FOG RANSOMWARE GANG USES UNCONVENTIONAL METHOD

0:01 Hackers that use siteeca, GC two and adaptics in an espionage style intrusion against an Asian financial institution. FOG ransomware hackers known for targeting US educational institutions are now using legitimate employee monitoring software siteeca and several open source pen testing tools alongside usual encryption. In a May five attack on a unnamed financial institution in Asia, Symantec researcher spotted hackers using siteteca and several pen testers, including GC two in adaptics. The behavioral they found highly unusual in a ransomware attack chain. Reflecting on the shift in FOG's attacks, bug crowd SISO triy Ford said we should expect the use of ordinary and legitimate corporate software as the norm.

0:46 We referred to this as living off the land. Why would an attacker introduce new software, create more noise and logs and increase the likelihood detection when the liable software gets the job done for them well, Simantech identify the initial infection vector using the attack. FOG ransomware actors have used critical vulnerabilities in the past. Syteca was likely used as a stealer. Researchers found attackers using stowaway, the open source proxy tool designed for secure communication between internal and external networks. It is not known how the attackers use the setecha tool during the intrusion, which was distributed as files under the names like Syteca client dotxe. Still, they have very serial potential of an employee monitoring tool with

1:32 screen recording, a keystroke logging capabilities isn't too hard to guess. Several libraries are loaded by this executable, suggesting it was possibly used for information stealing or spying. The real danger in this case isn't the ransom note, it's how fog turns a simple screen record into a hidden camera. Software is an essential driver of growth and innovation for every company. However, business apps we install an autopilot can suddenly become spy tools.

1:59 Security team, you should keep a live map, but where every monitoring app is allowed to run and flag it the one moment it pops up somewhere odd. In addition, another peculiarly observed in the attack was the use of open source penetration testing tools like GCT and adaptics, rarely seen with ransomware attacks. Google Command and Controls GC two is an open source post exploitation tool that allows attackers to control compromise systems using legitimate cloud services like Google Sheets and Google Drive. The GC two implant alone potentially allowed attackers to run discovery commands, transfer files, and load shell code, hitting a deeper intelligence gathering objectives. Unlike typical ransomware actors that exit post encryption, the FOG group was

2:41 seen establishing persistence even days after deploying the ransomware and move more common and espionage operations. The attackers establishing persistence on a victim network having deployed the ransomware is also not something they would typically see in a ransom ware attack. And that's your update for now in regards to Fogg and get the rest of the article if you want from c s o O CSO online dot com for the whole article. That's it for now