Over the past 10 days, we have thwarted several attacks by the Kryptis malware before it became active. This malware is not detected by antivirus software or firewalls.
What Are the Risks to Your Business?
Once installed, a Trojan can be controlled remotely by the attacker (Command & Control). It is then used to steal your information: usernames, passwords, and sensitive files (exfiltration).
It can also capture screenshots and keystrokes (keylogging) and send them to a remote server controlled by an attacker. Using this malware, the attacker can monitor your network traffic, launch executable files, and potentially take control of your IT system.
The threat was detected using our database (IOC list, including TOR nodes, via Reveelium CTI). Very regular and frequent connection attempts to one of these IP addresses, as well as to a port known to be used by TOR services (the dark web), were detected. A port scan conducted by the ITrust teams confirmed that this was indeed a gateway to the dark web.
Port scan results:Â
How to protect yourself against it?
Our tips:
- Block outbound traffic on the relevant ports and IP addresses in your firewalls.
- If there is active communication on these IP addresses or ports, quarantine the endpoints initiating the communication. They may be carrying a virus.
- Scan your information system regularly to detect existing security vulnerabilities.
- Set up a SOC equipped with EDR to detect cyber threats, ransomware, viruses, and abnormal behavior within your IT system.
> If you would like to learn more, please contact your ITrust account manager.
> To stay up to date on cybersecurity news, visit the ITrust blog
