SASE Week 2023 On-Demand! Explore sessions.

  • Servicio de seguridad Productos Edge

    Protéjase contra las amenazas avanzadas y en la nube y salvaguarde los datos en todos los vectores.

  • Borderless SD-WAN

    Proporcione con confianza un acceso seguro y de alto rendimiento a cada usuario remoto, dispositivo, sitio y nube.

La plataforma del futuro es Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG) y Private Access for ZTNA integrados de forma nativa en una única solución para ayudar a todas las empresas en su camino hacia el Servicio de acceso seguro Arquitectura perimetral (SASE).

Todos los productos
Vídeo de Netskope
Borderless SD-WAN: el comienzo de la nueva era de la empresa sin fronteras

Netskope Borderless SD-WAN offers an architecture that converges zero trust principles and assured application performance to provide unprecedented secure, high-performance connectivity for every site, cloud, remote user, and IoT device.

Leer el artículo
Borderless SD-WAN
Adopte una arquitectura de borde de servicio de acceso seguro (SASE)

Netskope NewEdge es la nube privada de seguridad más grande y de mayor rendimiento del mundo y ofrece a los clientes una cobertura de servicio, un rendimiento y una resiliencia incomparables.

Más información sobre NewEdge
NewEdge
Tu red del mañana

Planifique su camino hacia una red más rápida, más segura y más resistente diseñada para las aplicaciones y los usuarios a los que da soporte.

Obtenga el whitepaper
Tu red del mañana
Netskope Cloud Exchange

Cloud Exchange (CE) de Netskope ofrece a sus clientes herramientas de integración eficaces para que saquen partido a su inversión en estrategias de seguridad.

Más información sobre Cloud Exchange
Vídeo de Netskope
Cambie a los servicios de seguridad en la nube líderes del mercado con una latencia mínima y una alta fiabilidad.

Más información sobre NewEdge
Lighted highway through mountainside switchbacks
Habilite de forma segura el uso de aplicaciones de IA generativa con control de acceso a aplicaciones, capacitación de usuarios en tiempo real y la mejor protección de datos de su clase.

Descubra cómo aseguramos el uso generativo de IA
Habilite de forma segura ChatGPT y IA generativa
Soluciones de confianza cero para implementaciones de SSE y SASE

Más información sobre Confianza Cero
Boat driving through open sea
Netskope hace posible un proceso seguro, rápido y con inteligencia cloud para la adopción de los servicios en la nube, las aplicaciones y la infraestructura de nube pública.

Más información sobre soluciones industriales
Wind turbines along cliffside
  • Recursos

    Obtenga más información sobre cómo Netskope puede ayudarle a proteger su viaje hacia la nube.

  • Blog

    Descubra cómo Netskope permite la transformación de la seguridad y las redes a través del servicio de seguridad (SSE).

  • Eventos & Workshops

    Manténgase a la vanguardia de las últimas tendencias de seguridad y conéctese con sus pares.

  • Seguridad definida

    Todo lo que necesitas saber en nuestra enciclopedia de ciberseguridad.

Podcast Security Visionaries

Leveling Up the SASE Conversation
Robert Arandjelovic and Gerry Plaza sit down to chat with Max Havey about how embracing a SASE journey can help bring networking and security teams closer together.

Reproducir el pódcast
Leveling Up the SASE Conversation
Últimos blogs

Cómo Netskope puede habilitar el viaje de Zero Trust y SASE a través de las capacidades del borde del servicio de seguridad (SSE).

Lea el blog
Sunrise and cloudy sky
SASE Week 2023: Your SASE journey starts now!

Replay sessions from the fourth annual SASE Week.

Explorar sesiones
SASE Week 2023
¿Qué es Security Service Edge (SSE)?

Explore el lado de la seguridad de SASE, el futuro de la red y la protección en la nube.

Más información sobre el servicio de seguridad perimetral
Four-way roundabout
  • Nuestros clientes

    Netskope da servicio a más de 2.000 clientes en todo el mundo, entre los que se encuentran más de 25 de las 100 empresas de Fortune

  • Soluciones para clientes

    Le apoyamos en cada paso del camino, garantizando su éxito con Netskope.

  • Comunidad de Netskope

    Aprenda de otros profesionales de redes, datos y seguridad.

  • Formación y certificación

    La formación de Netskope le ayudará a convertirse en un experto en seguridad en la nube.

Ayudamos a nuestros clientes a estar preparados para cualquier situación

Ver nuestros clientes
Woman smiling with glasses looking out window
El talentoso y experimentado equipo de servicios profesionales de Netskope proporciona un enfoque prescriptivo para su exitosa implementación.

Más información sobre servicios profesionales
Servicios profesionales de Netskope
La comunidad de Netskope puede ayudarlo a usted y a su equipo a obtener más valor de los productos y las prácticas.

Acceder a la Netskope Community
La comunidad de Netskope
Asegure su viaje de transformación digital y aproveche al máximo sus aplicaciones en la nube, web y privadas con la capacitación de Netskope.

Infórmese sobre Capacitaciones y Certificaciones
Group of young professionals working
  • Empresa

    Le ayudamos a mantenerse a la vanguardia de los desafíos de seguridad de la nube, los datos y la red.

  • Por qué Netskope

    La transformación de la nube y el trabajo desde cualquier lugar han cambiado la forma en que debe funcionar la seguridad.

  • Liderazgo

    Nuestro equipo de liderazgo está firmemente comprometido a hacer todo lo necesario para que nuestros clientes tengan éxito.

  • Partners

    Nos asociamos con líderes en seguridad para ayudarlo a asegurar su viaje a la nube.

Apoyar la sostenibilidad a través de la seguridad de los datos

Netskope se enorgullece de participar en Vision 2045: una iniciativa destinada a crear conciencia sobre el papel de la industria privada en la sostenibilidad.

Descubra más
Apoyando la sustentabilidad a través de la seguridad de los datos
La más Alta en Ejecución. Más Avanzada en Visión.

Netskope ha sido reconocido como Líder en el Gartner® Magic Quadrant™ de 2023 en SSE.

Obtenga el informe
Netskope ha sido reconocido como Líder en el Gartner® Magic Quadrant™ de 2023 en SSE.
Pensadores, constructores, soñadores, innovadores. Juntos, ofrecemos soluciones de seguridad en la nube de vanguardia para ayudar a nuestros clientes a proteger sus datos y usuarios.

Conozca a nuestro equipo
Group of hikers scaling a snowy mountain
La estrategia de venta centrada en el partner de Netskope permite a nuestros canales maximizar su expansión y rentabilidad y, al mismo tiempo, transformar la seguridad de su empresa.

Más información sobre los socios de Netskope
Group of diverse young professionals smiling

Phishing Attacks on Retail Industry Ramp Up as the Holiday Shopping Season Approaches

Dec 13 2017
Etiquetas
Cloudphishing
Malware
Phishing
Threat Research

The end-of-year holidays are a lucrative time for phishing attackers and spammers as they try to leverage the festive season to victimize online consumers. This season also puts pressure on the retail industry to build up their inventory to meet the seasonal demand. Netskope Threat Research Labs has been tracking multiple campaigns where phishing emails are crafted to target the retail industry. The email body observed in these campaigns is specifically crafted to lure the warehouse managers and other smaller firms who provide inventory support to larger retail businesses. Netskope Threat Protection detects these malicious MS Office file attachments as Trojan.Valyria.111 and the dropped payload as Gen:Variant.Graftor.421418.

Attack Vector

As mentioned earlier the attack vector arrives as an email with an attachment as shown in Figure 1.

Figure 1: Email example targeting specific businesses

The email contains a weaponized Microsoft Excel or Word document file with embedded macros. In a number of enterprises, email attachments are often automatically synced to cloud storage services using file collaboration settings in popular SaaS applications and third-party applications. Since the file names appear less suspicious, they are more likely to be viewed as coming from within the organization (and therefore trusted) and shared with others in the same user group thereby resulting in a CloudPhishing fanout effect.

The doughnut chart shown in Figure 2 depicts the top enterprise cloud applications where CloudPhishing is dominant. Applications linked with email clients are mostly affected. For example, Microsoft OneDrive and Google Drive seamlessly integrate with their email clients and hence the files get synced across all users accessing the synced drive folders.


Figure 2: Distribution of malicious attachments stored in Cloud Applications

Analysis of malicious document

The attack follows the usual scenario wherein the office document contains an embedded macro and upon opening it prompts to enable editing. The list of indicators from the embedded macros upon executing Olevba from Oletools is shown in Figure 3.

Figure 3: List of indicators captured by Olevba

As shown in the above figure, the Excel document contains workbook_open() function which denotes the execution of the macro code when the document is opened. The initial macro code is highly obfuscated with the nature of the subroutines containing long variable declarations. All these functions are then called within workbook_open() as shown in Figure 4.

Figure 4: Obfuscated functions called by workbook_open()

Upon deobfuscation, the VB macro launches command prompt which in turn invokes Powershell. A simple representation of the shell command is shown in Figure 5.

Figure 5: Powershell command execution performed by the malicious macro

The PowerShell command then begins to download the payload from an SSL website https://lambda[.]sx , which appears to be a web server built using the GO programming language and open-sourced here: https://github.com/mstojcevich/lambda-ng-go. The malicious intent of the file cannot be tied to the web server and/or its owner at this point. We assume the website could have been compromised to host the malicious code. On further analysis of the related samples attributed to this campaign, we have also observed payloads delivered from popular cloud services like Dropbox and some other compromised web servers which we had blogged about in the past.

Malware Payload – Pony

The downloaded payload appears to exhibit the properties of the infamous data theft botnet called Pony or Fareit. This malware family has been used in phishing campaigns ever since its source code was made available for sale in underground hacking forums. The payload analysed in our investigation appeared to be built using Pony builder 2.0 and exhibits properties similar to the original Pony samples seen in the wild before its source code was for sale. The sample’s flow is obfuscated in a slightly more complex way than its predecessors but uses the same concept of Push-to-Ret which simulates a call return handle.

The malware begins its operation by creating persistence onto the host system through a VB script in the Startup directory which would invoke a copy of the malware stored in User/AppData/Roaming as shown in Figure 6.

Figure 6: VB script that creates persistence by running the malware binary on startup

The malware attempts to steal credentials from multiple services that use password authentication and contain critical data like FTP, RDP and Outlook as shown in Figure 7.

Figure 7: Pony malware attempting to enumerate FTP services on the infected host

The pony data theft trojan also attempts to change Internet access settings, steal browser history, and cookies from the infected host. The main thread then performs a process injection into explorer and counts on its persistence mechanism to ensure that it runs every time the machine restarts.

The malware attempts to communicate with its command and control server hosted on IP 185[.]62[.]188[.]128 which was down at the time of this analysis. The Post request made by the malware to its command and control server and the URI pattern is similar to the previous versions of pony as shown in Figure 8. Passive DNS data from Virustotal shows that the IP has a long history of hosting malicious services for malware authors and spammers.

Figure 8: Malware command and control activity

Conclusiones

With the holiday shopping season around, organizations and individual users should be extra cautious about their online activities. Pay close attention to media where we share critical information like email communications, credit card details, and PII data. Year after year, we are witnessing a surge in digital crime activities during these months. Staying vigilant is the best approach towards a digitally safe holiday.

General Recommendations

Netskope recommends the following to combat such threats:

  • Detect and remediate cloud threats using a threat-aware CASB solution like Netskope and enforce policy on usage of unsanctioned services as well as unsanctioned instances of sanctioned cloud services
  • Sample policies to enforce:
    • Scan all uploads from unmanaged devices to sanctioned cloud applications for malware
    • Scan all uploads from remote devices to sanctioned cloud applications for malware
    • Scan all downloads from unsanctioned cloud applications for malware
    • Scan all downloads from unsanctioned instances of sanctioned cloud applications for malware
    • Enforce quarantine/block actions on malware detection to reduce user impact
    • Block unsanctioned instances of sanctioned/well known cloud apps, to prevent attackers from exploiting user trust in cloud. While this seems a little restrictive, it significantly reduces the risk of malware infiltration attempts via cloud
  • Enforce DLP policies to control files and data en route to or from your corporate environment
  • Regularly backup and turn on versioning for critical content in cloud services
  • Enable the “View known file extensions” option on Windows machines
  • Warn users to avoid executing unsigned macros and macros from an untrusted source, unless they are very sure that they are benign
  • Warn users to avoid executing any file unless they are very sure that they are benign
  • Warn users against opening untrusted attachments, regardless of their extensions or filenames
  • Keep systems and antivirus updated with the latest releases and patches

Stay informed!

Subscribe for the latest from the Netskope Blog