VMware Carbon Black Connect 2020 - Presentation on Destructive Malware and how the threat landscape is evolving as it relates to Nation State Adversaries and their capabilities.

1. Confidential │ ©2019 VMware, Inc.
The Future of
Destructive Malware
Greg Foss
Senior Threat Researcher
May 13th, 2019

2. 2Confidential │ ©2019 VMware, Inc.
“ I think computer viruses should count as life.
I think it says something about human nature
that the only form of life we have created so
far is purely destructive.
We’ve created life in our own image.
Stephen Hawking
01/08/1942 – 03/14/2018

3. Confidential │ ©2019 VMware, Inc. 3
Actions taken via computer networks to
disrupt, deny, degrade, or destroy the
information within computers and
computer networks and/or the
computers/networks themselves.
• US DoD Joint Publication 3-13
• https://fas.org/irp/doddir/dod/jp3_13.pdf
What classifies as a “Destructive Cyber Attack?”

4. Confidential │ ©2019 VMware, Inc. 4
2015: Black Energy
Russian attack on three Ukrainian
Energy Distribution Companies.
Cutting power to 750,000 civilians.
2010: Stuxnet
US and Israeli developed-malware
leveraged to delay the Iranian
Nuclear Program’s ability to enrich
Uranium. The malware targeted
Siemens ICS and physically
destroyed Uranium centrifuges,
leveraging 4 zero-days.
Subset of High Profile, Public, and Documented Destructive Attacks
History of Destructive Cyber Attacks
1980 1990 2000 2010
2008: Georgia
Russian Joint campaign against
Georgian targets. Website
defacement, DDoS, and diverting
citizens web traffic through Russia.
1982: Siberian Pipeline
The CIA tricked the Soviet Union
into acquiring ICS software with
built-in flaws. Software was
programmed to malfunction -
resulting in one of the worlds
largest non-nuclear explosions.
2017: NotPetya
One of the most damaging Cyber
Attacks in history. Russia targeted
large Ukraine companies.
Estimated to have cost over $10
Billion in damages, globally.
2013: Dark Seoul
North Korean attacks on
South Korean Television
Stations and Banks.
Physically Destructive
Destructive
1998: Kosovo
35,000 Computers wiped
and replaced with burning
American flag by Iranians.
1998: CIH
Chernobyl virus which
overwrote critical system
data – affecting 60-million
computers. Developed by
a Taiwanese Student.
2014: Sony Entertainment
North Korean attack in
response to movie – data
theft and wiping resulting in
$35 million in damages.
2015: TV5Monde
Russian actors
destroyed French
TV station
hardware, taking
the network offline
for 12-hours.
2014: German Steel Mill
Attack on ICS controlling blast
furnace, resulting in significant
physical damage.
2016: Crash Override
Russian attack on
electric transmission
station ICS systems in
Kiev, Ukraine.
2008: Beijing Olympics
Deceptive Russian
Campaign to disrupt the
Olympic Games.

5. 5Confidential │ ©2019 VMware, Inc.
Ukraine
Russia’s Malware Testing Grounds

6. Confidential │ ©2019 VMware, Inc. 6
June, 2017 – Modified version of Petya Ransomware Unleashed on Ukraine
Reads the MBR and encrypts it using a simple XOR key
• Petya stopped after encrypting the Master Boot Record
NotPetya spread on its own and encrypts everything – maximizing potential impact
• Leveraged a backdoor in Ukraine Accounting Software M.E.Doc
• Spread laterally via SMB using leaked NSA tools – EternalBlue and EternalRomance
NotPetya is not actually ransomware. Designed only to destroy, regardless of payment
• Unique system identifier is actually randomly generated
NotPetya
https://www.csoonline.com/article/3233210/petya-ransomware-and-notpetya-malware-what-you-need-to-know-now.html

7. 7Confidential │ ©2019 VMware, Inc.
Financial Impact of NotPetya
https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/
$ 7.5 Billion in damages
to smaller companies

8. 8Confidential │ ©2019 VMware, Inc.
GRU - Unit 74455
“Sandworm”

9. Confidential │ ©2019 VMware, Inc. 9
Sophisticated Hacking, Espionage, Large-Scale PsyOps, and destructive attack capabilities
Repurposed Petya ransomware and leverage spreading capabilities to inflict maximum damage
Targeted disinformation social media campaigns with the goal of swaying the 2016 US election
Willing to attack Russian-Owned Companies for plausible deniability
Believed to have been involved in the Beijing Olympics hack in 2008

10. Confidential │ ©2019 VMware, Inc. 10
Sandworm
Is Still
Very
Active
Primarily
Targeting
The
Ukraine

11. Confidential │ ©2019 VMware, Inc. 11
Google Threat Analysis Group (TAG)

12. Confidential │ ©2019 VMware, Inc.
Distribution of Ransomware Across Industry Verticals
12

13. 13Confidential │ ©2019 VMware, Inc.
Lowering the Bar

14. Confidential │ ©2019 VMware, Inc. 14
Breaching a third party / adjacent target / company in order to achieve a primary objective
Infrastructure / Service Providers, Law Firms, Business Partners, Managed Services, etc.
Most well-known incident: Target.
• The first “island” in the planned attack was Fazio Mechanical Services
• The HVAC company was compromised shortly before Target’s breach
Watering Hole attacks against local low-profile business websites are the most common
Island Hopping / Leapfrogging / Watering Hole Attacks
https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/utilizing-island-hopping-in-targeted-attacks

15. Confidential │ ©2019 VMware, Inc. 15
Access Mining - The Resale of Credentials and Direct Access

16. Confidential │ ©2019 VMware, Inc. 16

17. Confidential │ ©2019 VMware, Inc. 17

18. Confidential │ ©2019 VMware, Inc. 18

19. Confidential │ ©2019 VMware, Inc. 19

20. Confidential │ ©2019 VMware, Inc. 20

21. Confidential │ ©2019 VMware, Inc. 21
March, 2019 – Sophisticated Russian Hacking Group FXSMP
Three Antivirus Companies Compromised
Source code for all products stolen
30 Terabytes exfiltrated – Asking $300k
Selling both stolen data and direct access
High Profile Assets and Data for Sale
https://www.advanced-intel.com/post/top-tier-
russian-hacking-collective-claims-breaches-
of-three-major-anti-virus-companies

22. Confidential │ ©2019 VMware, Inc. 22

23. Confidential │ ©2019 VMware, Inc. 23
Connected directly to the
Internet
Inherently insecure
Invalid certs
Not patched
Firewall disabled
Control infrastructure
SCADA / ICS

24. 24Confidential │ ©2019 VMware, Inc.
Small and Local Service Providers

25. Confidential │ ©2019 VMware, Inc. 25

26. Confidential │ ©2019 VMware, Inc. 26
https://www.blackhat.com/docs/asia-
14/materials/Rios/Asia-14-Rios-
Owning-A-Building-Exploiting-Access-
Control-And-Facility-Management.pdf

27. Confidential │ ©2019 VMware, Inc. 27
More infrastructure connectivity and increasing reliance upon technology expands attack surface
Nation State’s are consistently improving their capabilities and are actively inside US companies
Repurposing of Ransomware makes for great wipers and increases the difficulty of attack attribution
Access Mining, Island Hopping, and readily available ICS documentation lower the bar to entry
Right now is only the beginning…
Closing Thoughts

28. 28Confidential │ ©2019 VMware, Inc.
Recommended Reading

29. Confidential │ ©2019 VMware, Inc. 29
Deep Dive
2020
Cybersecurity
Outlook Report
Review of 2019 and analysis of
trends that will continue into 2020
and beyond…

30. 30Confidential │ ©2019 VMware, Inc.
Thank you
gfoss [at] vmware . com