CTT Report Hub

09:45

#cyberthreattech
Итого, по автоматическому построению описания угроз удалось запустить движочек и обработать все отчеты с 2022 года.
Получился механизм, в который можно подать строку (пока не более 50 символов и ^[a-zA-Z0-9 _-]+$, т.к. наш продакшен токенайзер я не смог пока вытащить отдельным микросервисом, а он уже умеет разбирать любой текст) и движочек найдет в ней названия угроз.
По каждой угрозе из текста он попробует найти описание.
Встал вопрос, как вытаскивать в паблик: допилить бота в ТГ, или добавить REST API. Опрос будет ниже.

{
  "data": {
    "summary": [
      {
        "id": "inc_ransomware",
        "found": true,
        "generation": {
          "date": "20240513 02:37:12",
          "sources": {
            "begin": "20231121",
            "end": "20240417",
            "urls": [
              "https://mp.weixin.qq.com/s/_KuFPPs6XFOICNpRjzn5AA",
              "https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware",
              "https://www.cybereason.com/blog/threat-alert-inc-ransomware",
              "https://socradar.io/dark-web-profile-donutleaks",
              "https://socradar.io/dark-web-profile-inc-ransom"
            ]
          }
        },
        "text": "INC Ransomware, also known as INC Ransom, is a newly emerged ransomware group first observed by security researchers in early August 2023. This group primarily targets the United States and European countries, with a few victims from other Western countries such as Singapore. The majority of the victims are private sector businesses, but the group has also targeted a government organization and a charity association.\nThe INC Ransomware operates by employing partial encryption combined with a multi-threading approach to accelerate the encryption process. The group does not charge for the leaked data, unlike some other ransomware groups like LockBit 3.0. Instead, they follow a double and triple extortion strategy.\nAfter gaining access to the network, the attacker drops an executable (p443x64.exe) that installs a Meterpreter shell. They then use the AdFind command-line Active Directory query tool to enumerate the environment, WinRAR to archive files and folders, and the Megasync cloud hosting solution to exfiltrate more than 70 GB of data. After exfiltrating the data, the threat actor copies the INC ransomware executable to over 500 other systems and then runs it remotely via PsExec. The executed binary encrypts files, adds a .inc file extension to the encrypted files, and drops the INC ransom note (INC-README.txt).\nThe INC ransom note includes a Tor .onion address along with a personal ID, and it instructs the victim to contact the threat actor within 72 hours or sensitive data will be published to the leak site. The structure and design of the INC Ransom leak site are similar to the LockBit leak site, but there are no other indications that the groups are related.\nThe INC Ransomware group, tracked by Secureworks Counter Threat Unit (CTU) researchers as GOLD IONIC, uses the common double extortion method: they exfiltrate data before encrypting systems and then threaten public exposure as leverage in ransom negotiations with victims."
      }
    ]
  }
}

303 viewsedited 12:17