OXFORD, U.K. — Febbraio 25, 2020 —

 Sophos (LSE: SOPH), a global leader in next-generation cybersecurity, today published a SophosLabs report on Cloud Snooper, a sophisticated attack that uses a unique combination of techniques to allow malware on servers to communicate freely with its command and control servers through firewalls. The report deconstructs the tactics, techniques and procedures (TTPs) used in the attack. SophosLabs believes the attack was the work of a nation state motivated by espionage.

As detailed in the report, the TTPs used together include: a rootkit circumventing firewalls, a rare technique to gain access to servers disguised as normal traffic, and a backdoor payload that shares malicious code between both Windows and Linux operating systems, a known, but uncommon approach. While each individual element has been observed previously in attacks by highly-skilled adversaries, they have not been seen before in combination. Sophos expects that this package of TTPs will trickle down to the lower rungs of the cybercriminal hierarchy and be used as blueprints for new firewall attacks.

“This is the first time we have seen an attack formula that combines a bypassing technique with a multi-platform payload targeting both Windows and Linux systems. IT security teams and network administrators need to be diligent about patching all external-facing services to prevent attackers from evading cloud and firewall security policies,” said Sergei Shevchenko, threat research manager, SophosLabs. “IT security teams also need to protect against multi-platform attacks. Until now, Windows-based assets have been the typical target, but attackers are more frequently considering Linux systems because cloud services have become popular hunting grounds. It’s a matter of time before more cybercriminals adopt these techniques.”

Advice for Defenders

  • Create a full inventory of all devices connected to the network, and update all security software used on these devices
  • Ensure all external-facing services are fully patched. Cloud hosting services often provide firewall security, but this should not be a substitute for an organization’s own cloud security measures
  • Check and double check all cloud configurations. The Sophos 2020 Threat Report reveals that user misconfiguration and lack of visibility are the top causes of attacks in the cloud
  • Enable multi-factor authentication on any security dashboards or control panels used internally to prevent attackers from disabling security products during an attack
  • Remember, there is no single silver bullet for security, and a layered, defense-in-depth, next generation security model – including components designed specifically to protect data and networks in the cloud, like Sophos Cloud Optix with Sophos Intercept X for Server – is an essential best practice

For additional information, please reference this SophosLabs Uncut article.

Informazioni su Sophos

Sophos, leader mondiale e innovatore nelle soluzioni di sicurezza avanzate per neutralizzare i cyberattacchi, tra cui servizi MDR (Managed Detection and Response) e incident response, mette a disposizione delle aziende un’ampia gamma di soluzioni di sicurezza per endpoint, network, email e cloud al fine di supportarle nella lotta ai cyber attacchi. In quanto uno dei principali provider di cybersecurity, Sophos protegge oltre 600.000 realtà e più di 100 milioni di utenti a livello globale da potenziali minacce, ransomware, phishing, malware e altro. I servizi e le soluzioni di Sophos vengono gestiti attraverso la console Sophos Central, basata su cloud, e si incentra su Sophos X-Ops, l'unità di threat intelligence cross-domain dell'azienda. Sophos X-Ops ottimizza l’intero ecosistema adattivo di cybersecurity di Sophos, che include un data lake centralizzato, che si avvale di una ricca serie di API aperti, resi disponibili ai clienti, ai partner, agli sviluppatori e ad altri fornitori di cyber security e information technology. Sophos fornisce cybersecurity as a service alle aziende che necessitano di soluzioni chiavi in mano interamente gestite. I clienti possono scegliere di gestire la propria cybersecurity direttamente con la piattaforma di Sophos per le operazioni di sicurezza o di adottare un approccio ibrido, integrando i propri servizi con quelli di Sophos, come il threat hunting e la remediation. Sophos distribuisce i propri prodotti attraverso partner e fornitori di servizi gestiti (MSP) in tutto il mondo. Sophos ha sede a Oxford, nel Regno Unito. Ulteriori informazioni sono disponibili su www.sophos.it.