<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<i></i> Share on facebook
</div>
</div>
<div>
<div>
<i></i> Share on twitter
</div>
</div>
<div>
<div>
<i></i> Share on linkedin
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<p>One of my favourite parts of working at Guardicore is seeing the cool stuff that our Labs team does, and their latest piece of research is no different. The illustrious Guardicorians <a href="https://www.linkedin.com/in/liad-mordekoviz-8b012511b/" rel="noreferrer" target="_blank">Liad Mordekoviz</a> and <a href="https://www.linkedin.com/in/ophir-harpaz/" rel="noreferrer" target="_blank">Ophir Harpaz</a> are back at it with their update to the Indexsinas worm. You might also know this worm by its pseudonym NSABuffMiner.</p><p>If you missed the original research release, I’ll break it down in a high-level here. Like, <em>super</em> high-level. If the actual research is more your jam, check click that button below. </p> </div>
</div>
</div>
<div>
<div>
<div>
<a href="https://www.guardicore.com/labs/smb-worm-indexsinas/" rel="noreferrer" target="_blank">
Read the original Labs blog
</a>
</div>
</div>
</div>
<div>
<div>
<h3>Who was affected?</h3> </div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p>This was a pretty large attack scope. Since 2019, our sensors have recorded over 2000 attacks from over 1300 sources. Some of the notable affected industries were hospitality, education, healthcare, government, and telecom.</p> </div>
</div>
</div>
<div>
<div>
<h3>How does Indexsinas work?</h3> </div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<img alt="" height="231" src="https://www.guardicore.com/wp-content/uploads/8rBfmSa.gif" width="420" /> </div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<p>It’s nothing if not persistent. Between covering its tracks by deleting its own handiwork and stopping other unrelated programs – this worm is no joke.</p>
Once the worm makes it into an environment, it installs a Remote Access Tool (RAT) and
<div>
<div>
<div>
<p>and pulls an E.T. – phones home – to the command and control domain in South Korea. Once this has happened, it can propagate throughout using the user’s token.</p><p>Then it drops the cryptominer.</p> </div>
</div>
</div>
<div>
<div>
<h3>What does it want?</h3> </div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p>Indexsinas wants two things: to move and groove across the network and across the internet. Just like any other worm, it wants more friends at their party. As mentioned before, it cleans house of the programs that could tattle on it as well as its own old traces. At least it’s a rather polite house guest, cleaning up after itself. Once it’s ready for the next one, it moves onto the next machine (house in this analogy) and starts over. </p> </div>
</div>
</div>
<div>
<div>
<h3>How to detect and prevent against Indexsinas</h3> </div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p>Our Labs team not only did the research, but has a detection tool as well. You can run a command line prompt <a href="https://github.com/guardicore/labs_campaigns/tree/master/Indexsinas" rel="noreferrer" target="_blank">found in our Github</a> with detailed instructions. </p> </div>
</div>
</div>
<div>
<div>
<div>
<a href="https://www.guardicore.com/solutions/prevent-lateral-movement/" rel="noreferrer" target="_blank">
<img alt="" height="163" src="https://www.guardicore.com/wp-content/uploads/Centra-blog-banner-1-1024x209.jpg" width="800" /> </a>
</div>
</div>
</div>
<div>
<div>
<div>
<p>For prevention, as it is with any sort of threat that thrives on lateral movement, visibility and segmentation are going to be your friends here. As cliche as it is, you really can’t secure what you can’t see. Additionally, having proper segmentation in place makes it more difficult for the attack to move – and allows more opportunities for it to be seen and stopped. It’s just like <a href="https://www.guardicore.com/solutions/ransomware-prevention/" rel="noreferrer" target="_blank">stopping ransomware</a>, the less it can move, the less damage it can do.</p> </div>
</div>
</div>
<div>
<div>
<h3>Want to learn more?</h3> </div>
</div>
<div>
<div>
<div>
<p>Like I mentioned, this is just an overview of the incredible work Ophir and Liad did on this project. You can see their full research on our Labs blog. It’s, as the kids say, lit. <img alt="🔥" src="https://s.w.org/images/core/emoji/13.1.0/svg/1f525.svg" /> </p><p>I wouldn’t be doing my job as a marketer without hat tipping to the fact that the prevention piece of shutting down lateral movement is exactly what we do here. You can see some screenshots of Centra in the research showcasing that.</p> </div>
</div>
</div>
<div>
<div>
<div>
<a href="https://www.guardicore.com/labs/smb-worm-indexsinas/" rel="noreferrer" target="_blank">
See the research <img alt="" src="https://s.w.org/images/core/emoji/13.1.0/72x72/1f41b.png" style="height: 1em;" />
</a>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
Article Link: Indexsinas Worming its Way Laterally - Guardicore