ac821c88e5a 71a0ff18fd14f</p>
<h2 id="about-the-global-threat-intelligence-center">About the Global Threat Intelligence Center</h2>
<p>The Global Threat Intelligence Center (GTIC) protects, informs and educates NTT’s clients through the following activities:
• Threat research
• Vulnerability research
• Intelligence fusion and analytics
• Communication to NTT Group clients</p>
<p>The GTIC goes above and beyond the traditional pure research organization, by taking their threat and vulnerability research and combining it with their detective technologies development to produce applied threat intelligence. The GTIC’s mission is to protect clients by providing advanced threat research and security intelligence to enable NTT to prevent, detect and respond to cyberthreats.</p>
<p>Leveraging intelligence capabilities and resources from around the world, our threat research is focused on gaining understanding of, and insight into the various threat actors, exploit tools and malware – and the techniques, tactics and procedures (TTP) used by attackers.</p>
<p>Vulnerability research pre-emptively uncovers zero-day vulnerabilities which are likely to become the newest attack vector, while maintaining a deep understanding of published vulnerabilities. With this knowledge, our security monitoring services can more accurately identify malicious activity which is ‘on-target’ to our clients’ infrastructure.</p>
<p>Intelligence fusion and analytics is where it all comes together. The GTIC continually monitors the global threat landscape for new and emerging threats using our global internet infrastructure, clouds and data centers along with third-party intelligence feeds; and works to understand, analyze and enrich those threats using advanced analysis techniques and proprietary tools; and curates and publishes them using the Global Threat Intelligence Platform (GTIP).</p>


Old domains resurface in new Vermillion Strike campaign

<h1 id="log4j-protect-your-business-from-the-most-serious-cyber-breach-ever">Log4j: Protect Your Business from the Most Serious Cyber Breach Ever</h1>
<p>For the past two weeks, cybersecurity experts, engineers and coders around the world have been working 24/7 to stop what the <a href="https://www.washingtonpost.com/technology/2021/12/20/log4j-hack-vulnerability-java/">Washington Post</a> described as &quot;the most serious security breach ever.&quot;</p>
<p>The breach was discovered in Log4j, a ubiquitous chunk of code within the Java programming language that helps apps and services track past activities. According to the UK&#39;s <a href="https://www.ncsc.gov.uk/information/log4j-vulnerability-what-everyone-needs-to-know">National Cyber Security Centre</a>, the Log4j vulnerability allows hackers to easily break into systems, steal passwords, extract data and infect networks with malicious software.</p>
<h2 id="how-bad-is-log4j">How Bad is Log4j?</h2>
<p>Hundreds of millions of devices have been affected by Log4j. In one example, the U.S. Patent and Trademark Office took its system offline for 12 hours to safeguard against the Log4j vulnerability. The bug is so simple to exploit and open access for full server takeover that US Cybersecurity and Infrastructure Security Agency director <a href="https://www.wired.com/story/log4j-log4shell/">Jen Easterly</a> called the Log4j flaw &quot;one of the most serious I&#39;ve seen in my entire career, if not the most serious.&quot;</p>
<h2 id="the-log4j-problem-gets-worse">The Log4j Problem Gets Worse</h2>
<p>While the seriousness of the Log4j vulnerability stems from <em>current</em> data and server exploitation, the more daunting threat lies in the bug&#39;s long-term effects. Patches can be installed now to resolve the immediate security breach. However, the Log4j vulnerability gives hackers access to install malicious code that remains on servers and in applications long after the problem gets &quot;fixed.&quot; As a result, Log4j will be a lethal cyber threat for years to come.</p>
<h2 id="detecting-and-responding-to-log4j-threats">Detecting and Responding to Log4j Threats</h2>
<p>Most companies will find it nearly impossible simply to detect Log4j instances because the code&#39;s widespread use. Even if detected and patched, the long-term threats of Log4j require a more precise, robust and permanent solution.</p>
<p><strong>Cyber Threat Sensor AI</strong> (CTS-AI) can detect Log4j instances deep within your network infrastructure and on VPCs, alert you of the vulnerability and remediate the issue by putting block rules in place.</p>
<p>More importantly, CTS-AI can provide ongoing Log4j detection and response to protect you well into the future.</p>
<h2 id="the-cts-ai-difference">The CTS-AI Difference</h2>
<p>CTS-AI provides an unparalleled combination of detection and automated response capabilities to defend against Log4j vulnerability attacks:</p>
<ul>
<li><p><strong>Up-to-Date Signatures</strong>
CTS-AI maintains a fresh set of signatures to detect the known traffic patterns of Log4j exploits – even if the session is encrypted. We apply these signatures to all network traffic in and out of the monitored hosts or VPCs.</p>
</li>
<li><p><strong>Unique Threat Intel</strong>
Every five minutes, CTS-AI applies high-fidelity threat intel data containing malicious IPs, domains, exploit hosting sites and exploit sources. Our advanced detection SOCs and patent pending tier-1 backbone analysis detect any traffic to or from malicious objects.</p>
</li>
<li><p><strong>Malicious Behavior Models</strong>
CTS-AI delivers unique detection capabilities through our real-world attack and victim scenarios. With this advanced modeling, we&#39;re able to detect never-before-seen attacks based on communication patterns.</p>
</li>
<li><p><strong>Proven Global Cyberthreat Intelligence</strong>
Backed by <a href="https://www.global.ntt/">NTT Global</a>, CTS-AI has the global support and proven track record of stopping the world&#39;s most malicious cyberthreats. We&#39;re uniquely qualified to protect your business from the Log4j vulnerability.</p>
</li>
<li><p><strong>Human-Verified Cyberthreats</strong></p>
</li>
</ul>
<p>With CTS-AI, you get the best of both worlds: Advanced AI that provides continuous scanning of global internet traffic _ <strong>and</strong> _ an expansive human-validated threat intelligence ecosystem. The result is accurate contextualization and prioritization – and peace of mind in an increasingly dangerous cyber environment.</p>


Log4j: Protect Your Business from the Most Serious Cyber Breach Ever

<h2 id="summary">Summary</h2>
<p>Though digital assets have been a valuable commodity since the dawn of the internet, never has it been as relevant as it is now. Cryptocurrencies have revolutionized the space, accompanied by trendy new blockchain applications such as NFTs. With more mainstream adoption, however, comes predators such as Mars Stealer.</p>
<p>This malicious piece of software can extract <a href="https://www.investing.com/news/cryptocurrency-news/malware-alert-mars-stealer-attacks-crypto-wallets-and-2fas-2756374">keys and 2FAs</a> from multiple sources.</p>
<p>If you have any dealings with crypto, you need to be aware of how this malware functions. But, even more crucially, you must understand the most efficient preventative measures. Read on to learn more.</p>
<h2 id="the-threat">The Threat</h2>
<p>The world of cryptocurrency shines with such bright allure that it&#39;s often easy to forget about what lurks in the shadows. Malicious actors targeting crypto for theft are nothing new, but the techniques are becoming elegant and difficult to detect.</p>
<p>Mars Stealer, in particular, has the potential to gain access to any crypto wallets that utilize browser extensions. Not only that, it can extract information from popular email clients, as well as harvest information about the host computer.</p>
<p>Cryptocurrencies and other digital assets look set to soar in value over the coming years. It follows then that these kinds of threats will continue to rear their heads.</p>
<p>Anybody investing in this technology should also be looking at the <a href="/resources/features/">most efficient ways</a> to avoid targeting by malware. Part of that defense comes from understanding how the malware functions.</p>
<h2 id="how-it-works">How It Works</h2>
<p>Exactly what is Mars Stealer?</p>
<p>Before the existence of Mars Stealer was its predecessor, Oski Stealer. The original blueprint for the newest iteration came from a piece of malware that had many of the same capabilities.</p>
<p>The original Oski Stealer relied on a vulnerability with Windows: the ability to hijack the NCSI (Network Connectivity Status Indicator). This hijacking allowed Oski to install itself on a host computer.</p>
<p>Unfortunately for anybody seeking to safeguard against this type of malware, the new variant is far more deadly. Not only is it capable of more theft, but it also possesses powerful obfuscation techniques to keep itself safe.</p>
<p>A few techniques it can employ include the ability to encrypt strings of code and hide the DLLs that it uses to function. Managing to find Mars Stealer before it causes damage is a difficult task.</p>
<h2 id="risk-groups">Risk Groups</h2>
<p>You might be under the impression that your network or computers have sufficient security. Seeing the list of services and software vulnerable to Mars Stealer is sure to dispel that notion.</p>
<p>Almost every popular browser that uses an extension will be vulnerable—even the most secure, popular options. Users of Chrome, Firefox, and Opera will all be at risk from Mars Stealer.</p>
<p>The malware can tap into the browser extensions for popular crypto wallets, harvesting logins, keys, and 2FAs. Due to the nature of the malware, it&#39;s a difficult task to identify whether or not you are currently at risk.</p>
<p>If you live in the Commonwealth of Independent States and encounter this particular malware, you might get away unscathed. According to multiple sources, the malware will not steal any information from hosts in <a href="https://encryptobyte.com/beware-a-new-malware-mars-stealer-can-steal-your-crypto/">that specific area</a>.</p>
<p>You might consider yourself lucky in those circumstances, but it&#39;s a huge gamble to take. There&#39;s no guarantee that the malware will remain the same, and new variants are constantly under development.</p>
<p>That possible refinement and development mean that the people at risk are also under constant change. Thinking you are safe today doesn&#39;t mean that tomorrow won&#39;t bring something worse.</p>
<p>Whether you run a single computer with access to digital assets or have a network of computers, the risk is still there.</p>
<p>Somebody spreading malware will not differentiate between individuals and businesses. Everybody will be fair game.</p>
<h2 id="protecting-yourself">Protecting Yourself</h2>
<p>Keeping your network and computers safeguarded against the latest threats can be difficult. The cybersecurity landscape is constantly changing to meet the demands of new threats. Standard security offerings such as virus checkers and firewalls are becoming less and less reliable.</p>
<p>It can take time for virus checkers to figure out how to remove Mars Stealer and similar malware. Time is the one thing you can&#39;t afford against a threat like this.</p>
<p>If traditional security solutions are becoming less viable, what is the answer? We live in a world that now demands near-constant internet access, with all of the issues that can bring from malware.</p>
<p>In the case of crypto assets, offline wallets are an option. A measure like this is somewhat draconian, though. Not only that, an offline wallet isn&#39;t a <a href="https://www.protrada.com/are-crypto-wallets-safe">guarantee of safety</a> against a malicious actor.</p>
<h2 id="the-elegant-solution-to-mars-stealer">The Elegant Solution to Mars Stealer</h2>
<p>There is an elegant way to solve the problem of Mars Stealer and similar malware, though.</p>
<p>A large company will have the resources to implement a sophisticated security setup for its network. Though this is effective, it would be exhausting to the finances of a smaller business to do so.</p>
<p>An external solution exists in the form of CTS-AI. Streams of cyber security intelligence pour into the CTS-AI, giving it a powerful <a href="/use-cases/cryptojacking-and-cryptomining-malware/">unique threat detection</a> for detecting Mars Stealer.</p>
<p>Malicious code, suspicious network activity, or elevated CPU usage levels are all tell-tale signs. Without a team of security experts or an expensive software solution, these red flags can go undetected.</p>
<p>Managing to find Mars Stealer is a perfect example of where CTS-AI shines, though. It is constantly running, a watchful eye that never sleeps. Not only that, all of the threats receive validation from humans, meaning the accuracy is of a high standard.</p>
<p>CTS-AI can also be set to respond automatically to the threat. In a situation where minutes could mean the difference between secure and lost information, the value speaks for itself.</p>
<h2 id="protect-yourself-today">Protect Yourself Today</h2>
<p>It could be Mars Stealer today or something worse tomorrow. As the relentless march of malware development continues, it is imperative to stay one step ahead. NTT&#39;s CTS-AI is the perfect tool to help you protect your network from malware.</p>
<p>If you want to know how to detect Mars Stealer, this is the way to do it. Don&#39;t skimp on your security when there are affordable, effective safeguards.</p>
<h2 id="read-the-mars-stealer-malware-white-paper-from-the-global-threat-intelligence-center">Read the Mars Stealer Malware White Paper from the Global Threat Intelligence Center</h2>
<p><a href="/img/blog/Mars-Stealer-Malware_WP-1.pdf">Mars Stealer Malware White Paper</a></p>


Articles

CTS-AI Offers Immediate Access to Robust Protection Against Vermillion Strike Domain Activity

Old domains resurface in new Vermillion Strike campaign

Log4j: Protect Your Business from the Most Serious Cyber Breach Ever

Detecting and Responding to Mars Stealer Cryptojacking Malware on Your Network