2023年2月21日

2023年2月21日下午6:45,以色列的高級技術學校,帶以色列理工學院(IIT),是由DarkBit ransomware攻擊的受害者的黑客團體,它要求一個80比特幣支付時(約170萬美元)的贖金注滿反以色列情緒。大學報道攻擊2月12日,一天後威脅演員編譯負載,根據一份報告黑莓。”這也許表明DarkBit保持初始訪問受害者的網絡之前,而植入編譯前幾個小時攻擊物化,“說德米特裏•Bestuzhev研究員黑莓的威脅。BlackBit IIT也警告稱,如果組織沒有在48小時內支付贖金,將躍升30%。損傷的程度,違反的起源,最初的感染向量尚未公布。的Golang-based ransomware具有幾個顯著的特性,比如獨立接受命令行參數和功能的能力。其默認模式涉及到加密受害者的設備利用aes - 256,影響眾多的文件類型。此外,它采用多線程的方法以確保更快和更有效的加密。Bestuzhev告訴深閱讀,根據贖金,演員的Twitter賬戶和電報和威脅,攻擊是地緣政治的主要動力而不是金融。額外的動力——複仇——表示通過DarkBit tweet和贖金的文本,它暗指的可能性複仇前科技員工可以利用內部的知識工具和軟件進行攻擊。 “A kindly advice to the hight-tech [sic] companies: From now on, be more careful when you decide to fire your employees, specially [sic] the geek ones. #DarkBit,” the tweet stated. While the statement could be a red herring, it’s worth noting that insider threats — for example an angry employee who has been fired, or a disgruntled worker trying to cause some damage to the enterprise — are a growing concern for security professionals. The commentary on Telegram, Twitter, and the DarkBit website also displays hacktivist motivations against Israel. Bestuzhev says that targeting a university creates noise, and since geopolitics is the agenda, the goal is to spread the message. “With many students and associates who can’t study and work, it serves as a message amplifier,” he says. “From the attacker’s perspective, it’s a great target to reach as many people as possible.” Multiple Motivations: Political, Financial, Personal Melissa Bischoping, director of endpoint security research at Tanium, agrees this attack touches on multiple motivations — political hacktivism, revenge, and financial gain. “Whoever is behind DarkBit has included comments in their ransom notes about their stances on political regimes as well as comments regarding layoffs and terminations of technical employees,” she says. “It remains to be seen if this is an entirely new group or an offshoot of a previous gang.” She points out that ransomware is increasingly used as a weapon in geopolitics , because it can be easily purchased and deployed, and it can deliver high-impact destruction quickly. “Ransomware operators are not concerned with remaining undetected,” Bischoping says. “In fact, it’s quite the opposite — they want to send a message, cause damage, and get paid.” She explains that universities can be popular targets because they often have understaffed IT departments and many endpoints to manage and secure, leaving multiple openings for a compromise. “It wasn’t a random attack, as DarkBit’s social media as well as their ransom note indicate clear political stances and motives against the Israeli government and its associated organizations,” she adds. Murky Intentions May Mask Something Worse Darren Guccione, CEO and co-founder at Keeper Security, says it’s inadvisable to assume a threat actor’s only motivations behind a ransomware attack, or any other type of malware offensive, are the ones that seem obvious or are spelled out by the threat actors themselves. “While ransomware is typically used to get paid, it could also be nothing more than a smoke screen or bonus payday as the threat actors work to compromise a target’s system or IT infrastructure in other ways,” he says. “No matter the threat actor’s apparent or true motivations behind this attack, a full investigation must be done to evaluate the scope of the cyberattack and remediate the damage,” Guccione says. As with all ransomware attacks, he advises against paying the ransom to deter future attacks of a similar nature. “Organizations should also consider implementing a zero-trust, zero-knowledge architecture to mitigate the damage of any future cyberattack,” Guccione says.