Cloud Hosting

Sophos(LSE: SOPH), a global leader in next-generation cybersecurity, today published a SophosLabs report onCloud Snooper,a sophisticated attack thatuses a unique combination of techniques to allow malware on servers to communicate freely with its command and control servers through firewalls. The report deconstructs the tactics, techniques and procedures (TTPs) used in the attack. SophosLabs believes the attack was the work of a nation state motivated by espionage.

As detailed in the report, the TTPs used together include: a rootkit circumventing firewalls, a rare technique to gain access to servers disguised as normal traffic, and a backdoor payload that shares malicious code between both Windows and Linux operating systems, a known, but uncommon approach. While each individual element has been observed previously in attacks by highly-skilled adversaries, they have not been seen before in combination. Sophos expects that this package of TTPs will trickle down to the lower rungs of the cybercriminal hierarchy and be used as blueprints for new firewall attacks.

This is the first time we have seen an attack formula that combines a bypassing technique with a multi-platform payload targeting both Windows and Linux systems. IT security teams and network administrators need to be diligent about patching all external-facing services to prevent attackers from evading cloud and firewall security policies, said Sergei Shevchenko, threat research manager, SophosLabs. IT security teams also need to protect against multi-platform attacks. Until now, Windows-based assets have been the typical target, but attackers are more frequently considering Linux systems because cloud services have become popular hunting grounds. Its a matter of time before more cybercriminals adopt these techniques.

Advice for Defenders

For additional information, please reference thisSophosLabs Uncutarticle.

# # #

Additional Resources

About Sophos

As a worldwide leader in next-generation cybersecurity, Sophos protectsmore than400,000organizations of all sizesin more than 150 countries from todays most advanced cyberthreats. Powered by SophosLabs a global threat intelligenceand data science team Sophos cloud-native and AI-enhanced solutions secure endpoints (laptops, servers and mobile devices) and networks againstevolving cybercriminal techniques, including ransomware, malware, exploits, dataexfiltration, automatedand active-adversary breaches, phishing, and more. Sophos Central, a cloud-native management platform, integrates Sophos entire portfolio ofnext generationproducts, includingtheIntercept X endpoint solution and theXG next-generation firewall, into a single synchronized security system accessible through a set of APIs. Sophos has been driving a transition to next-generation cybersecurity, leveraging advanced capabilities in cloud, machine learning, APIs, automation, managed threat response, and more, to deliver enterprise-grade protection to any size organization. Sophos sells its products through a global channel of more than 53,000 partners and Managed ServiceProviders(MSPs).Sophosalso makes itsinnovativecommercial technologies available to consumersviaSophos Home.The company is headquartered in Oxford, U.K., and is publicly traded on the London StockExchange under thesymbolSOPH.Moreinformation is available atwww.sophos.com.

Follow this link:
SophosLabs Reports on Cloud Snooper, an Advanced Targeted Attack that Allows Malware to Communicate Across Firewalls - CXOToday.com