Know Your Adversary™

In Episode 2 of Know Your Adversary™, we discuss an attempted compromise of a managed service provider (MSP) by a disgruntled former employee who tried to sell backdoor access on the dark web. Our guest is former Senior FBI Computer Scientist and current VP of Threat Hunting & Counterintelligence at Binary Defense, Randy Pargman. 

In 2019, Binary Defense engaged with an actor selling backdoor, unauthorized, and illegal access to an MSP in the eastern United States. The MSP provided out-source IT functions for many companies, and a compromise of their systems would have a major impact on hundreds of their clients. The actor, who identified himself only as “W0zniak,” attempted to sell the username and password for $600. In order to ensure confidentiality and proper legal engagement, Binary Defense coordinated with the FBI to properly conduct a “controlled purchase” of the credentials, inform the MSP, prevent any other threat actor from buying or accessing the MSP with the same credentials, help the FBI attribute and unmask the individual, and bring the actor to justice. 

Here are some of the key takeaways from the episode. 

Threat Actors Sell Access to Victim Networks using a Variety of Methods. In most cases, actors typically fall into several groups. Those that sell access, buy access, gain access and persist (ransomware, espionage, etc.), steal valuable information, and facilitate the payment(s) can all be different individuals or groups. In this case, a former employee created credentials with the intent to sell to another criminal(s). Unfortunately, he sold them to the good guys, Binary Defense and the FBI.

The Case for More Aggressive Attribution and Unmasking of Adversaries. An enterprise often needs to have the ability to determine if an attack is a target of opportunity (drive-by scam or smash and grab) or well-orchestrated and directed with a specific purpose in mind (insider threat, espionage to gain information, targeted fraud, and ransomware). When it’s clear an enterprise is under a direct assault, unmasking identities for attribution is often warranted in order to disrupt the attack and identify the perpetrator. Selling unauthorized access that could impact hundreds of other commercial victims justifies unmasking at the identity level to prevent the initial and potential subsequent attacks.

In episode 1 of the Know Your Adversary™ Podcast, we are joined by Mark Ray, former FBI Special Agent, Kamal Ghali  former Assistant US Attorney and current partner at Bondurant, Mixon & Elmore, and former FBI Forensics Expert and current Technical Principal at Nisos Willis McDonald. We discuss  one of the most famous cyber criminal cases of the 21st century, the attribution and takedown of Spyeye malware developer Alexander Panin and his primary facilitator Hamza Bendallaj. Spyeye was commodity malware that was sold on dark web marketplaces beginning in 2009. The malware was a program that ran on numerous browsers and operating systems allowing hackers to steal money from online bank accounts and initiate transactions even while valid users were logged into the bank account. Over seven years, the losses to consumers and enterprises exceeded $500 million worldwide. The investigation and takedown of  Panin and Bendallaj culminated in 2016 when they were sentenced to a combined 24 years and 6 months in prison.  

Here are some of the key takeaways from the episode.  

• The Real and Fake Lives of Personas Used By Cyber Criminals Online Often Intersect. Just like an enterprise, cyber criminals consider their return on investment when engaging in malicious activity. Just like Alexander Panin and Hamza Bendellaj did when they were establishing their complex web of bots and proxy servers, current criminals want to monetize crime as quickly as possible.  They want to scale their activities so it can be replicated between numerous victims and maximize their profits. When they do this, they often make operational security mistakes.   Identifying these mistakes are key to remediation.

• Criminals and Nation States Purchase Malicious Command and Control Servers Near Victim’s Locations to Reduce Malicious Signature. Attackers will not typically link their activity directly to their destination command and control servers in Russia or Eastern Europe. Typically, they establish C2 nodes near server farms, virtual physical locations, or individual machines physically located near their victims.  In this case, Bendallaj and Panin used servers in Atlanta. Gaining access to the local infrastructure can provide critical information about the commands and signatures the attackers used in their attacks.

Welcome to the podcast series, “Know Your Adversary™”.  In this podcast series, we will  show you how organizations can achieve attribution, unmask adversaries,  and understand the context of threats against their enterprise.  Nisos will share investigative stories revolving around trust and safety, adversary attribution, supply chain risk, executive protection, disinformation, brand protection, fraud, and cyber threat intelligence. Thank you and stay tuned for our first episode which will be the attribution of the well-known Spyeye malware developers.