{"id":74491,"date":"2023-12-29T17:43:55","date_gmt":"2023-12-29T09:43:55","guid":{"rendered":"https:\/\/version-2.com\/?p=74491"},"modified":"2023-12-22T12:11:16","modified_gmt":"2023-12-22T04:11:16","slug":"msps-putting-a-stop-to-hide-and-seek-within-their-environments-with-eset-cloud-office-security","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2023\/12\/msps-putting-a-stop-to-hide-and-seek-within-their-environments-with-eset-cloud-office-security\/","title":{"rendered":"MSPs putting a stop to \u201chide and seek\u201d within their environments with ESET Cloud Office Security"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Amidst increased obfuscation of multistage malware attacks, MSPs need an effective way to secure cloud communication while avoiding the need for multiple unique network connection authorizations.<\/span><\/em><\/p>

The days of simple and easily detectable malware are long gone. Recent campaigns by both OilRig <\/a>and MuddyWater<\/a> advanced persistent threat (APT) groups show that threat actors are constantly seeking new ways to hide their multistage malware attacks among files of commonly used cloud services.\u00a0<\/span><\/p>

This presents a dilemma for managed service providers (MSPs) that rely heavily on cloud-based solutions. But how should MSPs defend against increasingly sophisticated attacks without the burden of trying to control every single stream of communication within the MSP environment? <\/span><\/p><\/div>

A growing market and a growing threat<\/h3>

With the never-ending hunger for cloud-managed services, it is no surprise that the MSP market is constantly expanding, and business reports, such as MarketsandMarkets<\/a>, expect further growth by around $100 billion U.S. dollars within the next five years. <\/span><\/p>

Both MSPs and other outsourced business practices have proven to be the answer for countless companies seeking high-end solutions for reasonable prices. But there are two sides to every coin. Professional communications, services, and shared files all moving to the cloud has created a new breeding ground for sophisticated malware. <\/span><\/p>

Threat actors deploying this malware are often profit-driven and\/or state-sponsored APT groups using command-and-control (C&C) servers to communicate with compromised devices over targeted networks. When successful, these servers can issue commands to steal or encrypt data, spread malware, disrupt web services, and more. <\/span><\/p>

To enable this approach, APT groups need to establish persistence within the targeted businesses, obfuscating malicious files and processes among legitimate ones. <\/span><\/p><\/div>

A draft email you\u2019ll never send … nor ever even wrote<\/h3>

ESET researchers have described recent attacks in detail while following the evolution of campaigns run by the OilRig group<\/a>. <\/span><\/p>

To avoid cybersecurity scanning tools, OilRig has not been deploying fully fledged malware but, instead, has scaled its attacks. While the initial attack vector of the recent campaigns<\/a> remains unknown, presumably it was a phishing email. This email would contain a downloader that wouldn\u2019t cause any specific damage but, as the name implies, is designed to secretly download additional malware from the internet. Several versions of these downloaders have been documented by ESET researchers. <\/span><\/p>

Studying these downloaders, it is clear that OilRig is keenly focused on identifying new ways to obfuscate malware deployment using legitimate cloud service providers for C&C communication.<\/span><\/p>

The first in the series, SC5k downloader, uses the a shared Microsoft Exchange email account and Microsoft Office Exchange Web Services<\/a> API for C&C communication. Within this email account, the attackers create draft messages with hidden commands. Once the downloader infests a device, it will log in to the same account to receive both the commands and the payloads to execute. Its successor, OilCheck, works similarly but uses the Outlook mail API in Microsoft Graph.\u00a0 <\/span><\/p>

New versions of OilRig downloaders, ODAgent and OilBooster, communicate using the Microsoft Graph OneDrive API<\/a>. They access a OneDrive account controlled by the attackers for C&C communication and exfiltration. <\/span><\/p>

The evolution of malware-hiding capabilities was also recently noted in the case of another APT group linked to Iran called MuddyWater<\/a>.\u00a0 <\/span><\/p>

In a separate MuddyWater campaign, described by DeepInstinct<\/a>, the APT group reused previously known remote administration tools and hid them in the cloud-based content management system (CMS), called Storyblok<\/a>, to host archives with compromised files.<\/span><\/p><\/div>

ESET to help deal with the dilemma<\/h3>

The hiding capabilities of present-day C&C attacks have pushed businesses toward higher control over their network traffic<\/a>. From standard network monitoring, it can go as far as individually authorizing any network connection. <\/span><\/p>

However, the higher the control, the higher the workload on MSP admins and technicians who are already drained from a never-ending stream of alerts. So what do businesses choose: strict control that comes with alert fatigue or lower security standards that can result in a data breach? <\/span><\/p>

With its MSP Program<\/a>, ESET can help businesses deal with this dilemma. The program is based on the ESET PROTECT <\/a>solution, which provides multilayered protection, and its higher tiers also integrate ESET Cloud Office Security<\/a> (ECOS), which is designed to protect Microsoft 365 and Google Workspace applications. <\/span><\/p>

ECOS \u2014 effectiveness in numbers* <\/strong><\/span><\/p>