Under the Microscope: Jan 2023 edition — Elastic Security Labs

2022 Elastic Global Threat Report

Recently, Elastic published its inaugural annual threat research report — the 2022 Elastic Global Threat Report. This report covers a full year’s worth of security threat research from Elastic Security Labs. It includes trends, correlations, insights, forecasts, recommendations, and threat profiles on Blister Loader, Follina CVE, CUBA Ransomware analysis, and BPF door.

Get-InjectedThreadEx – Detecting thread creation trampolines

While threats of all kinds leverage process injection to bypass security controls or evade detection, process trampolining is much less widely understood. This article provides background on the history of in-memory capabilities and describes common trampolining methods like hooks, hijacks, gadgets, and functions. In sharing this information, Elastic Security Labs also explains how to hunt for and detect these capabilities in your environment.

SiestaGraph: New implant uncovered in ASEAN member foreign ministry

Elastic Security Labs is tracking an active intrusion, by likely multiple threat actors, into the Foreign Affairs office of an ASEAN member. Elastic Security Labs observed Powershell commands used to collect and export mailboxes from an internet-connected Microsoft Exchange server for the Foreign Affairs Office of an Association of Southeast Asian Nations (ASEAN) member.

Exploring the REF-2731 Intrusion Set

In September 2022, we published research about the malware and campaign pattern associated with the REF-2731 intrusion set. The research covers how the intrusion set leverages the PARALLAX loader to initiate the Netwire Rat. It incorporates techniques like DLL side-loading, syscall adoption, process injection, and leveraging steganography.

Deep dive into the TTD ecosystem

Recently, Elastic Security Labs investigated the Time Travel Debugging (TDD) ecosystem. This research sheds light on the inner workings of TTD and assesses some interesting applicable use cases where it can be leveraged.