Beware of What Is Lurking in the Shadows of Your IT



Beware of What Is Lurking in the Shadows of Your IT






























Five Stages of a Ransomware Attack, during one ransomware incident X-Force uncovered an entrenched advanced adversary that was leveraging a Shadow IT bridged network to maintain access to two organizations for over a year.

During the investigation, X-Force identified the ransomware attack was contained within a single domain of the multi-domain forest. However, X-Force was able to uncover evidence indicating the adversary had pivoted throughout the entire forest to execute the attack.

X-Force traced the evidence across the forest root domain to another child domain where the adversary had maintained persistence access for 381 days. While monitoring the environment, X-Force detected the adversary return to the environment from an IP range unknown to the client’s IT department. Working with the client’s IT team, X-Force and the client traced the activity back to the security office, where a rogue networking device was discovered that was installed to share badge printing capabilities between the client and another organization.

While interviewing the client and the other organization, the bridged network was unknown to all IT departments and had allowed the adversary to pivot back and forth and operate outside of the visibility of both security teams. This is a worst-case scenario for Shadow IT. Had X-Force not been persistent during the investigation and followed the evidence to determine the root cause of the attack, the adversary would have maintained access to the environment and could have executed another ransomware attack against the client.

Shadow IT - Bridged Network.png

Shadow IT Preparedness

Shadow IT can introduce unnecessary risk to an organization because blind spots are the enemy of security. X-Force recommends organizations implement a prevention, detection, and response strategy with regard to Shadow IT to achieve a holistic approach to risk management.

If you are interested in learning more about how to prevent, detect, and respond to Shadow IT within your organization, X-Force provides world-class proactive and reactive services to ensure your organization achieves complete preparedness for the threat of Shadow IT.

If you have questions and want a deeper discussion about Shadow IT prevention, detection, and response techniques or to learn how IBM X-Force can help you with incident response, threat intelligence, or offensive security services schedule a no-cost follow-up meeting here: IBM X-Force Scheduler.

If you are experiencing cybersecurity issues or an incident, contact X-Force to help: U.S. hotline 1-888-241-9812 | Global hotline (+001) 312-212-8034.

Lastly, download the 2022 Definitive Guide to Ransomware to fortify your knowledge and defenses against ransomware threats here.

More from Defensive Security

A diverse group of professionals having a discussion in a modern cyber defense office with large digital screen wall
A diverse group of professionals having a discussion in a modern cyber defense office with large digital screen wall

Why federal agencies need a mission-centered cyber response

4 min read – Cybersecurity continues to be a top focus for government agencies with new cybersecurity requirements. Threats in recent years have crossed from the digital world to the physical and even involved critical infrastructure, such as the cyberattack on SolarWinds and the Colonial Pipeline ransomware attack. According to the IBM Cost of a Data Breach 2023 Report, a breach in the public sector, which includes government agencies, is up to $2.6 million from $2.07 million in 2022. Government agencies need to move…

Closeup on a screen with binary code & the word password which is being grabbed by a hand holding tweezers
Closeup on a screen with binary code & the word password which is being grabbed by a hand holding tweezers

X-Force uncovers global NetScaler Gateway credential harvesting campaign

6 min read – This post was made possible through the contributions of Bastien Lardy, Sebastiano Marinaccio and Ruben Castillo. In September of 2023, X-Force uncovered a campaign where attackers were exploiting the vulnerability identified in CVE-2023-3519 to attack unpatched NetScaler Gateways to insert a malicious script into the HTML content of the authentication web page to capture user credentials. The campaign is another example of increased interest from cyber criminals in credentials. The 2023 X-Force cloud threat report found that 67% of cloud-related…

data transfer concept, internet server connection icon
data transfer concept, internet server connection icon

X-Force releases detection & response framework for managed file transfer software

5 min read – How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.

Subscribe today

Source: https://securityintelligence.com/posts/beware-lurking-shadows-it/

Tags: SHADOW IT, LEARN, VULNERABILITY, CREDENTIAL, CVE, CLOUD, PERSISTENCE, EMAIL