Welcome back to salted hash, my name is steve regan with CSO online today
We're going to be talking about the matrix banker malware and a couple of other goodies stick with me, and we'll be right back
The matrix maker malware is a campaign. It's been taking place in Latin America and
The malware itself was first discovered in June
this year now what's interesting is is one of us first found it appeared to be under development and
Here lately it appears that developments going good because researchers a dark tray so it actually found
traces of it in Latin America particularly in Mexico and
according to what they've been saying between
August and October of 2017 dark traits detected highly anomalous behavior in five seemingly unrelated networks in Mexico
unlike the original strain of this attack which was believed to be targeting financial institutions almost exclusively this lady event latest variant
Affected customers across a number of verticals suggesting that the threat actors are diversifying their targets
With us to talk more about this. It's Justin fear director for cyber intelligence analytics at dark Trace Justin. How are you?
Great, thank you. Thank you for having me. Hey. Thanks for coming on I appreciate it so clue us in here
Tell me what tell me a little bit about this malware its background and what you guys know about matrix banker
Yeah, so you nailed it on the head. You know it was first discovered right around that time frame is mostly being in development
What was really most fascinating to us? Is that we found it?
crossing from the financial
vertical into other industry verticals
So it really appears that the attackers may be diversifying their attack set in addition
It was highly targeted, and we really didn't see it outside of the Latin America region at all
We caught the latest variant across five or six of our clients
across three different very
Industry verticals it had nothing to do what financial at this point, so it has morphed a little bit and changed
And it's it's very stealthy in its nature so when the random ransomware
So we just recently finished talking about ransomware in the studio, so that's obviously so stuck in the back of my head
when this malware starts to spread us it's still coming for through phishing or
You know like booby-trapped web sites are we talking about other other means? Yeah, so for the most part. It's still coming through phishing and
unfortunately in
2017 employees are still clicking
And it's it's the gift that keeps on giving
you know
But what we actually caught was a number of?
Different indicators of compromise when we catch it on our clients so we catch the download of the anomalous executable file from a rare
Destination we catch the second-stage payloader come down we see the device actually
Speaking out to command and control infrastructure
So will actually catch it on five or six different fronts when it does finally land in the network
So once the footholds established, what are you seeing the actors do with this this malware itself?
Well, I think the scariest part about it is we've actually seen it deactivate
endpoint protections and antivirus
Which you know?
Unfortunately too many companies rely on that and this is just another example of why you cannot rely on that technology
I would never tell a company not to invest in that technology
But what I would tell the company is not to rely so heavily why it's a bullet in other words was where you say
Yeah, absolutely and in this particular case this malware successfully disabled endpoint protection on these these
Clients and so had they not had a network anomaly detection tool such as dark Trace it probably would have gone unnoticed
And wreaked a whole lot more damage than a good. Who'd they disable?
What's that who was who what were the endpoint protections being dissed? I could I couldn't say specifically what programs
Do the ndas that we have in place?
Go figure leave it to the lawyers have an interesting discussion on on hacking methods
So circling back to the the malware itself when it is you know being installed and everything like this
Not just disabling like a
Be are you seeing it? You're seeing like data exfiltration are they actually taking stuff away from these companies are they just sitting
evidence waiting
Could you repeat question you froze up on my end sorry about that so going back to the question when you see it in fact
on a network and the the malware takes hold are you seeing data exfiltration you're seeing actual like a
hacks with this malware
It's just installing itself and sitting you know
Resident as it disables a V in this particular case we did see some beaconing activity and command and control
We didn't see any large-scale X filtration um you know
But that's not to say it wouldn't have happened had we not caught it in advance
So usually that's the end goal with any of these things so but hurrah wanna catch it
Okay
How far has development gone on this back in June when it was first discovered like like I'd mentioned earlier
It seemed like this was still in development, so how it's the the for example disabling a V
Is that a new thing or is it there more to it? I?
Couldn't say because I haven't looked at the you know analysis comparing both of them
As I said before the more interesting part to us is the fact that they moved from one industry into another so
Regardless of whether or not they've tweaked software
They're getting more brazen and they're going for four different targets in addition the fact that it's so
Targeted towards just the Latin American market there were certain
IOS C's in there such as you know the top-level domain being dot MX using cat LAN
You know domains as well that really led to that targeted nature. You know which really is interesting from our perspective
Any indicators as to why they're targeting these particular organizations?
directly or isn't
Unclear at this point. I think you'd have to ask them
alright
Well moving on from the the malware itself another reason why I had to come on today was to talk about
insider threats and here lately there's been a
sudden push for insiders, and and I guess detections of
you know inside her behavior at organizations, and I was wondering if you could chat for a little bit about
What you think the most serious insider threats are are they a particular employee in a certain you know department within the?
Organization are they an employee that has certain characteristics behind them, what should organizations watch out for when there
Considering insider threats, I'd good answer see all of the above
Unfortunately there really is no one category
They're all a threat and the fact of the matter is they have a badge into the building and a password onto the network
It's identifying when somebody moves over from regular
Employee to disgruntled employee, or is coerced by an outside entity to actually carry out an action
Insider threat is very difficult to catch because there is no rule or signature you can write for it
There is no sim query to write to catch it. It really it
Just is a matter of detecting and they start deviating from their standard pattern of life
You know if an employee is used to doing one thing for the last six months and now all of a sudden
They're looking at files that they don't normally look at they're connecting to cloud shares
They don't normally look at and then we see massive exfiltration happening
You know you should be able to spot that and on
Forge try there are too many tools out there outside of dart trace that can actually do just that the other thing
I really like to do is I spend a lot of time with my clients helping them build insider threats on teams
And there's one thing that's always missing from those teams that they've built and that's somebody from HR
HR knows the employees better than anybody and they should be part of that insider threat one team because they can spot things
Sooner than the security team can that might allude to somebody becoming a high-risk user so that's interesting I actually
I'm curious
Why does HR left out of the loop on that when I figured when your threat modeling for employees HR would be the first place?
You'd go
How do they get left out of the loop here?
Um I think it's just one of those things that a lot of security teams haven't even decided or built insider threat
Hunting's that's the first problem unfortunately?
We're still hyper focused on the desktop server model and just trying to get a handle on all the ransomware and all the commodity stuff
That's hitting our networks a lot of times insider threat becomes an afterthought until they actually get hit with it themselves so
Usually those teams that are starting to think about it from the ground up. They'll usually bring somebody from HR
So when it comes to threat modeling for employees that?
Could you know cause severe harm are there?
Markets or verticals that need to do this more than others like what's the priority here if somebody wants to do that now
I think it doesn't matter. I think every company's got something that somebody else wants. You know so regardless of the industry. You're in
You are at risk of it. You know it doesn't necessarily mean, it's gonna be nation state or corporate espionage
But it could just be a sales rep that moves from company a to Company B and brings their Rolodex with them
That's still considered insider threat
So you know the biggest thing is just getting a handle on your network and the hundred and ten percent
Visibility you need in order to spot the red flags
Awesome well Justin. Thanks again for taking the time to talk with us today
This has been salted hash, and I'm Steve Reagan if you want to keep up with Justin or any other developments on
Insider threats or new malware variants stay tuned to CSO online.com, and we'll be around with the show every week
You