Transcription performed by LeahTranscribes[FULL TRANSCRIPT]
JACK: Today we’re talking with Andrew.
ANDREW: I’m a District Forensics and Incident Response Consultant.
JACK: Andrew works on a team that does incident response. Once malware is detected on the network it’s up to him to go in, study the malware, and remove it. Andrew, do you like doing this kind of work?
ANDREW: I love it. It’s wonderful. It’s very exciting work. There are many positions where you can be working on a client’s system and actually – the threat act is on there at the same time as you, trying to move files around. You are trained to thwart them in a toe-to-toe scenario. It can be very exciting. It can be very exciting.
JACK (INTRO): [INTRO MUSIC] This is Darknet Diaries, true stories from the dark side of the internet. I’m Jack Rhysider. [INTRO MUSIC ENDS]
JACK: Andrew works for a security assessment and digital forensics company. Other companies hire his team to come in and do security work. It’s actually pretty common for a company to outsource their security team to someone else. It’s expensive and hard to maintain an internal group of security experts. Andrew is often seen travelling around, taking care of threats in his clients’ networks. He wants to share an interesting story with us today about the time he faced a hacker in a company that develops cutting-edge technology.
ANDREW: The client is a global firm; it’s a technology firm. We were looking at – we had to go on-site in their European – one of their European bases to work with a team there.
JACK: We won’t give the name of the company but this company in particular spends a lot of time and money developing new technology. They have a full R&D department and is working on cutting-edge tech. In fact, they’re developing tech that no other company is developing, so one of their most precious assets is intellectual property, or otherwise known as IP. The company wants to make sure there aren’t any hackers stealing this information.
ANDREW: It started off as a compromise assessment.
JACK: Sometimes companies hire a security team to examine the network to see if there’s any evidence that a hacker is in the network.
ANDREW: They wanted us to go in, put some stuff in their network. We put some stuff on their end-points, just have a look around, used the intel that we’d already built up in the team during the engagements that we’d done previously. Just basically have a look around and see what came out.
JACK: The team starts examining the logs and the network, and they look at different security devices and network activity.
ANDREW: [ELECTRONIC MUSIC] Their security assessment involved using intel that my colleagues had seen elsewhere in other engagements for APT groups. They spotted a few pieces of evidence which, I’m not sure exactly what it was, it may have been specific malware that continued elsewhere, but they were able to identify that there was an active threat act in that client’s environment.
JACK: [DARK MUSIC] He mentioned APT and threat actor. This is the worst kind of hacker to find in your network. The term threat actor is just a fancy way to describe someone who poses a threat to your network, but an APT stands for Advanced Persistent Threat. It describes a group of highly-skilled and motivated hackers that have a specific goal of what they want to accomplish. But what’s more is they often have significant resources such as being sponsored by a nation state, or simply well-funded.
ANDREW: So I’ve been told, it’s state-sponsored. It’s in the east, I guess. The group itself has been known to infiltrate other technology companies.
JACK: To be attacked by an APT means you’re facing a very skilled and serious attacker who likely won’t go away easily. [00:05:00] It’s extremely difficult to detect an APT in the network. Someone has to have studied that APT for months or maybe years to understand the malware they use in their tactics, and then publish that data to the world. Then if we detect certain malware in the network, we may be able to link it back to that specific APT but the problem is once that report gets published, other people have access to those techniques, too. The APT group may change their tactics to be more covert. In this case the malware found in the network matched exactly the same malware that someone had published in a report which linked it back to that APT group.
ANDREW: We spun it up to – the company that I work for spun it up to a follow incident response engagement. I came in as part of the team that was doing some of the forensics work, so they would ask us to take a look at the data that they were collecting.
JACK: This process is fascinating to me. The forensics team first identifies and isolates the malware and they study it. They develop a profile for that malware; things like file size, files names, and the activity the malware is doing. Is it reaching out to the internet? Is it trying to access something internal? Is it using specific ports? All this gets collected and so now we know the indicators have compromise, or IOCs. This is given to another security team which they can use to look for those IOCs in the logs, which would then reveal more places this malware has been in the network. These teams would continue to feed each other information to learn and detect more and more about this APT in their network.
ANDREW: That went on for a few months.
JACK: Why not remove the malware right away?
ANDREW: That’s a good question. We do get asked a lot why we don’t immediately remediate. The client environment, it’s a global company. They have a lot of satellite offices, quite a complex infrastructure. What we would do, and this is quite common for all IR companies, is you’ll have like a monitoring period or a discovery phase where you will look for where the threat actor is active in the environment, what tools they are using, try and identify how many back doors these people have into their environment. We wanted to get as accurate a picture as possible as to where they were active, where they were coming in, where their ingress points were, where they were moving data out, ‘cause we had seen that. Just so when we came to remediation, it wasn’t the case that we were removing some of their infrastructure only for them to come back in the following week somewhere else that we hadn’t seen. The other concern there is that they know that we’re onto them. Once you do that remediation, once you do that kick out, they know you’re onto them and they will change their tools and their tactics and their procedures. That makes you blind, I guess, depending on what else you implemented. For a threat actor or for any adversary to know that you are – that you’re onto them, and you remove what they have used in an environment, if they have a backup plan, they’ll go to that. And whether that’s immediately or over a period of time, they might let time lapse before they come back in.
JACK: The team spends a few months researching this hacking group and what they’re doing. What was discovered confirms the company’s worst fears.
ANDREW: They were looking for R&D systems. They were looking to exfiltrate and they did exfiltrate some intellectual property. [MUSIC]
JACK: This hacking group not only successfully broke into the network but they’re successfully exfiltrating or stealing the latest cutting-edge technology from the company. For a tech company that’s this advanced, having their intellectual property stolen is a huge problem which may have millions of dollars of impact to the company.
ANDREW: I don’t have a financial amount but there was a lot of concern simply because they were working on next-gen killer tech, I guess, which if in a competitor’s hands or in any other company’s hands, would obviously affect the performance of their company quite significantly. It’s the same with every client that we’ve ever worked with. They don’t want any kind of exfil at all but this specific one we saw quite intensive interest in their R&D department. [00:10:00]
JACK: The company was terrified that their IP was being stolen and wanted the malware removed immediately but the security team still needed to understand the threat and study it further. They weren’t ready to remove it.
ANDREW: We saw that they were active and we did a lot of forensic work. We did a lot of deployment into different areas. Like I said, we built that knowledge package up for remediation. Now, we were able to – so this was – I became involved in 2015 and the earliest evidence that we found was in 2010. That wasn’t the entry point; that was just the earliest sign of activity that we could find, was 2010. We had evidence to suggest that the threat act had been in there for five years at least. The evidence we found, I think it was some file activity on one of the drives which somebody had dated as 2010, which could have been planting something. I don’t know the details of it more than the date, I’m afraid. I remember sitting in the board room with the client in their office and there was a team of us there. We broke it to them that 2010 was the earliest we could find. It hit home that they’ve had, for half a decade somebody has had access to their environment without their awareness.
JACK: How did the client take this kind of news?
ANDREW: It was a mixed response; some of the people there got angry and wanted to know why we weren’t remediating immediately, which comes back to your original question. Then there were others who were on board; how do we progress this? What are we seeing? What do we do next? Then there was fear, obviously, ‘cause like I said, it’s a technology firm; they have their R&D and they want to be the best in the market. They want to know what’s being filtered out the door but if we’re only coming into their environment in – I think it was early 2015, it was before I started. Like I said, that’s half a decade that this entity could have been moving data out. It was a mixed bag of emotions and all completely understandable. At the end of the day we’re strangers sitting in a room telling them that they’ve been owned for a long time, but that we’re not in a position yet to remediate because we’re not ready. It’s a difficult subject to – it’s a difficult topic to discuss with any client.
JACK: The security team goes back to studying the APT to collect even more data.
ANDREW: We were still seeing activity during the examinations, during the monitoring phase and during the discovery phase. [MUSIC] It was quite interesting because they were active. We could see lateral movement, we could see them doing things like basically logging in to make sure that their stuff was still sitting on these end-points, that they could reach out to certain – see to communications, updating their tools. It’s interesting to see them do it because these guys in the background who are logging in and making sure that their malware is still running and deploying newer versions, it was – I don’t really want to say it was interesting to watch ‘cause obviously this is a company’s livelihood but from a detached perspective, watching how they functioned was very interesting.
JACK: Now that a few months have gone by the forensics team feels confident enough that they’ve collected enough information that they can remove the APT from the network once and for all. They’ve discovered the potential ways [00:15:00] it got in, and what log-ins it’s used, and where it’s gone, and what it’s done. It’s time to remediate and finally kick this hacking group off the network but all of a sudden the activity from the APT stopped.
ANDREW: In the weeks up to the remediation the threat act had gone quiet, had gone very quiet. We weren’t seeing any movement. We weren’t seeing anything, really, which usually means that they’ve either succeeded in what they came to do or something else.
JACK: Andrew and his team are all ready to clean this off the network but he has to fly to the office location to do the remediation so he packs his things and heads to the airport. He’s scheduled to do the remediation in just two days.
ANDREW: I was sitting in the airport waiting to fly out and my colleague phoned me. He was supposed to have been coming out with me but he had some last minute issues and couldn’t be out there. There was a few of us going out but he couldn’t make it with me but he phoned me up and he said, “Have you seen the news?” It wasn’t headline news; it was just financial news where the firm that we were working for had been the subject of a buy-out, a very expensive buy-out attempt by a company that was from the same part of the world that we believed the threat actor was from. As soon as my colleague phoned me in the airport and I told everyone else that I was flying out with, it was kind of a oh, I wonder, penny-dropped kind of thing.
This is obviously – it’s a what-if, right, that we don’t know for sure. But the timing to me seemed awfully convenient and like I said, for the last couple of weeks the threat act had gone quiet and then all of a sudden out of the blue came this attempt at a buy-out. It was for a phenomenal amount of money, a phenomenal amount of money. It came as a surprise to everyone but when I actually told the people I was working with, there was that kind of, yeah, I wonder if that was what was going on. That got me thinking about how these companies – they get compromised by these state-sponsored groups as a means of due diligence, I guess. Has the company – how much are they worth? What kind of IT do they have? What’s their R&D department look like? As a means of, should we buy them? Can we make money off it? The client has designed something where it could be the next big thing. It really could be the next big thing.
It just makes me wonder whether or not they are the subject of these compromises as a means of some other third party conducting due diligence because there have been a couple of things in the media where companies are being genuinely purchased, have inflated their figures prior to acquisition. If you’re getting – if you’re compromised and they’re in there looking at your accounts, I guess, and what you’ve got going on there, that’s a perfect opportunity to get what a company is worth and feed this back to whoever. That was my train of thought on that. As far as remediation goes it was very quiet, touch wood. We didn’t hear anything after that. Once you do a remediation you’re kind of on high-alert for some kind of activity afterwards where the threat actor realizes you’ve closed them out of the environment and then try and make their way back in. That’s a good opportunity to look for stuff that was – there’s no other way of putting it, stuff that was missed during the monitoring phase, the discovery phase. But that one was very quiet.
JACK: So, did they accept the buy-out offer?
ANDREW: Yes, they succeeded in buying the company, yeah. It just gets you thinking. Hacking is like a business. For everything I’ve seen, I’ve never worked on an engagement where there’s been any destruction to data, any corruption, any deletion. There’s been no – [00:20:00] whilst theft in itself is malicious, I’ve not seen anything beyond theft. I’ve never seen cyber-vandalism or the hacktivism or anything like that. I’ve always seen it – it’s always been attempts at theft and intellectual property. I think that’s a business. I think in the real world, in the above board world of business, people steal ideas every day. I just think this is another form of it. I think companies need to think differently to the way they are right now about how these groups and their sponsors are thinking. It’s all about money. It’s all about money.
JACK (OUTRO): [OUTRO MUSIC] You’ve been listening to Darknet Diaries. For show notes and links, check out darknetdiaries.com.
[OUTRO MUSIC ENDS]
[END OF RECORDING]