SentinelLabs came into being at the back end of 2019 as a means of providing value to the cyber security community by focusing on research and threat intelligence unavailable elsewhere. In an action-packed 13 months or so since then, we have published 65 posts on malware, ransomware, phishing campaigns, threat actors, software vulnerabilities and cybercrime fighting tools, and we have plenty more research and intelligence coming in 2021, too!
Looking back over the last 12 months, we have seen the cybercrime story unsurprisingly dominated by social engineering and malware campaigns themed around the COVID-19 pandemic. But there was also a lot of other things going on this year, from an explosion in RaaS (ransomware as a service) offerings and victim data exploitation with operators like Maze and Egregor, to a unique macOS ransomware/spyware campaign and, notably, the SUNBURST SolarWinds Orion supply chain attack.
Of course, you can catch up on all our research and threat intelligence posts over at SentinelLabs, but for a quick recap on some of the main highlights, take a scroll through our 2020 timeline below.
January
Following on from SentinelLabs’ groundbreaking discovery of the TrickBot Anchor malware at the end of 2019, our first research post of 2020 broke news of a new TrickBot backdoor called “PowerTrick”. Built for stealth, persistence and reconnaissance, PowerTrick is deployed inside infected high-value targets such as financial institutions.
February
North Korean cybercrime actors, specifically the Lazarus group (aka ‘Hidden Cobra’), have a long and storied history of destructive cyber attacks. 2020 was no different for the APT group, with campaigns targeting macOS as well as the Windows platforms. SentinelLabs rounded up a collection of this adversary’s toolsets, including Bistromath, Hoplight, Slickshoes and more.
March
TA5050 is crimeware group that has been around since at least 2014 and associated with a variety of advanced malware families, including Dridex, FlawedAmmyy, SDBot, TrickBot and Get2, a downloader used to deliver any of the above (and others). SentinelLabs developed a unique unpacker for the crypter used to obfuscate Get2 DLLs utilizing SMT.
April
More generally known as a banking malware trojan, the IcedID botnet was also deployed during 2020 to take advantage of the COVID-19 pandemic and to engage in a spot of tax fraud. SentinelLabs was the first to uncover how the infamous IcedID botnet uses social engineering and custom PowerShell uploaders to steal documents related to the victim’s identity and tax returns.
May
Understanding how APT actors operate is key to protecting your organization. SentinelOne’s Vigilance MDR team revealed how their Incident Response procedure uncovered an APT actor’s entry point, lateral movement, and persistence mechanisms.
June
This year, NetWalker ransomware, like many others, evolved into a RaaS (ransomware as a service) offering and also incorporated data leakage extortion into its repertoire. SentinelLabs revealed affiliate preconditions, technical details, and victim exploitation associated with the NetWalker RaaS.
July
A rare case of ransomware came to the macOS platform in 2020, variously called ‘EvilQuest’, ‘ThiefQuest’ and ‘MacRansom.K’. SentinelLabs researchers were the first to reverse the encryption routine used in the malware and to release a public decryptor for any unfortunate victims.
August
Right up until August, Maze was one of the most widespread and successful ransomware threats out there. Maze’s success can in part be attributed to the fact that attacks are customized by human operators to exploit the particular environment of victims. SentinelLabs caught one in action and detailed the attacker’s moves.
September
From the earliest months of the pandemic, threat actors exploited the COVID-19 coronavirus in multiple ways. This rolling blog post began in February and details the phishing campaigns and other social engineering lures seen by SentinelLabs throughout the year.
October
In October, CISA released an urgent advisory warning that cybercriminals were targeting the Healthcare and Public Health (HPH) sector with Ryuk and Conti ransomware. The threat actors relied heavily on Anchor, a Trickbot derivative, as a loader to infect victims, and leveraged both DNS tunneling and ICMP for C2 communications. SentinelLabs was the first to uncover and reverse the ICMP component of the Anchor module.
November
Widely-believed to be the successor to the Maze ransomware, Egregor appeared around mid-September and has already been associated with cyberattacks against GEFCO and Barnes & Noble, Ubisoft, and numerous others. SentinelLabs detailed its payload, leveraging of Cobalt Strike and Rclone, and its post-compromise behavior.
December
The final month of 2020 revealed that a nation-state actor had been running a campaign since at least April via what may turn out to be one of the most damaging supply chain attacks of all time, the compromise of SolarWinds Orion, first detected in the environment of cyber security outfit FireEye. While we were able to validate that no SentinelOne customers were victims of this wide-ranging breach, many others were not so lucky and the fall out from SUNBURST is likely to continue into 2021. SentinelLabs took a look inside the SUNBURST backdoor and the dropped SUPERNOVA webshell trojan.
Conclusion
2020 turned out to be a busy twelve months for all those involved in fighting cybercrime, and for SentinelLabs’ researchers, there was no shortage of threats and threat intelligence to keep on top of. And of course, we’ll be right there with you throughout this coming year and beyond.
To all, we wish a happy and secure New Year and 2021. Ensure that you keep your organization, endpoints, network and cloud infrastructure safe with SentinelOne’s award-winning Singularity platform, and keep your security team up-to-date with SentinelLabs’ original and timely research.
